cofactor

Cofactor 1 does not have a complete addition law, nor did original specs forbid cofactor >1 on security grounds.

It also makes the difference clear between cofactor is any Magnesium or cofactor is only Magnesium(2+).

But the result was something like checking which subgroup a point was in leaking log2(cofactor) bits about the secret.

This cofactor discussion seems to me a little like debating whether attackers are going to factor RSA-3072 or RSA-4096.

Edit: Beyond cofactor expansion everyone should know of at least one quick method to write down determinants of 3x3 matrices.

Further, it HAS been shown that stress is a strong cofactor in peptic ulcers.

But all things aren't equal; you also want a performant curve, which is hard to get with a curve with a cofactor of 1.

If you have a secure hash function taking some string into a point of elliptic curve E, multiplying said point by the cofactor is also a secure hash function into the relevant subgroup of E.

All things being equal, you want a cofactor of 1.

> the result was something like checking which subgroup a point was in leaking log2(cofactor) bits about the secret.

You generate a random cofactor pubkey alone, which will be used together with the recipient's privkey to produce a shared secret from which AES key is derived.

Hi daemonk, Jon Armstrong from Cofactor Genomics here.