What Every Programmer Should Know About Twists of Elliptic Curves
6 hours ago
- Twists of elliptic curves are alternative curves sharing group law properties; quadratic twists are the most common.
- Bitcoin's secp256k1 has sextic twists with small subgroup orders, enabling twist attacks if point validation is missing.
- Twist attacks exploit libraries that fail to verify input points lie on the original curve, allowing ECDLP on a weak twist.
- Quadratic twists have two equivalence classes over the base field; curves with complex multiplication (j-invariant 0) have sextic twists.
- Programmers must check that x-coordinates correspond to a point on the actual curve to prevent twist attacks.