What is the cofactor of an elliptic curve group, and why does it matter for security?

The cofactor $h = |E| / n$ where $n$ is the largest prime order subgroup. Ideally $h = 1$ (the full group has prime order). Larger cofactors enable small-subgroup attacks.

Definition:

• $|E|$ = total number of points on the curve (group order)
• $n$ = order of the largest prime-order subgroup
• $h = |E| / n$ = the cofactor

Why $h = 1$ is ideal:

• The entire group has prime order → every point (except $\mathcal{O}$) is a generator
• No small subgroups exist → no small-subgroup attacks possible
• Parameter selection is simpler

Risks of $h > 1$:

• An attacker can force a victim's point into a small subgroup of order $h$
• The resulting shared secret has only $h$ possible values → trivially broken
• Countermeasure: Always multiply received points by $h$ (cofactor multiplication) — if the result is $\mathcal{O}$, reject the point

Standard curves and their cofactors:

Curve25519's cofactor of 8: Daniel Bernstein designed it this way deliberately for performance. The X25519 protocol handles cofactor clearing internally, so users don't need to worry — but implementations must be aware.

Go deeper:

• Curve25519 — Wikipedia — a concrete cofactor-8 curve and how X25519 clears it.
• Elliptic-curve cryptography — Wikipedia — cofactor and small-subgroup considerations in context.