[curves] How do you find a generator of an EC group?

Ben Smith hyperelliptic at gmail.com
Mon Dec 12 01:45:54 PST 2016

2016-12-12 0:58 GMT+01:00 Mike Hamburg <mike at shiftleft.org>:
> This is definitely the most straightforward way find the generator of a subgroup, except that you want qP = 0.  If you want a NUMS property, you could take the first generator with x-coordinate greater than or equal to some hash value, or similar.
> An alternative method is to obtain a point on the curve (either by brute force or with SWU or Elligator), and then multiply it by the cofactor h = #E/q, and then check that it’s not 0.

It's worth noting that multiplying-by-the-cofactor is something that
you'll definitely need to do if you have larger cofactors, like if
you're in a pairing-based situation, because otherwise the probability
that your randomly generated point is even in the subgroup is
somewhere between "annoyingly small" and "negligible".


You know we all became mathematicians for the same reason: we were lazy.
  --Max Rosenlicht

More information about the Curves mailing list