Generating complete Edwards curves

Abstract

Twisted Edwards curves are elliptic curves of the form ax2 + y2 = 1 +dx2 y2 for some constants a and d. The curves are called complete Edwards curves for the special case when a = 1 and d is not a square. Using complete Edwards curves for elliptic curve cryptography has many advantages as they have very efficient, complete, and unified point addition formula. In order to use complete Edwards curves for elliptic curve cryptography, we need to specify the curve as well as a point on the curve (typically of prime order). In this paper, we introduce some algorithms for generating complete Edwards curves over Fp with 4p0 number of points, where p0 is a prime and p is a prime of user-specified bit length. These algorithms are able to generate a complete Edwards curve over Fp and a point of prime order on the curve in less than 3 (resp. 15, 35) minutes when p is a 256 (resp. 384, 512)-bit prime. These are much faster than the running time of the twisted Edwards curves generation algorithm proposed by Costello et al. in [4].