# Elliptic Curve Twist ## Metadata **Status**:: #x **Zettel**:: #zettel/fleeting **Created**:: [[2024-03-29]] ## Synopsis A twist of an elliptic curve is another elliptic curve isomorphic to it over an algebraic closure of the base field. Twists facilitate the search for [[Elliptic Curve Paring|pairing]]-friendly curves. Roughly speaking, if we have bi-direction mapping between the curve $E$ and its twist $E'$ the two curves $\phi: E \rightarrow E'$, the addition holds after mapping. $ \begin{align} \forall{P_1, P_2 \in E}& : \phi(P_1) + \phi(P_2) = \phi(P_1 + P_2) \\ \forall{P_1, P_2 \in E'}& : \phi^{-1}(P_1) + \phi^{-1}(P_2) = \phi^{-1}(P_1 + P_2) \\ \end{align} $ ## Examples ### Quadratic Twist > [!info] Definition > Let $E$ be an elliptic curve of the form $y^2 = x^3 + ax + b$, the quadratic twist of $E$ is the curve defined by the equation: $dy^2 = x^3 + ax + b$. Let $\phi(x, y) = (x, y/\sqrt{d})$ Taking the formulas for [[Elliptic Curve Addition#Adding Distinct Points|adding distinct points]] as an example. ![[Elliptic Curve Addition#^n4mj9n]] The twist curve has the similar formulas: $ \begin{align} \lambda &= \frac{y_2 - y_1}{x_2 - x_1} \\ x_3 &= d\lambda^2-x_1-x_2 \\ y_3 &= \lambda(x_1-x_3) - y_1 \\ \end{align} $ To prove $\phi(P_1) + \phi(P_2) = \phi(P_1 + P_2)$, first compute the left hand. Let $ \begin{align} \phi(P_1) &= (x_1, y_1/\sqrt{d}) \\ \phi(P_2) &= (x_2, y_2/\sqrt{d}) \\ \lambda' &= \frac{y_2/\sqrt{d} - y_1/\sqrt{d}}{x_2 - x_1} \\ &= \frac{\lambda}{\sqrt{d}} \\ x'_3 &= d\lambda'^2 - x_1 - x_2 \\ &= \lambda^2 - x1 - x2 \\ &= x_3 \\ y'_3 &= \lambda'(x_1 - x_3) - y_1/\sqrt{d} \\ &= \frac{\lambda(x_1 - x_3) - y_1}{\sqrt{d}} \\ &= \frac{y_3}{\sqrt{d}} \\ \phi(P_1) + \phi(P_2) &= (x'_3, y'_3) = (x_3, \frac{y_3}{\sqrt{d}}) \end{align} $ Then compute the right hand $ \phi(P_1 + P_2) = \phi(x_3, y_3) = (x_3, \frac{y_3}{\sqrt{d}}) $ ### BN128 Twist > [!info] Definition > BN curves always have order 6 twists. If m is an element that is neither a square nor a cube in an extension field $F_{p^2}$, the twist E' of E is defined over an extension field $F_{p^2}$ by the equation $E': y^2 = x^3 + b'$ with b' = b / m or b' = b * m. Since the equations in [[Elliptic Curve Addition]] do not use b, it's apparently that the twist curve has the same equations for addition. The mapping function is: $\phi(x, y) = (x/\sqrt[3]{\frac{b}{b'}}, y/\sqrt{\frac{b}{b'}})$ ## References - [Twists of elliptic curves - Wikipedia](https://en.wikipedia.org/wiki/Twists_of_elliptic_curves) - [draft-irtf-cfrg-pairing-friendly-curves-05 (ietf.org)](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-pairing-friendly-curves-05)