Why are co-factors 4 and 8 so popular when co-factor is more than one?

Question

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group.

Is this a co-incidence? Have we studied ECC for curves which produce cofactor = 3 for example?

Answer 1

Having a cofactor $h > 1$ does not inherently provide an advantage; in addition, it has these small disadvantages:

• It reduces the expected effort of an attacker to solve the ECDLog problem by a factor of $\sqrt{h}$ (over a curve with approximately same size group order, and $h=1$)

• We then have to worry about "what if the adversary passes us a point that's not in the prime-order subgroup" (and how much of a concern that is depends on where we're using the curve).

Both of these are actually fairly minor; however if we're using the standard Weierstrass curve addition routines, there's no reason to put up with them at all - he can just as easily pick a curve that has $h=1$, and avoid these minor issues.

So, why do we use curves with $h>1$? Well, that's mostly because we want to use curves from more limited curve families (such as Montgomery and Edwards) and use that point addition logic associated with those equations - both Edwards curves and Montgomery curves always have $h$ a multiple of 4 (as they always has a point of order 4); the advantages of the Edwards and Montgomery point addition logic is seen to be a good trade-off (compared to the rather minor disadvantages of having $h>1$).

Have we studied ECC for curves which produce cofactor = 3 for example?

Do you know of a family of elliptic curves that always include a point of order 3? Do those curves have some advantage over other elliptic curves?