Distribution of elliptic twins over fixed finite fields: Numerical results

This paper presents the results of numerical experiments to determine the probability, over concrete fixed finite fields, of prime-order elliptic curves having a prime-order twist. These curves are called “elliptic twins” by [7], and are useful for a variety of cryptographic applications. Most notable is that such curves are secure against an “insecure twist” attack. This attack was introduced in 2001 by Daniel Bernstein, see [2], who has proposed “twist-security” (a slightly weaker condition) as an essential safety criterion for elliptic curves. [1] The most interesting result of this paper is that, for the finite fields the NSA-generated curves are defined over, there is only an approximately 1/100 probability of a random prime-order curve having a prime-order twist. P-384 was standardized by NIST in 1999, and generated by the NSA at some previous time.[9] It has a prime-order twist. [2] P-224 was standardized by NIST at the same time. It does not have a prime-order twist. In fact, its twist has only 58-bit security. 3