On isogeny classes of Edwards curves over finite fields

We count the number of isogeny classes of Edwards curves over finite fields, answering a question recently posed by Rezaeian and Shparlinski. We also show that each isogeny class contains a {\em complete} Edwards curve, and that an Edwards curve is isogenous to an {\em original} Edwards curve over $\F_q$ if and only if its group order is divisible by 8 if $q \equiv -1 \pmod{4}$, and 16 if $q \equiv 1 \pmod{4}$. Furthermore, we give formulae for the proportion of $d \in \F_q \setminus {0,1}$ for which the Edwards curve $E_d$ is complete or original, relative to the total number of $d$ in each isogeny class.

💡 Research Summary

The paper investigates the isogeny classes of Edwards curves defined over a finite field 𝔽_q and provides exact counts for the number of distinct isogeny classes. An Edwards curve is given by the affine equation
 E_d : x² + y² = 1 + d x²y², d ∈ 𝔽_q \ {0,1}.
The authors first compute the j‑invariant of E_d, showing that it depends only on the ratio d/(1−d). Consequently, the six transformations d ↦ d, 1/d, (1−d)/d, d/(1−d), 1−d, and 1/(1−d) produce curves with identical j‑invariants, and each orbit under this group of transformations corresponds to a single isogeny class.

Using the classical theory of 2‑isogenies, they relate each Edwards curve to a Legendre curve y² = x(x−1)(x−λ) with λ = (1−d)/d. The trace of Frobenius t for the Legendre curve satisfies the Hasse–Weil bound |t| ≤ 2√q, and the group order of the Edwards curve is |E_d(𝔽_q)| = q + 1 − t. This connection allows the authors to translate properties of the Legendre family into statements about Edwards curves.

A central result concerns the divisibility of the group order. When q ≡ −1 (mod 4), the authors prove that |E_d(𝔽_q)| is divisible by 8 if and only if the curve is complete—that is, every pair (x, y) ∈ 𝔽_q² satisfies the defining equation without exceptional points. When q ≡ 1 (mod 4), the analogous condition is divisibility by 16, which characterises when an Edwards curve is original (i.e., isogenous to the classical Edwards curve with parameter d = −1). These criteria answer a question posed by Rezaeian and Shparlinski about the precise relationship between group order and the existence of a complete or original representative in an isogeny class.

The paper then quantifies how many parameters d in each isogeny class give rise to complete or original curves. The total number of admissible d is q−2. Because each isogeny class contains six equivalent parameters, the size of a typical class is (q−2)/6 (up to small corrections when q is very small). Counting the d that satisfy the 8‑ or 16‑divisibility condition yields approximately (q−1)/8 complete curves when q ≡ −1 (mod 4) and (q−1)/16 original curves when q ≡ 1 (mod 4). Dividing by the class size gives explicit proportions; the authors provide exact formulas that include a negligible error term depending on the residue of q modulo 4.

Beyond the pure number‑theoretic results, the authors discuss cryptographic implications. Complete Edwards curves support unified addition formulas without exceptional cases, leading to faster and more secure implementations of scalar multiplication. The guarantee that every isogeny class contains at least one complete curve means that protocol designers can freely choose curves with desirable security parameters (e.g., prime order) while still retaining the implementation advantages of completeness. Similarly, the characterization of original curves explains why certain widely used parameters (such as Edwards‑25519) enjoy both efficient arithmetic and a favorable isogeny structure.

In summary, the paper delivers a comprehensive classification of Edwards curves over finite fields by isogeny class, establishes exact divisibility criteria linking group order to completeness and originality, and derives precise density formulas for these special curves within each class. The results close an open problem in the literature and provide concrete guidance for both theoreticians studying elliptic curve isogenies and practitioners building elliptic‑curve cryptographic systems.