Subgroups, Generators, Orders, And Cofactors

Core analogy: Treat the finite curve group as a circular route.

• Curve order $\#E$: total number of stops in the complete group.
• Point order $\operatorname{ord}(P)$: lap length—the first positive $n$ with $nP=\mathcal{O}$.
• Generated subgroup $\langle P\rangle$: all stops reachable by repeatedly taking the $P$-step.
• Generator: a point whose multiples reach every element of the group being discussed.
• Base point $G$: the public generator selected by a parameter set.
• Subgroup order: $n=\operatorname{ord}(G)$. When the selected order is prime, pairing literature commonly names it $r$.
• Cofactor $h$: number of subgroup-sized cosets in the full group: $$\#E=hn, \qquad h=\frac{\#E}{n}.$$

The notation $a\mid b$ means “$a$ divides $b$,” so $b=ca$ for some integer $c$. Lagrange's theorem guarantees that a point's order divides the curve order:

$$\operatorname{ord}(P)\mid\#E(\mathbb{F}_p).$$

Running example

$P=(1,5)$ takes a 14-stop lap and generates the whole curve. Choosing $G=2P=(3,3)$ skips every other stop, producing a prime-order subgroup with

$$\#E=14, \qquad n=r=7, \qquad h=2.$$

Base field and scalar field

• The curve coefficients and point coordinates live in the base field $\mathbb{F}_p$. Here, $x_G,y_G\in\mathbb{F}_{11}$.
• The point $G$ lives in the subgroup $\langle G\rangle\subset E(\mathbb{F}_{11})$; it is not itself a field element.
• Scalars live in the scalar field $\mathbb{F}_r$. Here, $k\in\mathbb{F}_7$.
• Scalar multiplication maps a scalar and a subgroup point back to the subgroup: $$k\in\mathbb{F}_r, \quad G\in\langle G\rangle, \quad kG\in\langle G\rangle.$$
• Scalars wrap around modulo $r$ because $rG=\mathcal{O}$, so $(k+r)G=kG$.

Protocol bridge: A nonzero private scalar $k\in\mathbb{F}_r$ produces the public point $Q=kG$; production systems make $r$ enormous.