Consensys Cryptography Team Proposes Divide-and-Pair Method to Accelerate Elliptic Curve Subgroup Membership Checks

According to TechFlow, on October 30, Consensys announced on its official Twitter account that its cryptographer Youssef El Housni, together with collaborators from Wuhan University of Technology, KU Leuven, and the National Academy of Sciences of Belarus, proposed a new subgroup membership testing method called Divide-and-Pair. On non-prime-order curves such as Curve25519, not all points belong to the target subgroup; skipping this check may expose systems to small-subgroup attacks. NIST P-series curves are prime-order and do not require this check. The method treats two known approaches as the two ends of the same parameter range, selects the optimal setting for each curve, and is at least as fast as existing methods. According to Consensys, the speedups are approximately 1.6x for Curve25519, 1.3x for Curve448, 1.4x for GC256A, 10.8x for FourQ, and 7x for Jubjub.

The method has been integrated into the open-source library gnark-crypto. The library currently runs in Besu, Linea, go-ethereum, and gnark-based systems such as Succinct and Lighter. The related paper has been accepted by IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES) and will be presented at CHES 2027.

Source: TechFlow