What Every Programmer Should Know About Twists of Elliptic Curves Twists Make Elliptic Curves Wildly Insecure. Here's a Cheatsheet Using Bitcoin's Familiar Secp Murage Kibicho Jul 30, 2026 1 Share Given 13 faults and a good PC, one can break secp256k1 (and Bitcoin) in 1 min. Paulo S.L.M. Barreto. This free article is part of our series on Practical Elliptic Curve Theory For Programmers : Part 1 : Hacking Dormant Bitcoin Wallets in C. Part 2 : Smart Attack on Anomalous Curves. Part 3 : Finding Anomalous Curves. Part 4 : Division Polynomials of Elliptic Curves in Python. Part 5 : Applying Division Polynomials to Point Counting. Part 6 : Fast Point Multiplication on Curves With Efficient Endomorphisms. Part 7 ( we are here ): Twists of Elliptic Curves in Sage/Python. Part 8 : Using Equivalence Classes to Accelerate Solving the Discrete Logarithm Problem in a Short Interval. Barreto is the B in the BLS family of elliptic curves 1.0 Introduction Elliptic curve theory is somewhat esoteric and the twists of an elliptic curve are pretty obscure. This guide demonstrates the workings of elliptic curve twists to a programming audience. In typical LeetArxiv style, we show you actual code in lieu of dense math equations. We teach programmers how to turn advanced math papers into code. Subscribe Subscribe Our primary source is Twists of Elliptic Curves (Ono, 1997) 1 . Abstract for Twists of Elliptic Curves (Ono, 1997) 1.1 Definition of ‘Twist of Elliptic Curves’ The term ‘twist’ of an elliptic curve is somewhat vague. When people say twist without a modifier, they tend to mean the quadratic twist of an elliptic curve (Cook, 2019) 2 . Cubic, sextic, and other twists exist however. Informally * , the twist of an elliptic curve is another algebraic curve that shares some x or y coordinates and a group law with the original elliptic curve. * The pedantic will crucify me. For instance, the bitcoin secp256k1 curve has these sextic twists (Lundkvist, 2020) 3 corresponding somewhat with the GLV endomorphism from Part 6 : y^2 = x^3 + 7 //secp curve Sextic Twists of secp E1: y^2 = x^3 + 1 E2: y^2 = x^3 + 2 E3: y^2 = x^3 + 3 E4: y^2 = x^3 + 4 E6: y^2 = x^3 + 6 The modifier before twist indicates how many equivalence classes (we cover this in Part 8 ) exist for that particular twist. The quadratic modifier means two while the sextic modifier means six. In the bitcoin example, equivalence class means there are infinitely many equations of the form y 2 = x 3 + b and these can be grouped into 6 classes depending on the value of b . 2.0 Quadratic Twists (Ono, 1997) formally states, let E be an elliptic curve with the given Weierstrass equation: Weierstrass equation of an elliptic curve. Taken from equation 1 of (Ono, 1997) If D is a square-free integer then E(D) denotes the D -quadratic twist of E that is given by: Quadratic twist equation of an elliptic curve. Taken from equation 1 of (Ono, 1997) We can perform the change of variables below (Joyal, 2013) 4 : To obtain an equivalent form for the D -quadratic twist as demonstrated below (user100659, 2025) 5 : Equivalent forms for D-quadratic twist. Taken from (user100659, 2025) We manipulated extension fields in Part 5 . For quadratic twists, the x-coordinates exist on the original curve, but the y-coordinates tend to exist on the extension of the original curve. Here’s a more coherent presentation (Neves, 2014) 6 : Quadratic twists obtained either by modifying the curve equation or moving to the extension field. Taken from (Neves, 2014) Here are some super salient points about quadratic twists: All elliptic curves have two unique quadratic twist equivalence classes over the base field. That is, there are infinitely many curves but we can only group them into two classes: isomorphic to original or isomophic to quadratic twist. The two unique base field classes merge into one class (become isomorphic) over the quadratic extension. 2.1 Coding Quadratic Twists Code for this section is available on GitHub . Let’s take secp as an example p = 2^256 - 2^32 - 977 F = GF(p) E = EllipticCurve(F, [0,7]) # y^2 = x^3 + 7 We find quadratic residues modulo p quadraticResidue = F(4) # 4 = 2^2, a square nonQuadraticResidue = F(3) # 3 a nonsquare assert(quadraticResidue.is_square() == True) assert(nonQuadraticResidue.is_square() == False) Let’s find a random curve whose quadratic twist is isomorphic to the original curve: E_QR = E.quadratic_twist(quadraticResidue) assert(E.is_isomorphic(E_QR) == True) print(E_QR) #Elliptic Curve defined by y^2 = x^3 + 28672 over Finite Field of size 115792089237316195423570985008687907853269984665640564039457584007908834671663 Observe that finding a quadratic twist of a non-residue yields false in the isomorphism test: E_nonQR = E.quadratic_twist(nonQuadraticResidue) print(E_nonQR) assert(E.is_isomorphic(E_nonQR) == False) #Elliptic Curve defined by y^2 = x^3 + 12096 over Finite Field of size 115792089237316195423570985008687907853269984665640564039457584007908834671663 N...