Type D internals

These are ordinary curves of with embedding degree 6, whose orders are prime or a prime multiplied by a small constant.

A type D curve is defined over some field F_q and has order h * r where r is a prime and h is a small constant. Over the field F_q6 its order is a multiple of r2.

Typically the order of the curve E is around 170 bits, as is F_q, the base field, thus qk is around the 1024-bit mark which is commonly considered good enough.

d_param struct fields:

q   F_q is the base field
n   # of points in E(F_q)
r   large prime dividing n
h   n = h * r
a   E: y^2 = x^3 + ax + b
nk  # of points in E(F_q^k)
hk  nk = hk * r * r
coeff0 coefficients of a monic cubic irreducible over F_q
nqr quadratic nonresidue in F_q

These were discovered by Miyaji, Nakabayashi and Takano, "New explicit conditions of elliptic curve traces for FR-reduction".