Consensys Cryptographers Propose Divide-and-Pair Method to Accelerate Elliptic Curve Subgroup Membership Check

On October 30, Consensys' official Twitter account announced that its cryptographer Youssef El Housni, together with collaborators from Wuhan University of Technology, KU Leuven, and the National Academy of Sciences of Belarus, has proposed a new subgroup membership testing method named Divide-and-Pair. Not all points on non-prime-order curves such as Curve25519 belong to the target subgroup; skipping this check may leave the system vulnerable to small-subgroup attacks. NIST P-series curves are prime-order and do not require this check. The method treats two known approaches as endpoints within the same parameter range, enabling optimal configuration selection for each curve while maintaining speeds comparable to existing methods. According to Consensys, the speedup factors for each curve are: approximately 1.6x for Curve25519, 1.3x for Curve448, 1.4x for GC256A, 10.8x for FourQ, and 7x for Jubjub.

The method has been integrated into the open-source library gnark-crypto. The library currently operates on Besu, Linea, go-ethereum, as well as other gnark-based systems such as Succinct and Lighter. The related paper has been accepted by IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES) and will be published at CHES 2027.