[Cryptography] Choosing an elliptic curve

[Pierre Abbat]

Let's say you want to choose an elliptic curve over a prime field F[p]. You 
want the curve to have size n, where n=cq, c (cofactor) is small, and q is 
prime.

Does it matter if p-1 has a large prime factor? Does it matter if q does?

I know that Schoof's algorithm can find the size of a curve. I have a vague 
idea how it works, but not well enough to implement it.

Do you try various equations of curves (e.g. y²=x³+ax+b, you vary a and b) 
until you find a curve with a suitable size, or do you find a number n close to 
p which has a large prime factor and construct a curve of that size?

Pierre
-- 
sei do'anai mi'a djuno puze'e noroi nalselganse srera