Testing membership of elliptic curve points in subgroups of binary extension fields I come from an engineering background. Let a binary extension field $GF(2^{233})$ and a finite group $E$ made of points defined by a curve over Binary Fields i.e. $y^2 + xy = x^3 + x^2 + b$ with constructing polynomial $f(z)=z^{233}+z^{74}+1$ and let a subgroup $C \subset E$ only with elements that are created from doubling another point in $E$, i.e. $C(GF(2^m))=\{P+P:P \in E(GF(2^m)\}$.
Is there a way to test if a given element - point $a$ is a member of $C$ and what restrictions should apply on $E$ and $C$ for this test to be valid?
Thank you for your time,
 A: Except for your mention of the “constructing polynomial” $f$, I’m pretty sure that I understand your question.
You consider an elliptic curve $E$ whose coefficients are in $\Bbb F_{2^m}$, the field with $2^m$ elements; I’ll just refer to this as $\Bbb F$, since you don’t seem to be changing $m$ throughout your question. And your elliptic curve has equation $Y^2+XY=X^3+X^2+b$, with $b\in\Bbb F$. (The parameter $b$ must be nonzero; otherwise you get a singularity at $(0,0)$, which would make your curve not elliptic.)
You are interested in the group of points $Q$ on $E$, and ask which are of form $P+_EP$, i.e. twice $P$ with respect to the addition on $E$. I’m sure you have seen that the addition on $E$ is by the chord-and-tangent process. That is, to get $P+_EQ=R$, you draw the line connecting $P$ and $Q$ (in $\Bbb F$-geometry, it’s understood) and see what is the third intersection of this line with $E$. This is not $R$, but rather $-_ER$, the inverse of $R$ with respect to the $E$-addition $+_E$. The fact to know is that $R$ and $-_ER$ lie on the same “vertical” line $X=c$. In case $P=Q$, you use the tangent to the curve at $P$ instead of a chord, and proceed.
I’ll use the (by now) standard notation $[n]_E(P)$ for what you get by adding $P$ to itself $n$ times. It’s $n\times P$ with respect to the $E$-addition.
Now, your curve, no matter what $b$ is, has the property that it’s “ordinary”: it has the maximum number of points $p$ with $[2]_E(Q)=\Bbb O$; that’s the neutral element (identity) of the group, and it’s not in the regular (affine) $\Bbb F$-plane, it’s at infinity vertically upwards in the projective plane, with (homogeneous) coordinates $(0:1:0)$. (The opposite of “ordinary” is “supersingular”, and supersingular curves have no points of order the characteristic ($2$ in our case) other than the identity. One such if $Y^2+Y=X^3$.)
Finally here’s the meat of what I can tell you: since the group of all points of $E(\Bbb F)$ is finite and abelian, and since the group $\{Q\in E(\Bbb F):[2]_E(Q)=\Bbb O\}$, that’s the kernel of $[2]$, has only the two elements $\Bbb O$ and $(0,\sqrt b\,)$ (that’s the unique element $\beta\in\Bbb F$ with $\beta^2=b$), the “cokernel” of $[2]$ also has order two, $\text{coker}([2])=E(\Bbb F)/\text{image}([2])$. The image of $[2]$ is just the set you’re worried about, the set of things writable as $[2]_E(P)$ for some element $P\in E(\Bbb F)$.
Discomplicating what I just wrote, this means that in all cases, exactly half of the points $Q\in E(\Bbb F)$ are of the form $[2](P)$, the points you’re interested in.
But now I have to disappoint you, because I’m not a specialist in this racket, and have no idea how you can tell that a given point $Q=(\xi,\eta)$ is in your good set. But let me give you an example.
In case $m=2$ and $b=1$, the points of $Y^2+XY=X^3+X^2+1$ are:
$$
\Bbb O, (0,1),(1,\omega),(1,\omega^2),(\omega,1),(\omega,\omega^2),(\omega^2,1),(\omega^2,\omega)\,,
$$
eight in all, and the first four make up the subgroup you’re interested in. Notation: $\omega$ is an element of $\Bbb F_4$ not in $\Bbb F_2$. For instance, $[2](\omega,1)=(1,\omega^2)$, if I haven’t slipped up in my pencil-work.
