diff --git a/include/polarssl/ecp.h b/include/polarssl/ecp.h
index 61d6a1d..1cafc46 100644
--- a/include/polarssl/ecp.h
+++ b/include/polarssl/ecp.h
@@ -118,6 +118,9 @@
  * short weierstrass, this subgroup is actually the whole curve, and its
  * cardinal is denoted by N.
  *
+ * In the case of Short Weierstrass curves, our code requires that N is an odd
+ * prime. (Use odd in ecp_mul() and prime in ecdsa_sign() for blinding.)
+ *
  * In the case of Montgomery curves, we don't store A but (A + 2) / 4 which is
  * the quantity actualy used in the formulas. Also, nbits is not the size of N
  * but the required size for private keys.