Abstract.
The security of elliptic curve cryptosystems is based on the presumed intractability of the discrete logarithm problem on the curve. Other than algorithms that work in an arbitrary group and are exponential in the general case, the only general-purpose algorithm that has ever been proposed for the elliptic curve discrete logarithm is that of Menezes—Okamoto—Vanstone (MOV). The MOV algorithm, which embeds an elliptic curve group of prime order l in the multiplicative group of a field F qk, is subexponential only under special circumstances, however. In this paper we first prove that, under a mild condition that always holds in practical applications, the condition that l|(q k -1) , which is obviously necessary for realizing the MOV algorithm, is also sufficient. We next give an improved upper bound for the frequency of occurrence of pairs of primes l, p such that l|(p k -1) for k small, where l is in the Hasse interval \([p+1-2\sqrt{p},p+1+2\sqrt{p}]\) .
Article PDF
Similar content being viewed by others
Avoid common mistakes on your manuscript.
Author information
Authors and Affiliations
Additional information
Received 28 November 1995 and revised 20 September 1996
Rights and permissions
About this article
Cite this article
Balasubramanian, R., Koblitz, N. The Improbability That an Elliptic Curve Has Subexponential Discrete Log Problem under the Menezes—Okamoto—Vanstone Algorithm. J. Cryptology 11, 141–145 (1998). https://doi.org/10.1007/s001459900040
Published:
Issue Date:
DOI: https://doi.org/10.1007/s001459900040