Skip to main content

The Improbability That an Elliptic Curve Has Subexponential Discrete Log Problem under the Menezes—Okamoto—Vanstone Algorithm

Abstract.

The security of elliptic curve cryptosystems is based on the presumed intractability of the discrete logarithm problem on the curve. Other than algorithms that work in an arbitrary group and are exponential in the general case, the only general-purpose algorithm that has ever been proposed for the elliptic curve discrete logarithm is that of Menezes—Okamoto—Vanstone (MOV). The MOV algorithm, which embeds an elliptic curve group of prime order l in the multiplicative group of a field F qk, is subexponential only under special circumstances, however. In this paper we first prove that, under a mild condition that always holds in practical applications, the condition that l|(q k -1) , which is obviously necessary for realizing the MOV algorithm, is also sufficient. We next give an improved upper bound for the frequency of occurrence of pairs of primes l, p such that l|(p k -1) for k small, where l is in the Hasse interval \([p+1-2\sqrt{p},p+1+2\sqrt{p}]\) .

Author information

Authors and Affiliations

Authors

Additional information

Received 28 November 1995 and revised 20 September 1996

Rights and permissions

Reprints and Permissions

About this article

Cite this article

Balasubramanian, R., Koblitz, N. The Improbability That an Elliptic Curve Has Subexponential Discrete Log Problem under the Menezes—Okamoto—Vanstone Algorithm. J. Cryptology 11, 141–145 (1998). https://doi.org/10.1007/s001459900040

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s001459900040

  • Key words. Discrete logarithm, Elliptic curve, Weil pairing.