7

In the elliptic Curve cryptography, it is said that the order of base point should be a prime number, and order of a point $P$ is defined as $k$, where $kP = \mathcal{O}$.

And to compute the order we have $P$, $\mathcal{O}$ and we need to compute $k$ (Where $\mathcal{O} = kP$), which is ECDLP.

SO is it possible to compute order of a point over EC ?

BlackAdder
  • 4,029
  • What size field are we talking about (that is, order of your curve)? – Amzoti Mar 15 '13 at 19:10
  • If the order is small then it shouldn't be too hard. I believe the whole point of the elliptic curve cryptography is to construct an elliptic curve over a finite field in such a way that computing the order of certain points is very, very difficult. The harder it is to compute, the more secure it is. I believe... – Brent J Mar 15 '13 at 20:33

1 Answers1

10

Lagrange's Theorem: The order of a group element divides the order of the group.

The order of the group is the number of points on the elliptic curve. There is a polynomial time algorithm (Schoof/Schoof-Elkies-Atkin) to compute the number of points on an elliptic curve over a finite field.

So, to generate an ECC system: You compute the number of points on the curve in polynomial time. Factor that number (not polynomial time in general, but in practice fine) and then determine the order of the point using a standard algorithm (see Section 11.1 of Victor Shoup's book -- free on his webpage).

IMPORTANT: You do not need to solve ECDLP to determine the order of a point.

However, in practice most users do none of this. In cryptosystems (already set up by someone else) the system parameters include $(E, P, k)$. To verify that parameters are correct all one has to do is this: test that $P$ satisfies the curve equation, test that $P$ is not itself the identity element, test that $k$ is prime, compute $[k]P$ and test that this is the identity. It follows that the order of $P$ is equal to $k$. This is a polynomial time computation.

BlackAdder
  • 4,029