On ordinary elliptic curve cryptosystems

Abstract

Recently, a method, reducing the elliptic curve discrete logarithm problem(EDLP) to the discrete logarithm problem(DLP) in a finite field, was proposed. But this reducing is valid only when Weil pairing can be defined over the m-torsion group which includes the base point of EDLP. If an elliptic curve is ordinary, there exists EDLP to which we cannot apply the reducing. In this paper, we investigate the condition for which this reducing is invalid. We show the next two main results. (1) For any elliptic curve E defined over F2r, we can reduce EDLP on E, in an expected polynomial time, to EDLP that we can apply the MOV reduction to and whose size is same as or less than the original EDLP. (2) For an ordinary elliptic curve E defined over Fp (p is a large prime), EDLP on E cannot be reduced to DLP in any extension field of Fp by any embedding. We also show an algorithm that constructs such ordinary elliptic curves E defined over Fp that makes reducing EDLP on E to DLP by embedding impossible.