0

I am quite new to elliptic curves so apologies if my terminology is totally messed up.

Given an elliptic curve $E(\mathbb{F}_p):y^2 = x^3 + ax + b\text{ (mod } p)$, I am wondering if the image of multiplication map $nE = \{nP : P\in E(\mathbb{F}_p)\}$ also lies on an elliptic curve? (My intuition tells me no). If not, is there any nice way to describe the group of points?

Another question I have is I know that $E\cong \mathbb{Z}/n\mathbb{Z}\times \mathbb{Z}/m\mathbb{Z}$ for some $n, m$. For example, the curve $$E(\mathbb{F}_{23}): y^2 = x^3 + x + 2$$ is isomorphic to $\mathbb{Z}/12\mathbb{Z}\times \mathbb{Z}/2\mathbb{Z}$, according to pari/gp. Then the group $4E\cong\mathbb{Z}/3\mathbb{Z}$, meaning it's cyclic, verified by $$4E = \{(3, 3), (3, 20), \infty\}.$$ Recalling that for cyclic elliptic curves, there is the Additive Transfer that maps points from $E(\mathbb{F}_p)$ to $\mathbb{Z}/p\mathbb{Z}$, where we can just divide to compute discrete log efficiently. Although $4E$ is not an elliptic curve, are there similar transfers/mappings that can solve discrete log efficiently over $nE\cong\mathbb{Z}/m\mathbb{Z}$?

Thank you so much for your time.

Gareth Ma
  • 3,725
  • What do you mean with "lies on an elliptic curve"? Depending on what you mean then Hasse's bound says that $|[n] E(\Bbb{F}_p)|$ cannot be equal to $|C(\Bbb{F}_p)|$ when $p\ge 37$. – reuns Dec 19 '21 at 05:16
  • @reuns Like another curve $y^2=x^3+cx+d$ would yield those points, but now that you point that out, yeah it can't happen – Gareth Ma Dec 19 '21 at 05:17
  • https://www.johndcook.com/blog/2019/03/11/elliptic-curves-gf2-gf3/ gives an example of two curves over $\Bbb{F}_2$ with $|C(\Bbb{F}_2)|=2$ and $|E(\Bbb{F}_2)|=4$ so that $[2]E(\Bbb{F}_2)=C(\Bbb{F}_2)$ when choosing the good model for $C$. The point is that this is not an isogeny, it is not given by some rational functions that extend it to $E(\overline{\Bbb{F}}_2)$ and to the function field. – reuns Dec 19 '21 at 05:19
  • I forgot to say $E(\Bbb{F}_2)\cong \Bbb{Z/4Z}$ – reuns Dec 19 '21 at 07:40
  • Do you mean $nP$ as $P+\cdots+P$ n-times? – kelalaka Dec 19 '21 at 20:21
  • @kelalaka yes, all the $kP$ mean $[k]P$ – Gareth Ma Dec 19 '21 at 20:24
  • If the order is $8p$ for a prime $p$ like in the Curve25519, there are subgroups of order $2,4,8,p,2p,4p,8p$ ( it is known not by the Lagrange theorem where the inverse is always not true) so your map select one of the subgroups. – kelalaka Dec 19 '21 at 20:30

0 Answers0