# order of elliptic curve divisible by prime

Why order "u" of an elliptic curve "E" defined over a finite field "GF (q)" (u = | E / GF (q) |) must be divisible by a large prime number r to be appropriate for cryptographic purposes?

-

If you would work in the entire group the ECDLP is attackable by algorithms such as Pohlig-Hellman, Pollards' $\rho$ method or the babystep-giantstep algorithm. Additionally one avoids curves (such as supersingular ones) that are susceptible to the MOV and SSSA attack (such that you can even use subexponential algorithms).