I'd like to have an implementation of elliptic curve cryptography along the lines of secp256k1 which is secure until some information is published after which it is broken.
One idea would be to use elliptic curves over a ring $Z_n$ where $n=pq$ or perhaps $n=pqr$ where $p$, $q$ and $r$ are primes of similar size and the order of the curve over each factor is also prime. The factors would be small enough that discrete logarithms on curves over individual factors would be very practical but factoring $n$ would still be hard.
With the above construction the "order" of the ring would be a large composite which would be hard to factor so there wouldn't be a problem publishing that and the chances of happening across points for which the addition operation is undefined (hence leading to a factorization of n) is small.
These parameters could be used to implement a scheme which would be secure until the factorization of $n$ is published whereupon it is broken. Are there any problems with this scheme?
ByteCoin