EDIT: The bounty is actually to draw more attention. I accidentally chose the wrong reason.
$E$ – Elliptic Curve over finite field $\mathbb F_p$.
Let $k$ be the embedding degree of the Curve with respect to a prime $q$: The full torsion group of all $q$-torsion points lies in $E(\mathbb F_{p^k})$.
For the MOV attack, we use 2 particular subgroups of the Full Torsion Group, $H_1$ and $H_2$, and we use the Weil Pairing $$H_1 \times H_2 \longrightarrow \mathbb F_{p^k} \text. $$
- $H_1$ is the subgroup of the full torsion group which has all the $q$-torsion which only belong to the EC over the base field $F_p$.
- $H_2$ is another subgroup of the full torsion group. Most books say that this is formed by the Frobenius Endomorphism.
The Frobenius Endomorphism is
$$F(r) = r^p$$
where $p$ is the prime characteristic of the ring.
Most math books refer to the Frobenius Endomorphism as something which applies only to Commutative Rings with a prime characteristic. If this is true, then obviously wouldn't apply to an Elliptic Curve Group. So if we had to apply it here, it would be applied to the coordinates of the points which lie in a Finite Field (which is also a commutative ring with prime characteristic). The map fixes points in $H_1$ — i.e. any point $R(x, y)$ in $H_1$ will always map to itself because $x^p = x$ and $y^p = y$.
However, for points on the extension group, it's a non-trivial map — i.e. a point would map to a different point.
My questions are as follows:
In another book, I also read that if you have a Point from the subgroup $H_2$, then the map exhibits in 2 ways — i.e. if $A=(x,y) \in H_2$, and $B=(x^p, y^p)$, then it also follows that $B$ is also $B = p*A$ (i.e. scalar multiplying $A$ by $p$).
In other words, the map is both Multiplicative & Additive. Is this true?
How do we form the points of the subgroup $H_2$?
Is it all points of the full torsion group which don't belong $H_1$? Or a subset of them?
Is $H_2$ the left hand side of the Endomorphism or the right hand side? Either way, what group is on the other side?
I understand how the MOV attack itself works — i.e. you transform the ECDH on $E(\mathbb F_p)$ to a DH on $\mathbb F_{p^k}$ which is simpler to solve because of Index Calculus if the embedding degree is small.
My question above is only about the Frobenius Endomorphism with respect to the MOV attack.