# Is MOV attack against ECDLP fundamentally impossible?

The main idea of the MOV attack is to map EC additive group of order $$n$$ to multiplicative group in the finite field extension $$p^k$$. For this, the groups must have the same order, what fully relies on property that multiplicative group over $$p^k$$ has order $$p^k-1$$, but it hasn't. The fundamental mistake is in the fact that such multiplicative group has order $$p^{k-1}(p-1)$$ which wouldn't be divisible by $$n$$ if $$n≠p$$, so the main idea of such attack is (as i think) completely broken.

And there is my question: is there any example of usage of MOV attack against any curve except those with $$p=n$$? I don't believe that since 90s there wasn't any practical usage of this method for, even, weak curves, so the inapplicability of such attack would be visible. Or am I just mistaken and don't know something important, and the MOV attack really works?

Actually, the multiplicative group of the extension field $$GF(p^k)$$ does have order $$p^k-1$$. In particular, for any $$m$$ that does not have $$p$$ as a factor, there will exist a $$k$$ such that $$GF(p^k)$$ will have a subgroup of order $$m$$.
You appear to be confusing that with the multiplicative group $$\mathbb{Z}_{p^k}^*$$. That does have order $$p^{k-1}(p-1)$$, however that's not the group that MOV maps the point into.
• @user2284570: so what did you try? And what did you mean "order of the finite field elements" (is that "I did a pairing and got an element $x$, and $x^n = 1$, so $n$ is the order", or something else?), and what do you mean as "order of the curve" (is that "the number of points of the curve" or the "characteristic of the curve, that is, if the curve is defined in $GF(p)$, the value $p$). I'm not accusing you of being wrong - I just want to make sure we're using the same terminology... Commented Jul 24 at 13:46
• I m meaning E.order() in sagemath. Commented Jul 25 at 3:02