Imagine if we were on a mission to try to calculate the order of the cyclic group $n$
n = 115792089237316195423570985008687907852837564279074904382605163141518161494337
Given the order of the finite field $p$
p = 115792089237316195423570985008687907853269984665640564039457584007908834671663
Generator point $G$:
G = (
55066263022277343669578718895168534326250603453777594175500187360389116729240,
32670510020758816978083085130507043184471273380659243275938904335757337482424
)
which has the private key of $1$.
Cofactor $h$ is $1$. The equation is $y^2 = x^3 + 7$
We can find the $n$ with Schoof-Elkies-Atkin algorithm
However, it's a bit confusing. Here's the solution in Sage. It presents one code example:
sage: p = 115792089237316195423570985008687907853269984665640564039457584007908834671663
sage: EllipticCurve(GF(p), [0,7]).order()
115792089237316195423570985008687907852837564279074904382605163141518161494337
What is [0, 7]
specifically? These cannot be the coordinates of the G
, since we already established that they are different.
And where is the $G$ even used in this calculation?
What if we used instead of $G$, another point on the elliptic curve, that we know for sure that it sits on the curve and is part of our cyclic group? Like this one:
(x,y) = (
44886295857190546091508615621464465421050773292389158775895365558788257183826,
79820197542983972470655013754473404410649480536210503962616926227235987362275
)
The private key for this point sits somewhere between $2^{129}$ and $2^{130}$. What would happen if we use this point, instead of $G$ for our Schoof-Elkies-Atkin to calculate the $n$ (order of the cyclic group)?