# Elliptic curve trapdoor function without modular arithmetic?

From what I understand, an elliptic contains a set points satisfying the equation

$y^2=x^3 + ax + b$

together with the point at infity.

It seems clear how multiplication with a scalar and a point works, and how point addition works. Discussions about cryptographic applications usually jump right to curves defined over finite fields at this point. I think I understand how that works as well.

What doesn't make sense is whether a curve defined over the field of real numbers could also work as a trapdoor.

If I know that point Q results from multiplication of some integer with the generator point on a curve over real numbers

$Q = dG$

what feasible methods exist to compute d given only a, b, and Q, and G?

In other words, aside from convenience in implementation, what exactly does the finite field add to elliptic curves as trapdoors?

I've seen this discussion, but it doesn't seem to directly address the question here.

• Real numbers don't work real well in crypto, because we typically hope to be able to express the values we use, and almost all real numbers cannot be expressed, even with an unbounded number of bits. – poncho Nov 18 '14 at 20:42
• The other potential issue would be how real-based elliptic curves behave. If (say) the x-coordinate of $dG$ was approximately $c a^d$ for some values $c, d$, this would imply an efficient way to do logs (I almost wrote 'discrete logs'...) – poncho Nov 18 '14 at 20:59
• @pomch What do you mean that not all real numbers can be represented with an unbounded number of bits? – Melab Feb 27 '18 at 15:39

Third, real-numbers often allow for more structure than we'd like. Take for example the logarithm. Computing $\log_3 b$ is easy in $\mathbb R$ (we know efficient algorithms that will yield a solid approximation) whereas finding this over $\mathbb Z_p$ tends to be hard. The fear is that a similar property can be found for the elliptic curve discrete logarithm problem. Also most problems over $\mathbb R$ are a matter of finding a good enough approximation where you can use intermediate approximations and have helpful navigatory metrics and thelike, whereas with crypto you want "hit-or-miss" and no guidance in the right direction.
• @fkraiem: That doesn't mean you can't approximate arithmetic in elliptic curve over $\mathbb Q$ with floating-point arithmetic; the original question was about curves over $\mathbb R$. Does the approximation explode beyond the range of floating-point numbers? My intuition said yes, but fgrieu suggested otherwise. Is elliptic curve addition or scalar multiplication over $\mathbb Q$ well-conditioned? I don't know! My intuition says there's nothing useful down this path, but these are questions that it might be interesting to see an answer to, not just brushed off because of a hunch. – Squeamish Ossifrage Nov 6 '17 at 3:40