I have just started to study Elliptic curve cryptography. I have a question: In elliptic curves in Fp (such as prime256v1 curve) I just learned that the discrete logarithm problem is, "finding k, where Q=kG and G and Q are known, is hard" (k is big integer and G is generator)

I'm curious if the below sentence is still correct?

"finding x or y or z is hard, where P0=xG, P1=xyG and P2=xyzG and P0, P1, P2 and G (also generator) are known"

I think there is too much information. Is this still hard?

  • 1
    $\begingroup$ Your problem is an easy exercise in a security proof by reduction to a standard DL problem. It is also not primarily related to elliptic curves but can be proved for arbitrary groups where the DL problem is difficult. $\endgroup$
    – user27950
    Commented Oct 26, 2016 at 15:49

1 Answer 1


This depends a bit on your group structure because P0, P1, P2 could lie in small subgroups but if you avoid that you are still trying to solve a hard discrete logarithm problem.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.