I have read a lot about the discrete logarithm problem of ecc, but I still do not understand the problem as follows:
We have domain parameters: (p, E, P, n, h), where n is the order group of P.
The process of creating privatekey - publickey is as follows:
- Select a random number k under [1, n - 1]
- Calculate Q = kP
- Return Q is publickey, k is privatekey.
As far as I know, domain paramters and Q will be public. But, suppose I was the eavesdropper, I know P produces 1000 points (as the parameter n), because Q = kP so Q will be a point in point set generated by P, so I can generate order group P and see the position of Q for privatekey k (since k is in [1, n-1]).
For example: P generate 0P, P, 2P, 3P, ... 1000P. I choose k under [1,999] is 120 -> Q = 120P -> position of Q in the order group P is 120 -> k = 120.
So if I know P and Q, then I know privatekey then ??? So where is it safe?
I suppose so because NIST gives you some recommended domain parameters and I think the order group has to be pre-calculated to save on computational cost.
Thank you for everyone's help!