I have parameters of an elliptic curve s.t $p=2n+1$ , when $n$ = order of elliptic curve over finite field of order prime p.

If I want to forge any message for such ECDSA, What can I do? Maybe the condition $p=2n+1$ will be helpful, but I have no idea for this.


Hasse's theorem on elliptic curves tells us that, using your notation: $|n-p+1|\le2\sqrt{p} \Rightarrow |n-(2n+1)+1)|\le2\sqrt{2n+1}\Rightarrow n\le2\sqrt{2n+1}$ which doesn't hold for $n>8$.

So either your curve is so small you can solve the ECDLP by hand or you are not defining an elliptic curve.

Could it be that the order of the curve is $2n$ but you are just working in the large prime order group (of order $n$)? Because in that case $n$ divides $p-1=2n$ and you can mount a MOV attack.

  • $\begingroup$ Thank for answers! Maybe order of Elliptic curve not be n, but for given Generating point have order n. I'll try MOV attack for this problem, but prime p is 128 bits. I don't know It will be worked In practical time. $\endgroup$ – Jungmin Kim Jul 25 '18 at 7:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.