This question already has an answer here:

Regarding cryptographic schemes in elliptic curve cryptography, is there a problem with having the order of an elliptic curve being equal to its prime field modulus?

That is, an elliptic curve where $\#E(\mathbb{F}_p) =p$ for some prime $p$?

As I understand it, this seems to be an optimal curve because by the lagrange's theorem the order of an elliptic curve's subgroup must be divisible by the order of the elliptic curve. But if the order of an elliptic curve is prime, that then that means that any point in this curve is a generator that produces all of the points in $E$ and has a cofactor of $1$. For example, this curve here.

So, is there some kind of 'gotcha' with this sort of elliptic curve? Something that might allow an attacker to easily solve it by some math trick? Of course, assume for an elliptic curve some large prime $p$ but with the same properties.


marked as duplicate by Ella Rose Jun 24 at 1:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Found an answer: Why Smart's attack doesn't work on this ECDLP?

Smart's attack seems to be what I was looking for.


Not the answer you're looking for? Browse other questions tagged or ask your own question.