How can we construct an Elliptic Curve subgroup of cryptographic interest out of an Elliptic Curve over a much larger finite field, including the familiar $\Bbb F_p$ for prime $p$? The Discrete Logarithm Problem and related should conjecturally require $\mathcal O(\sqrt q)$ field operations, where $q$ is the subgroup's order, which must be known.
Motivation: in a signature à la Schnorr, having an analog to Schnorr (sub)groups, but with resistance to NFS and index calculus regardless of choice of $p$; yet still with parameter $p$ to slightly tune up the cost of field operations, for likely increased security against ASICs and hypothetical quantum computers usable for cryptanalysis, at a given group/signature size.
One way to fulfill that need would be a randomized generation procedure parametrized by bit sizes for $p$ and $q$ (much larger for $p$), yielding primes $p$ and $q$ and the equation of an Elliptic Curve group over field $\Bbb F_p$ having order a multiple of $q$, with some presumption of hardness of the DLP.
I care much more for security for a given size of $q$, and simplicity of implementation on the signature verifier side (where side channels are a non-issue), than on speed, and on ease of making a secure (side-channel resistant) implementation on the side with the private key.
I envision a 192 to 512-bit $q$ for 96 to 256-bit conjectured security (counted in field operations in $\Bbb F_p$), and $p$ several times that size (at least twice).