# MOV attack when $E(\mathbb{F}_q)$ is cyclic

Suppose $$P\in E(\mathbb{F}_q)$$ and $$R=dP$$.

In the MOV attack, we compute $$\alpha=e(P,T)$$ and $$\beta=e(R,T)$$ and try to solve the discrete logarithm problem for $$\alpha$$ and $$\beta$$ in the finite field $$\mathbb{F}_{q^k}$$ where $$k$$ is the embedding degree.

But if $$E(\mathbb{F}_q)$$ is cyclic (which it can be even in the supersingular case), $$\alpha,\beta$$ are doomed to be $$1$$.

So what am I missing here?

• Why are they doomed to be 1? You would have $\alpha=\beta=1_{T}$ iff. $P=R=G_{1}$ and $T=G_2$, where $G_1$ and $G_2$ are the generators of the first group and second group respectively, which I suppose, is not the case. In the target group you have that $\beta=d\alpha$. Thus we have reduced the discrete logarithm problem on the group of points on an elliptic curve to the discrete logarithm on finite fields, where subexponential attacks are known. May 9 '20 at 7:54

For the purposes of the MOV attack you choose $$T$$ to be a point in $$E(\mathbb{F}_{q^k})$$.