<p>The security of the discrete logarithm problem in a group is only as hard as that of the largest prime subgroup.</p>

<p>Because of this, there is no security gain from working in the larger group. However; it's worse. If you're working in the larger group you must make sure to not accidentally ending up in a (much smaller) subgroup when multiplying.</p>

CC BY-SA 4.0
2019-02-22T20:07:20.923Z
first part of your answer I understand and makes sense. For the second part I have an add on question: When choosing a random element in the large group is there an obvious way to know if it lies in the largest subgroup or a smaller one? (Obviously I could use this element as a generator and start to compute powers to see the order of the subgroup it generates. But I guess that would only work fast in small groups which are the insecure ones? Or is that exactly the reason? )
Rene Pickhardt
CC BY-SA 4.0
2019-02-22T20:12:22.080Z
In a finite group, every subgroup has a size that divides the suoergroup's size. So it suffices to try multiplying your group element with every (n/p), where n is the supergroup's size, and p is every prime divisor of n, and checking you don't end up with 0 (the point at infinity).
Pieter Wuille
CC BY-SA 4.0
2019-02-22T22:17:14.907Z
would still need to know the prime factors of `n` but yeah I see why it makes sense to just take a large (or the largest) cyclic subgroup. thanks a lot!
Rene Pickhardt
CC BY-SA 4.0
2019-02-22T22:33:56.780Z
Finding the prime factors of a 256-bit number is trivial.
Pieter Wuille
CC BY-SA 4.0
2019-02-23T12:37:18.793Z
Oh, a small note: in elliptic curves, the largest *prime* subgroup is chosen to work with (which is always cyclic). However, there exist cyclic groups whose size is not a prime. In fact, a large portion of EC groups are cyclic, even the ones who are not prime.
Pieter Wuille
CC BY-SA 4.0
2019-02-22T19:58:38.013Z
2019-02-22T19:58:38.013Z
Pieter Wuille
<p>One thing which I am wondering for a long time and to which I did not find an answer after doing a web search and hope to find an answer here.</p>

<p>When we construct the elliptic curve over a prime field why do we actually select a cyclic subgroup instead of taking the entire group of the elliptic curve?</p>

<p>On a side note the thing that confuses me most about this choice: We know that the cyclic subgroup of prime order <code>p</code> is isomorphic to <code>Z/pZ</code> and finding the isomorphism would mean solving the discrete log. </p>

<p>Switching to a cyclic group seems actually rather like making the problem easier in comparison to staying with the full elliptic curve.</p>

CC BY-SA 4.0
2019-02-22T19:32:41.983Z
You may get better answers on Crypto.SE.
Nate Eldredge
CC BY-SA 4.0
2019-02-22T19:50:23.290Z
ah that is a good idea. I will repost it there if no answer comes in here (:
Rene Pickhardt
<cryptography><ecdsa>
Why is a cyclic subgroup chosen in ECDSA?
Rene Pickhardt
# Why is a cyclic subgroup chosen in ECDSA?

(Asked by: username_0 on 2019-02-22)

One thing which I am wondering for a long time and to which I did not find an answer after doing a web search and hope to find an answer here.

When we construct the elliptic curve over a prime field why do we actually select a cyclic subgroup instead of taking the entire group of the elliptic curve?

On a side note the thing that confuses me most about this choice: We know that the cyclic subgroup of prime order `p` is isomorphic to `Z/pZ` and finding the isomorphism would mean solving the discrete log.

Switching to a cyclic group seems actually rather like making the problem easier in comparison to staying with the full elliptic curve.

**Tags:** cryptography, ecdsa

> **Comments:**
> **username_1**: You may get better answers on Crypto.SE.  
> **username_0**: ah that is a good idea. I will repost it there if no answer comes in here (:  

---

## 1 answers

### Answer by username_2 on 2019-02-22. Score: 3 | Accepted answer

The security of the discrete logarithm problem in a group is only as hard as that of the largest prime subgroup.

Because of this, there is no security gain from working in the larger group. However; it's worse. If you're working in the larger group you must make sure to not accidentally ending up in a (much smaller) subgroup when multiplying.

> **Comments:**
> **username_0**: first part of your answer I understand and makes sense. For the second part I have an add on question: When choosing a random element in the large group is there an obvious way to know if it lies in the largest subgroup or a smaller one? (Obviously I could use this element as a generator and start to compute powers to see the order of the subgroup it generates. But I guess that would only work fast in small groups which are the insecure ones? Or is that exactly the reason? )  
> **username_2**: In a finite group, every subgroup has a size that divides the suoergroup's size. So it suffices to try multiplying your group element with every (n/p), where n is the supergroup's size, and p is every prime divisor of n, and checking you don't end up with 0 (the point at infinity).  
> **username_0**: would still need to know the prime factors of `n` but yeah I see why it makes sense to just take a large (or the largest) cyclic subgroup. thanks a lot!  
> **username_2**: Finding the prime factors of a 256-bit number is trivial.  
> **username_2**: Oh, a small note: in elliptic curves, the largest *prime* subgroup is chosen to work with (which is always cyclic). However, there exist cyclic groups whose size is not a prime. In fact, a large portion of EC groups are cyclic, even the ones who are not prime.  

---

