blocks|key|2845221|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|-4|4|5|6|B|7|@]|8|@]|9|$]]]|A|$]]

Short answer: the definition you're using (and, in particular, the notation in it) is specific to multiplicative groups modulo $p$. It makes no sense for elliptic curves, or for most other kinds of groups over which the discrete logarithm problem can be defined. In particular, for elliptic curves, there is no prime modulus $p$.

(Well, OK, for the elliptic curves used in cryptography, there is a prime modulus involved in the definition of the <a href="https://en.wikipedia.org/wiki/Finite_field" rel="noreferrer">finite field</a> over which the elliptic curve itself is defined. The size of this prime depends on the type of finite field used — it can be anything from $2$ up to the size of the field itself — and is only very indirectly relevant to the hardness of the discrete logarithm problem.)

<hr>

Longer answer: In mathematics, a <a href="https://en.wikipedia.org/wiki/Group_(mathematics)" rel="noreferrer">group</a> is simply any set $G$ equipped with some binary operator $\star$ that satisfies the following properties:

<ol>
<li>Closure: For every $a, b \in G$, the value $a \star b$ is defined and belongs to $G$.</li>
<li>Associativity: The equation $(a \star b) \star c = a \star (b \star c)$ holds for every $a, b, c \in G$.</li>
<li>Identity: There exists an identity element $\epsilon \in G$ such that $\epsilon \star a = a \star \epsilon = a$ holds for every $a \in G$.</li>
<li>Invertibility: For every $a \in G$ there exists another element $b \in G$ (called the group inverse of $a$) such that $a \star b = b \star a = \epsilon$.</li>
</ol>

If these properties seem fairly broad and abstract, that's because they are. Indeed, math is full of things that satisfy the definition of a group. For a few examples:

<ul>
<li>The integers $\Bbb Z = \{…, -2, -1, 0, 1, 2, …\}$ equipped with the operation $+$ (i.e. addition) form a group. The identity element is $0$ and the inverse of $a$ is $-a$.</li>
<li>The positive rational numbers $\Bbb Q^+$ equipped with the operation $·$ (i.e. multiplication) also form a group. The identity element is $1$, and the inverse of $a$ is $1/a$.</li>
<li>For any set $S$, the set of <a href="https://en.wikipedia.org/wiki/Bijection" rel="noreferrer">invertible functions</a> from $S$ to $S$ form a group, with <a href="https://en.wikipedia.org/wiki/Function_composition" rel="noreferrer">function composition</a> ($\circ$) as the group operator. This group is known as the <a href="https://en.wikipedia.org/wiki/Symmetric_group" rel="noreferrer">symmetric group</a> of $S$.</li>
<li>For any $n &gt; 0$, the numbers $\{0, …, n-1\}$ equipped with the operation $+_n$ defined as $$a +_n b = (a + b) \bmod n = \begin{cases}a + b &amp; \text{if }a + b &lt; n, \\ a + b - n &amp; \text{otherwise} \end{cases}$$ also form a group. The identity is still $0$, but the inverse of $a \ne 0$ is now $n - a$. This group is isomorphic to the (additive) group of <a href="https://en.wikipedia.org/wiki/Modular_arithmetic" rel="noreferrer">integers modulo $n$</a>, and indeed is one way to define that group (although a more commonly used definition uses <a href="https://en.wikipedia.org/wiki/Modular_arithmetic#Congruence_classes" rel="noreferrer">congruence classes</a> instead).</li>
<li>For any prime $p$, the numbers $\{1, …, p-1\}$ equipped with the operation $·_p$ defined as $$a ·_p b = ab \bmod p = ab - kp,$$ where $k$ is the largest integer such that $kp \le ab$, also form a group. The identity is $1$, and the inverse of any element $a$ can be calculated e.g. using the <a href="https://en.wikipedia.org/wiki/Extended_Euclidean_algorithm" rel="noreferrer">extended Euclidean algorithm</a>. This group is isomorphic to (and again, under some definitions, the same as) the <a href="https://en.wikipedia.org/wiki/Multiplicative_group_of_integers_modulo_n" rel="noreferrer">multiplicative group of integers modulo $p$</a>.</li>
</ul>

There are, however, plenty of other ways to form groups as well. For example, for any <a href="https://en.wikipedia.org/wiki/Elliptic_curve" rel="noreferrer">elliptic curve</a>, it's possible to define a binary operator that makes the set of points on the curve (including the "point at infinity") into a group. <a href="https://en.wikipedia.org/wiki/Elliptic_curve#The_group_law" rel="noreferrer">The definition is somewhat complicated</a>, so I won't attempt to summarize it here, but it can be shown to satisfy all the properties required of a group.

<hr>

Now, for any group $G$ with the group operation $\star$, we can define an "exponentiation" operator $\uparrow$ that maps a group element $g \in G$ and a non-negative integer $k \in \Bbb N$ into the group element $$g \uparrow k = \underbrace{g \star g \star … \star g}_{k \text{ times}}.$$ (In particular, $g \uparrow 0$ is defined to be the group identity element $\epsilon$.)

For any group element $g \in G$, the set $$g^{\Bbb N} = \{\epsilon, g, g \star g, g \star g \star g, …\} = \{k \in \Bbb N: g \uparrow k\}$$ of powers of $g$ forms a <a href="https://en.wikipedia.org/wiki/Subgroup" rel="noreferrer">subgroup</a> of $G$. This is called the subgroup <a href="https://en.wikipedia.org/wiki/Generating_set_of_a_group" rel="noreferrer">generated</a> by $g$, and also written $\langle g \rangle$. (For <a href="https://en.wikipedia.org/wiki/Cyclic_group" rel="noreferrer">some groups</a>, it's even possible to find a $g \in G$ such that $\langle g \rangle = G$, i.e. $g$ generates the entire group $G$.)

For a given generator $g \in G$ and an arbitrary element $a$ of the subgroup $\langle g \rangle \subset G$ generated by $g$, it's then possible to ask the question: what is the smallest (or even any) number $k \in \Bbb N$ such that $g \uparrow k = a$? Such a number $k$ is known as the <a href="https://en.wikipedia.org/wiki/Discrete_logarithm" rel="noreferrer">discrete logarithm</a> of $a$ with respect to $g$.

Now, for some groups, computing the discrete logarithm is very easy. For example, if $G = \Bbb Z$ is the additive group of integers, then $g \uparrow k = kg$, and the discrete logarithm of $a$ with respect to $g \ne 0$ is simply $a \mathbin/ g$. The additive group of integers modulo $n$ is not much harder: calculating the discrete logarithm of $a$ there just requires solving the modular congruence $a \equiv kg \pmod n$, which can be done using the aforementioned extended Euclidean algorithm.

However, for other groups, no easy or efficient way of calculating discrete logarithms is known. The multiplicative groups of integers modulo large primes $p$ are one example of a class of such groups; elliptic curves (<a href="https://en.wikipedia.org/wiki/Elliptic_curve#Elliptic_curves_over_finite_fields" rel="noreferrer">over a finite field</a>) are another.

For cryptography, the main advantage of <a href="https://en.wikipedia.org/wiki/Elliptic-curve_cryptography" rel="noreferrer">choosing elliptic curves</a> over multiplicative groups of integers is that the most efficient known algorithms for finding discrete logarithms over elliptic curves are even less efficient than those for multiplicative groups of integers. In other words, this means that we can use smaller groups (and thus shorter keys etc.) for the same conjectured level of security.

Of course, technically, we don't know that the discrete logarithm problem is actually hard over either kind of groups, and that there isn't some magic algorithm to solve it efficiently that we just haven't found yet. But a lot of smart people have studied this problem for both kinds of groups, trying to find such an algorithm, and so far (at least as far as publicly available academic literature goes) they haven't really found one. And so far, of the two kinds of groups, elliptic curves seem to be the harder nut to crack.

I understand that the discrete log problem is defined as
$G^y \bmod p = x$
Speaking generally, $G$ here is a generator for the group $\mathbb{Z}_p^*$, where $G$ is able to generate each element in the group for a given prime modulus.
My question is, in the context of elliptic curve cryptography, is the group the entire set of points that lies on the curve being used?
Assuming this is correct, does the prime used for the modulus have to be larger or smaller than this group of points, or even reside in it?

Group in the context of elliptic curve crypto

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我知道离散日志问题被定义为G^y \bmod p = x一般说来，这里的G是组\mathbb{Z}_p^*的生成器，其中G能够为给定的素数生成组中的每个元素。我的问题是，在椭圆曲线密码学的背景下，这组是否是所使用的曲线上的全部点？假设这是正确的，用于模量的素数是否必须大于或小于这组点，甚至驻留在其中？

问椭圆曲线密码中的群
EN

回答 1

Cryptography用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问椭圆曲线密码中的群EN