Posts
/ #POST-001295
REDDIT
Is there a name for this ‘inverse MOV’ attack and does it work in specialised cases?
The MOV attack works by choosing an elliptic curve with a small embedding degree then using a Tate pairing to map from the curve to a finite field, where the discrete log is sub-exponential.
Can you go the other way? Choose an elliptic curve over a small (~ 2^24 ) finite field with a fairly large embedding degree (~ 125). Then present adversaries with a large (2^(24*125) ) finite field Diffie Hellman protocol, which you then map back to the small curve for which discrete log is easy?
Has this been tried and does it have a name?