Posts  / #POST-001295
REDDIT

Is there a name for this ‘inverse MOV’ attack and does it work in specialised cases?

X
Feb 13, 2025 · 04:38

The MOV attack works by choosing an elliptic curve with a small embedding degree then using a Tate pairing to map from the curve to a finite field, where the discrete log is sub-exponential.

Can you go the other way? Choose an elliptic curve over a small (~ 2^24 ) finite field with a fairly large embedding degree (~ 125). Then present adversaries with a large (2^(24*125) ) finite field Diffie Hellman protocol, which you then map back to the small curve for which discrete log is easy?

Has this been tried and does it have a name?