# ECDSA - why not using the cyclic additive group

As I understand things so far, the ECDSA scheme used by Bitcoin uses a group G generated by a point on the elliptic curve y^2 = x^2 + 7.

Now G is a cyclic group of finite order n and is, hence, isomorphic to the additive group Z/nZ.

My question is: why not work within Z/nZ directly then? I am assuming there are certain security benefits of using G but I am lacking the general overview to understand why.

(Disclaimer: this is not my field.)

Let g be the chosen generator and n its (prime) order. In the ECDSA algorithm, these are publicly known. It is true that g generates a cyclic (abelian) group isomorphic to Z/nZ.

Now a private key consists of an integer k, and the corresponding public key is the group element h = kg. (I use additive notation since we are in an abelian group, so kg = g+g+...+g (k times)). If we were actually working in Z/nZ, it would be trivial to recover k from h: just divide h by g (mod n) using the Euclidean algorithm. Then we would have no security at all.

The point, as I understand it, is that in the elliptic curve group, there is no known efficient way to "divide". And while there certainly exist isomorphisms from `<g>` to Z/nZ (map g to any element of Z/nZ you like), the inverse of such an isomorphism is not trivial to compute.

• Interesting. A follow up question now would be why is this isomorphism hard to find? I.e is there a provable reason or just social consensus that people were not able to find it? May 26, 2019 at 15:06
• Now you're beyond the limits of my knowledge. You might find more experts at crypto.stackexchange.com. May 26, 2019 at 15:08
• @Jernej The reason is simply that people have tried and failed to find an algorithm for the discrete logarithm (given group elements A and B, find x such that xA=B). This is essentially true for all cryptography: people find a hard problem to base things on, and hope that problem gets attention from people trying to break it. May 26, 2019 at 17:17
• @PieterWuille So essentially saying that finding the said group isomorphism is equivalent to the discrete log problem? May 26, 2019 at 18:50
• Yes, the ismorphism from G to Z/nZ is exactly f(h) = DL(h wrt g). May 26, 2019 at 18:51