Much attention has recently been focused on the use of elliptic curves in public key cryptography, first proposed in the work of Koblitz [62] and Miller [103]. The motivation for this is the fact that there is no known sub-exponential algorithm to solve the discrete logarithm problem on a general elliptic curve. In addition, as will be discussed in Chapter I, the standard protocols in cryptography which make use of the discrete logarithm problem in finite fields, such as Diffie–Hellman key exchange, ElGamal encryption and digital signature, Massey–Omura encryption and the Digital Signature Algorithm (DSA), all have analogues in the elliptic curve case.

Cryptosystems based on elliptic curves are an exciting technology because for the same level of security as systems such as RS A [134], using the current knowledge of algorithms in the two cases, they offer the benefits of smaller key sizes and hence of smaller memory and processor requirements. This makes them ideal for use in smart cards and other environments where resources such as storage, time, or power are at a premium.

Some researchers have expressed concern that the basic problem on which elliptic curve systems are based has not been looked at in as much detail as, say, the factoring problem, on which systems such as RSA are based.