The Weierstrass normal form of elliptic curves (in fields with characteristic != 2 and != 3) $y^2 = x^3 + ax + b$ over the $Z_p$ field has found many applications in cryptography. But this curve form also has two types: non-singular (which can be used in crypto) and singular (which can’t). Let’s take a look at why singular curves cause problems in cryptography.
Singular curves are curves where the discriminant is equal to zero, so $4a^3 + 27b^2 = 0$.
In such cases, this curve can be represented in two forms:
-
$y^2 = x^3$ (when there is a triple root 0), where using the mapping $(x, y) \rightarrow \frac{x}{y}$ gives an isomorphism to an additive group (with the same order $p$) where the discrete logarithm is trivial.
-
$y^2 = x^2(x + c)$ (when there is a double root 0), where using the mapping $(x, y) \rightarrow \frac{y + xc}{y - xc}$ gives an isomorphism to a multiplicative group (with order $p^2$) where the discrete logarithm problem is easy to solve for default elliptic key sizes.
Both cases are perfectly reviewed in Section 2.10 of Washington’s Elliptic Curves: Number Theory and Cryptography.
Here is an example of how to solve the discrete logarithm problem for such curves.
