On the embedding degree of reductions of an elliptic curve

Abstract

Given an elliptic curve E over Q we estimate the number of primes p ⩽ T for which the number of points on reduction of E modulo p has a large prime factor ℓ and also a small embedding degree with respect to ℓ. Such curves are important for a number of cryptographic applications. However our result shows that they are very rare. On the other hand, it also shows that the so-called MOV attack is not likely to affect the reduction of a given elliptic curve over Q modulo a random prime.