Elliptic curves and zero-knowledge constructions are not shown over non-prime finite fields. Why?

70 Views Asked by At

What are the reasons that cryptography-related constructions -- such as featured in excellent explainers on elliptic curves on RareSkills and Practical Cryptography for Developers, and all the explainers on zero-knowledge proofs that I've found -- treat finite fields of size $p$ where $p$ is a prime, rather than the more general case of a non-prime finite field of size $p^n$, where $p$ is a prime and $n\geq 1$ is any number?

(Every finite field has order $p^n$ for some prime $p$ and $n\geq 1$ as per a nice argument on https://math.stackexchange.com/a/3067156/449733)

I understand that a prime finite field may be simple and sufficient, but non-prime finite fields seem not even to be considered or mentioned as a possibility, at least on the resources I've seen.

Are there practical reasons that ECC or zero-knowledge constructions should avoid these?

Thank you.

1

There are 1 best solutions below

0
On BEST ANSWER

Binary extension fields are used for Elliptic Curve crypto. There are even Elliptic curve cryptography standards using $GF(2^n)$. See Wikipedia. So extension fields are OK. There are practical reasons for preferring binary but there are some issues.

They are used less frequently in practice, mainly due to some patent issues. See this question and answer on cryptography stack exchange. Also if $GF(2^n)$ is used with some highly composite $n$ there are certain attacks possible.

Zero knowledge proofs are much rarer constructs, usually used as plugins to other primitives, such as identification schemes and group signatures, but I am not aware of explicit reasons for not using extension fields. I am also not sure if they are not used.