Silverman - MOV attack: why is $E[N] \subset E(\mathbb{F}_{q^d})$ important?

50 Views Asked by At

In Silverman's "Arithmetic of Elliptic Curves", the author describes the embedding degree $d$ of the integer $N$ in $\mathbb{F}_q$ as the smallest integer $d$ such that $\mu_N \subset \mathbb{F}_{q^d}^*$. Therefore we can use the Weil pairing to reduce the ECDLP of $Q = mP$ to the DLP with $e_N(Q,T) = e_N(P,T)^m$ for some $T$ such that $\{ P, T \} $ generate $E[N]$.

My question is: why is it important that $E[N] \subset E(\mathbb{F}_{q^d})$ (Silverman shows this in lemma XI.6.2)? Even if $E[N] \not \subset E(\mathbb{F}_{q^d})$ we would be able to reduce the ECDLP to the DLP with the Weil pairing in $\mathbb{F}_{q^d}^*$... Maybe because it is then easier to find $T$ such that $\{ P,T\}$ form a basis? But why should that be the case?