On The Bit Security Of Elliptic Curve Diffie-Hellman

This paper gives the first bit security result for the elliptic curve Diffie-Hellman key exchange protocol for elliptic curves defined over prime fields. About 5/6 of the most significant bits of the x-coordinate of the Diffie-Hellman key are as hard to compute as the entire key. A similar result can be derived for the 5/6 lower bits. The paper improves the result for elliptic curves over extension fields, that shows that computing one component (in the ground field) of the Diffie-Hellman key is as hard to compute as the entire key.