An Elliptic curve cryptography implementation which can be terminated
If discrete logarithm on the curve over $\mathbb{Z}_n$ is easy then $n$ can be as easily factored, precisely by using the Elliptic Curve Factorization Method, in which we indeed work with a curve over the ring $\mathbb{Z}_n$ and fervently hope for the computation to fail, i.e. to hit a non-invertible value. With figures: in practice, ECM works well when the smallest factor is no longer than 200 bits, but an "easy" discrete logarithm on an elliptic curve requires a much smaller field (an effort at breaking a single discrete logarithm on a 128-bit curve has begun, but it will take several years).