How to find the order of a generator on an elliptic curve? I was looking out to find optimum generator for an elliptic curve $E$ over a prime field $\mathbb F_p$. I found the following algorithm:


Choose random point $P$ on the curve.
Find the order of a generator $\ell$.
Calculate the number of points $n=\#E(\mathbb F_p)$.
Calculate the cofactor $h=n/\ell$.
Calculate a generator as $G=[h]P$.


Here I can find $n=\#E(\mathbb F_p)$ using Schoof's algorithm. I need to find $\ell$. How is that possible? How can I find the order of a generator/base point of an elliptic curve defined over a prime field?
Due to the Pohlig-Hellman algorithm, the hardness of discrete logarithms is dominated by the largest prime factor $\ell$ of the group order $n$. In particular, one typically works in a subgroup of order $\ell$ of the curve group, since the additional factors $h$ in a generator's order would not significantly contribute to security.

In that, note that $\ell$ depends on the group order $n$: You cannot just decide for some order $\ell$ and then find a point $G$ of that order on an arbitrary fixed curve, since it general such a point will not exist. (However, there is  the complex multiplication method, which generates a new curve of given order.)
Therefore, steps 2 and 3 of the algorithm given in the question must be swapped: You first compute the curve group order $n$, factor it, and determine $\ell$ from the factorization. (And if $\ell$ is too small, you should start over with a new curve. For example, Curve25519 has cofactor $h=8$.)

Other than that, the algorithm is fine, except that you might want to check whether $G=\infty$ and start over in that case. However, this only happens with probability $1/\ell$, so it should never occur in practice for cryptographically-sized curves. (Moreover, you would compute and factor the group order only once and find a good $P$ afterwards, but this does not impact the expected runtime much as $P$ usually is good at the first try.)

Thus, we have the following algorithm:


Compute the curve order $n=\#E(\mathbb F_p)$.
Factor $n$ to determine its largest prime factor $\ell$. (Note that you do not need to fully factor $n$: If the remainder after removing a few "small" divisors is not prime, the cofactor is going to be too big anyway.)
Compute the cofactor $h=n/\ell$. If $h$ is "too big", start over with a new curve.
Choose a random point $P\in E(\mathbb F_p)$ and let $G=[h]P$.
If $G$ is the point at infinity, go back to choosing a new $P$. Else, $G$ has order $\ell$.