Is there any trapdoor that can solve elliptic curve subgroup membership problem? Given an elliptic curve $E$ over a finite field q(q is a prime), and $&lt;G&gt;$, the cyclic subgroup of $E$, where G is the generator. Is there any trapdoor $T$, that given a random group element $P\in E$, we can decide if $P\in &lt;G&gt;$ in probabilistic polynomial time with the help of $T$?
Here is one (somewhat impractical) possibility:

We pick an Elliptic Curve that has a group size $n$ that is a secret factorization $n = pr$ (I'd say $pq$, except you already gave a separate meaning to $q$)

As our generator $G$, we pick an element of order $p$.

The trapdoor information is the value $p$


It would appear to be a hard problem to determine whether a random element $P$ is in the subgroup $&lt;G&gt;$; however with the knowledge of $p$, we can compute $pP$; that will be the null element iff $P$ is in the subgroup.
Now, $n$ has to be large enough for factorization to be infeasible (as anyone looking at the elliptic curve can run a point counting algorithm to obtain $n$); that means that $q$ (the prime the curve is based on) must be 2048 bits (or larger); hence computations on this curve will be expensive.  It also begs the question &quot;why are you using an elliptic curve at all, rather than (say) the group of quadratic residues in $\mathbb{Z}_{2pr+1}^*$ with $2pr+1$ prime&quot;