ECDSA - why not using the cyclic additive group As I understand things so far, the ECDSA scheme used by Bitcoin uses a group G generated by a point on the elliptic curve y^2 = x^2 + 7.

Now G is a cyclic group of finite order n and is, hence, isomorphic to the additive group Z/nZ.

My question is: why not work within Z/nZ directly then? I am assuming there are certain security benefits of using G but I am lacking the general overview to understand why.
(Disclaimer: this is not my field.)

Let g be the chosen generator and n its (prime) order.  In the ECDSA algorithm, these are publicly known.  It is true that g generates a cyclic (abelian) group isomorphic to Z/nZ.

Now a private key consists of an integer k, and the corresponding public key is the group element h = kg. (I use additive notation since we are in an abelian group, so kg = g+g+...+g (k times)).  If we were actually working in Z/nZ, it would be trivial to recover k from h: just divide h by g (mod n) using the Euclidean algorithm.  Then we would have no security at all.

The point, as I understand it, is that in the elliptic curve group, there is no known efficient way to "divide".  And while there certainly exist isomorphisms from &lt;g&gt; to Z/nZ (map g to any element of Z/nZ you like), the inverse of such an isomorphism is not trivial to compute.