[red_trumpet]

I don't get this article. They make a big fuss about looking for the right category, because apparently the category of groups cannot explain the difficulty of breaking Diffie-Hellman, since there is an isomorphism <g> -> Z/nZ. But the same isomorphism exists in the category of algebraic varieties! So was all in vain?

To me this sounds a bit like an a-posteriori justification of why people use elliptic curves to do cryptography. This feels weird to me, as elliptic curves are a well-studied subject in algebraic geometry, whose history reaches back over 150 years to Clebsch. So when Victor Miller and Neal Koblitz proposed to do cryptography with them, they already knew very well about elliptic curves (both have a background in algebraic geometry of finite fields).

[graybanana]

I think the author's point is that while you might a priori think there are lots of groups out there that might be good candidates for DH, it turns out that elliptic curves are a strictly better choice than every alternative, and the reasons for this were definitely no fully known at the time Miller and Koblitz proposed ECC.

There was a period during which there was lots of interest in using abelian varieties of higher dimension (arising as Jacobians of curves of higher genus), with dimensions g=3 and g=4 being particularly attractive because then you could work over a very computationally friendly base field like Fp with p = 2^61-1. But it turns out the discrete logarithm problem (and therefore DH) is strictly easier in these settings (one can exploit Weil restrictions to get an algorithm that is still exponential-time but strictly better than O(p^(g/2)). But this wasn't known until the 2000's.

That leaves g=1 and g=2 as the best choices, and the group law is faster and simpler for g=1, and as far as I know nobody is really working on the g=2 case anymore (but there was a lot of activity in this area 10-20 years ago).