What are the three possible group structure variants for an elliptic curve over $\mathbb{F}_p$, and how does the group order determine which variant applies?

If the group order is prime → always cyclic (every point is a generator). If non-prime → may or may not be cyclic (may or may not have generators). These three cases directly affect cryptographic parameter selection.

* Prime group order (a) is the ideal case — always cyclic, every point a generator; the two non-prime cases (b, c) may or may not be cyclic and need more care. *

The three variants:

Why this matters for cryptography:

• Variant (a) is ideal: Every point is a generator, no subgroup attacks, simplest to use. This is why curves with prime order are preferred (e.g., NIST P-256 has $h=1$)
• Variant (b) is usable: Must carefully choose a generator. $\varphi(|E|)$ generators exist among $|E|$ elements
• Variant (c) is problematic: No single point generates the whole group. Must work with subgroups

Determining element orders:

• Element orders must divide the group order (Lagrange's theorem)
• For group order 9: possible orders are $\{1, 3, 9\}$
• Compute: $2P$, $3P$, ... until you reach $\mathcal{O}$ — that's the element's order
• Example: For $P(0,3)$ on $y^2 = x^3+3x+2 \mod 7$: compute $2P, 3P, ...$ If $9P = \mathcal{O}$ → order 9 → generator

The sum of $\varphi(\text{divisors})$ must equal $|E|$: e.g., for $|E|=9$: $\varphi(1)+\varphi(3)+\varphi(9) = 1+2+6 = 9$ ✓

Go deeper:

• Cyclic group — Wikipedia — generators and why every prime-order group is cyclic.
• Lagrange's theorem (group theory) — Wikipedia — why an element's order must divide the group order.