Abstract. We present a new elliptic curve cryptosystem with fast encryption and key generation, which is provably secure in the standard model. The scheme uses arithmetic modulo n2 , where n is an RSA modulus, and merges ideas from Paillier and Rabin related schemes. Despite the typical bit length of n, our encryption algorithm is faster than El Gamal elliptic curve cryptosystems. The one-wayness of the new cryptosystem is as hard as factoring n while the semantic security is proved under a reasonable decisional assumption. Two new length-preserving trapdoor permutations equivalent to factoring are also described.