I was wondering if it is possible to solve the discrete logarithm on an Elliptic Curve E(Z/nZ) (defined over the ring of integers modulo a composite n) with #E(Z/nZ)=n by applying a method analogous to the Semaev, Satoh-Araki, and Smart attack for anomalous elliptic curves over prime fields.
[Math] Anomalous elliptic curves over finite rings
cryptographyelliptic-curves
Related Solutions
Let me first give you a heuristic "reason", why the regulator in the class number formula looks different from the regulator in the Birch and Swinnerton-Dyer conjecture. It is often more convenient (and more canonical) to combine the regulator and the torsion term in the Birch and Swinnerton-Dyer conjecture: one chooses a free subgroup $A$ of the Mordell-Weil group of $E(K)$ with finite index and looks at the quantity $R(A)/[E(K):A]^2$, where $R(A)$ is the absolute value of the determinant of the Néron-Tate height pairing on a basis of $A$. As you can easily check, the square in the denominator insures that this quantity is independent of the choice of $A$. Now, in the class number formula, the torsion term is replaced by the number of roots of unity in $K$ and that term is not squared. So for such a canonical formulation to be possible, it is reasonable to expect that not the regulator of the number field should be defined through a symmetric pairing on the units, but its square. Then you could make the same definition as in the elliptic curves case, and it would be independent of the choice of finite index subgroup.
Now, that we have established this, there are several ways to bring the two situations closer together. You could do the naïve thing: take the matrix $M=(\log|u_i|_{v_j})$, where $u_i$ runs over a basis of the free part of the units (or more generally $S$-units for any set of places $S$ which includes the Archimedean ones), and where $v_j$ runs over all but one Archimedean place (or more generally all but one place in $S$), v_0, say. The absolute values have to be suitably normalised (see e.g. Tate's book on Stark's conjecture). Now take the symmetric matrix $MM^{tr}$ and define this to be the matrix of a new pairing on the units. In other words, you would define your symmetric pairing as $$ (u_1,u_2) = \sum_{v\in S\backslash\{v_0\}} \log|u_1|_v\log|u_2|_v. $$ Then, it's clear that you have a symmetric pairing and that the determinant of that pairing with respect to any basis on the free part of the units is $R(K)^2$. As I mentioned above, the square was expected.
Depending on what you want to do, this pairing might not be the best one to consider. For example if now $F/K$ is a finite extension and you consider the analogous pairing on the $S$-units of $F$ and restrict it to $K$, then it's not clear how to compare it to the pairing on $K$. In the elliptic curves case by contrast, the former is $[F:K]$ times the latter. To fix this, we can make the following definition: $$ (u_1,u_2) = \sum_{v\in S} \frac{1}{e_vf_v}\log|u_1|_v\log|u_2|_v, $$ where $e$ and $f$ are the absolute ramification index and residue field degree respectively. With this definition, the compatibility upon restriction to subfields is the same as in the elliptic curves case. On the other hand, the relationship with the actual regulator is slightly less obvious. It is however quite easy to show (and I have done it in http://arxiv.org/abs/0904.2416, Lemma 2.12, in case you are interested in the details) that the determinant of this pairing is given by $$ \frac{\sum e_vf_v}{\prod e_vf_v}R(K)^2, $$ with both the sum and the product again ranging over the places in $S$.
So I guess, the moral is that one shouldn't seek analogies between the BSD-formula and the class number formula but rather between the BSD and the square of the class number formula (note that also sha, which is supposed to be the elliptic curve analogue of the class number, has square order whenever it is finite). There is also a corresponding heuristic on the analytic side.
I don't think that this should be too hard: take a simple family of curves, such as $y^2 = x^3 + px$ or something similar, and choose $p$ from a certain set of residue classes to guarantee that the 2-Selmer group has rank 1. You can complete the proof either by invoking rather deep constructions using Heegner points, or finding a family for which conditions such as $p = a^4 + b^2$ (there are infinitely many primes of this form) give you a global point (choose your family in such a way that $b^2 = px^4 - y^4$ occurs as a principal homogeneous space in your standard 2-descent; see e.g. Silverman's book). Sorry for being a little bit vague - a hard disk crash currently prevents me from looking at my own notes.
Best Answer
The condition $\#E(\mathbb{Z}/n\mathbb{Z}) = n$ is not enough, I believe. You would need that $E(\mathbb{Z}/p\mathbb{Z})$ is cyclic of order $p$ for all prime divisors $p$ of $n$.
By the Chinese Remainder Theorem, we have $E(\mathbb{Z}/n\mathbb{Z}) = \prod_{p\mid n} E(\mathbb{Z}/p^{k_p}\mathbb{Z})$ where $k_p=\operatorname{ord}_p(n)$. That reduces the problem to prime powers. If $E(\mathbb{Z}/p\mathbb{Z})$ is cyclic of order $p$, then you can use the $p$-adic logarithm to solve $E(\mathbb{Z}/p^{k_p}\mathbb{Z})$, too.
Now if $n=pq$ for two distinct primes and $E(\mathbb{Z}/p\mathbb{Z})$ has $q$ elements then the $p$-adic logarithm won't help to solve the discrete logarithm there.
This means that the naivest version of using the same idea only works in special cases. But maybe I am missing something.