Results 1  10
of
15
Speeding Up Pollard's Rho Method For Computing Discrete Logarithms
, 1998
"... . In Pollard's rho method, an iterating function f is used to define a sequence (y i ) by y i+1 = f(y i ) for i = 0; 1; 2; : : : , with some starting value y 0 . In this paper, we define and discuss new iterating functions for computing discrete logarithms with the rho method. We compare the ..."
Abstract

Cited by 56 (7 self)
 Add to MetaCart
(Show Context)
. In Pollard's rho method, an iterating function f is used to define a sequence (y i ) by y i+1 = f(y i ) for i = 0; 1; 2; : : : , with some starting value y 0 . In this paper, we define and discuss new iterating functions for computing discrete logarithms with the rho method. We compare their performances in experiments with elliptic curve groups. Our experiments show that one of our newly defined functions is expected to reduce the number of steps by a factor of approximately 0:8, in comparison with Pollard's originally used function, and we show that this holds independently of the size of the group order. For group orders large enough such that the run time for precomputation can be neglected, this means a realtime speedup of more than 1:2. 1. Introduction Let G be a finite cyclic group, written multiplicatively, and generated by the group element g. Given an element h in G, we wish to find the least nonnegative number x such that g x = h. This problem is the discre...
On Random Walks For Pollard's Rho Method
 Mathematics of Computation
, 2000
"... . We consider Pollard's rho method for discrete logarithm computation. Usually, in the analysis of its running time the assumption is made that a random walk in the underlying group is simulated. We show that this assumption does not hold for the walk originally suggested by Pollard: its per ..."
Abstract

Cited by 41 (5 self)
 Add to MetaCart
(Show Context)
. We consider Pollard's rho method for discrete logarithm computation. Usually, in the analysis of its running time the assumption is made that a random walk in the underlying group is simulated. We show that this assumption does not hold for the walk originally suggested by Pollard: its performance is worse than in the random case. We study alternative walks that can be efficiently applied to compute discrete logarithms. We introduce a class of walks that lead to the same performance as expected in the random case. We show that this holds for arbitrarily large prime group orders, thus making Pollard's rho method for prime group orders about 20% faster than before. 1. Introduction Let G be a finite cyclic group, written multiplicatively, and generated by the group element g. We define the discrete logarithm problem (DLP) as follows: given a group element h, find the least nonnegative integer x such that h = g x . We write x = log g h and call it the discrete logarithm of h...
Random walks on finite groups
 In Probability on Discrete Structures, Encyclopedia of Mathematical Sciences
, 2004
"... ..."
(Show Context)
SquareRoot Algorithms For The Discrete Logarithm Problem (a Survey)
 In Public Key Cryptography and Computational Number Theory, Walter de Gruyter
, 2001
"... The best algorithms to compute discrete logarithms in arbitrary groups (of prime order) are the babystep giantstep method, the rho method and the kangaroo method. The first two have (expected) running time O( p n) group operations (n denoting the group order), thereby matching Shoup's lower b ..."
Abstract

Cited by 36 (0 self)
 Add to MetaCart
(Show Context)
The best algorithms to compute discrete logarithms in arbitrary groups (of prime order) are the babystep giantstep method, the rho method and the kangaroo method. The first two have (expected) running time O( p n) group operations (n denoting the group order), thereby matching Shoup's lower bounds. While the babystep giantstep method is deterministic but with large memory requirements, the rho and the kangaroo method are probabilistic but can be implemented very space efficiently, and they can be parallelized with linear speedup. In this paper, we present the state of the art in these methods.
Random Walks On Finite Groups With Few Random Generators
 Electr. J. Prob
, 1999
"... . Let G be a finite group. Choose a set S of size k uniformly from G and consider a lazy random walk on the corresponding Cayley graph. We show that for almost all choices of S given k = 2 a log 2 jGj, a ? 1, this walk mixes in under m = 2a log a a\Gamma1 log jGj steps. A similar result was obtai ..."
Abstract

Cited by 14 (7 self)
 Add to MetaCart
(Show Context)
. Let G be a finite group. Choose a set S of size k uniformly from G and consider a lazy random walk on the corresponding Cayley graph. We show that for almost all choices of S given k = 2 a log 2 jGj, a ? 1, this walk mixes in under m = 2a log a a\Gamma1 log jGj steps. A similar result was obtained earlier by Alon and Roichman (see [AR]), Dou and Hildebrand (see [DH]) using a different techniques. We also prove that when sets are of size k = log 2 jGj+O(log log jGj), m = O(log 3 jGj) steps suffice for mixing of the corresponding symmetric lazy random walk. Finally, when G is abelian we obtain better bounds in both cases. A.M.S. Classification. 60C05,60J15. Key words and phrases. Random random walks on groups, random subproducts, probabilistic method, separation distance. Submitted to EJP on June 5, 1998. Final version accepted on November 11, 1998. Typeset by A M ST E X 2 IGOR PAK Introduction In the past few years there has been a significant progress in analysis of rando...
A survey of results on random random walks on finite groups
 Probab. Surv
, 2005
"... ..."
(Show Context)
Random Lazy Random Walks on Arbitrary Finite Groups
 J. Theoret. probab
, 2000
"... This paper considers "lazy" random walks supported on a random subset of k elements of a finite group G with order n. If k = da log 2 ne where a ? 1 is constant, then most such walks take no more than a multiple of log 2 n steps to get close to uniformly distributed on G. If k = log 2 n ..."
Abstract

Cited by 3 (2 self)
 Add to MetaCart
(Show Context)
This paper considers "lazy" random walks supported on a random subset of k elements of a finite group G with order n. If k = da log 2 ne where a ? 1 is constant, then most such walks take no more than a multiple of log 2 n steps to get close to uniformly distributed on G. If k = log 2 n + f(n) where f(n) ! 1 and f(n)= log 2 n ! 0 as n ! 1, then most such walks take no more than a multiple of (log 2 n) ln(log 2 n) steps to get close to uniformly distributed. To get these results, this paper extends techniques of Erdos and R'enyi and of Pak. Key words: Random walks, finite groups, uniform distribution. 1
TWO GRUMPY GIANTS AND A BABY
"... Abstract. Pollard’s rho algorithm, along with parallelized, vectorized, and negating variants, is the standard method to compute discrete logarithms in generic primeorder groups. This paper presents two reasons that Pollard’s rho algorithm is farther from optimality than generally believed. First, ..."
Abstract

Cited by 2 (0 self)
 Add to MetaCart
(Show Context)
Abstract. Pollard’s rho algorithm, along with parallelized, vectorized, and negating variants, is the standard method to compute discrete logarithms in generic primeorder groups. This paper presents two reasons that Pollard’s rho algorithm is farther from optimality than generally believed. First, “higherdegree local anticollisions ” make the rho walk less random than the predictions made by the conventional Brent–Pollard heuristic. Second, even a truly random walk is suboptimal, because it suffers from “global anticollisions ” that can at least partially be avoided. For example, after (1.5 + o(1)) √ ℓ additions in a group of order ℓ (without fast negation), the babystepgiantstep method has probability 0.5625 + o(1) of finding a uniform random discrete logarithm; a truly random walk would have probability 0.6753... + o(1); and this paper’s new twogrumpygiantsandababy method has probability 0.71875 + o(1). 1.
The diameter of a random Cayley graph of Zq
, 2009
"... Consider the Cayley graph of the cyclic group of prime order q with k uniformly chosen generators. For fixed k, we prove that the diameter of said graph is asymptotically (in q) of order k √ q. This answers a question of Benjamini. The same also holds when the generating set is taken to be a symmetr ..."
Abstract

Cited by 2 (0 self)
 Add to MetaCart
(Show Context)
Consider the Cayley graph of the cyclic group of prime order q with k uniformly chosen generators. For fixed k, we prove that the diameter of said graph is asymptotically (in q) of order k √ q. This answers a question of Benjamini. The same also holds when the generating set is taken to be a symmetric set of size 2k. 1
COLLISION BOUNDS FOR THE ADDITIVE POLLARD RHO ALGORITHM FOR SOLVING DISCRETE LOGARITHMS
"... Abstract. We prove collision bounds for the Pollard rho algorithm to solve the discrete logarithm problem in a general cyclic group G. Unlike the setting studied by Kim et al. we consider additive walks: the setting used in practice to solve the elliptic curve discrete logarithm problem. Our bounds ..."
Abstract
 Add to MetaCart
(Show Context)
Abstract. We prove collision bounds for the Pollard rho algorithm to solve the discrete logarithm problem in a general cyclic group G. Unlike the setting studied by Kim et al. we consider additive walks: the setting used in practice to solve the elliptic curve discrete logarithm problem. Our bounds differ from the birthday bound O ( √ G) by a factor of √ log G  and are based on mixing time estimates for random walks on finite abelian groups due to Hildebrand. 1.