Abstract

Abstract. Under the assumption that solving the discrete logarithm problem modulo an n-bit prime p is hard even when the exponent is a small c-bit number, we construct a new and improved pseudo-random bit generator. This new generator outputs n − c − 1 bits per exponentiation with a c-bit exponent. Using typical parameters, n = 1024 and c = 160, this yields roughly 860 pseudo-random bits per small exponentiations. Using an implementation with quite small precomputation tables, this yields a rate of more than 20 bits per modular multiplication, thus much faster than the the squaring (BBS) generator with similar parameters. 1

Citations

2292	New directions in cryptography - Diffie, Hellmen - 1976
1001	Probabilistic encryption - Goldwasser, Micali - 1984
601	A pseudorandom generator from any one-way function - H˚astad, Impagliazzo, et al. - 1999
533	How to generate cryptographically strong sequences of pseudorandom bits - Blum, Micali - 1984
453	Theory and applications of trapdoor functions - Yao - 1982
321	The Art of Computer Programming, vol. 3: Sorting and Searching - Knuth - 1973
256	An improved algorithm for computing logarithms over GF (p) and its cryptographic significance - Pohlig, Hellman - 1978
193	Monte Carlo methods for index computation (mod p - Pollard - 1978
185	A simple unpredictable pseudo-random number generator - Blum, Shub - 1986
165	A subexponential algorithm for discrete logarithms over the rational subgroup of the Jacobians of large genus hyperelliptic curves over finite fields, Algorithmic Number Theory - Adleman, DeMarrais, et al. - 1994
121	Number-theoretic constructions of efficient pseudorandom functions - Naor, Reingold - 1997
120	C.: RSA and Rabin Functions: Certain Parts are as Hard as the Whole - Alexi, Chor, et al. - 1988
69	Efficient cryptographic schemes provably as secure as subset sum - Impagliazzo, Naor - 1996
64	More flexible exponentiation with precomputation - Lim, Lee - 1994
51	On Diffie-Hellman key agreement with short exponents - Oorschot, Wiener - 1996
27	Stronger Security Proofs for RSA and Rabin Bits - Fischlin, Schnorr - 2000
26	A.: The Discrete Logarithm Modulo a Composite Hides O(n) Bits - Håstad, Schrift, et al. - 1993
18	M.: The Security of Individual RSA Bits - Håstad, Näslund - 1998
10	An efficient discrete log pseudo random generator - Patel, Sundaram - 1998
7	The discrete log hides O(log n) bits - Long, Wigderson - 1988
3	Simultaneous Security of Bits - Peralta - 1986
2	Security of Allmost ALL Discrete Log Bits. Electronic Colloquium on Computational Complexity. Report TR98-033. Available at http://www.eccc.uni-trier.de/eccc - Schnorr