On Diffie-Hellman Key Agreement with Short Exponents (1996)
| Venue: | Proc. Eurocrypt '96, LNCS 1070 |
| Citations: | 51 - 0 self |
BibTeX
@INPROCEEDINGS{Oorschot96ondiffie-hellman,
author = {Paul C. van Oorschot and Michael J. Wiener},
title = {On Diffie-Hellman Key Agreement with Short Exponents},
booktitle = {Proc. Eurocrypt '96, LNCS 1070},
year = {1996},
publisher = {Springer-Verlag}
}
Years of Citing Articles
Bookmark
 |
 |
 |
 |
 |
 |
OpenURL
Abstract
The difficulty of computing discrete logarithms known to be "short" is examined, motivated by recent practical interest in using Diftie-Hellman key agreement with short exponents (e.g. over Zp with 160-bit exponents and 1024-bit primes p). A new divide-and-conquer algorithm for discrete logarithms is presented, combining Pollard's lambda method with a partial Pohhg-Hellman decomposition. For random Diftie- Hellman primes p, examination reveals this partial decomposition itself allows recovery of short exponents in many cases, while the new technique dramatically extends the range. Use of subgroups of large prime order precludes the attack at essentially no cost, and is the recommended solution.
