## Spectral Analysis of Pollard Rho Collisions

Venue: | Proc. of the 7th Algorithmic Number Theory Symposium (ANTS VII); Springer LNCS |

Citations: | 11 - 0 self |

### BibTeX

@INPROCEEDINGS{Miller_spectralanalysis,

author = {Stephen D. Miller and Ramarathnam Venkatesan},

title = {Spectral Analysis of Pollard Rho Collisions},

booktitle = {Proc. of the 7th Algorithmic Number Theory Symposium (ANTS VII); Springer LNCS},

year = {},

pages = {573--581}

}

### OpenURL

### Abstract

Abstract. We show that the classical Pollard ρ algorithm for discrete logarithms produces a collision in expected time O ( √ n(log n) 3). This is the first nontrivial rigorous estimate for the collision probability for the unaltered Pollard ρ graph, and is close to the conjectured optimal bound of O ( √ n). The result is derived by showing that the mixing time for the random walk on this graph is O((log n) 3); without the squaring step in the Pollard ρ algorithm, the mixing time would be exponential in log n. The technique involves a spectral analysis of directed graphs, which captures the effect of the squaring step.

### Citations

233 | Lower Bounds for Discrete Logarithms and Related Problems
- Shoup
- 1997
(Show Context)
Citation Context ... and Venkatesan Spectral Analysis of Pollard Rho Collisions In the black-box group model (i.e. one which does not exploit any special properties of the encoding of group elements), a theorem of Shoup =-=[11]-=- states that any dlog algorithm needs Ω( √ n) steps. Hence, aside from the probabilistic nature of the above algorithm and the extra factor of (log n) 3 , the estimate of Theorem 1.1 is sharp. It shou... |

171 |
Modern Graph Theory, Graduate Texts
- Bollobás
- 1998
(Show Context)
Citation Context ... two sections we will describe some results in graph theory which are needed for the proof of Theorem 1.1. Some of this material is analogous to known results for undirected graphs (see, for example, =-=[2]-=-); however, since the literature on spectral analytic aspects of directed graphs is relatively scarce, we have decided to give full proofs for completeness. The three properties of subset expansion, s... |

133 |
Ten Lectures on the Interface between Analytic Number Theory and Harmonic Analysis,” published for
- Montgomery
- 1994
(Show Context)
Citation Context ...uoting a special case of the key estimate of that paper, which concerns quadratic forms. At first glance, the analysis is reminiscent of the of the Hilbert inequality from analytic number theory (see =-=[10, 12]-=-), but where the quadratic form coefficients are expressed as 1/ sin(µj − µk). Let n be an odd integer and λk = | cos(πk/n)| for k ∈ Z/nZ. Consider the quadratic form Q : R n−1 → R given by Q(x1, . . ... |

112 |
Eigenvalue bounds on convergence to stationarity for nonreversible Markov chains with an application to the exclusion process. Annals of Applied Probability 1:62–7
- Fill
- 1991
(Show Context)
Citation Context ... node, and the hash value is the end point. 5Miller and Venkatesan Spectral Analysis of Pollard Rho Collisions degree. This equivalence, however, fails for directed graphs. Although a result of Fill =-=[3]-=- allows one to deduce rapid mixing on directed graphs from undirected analogs, it involves adding self-loops (which the Pollard ρ graph does not have) and some additional overhead. In any event, it re... |

33 | On random walks for pollards rho method
- Teske
(Show Context)
Citation Context ...ithm heuristically mimics a random walk. Were that indeed the case, a collision would be found in time O( √ n), where n is the order of the group G. (The actual constant is more subtle; indeed, Teske =-=[13]-=- has given evidence that the walk is somewhat worse than random.) The main result of this paper is the first rigorous nontrivial upper bound on the collision time. It is slightly worse than the conjec... |

32 |
Mixing times, in: Microsurveys in Discrete Probability
- Lovász, Winkler
- 1998
(Show Context)
Citation Context ... The importance of τ stems from the fact that, typically, one incurs a overhead of multiplicative factor of τ const in the overall algorithm. 1 There are many inequivalent notions of mixing time (see =-=[7]-=-). Mixing time is only mentioned for purposes of rough comparison between different graphs; whatever we need about it is proved directly. Similarly, the reader need not recall any facts about expander... |

24 |
Mathematical aspects of mixing times
- Montenegro, Tetali
(Show Context)
Citation Context ...tural generalization of the spectral gap is the operator norm gap of the adjacency matrix, which suffices for our purposes (see Section 2). For a recent survey of mixing times on directed graphs, see =-=[9]-=-. The Pollard ρ graph is very similar to the graphs introduced by the authors in [8]. These graphs, which are related to expander graphs, also connect group elements x to f(x) via the operations given... |

17 |
Toward a theory of Pollard’s rho method
- Bach
- 1991
(Show Context)
Citation Context ... we refer the reader to the survey by Teske [14], and for an analysis of random walks on abelian groups, to the one by Hildebrand [4]. For the related Pollard ρ algorithm for factoring integers, Bach =-=[1]-=- improved the trivial bound of O(n) by logarithmic factors. An important statistic of the involved graphs is the mixing time τ, which loosely speaking is the amount of time needed for the random walk ... |

17 |
The Cauchy-Schwarz Master Class
- Steele
- 2004
(Show Context)
Citation Context ...uoting a special case of the key estimate of that paper, which concerns quadratic forms. At first glance, the analysis is reminiscent of the of the Hilbert inequality from analytic number theory (see =-=[10, 12]-=-), but where the quadratic form coefficients are expressed as 1/ sin(µj − µk). Let n be an odd integer and λk = | cos(πk/n)| for k ∈ Z/nZ. Consider the quadratic form Q : R n−1 → R given by Q(x1, . . ... |

3 |
Applications of cayley graphs, bilinearity, and higherorder residues to cryptology
- Horwitz
- 2004
(Show Context)
Citation Context ...eness. The three properties of subset expansion, spectral gap, and rapid mixing are all equivalent for families of undirected graphs with fixed 2 In this version one can derive a secure hash function =-=[5]-=- whose security is based on the difficulty of the discrete logarithm problem; here the input describes the path taken in the graph from a fixed node, and the hash value is the end point. 5Miller and ... |

3 |
and Ramarathnam Venkatesan, Random Cayley digraphs and the discrete logarithm, Algorithmic number theory
- Horwitz
- 2002
(Show Context)
Citation Context ...prime this is believed to happen with overwhelming probability, much more so than for the above task of finding a collision in O( √ n) time. This was shown for a variant of the Pollard ρ algorithm in =-=[6]-=-, but the method there does not apply to the original algorithm itself. Using more refined techniques we are able to analyze this question further; the results of these investigations will be reported... |

2 |
Ilya Mironov, and Ramarathnam Venkatesan, MV3: A New Stream Cipher Based On Random
- Keller, Miller
(Show Context)
Citation Context ...atrix, which suffices for our purposes (see Section 2). For a recent survey of mixing times on directed graphs, see [9]. The Pollard ρ graph is very similar to the graphs introduced by the authors in =-=[8]-=-. These graphs, which are related to expander graphs, also connect group elements x to f(x) via the operations given in (1.1) – in particular they combine the operations of multiplication and squaring... |

2 |
algorithms for the discrete logarithm problem (a survey), Public-Key Cryptography and Computational Number Theory
- Square-root
- 2001
(Show Context)
Citation Context ... the basis for estimating the relative bit-for-bit security of elliptic curve cryptosystems compared to others, e.g. RSA. For an analysis of dlog algorithms we refer the reader to the survey by Teske =-=[14]-=-, and for an analysis of random walks on abelian groups, to the one by Hildebrand [4]. For the related Pollard ρ algorithm for factoring integers, Bach [1] improved the trivial bound of O(n) by logari... |

2 |
A primer on modern techniques for bounding mixing times. Pre-print at http://www.math.gatech.edu/%7Etetali/RESEARCH/pubs.html
- Montenegro, Tetali
(Show Context)
Citation Context ...tural generalization of the spectral gap is the operator norm gap of the adjacency matrix, which suffices for our purposes (see Section 2). For a recent survey of mixing times on directed graphs, see =-=[8]-=-. The Pollard ρ graph is very similar to the graphs introduced by the authors in [7]. These graphs, which are related to expander graphs, also connect group elements x to f(x) via the operations given... |

1 |
A survey of results on random walks on finite groups
- Hildebrand
(Show Context)
Citation Context ...stems compared to others, e.g. RSA. For an analysis of dlog algorithms we refer the reader to the survey by Teske [14], and for an analysis of random walks on abelian groups, to the one by Hildebrand =-=[4]-=-. For the related Pollard ρ algorithm for factoring integers, Bach [1] improved the trivial bound of O(n) by logarithmic factors. An important statistic of the involved graphs is the mixing time τ, wh... |