## Diffie-Hellman Oracles (1996)

Venue: | ADVANCES IN CRYPTOLOGY - CRYPTO '96 , LECTURE NOTES IN COMPUTER SCIENCE |

Citations: | 34 - 3 self |

### BibTeX

@INPROCEEDINGS{Maurer96diffie-hellmanoracles,

author = {Ueli M. Maurer and Stefan Wolf},

title = {Diffie-Hellman Oracles},

booktitle = {ADVANCES IN CRYPTOLOGY - CRYPTO '96 , LECTURE NOTES IN COMPUTER SCIENCE},

year = {1996},

pages = {268--282},

publisher = {Springer-Verlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

This paper consists of three parts. First, various types of Diffie-Hellman oracles for a cyclic group G and subgroups of G are defined and their equivalence is proved. In particular, the security of using a subgroup of G instead of G in the Diffie-Hellman protocol is investigated. Second, we derive several new conditions for the polynomial-time equivalence of breaking the Diffie-Hellman protocol and computing discrete logarithms in G which extend former results by den Boer and Maurer. Finally, efficient constructions of Diffie-Hellman groups with provable equivalence are described.

### Citations

2714 | New directions in cryptography, in
- Diffie, Hellman
(Show Context)
Citation Context ...e described. Keywords. Public-key cryptography, Diffie-Hellman protocol, Discrete logarithms, Elliptic curves. 1 Introduction Let G be a cyclic group with generator g. The Diffie-Hellman (DH) problem =-=[6]-=- is, for given g u and g v , to compute g uv . A possible group for the DH protocol [6] is Z p , where p is a prime number, or an elliptic curve over a finite field [17],[9]. The DH problem is at most... |

695 |
Elliptic curve cryptosystems
- Koblitz
- 1987
(Show Context)
Citation Context ...iffie-Hellman (DH) problem [6] is, for given g u and g v , to compute g uv . A possible group for the DH protocol [6] is Z p , where p is a prime number, or an elliptic curve over a finite field [17],=-=[9]-=-. The DH problem is at most as difficult as computing discrete logarithms (DL) in G with respect to the base g. By analyzing DH-oracles and their application for computing discrete logarithms we take ... |

536 |
A Classical Introduction to Modern Number Theory, Second Edition
- Ireland, Rosen
- 1990
(Show Context)
Citation Context ...subgroup of order p + 1 of F p 2 is a useful auxiliary group for all p. The following statements about the orders of curves defined by the equations above in the case they are not p + 1 are proved in =-=[8]-=-. If p j 1 (mod 4), then p can uniquely be represented as a product in the ring Z[i] of Gaussian integers: p =s= (a + bi)(a \Gamma bi) = a 2 + b 2 , andsj 1 (mod 2+2i). The curves y 2 = x 3 \Gamma Dx ... |

529 |
Uses of elliptic curves in cryptography
- Miller
- 1986
(Show Context)
Citation Context ...The Diffie-Hellman (DH) problem [6] is, for given g u and g v , to compute g uv . A possible group for the DH protocol [6] is Z p , where p is a prime number, or an elliptic curve over a finite field =-=[17]-=-,[9]. The DH problem is at most as difficult as computing discrete logarithms (DL) in G with respect to the base g. By analyzing DH-oracles and their application for computing discrete logarithms we t... |

302 | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance
- Pohlig, Hellman
(Show Context)
Citation Context ...og jGj). Proof. The square root algorithm of Massey [12] can be generalized as follows. Let jGj = p j s (where js1 and (p; s) = 1), and let h be a p-th power in G. By the method of Pohlig and Hellman =-=[18]-=- we can compute the remainder k of the discrete logarithm of h to the base g with respect to p j . Note that k is a multiple of p because h is a p-th power. Let d j \Gammas \Gamma1 (mod p). The elemen... |

250 |
Algorithms for Computer Algebra
- Geddes, Czapor, et al.
- 1992
(Show Context)
Citation Context ...ms of equations which have triangular form, such that a method for solving univariate equations (as Berlekamp's algorithm) suffices to solve the whole system. For an introduction to Grobner bases see =-=[7]-=-, and for a detailed description of the computations see [21]. The idea is to compute the polynomials (with implicitly represented coefficients) of a Grobner basis of the polynomial ideal generated by... |

233 |
Factoring Integers with Elliptic Curves
- Lenstra
- 1987
(Show Context)
Citation Context ...ry fixed u, /(n; n 1=u )=n = u \Gamma(1+o(u))u , where /(n; y) denotes the number of integerssn with no prime divisorsy (see [4]). Smoothness can be tested with the elliptic curve factoring algorithm =-=[11]-=-. Because a and k are odd, exactly one of the expressions a + (k \Sigma 1)i is congruent to 1 modulo 2 + 2i. Let ff := a + (k \Sigma 1)i, respectively. Repeat the computations until p := ffff = a 2 + ... |

170 |
Elliptic curves over finite fields and the computation of square roots mod p
- Schoof
- 1985
(Show Context)
Citation Context ...a + b), and the six orders occur equally often. If p j 1 (mod 4) or p j 1 (mod 3), curves with the above orders are explicitly constructable by varying D. The orders are computable in polynomial time =-=[19]-=-. 3.4 Subgroups of Finite Fields as Auxiliary Groups We refer to [16] for an introduction to finite fields. The group F p n and hence every subgroup is cyclic. The field F p n is an n-dimensional vect... |

74 |
Algorithms for black-box fields and their application to cryptography (extended abstract
- Boneh, Lipton
- 1996
(Show Context)
Citation Context ...llow to find p efficiently by the method of [11], because no point can be generated on the curve modulo jGj. In [14] a method is described, presented initially in [21] and independently considered in =-=[3]-=-, for obtaining stronger results under the assumption of efficient DH-oracle algorithms using algebraic operations for certain groups. For example, a cyclic auxiliary group H p whose order contains a ... |

69 | Towards the equivalence of breaking the Diffie-Hellman protocol and computing discrete logarithms
- Maurer
- 1994
(Show Context)
Citation Context ... give an extended list of expressions in p, including for example all the cyclotomic polynomials of low degree in p (which include the known cases p \Gamma 1 due to den Boer [5] and p+1 due to Maurer =-=[13]-=-), such that, if for every large prime factor p of jGj one of the expressions in the list is smooth, then breaking the Diffie-Hellman protocol and computing discrete logarithms are equivalent for G. 2... |

45 |
Primality Testing And Abelian Varieties Over Finite Fields (Springer-Verlag
- Adleman, Huang
- 1992
(Show Context)
Citation Context ...perelliptic curves of genus 2 varies in a larger interval of size [n \Gamma \Theta(n 3=4 ); n + \Theta(n 3=4 )], but the more detailed results about the distribution of the orders which are proved in =-=[1]-=- are not sufficient to prove the existence of the side information string without unproven conjecture. The reason is that in [1] the existence of Jacobians with prime order is proved, whereas Jacobian... |

45 |
Constructing elliptic curves with given group order over large finite fields. Algorithmic Number Theory
- Lay, Zimmer
- 1994
(Show Context)
Citation Context ...ssibility is to find a multiple l of n (where l=n is small) such that l + 1 is prime and to use G = GF (l + 1) . An alternative, which may be more secure, is to use the construction of Lay and Zimmer =-=[10]-=- for finding an elliptic curve of order n. The second case is somewhat more involved. Such a group G can be obtained by choosing a large smooth number m and using the method of Lay and Zimmer [10] for... |

25 |
Diffie-Hellman is as strong as discrete log for certain primes
- Boer
- 1990
(Show Context)
Citation Context ...table auxiliary groups. We give an extended list of expressions in p, including for example all the cyclotomic polynomials of low degree in p (which include the known cases p \Gamma 1 due to den Boer =-=[5]-=- and p+1 due to Maurer [13]), such that, if for every large prime factor p of jGj one of the expressions in the list is smooth, then breaking the Diffie-Hellman protocol and computing discrete logarit... |

23 |
The discrete logarithm problem, Cryptology and Computational
- McCurley
- 1990
(Show Context)
Citation Context ...tion are known. This is the case in most known applications. It is conceivable that knowledge of jGj could be of some help in computing discrete logarithms. For example, the algorithm of Pollard (see =-=[15]-=-) requires knowledge of the group order. For the case of unknown factorization of the group order, note that in some cases the parameters of a smooth auxiliary group H p allow to compute p. If an appr... |

19 |
Factoring with cyclotomic polynomials
- Bach, Shallit
- 1989
(Show Context)
Citation Context ...rs of a smooth auxiliary group H p allow to compute p. If an appropriate multiplicative subgroup of an extension field of F p has smooth order, then p can be found efficiently as a factor of jGj (see =-=[2]-=-). The parameters A and B of a smooth elliptic curve over F p defined by y 2 = x 3 + Ax + B do generally not allow to find p efficiently by the method of [11], because no point can be generated on the... |

15 |
On a Problem of Oppenheim Concerning "Factorisatio Numerorum
- Canfield, Erdos, et al.
- 1983
(Show Context)
Citation Context ...=s \Delta (2l 0 =s) \Gamma2l 0 =s . This follows from the fact that for every fixed u, /(n; n 1=u )=n = u \Gamma(1+o(u))u , where /(n; y) denotes the number of integerssn with no prime divisorsy (see =-=[4]-=-). Smoothness can be tested with the elliptic curve factoring algorithm [11]. Because a and k are odd, exactly one of the expressions a + (k \Sigma 1)i is congruent to 1 modulo 2 + 2i. Let ff := a + (... |

10 |
Elliptic Curve Cryptosystems Using Curves of Smooth Order Over the Ring Zn
- Vanstone
- 1997
(Show Context)
Citation Context ...e method of Lay and Zimmer [10] for constructing a prime p together with an elliptic curve of order m. We now consider efficient constructions for the first case. We generalize a method, presented in =-=[20]-=- by Vanstone and Zuccherato, for constructing a large prime p such that either a quarter of the curves y 2 = x 3 \Gamma Dx or every sixth curve of the form y 2 = x 3 + D have smooth order. We show how... |

5 | On the complexity of breaking the Diffieâ€“Hellman protocol
- Maurer, Wolf
- 1996
(Show Context)
Citation Context ... error distribution there can be several candidates, and the correct one can be determined similarly to the detection of the correct root in Lemma 2. A full proof of the following theorem is given in =-=[14]. The-=-orem 1 For every cyclic group G with generator g and known order jGj and for every fi ? 0 there exists a DH-oracle algorithm which makes calls to an "-DH-oracle and whose answer is correct with p... |

1 |
Diffie-Hellman and discrete logarithms, Thesis
- Wolf
- 1995
(Show Context)
Citation Context ...The complexities stated in the theorem can be reduced by a time-memory tradeoff. The use of elliptic curves and subgroups of extension fields as auxiliary groups is discussed in the next sections. In =-=[21]-=- it is shown that Jacobians of hyperelliptic curves are also suitable auxiliary groups. Proof. Let a = g s be a given element of G for which the discrete logarithm s should be computed using a DH-orac... |