## Square-Root Algorithms For The Discrete Logarithm Problem (a Survey) (2001)

Venue: | In Public Key Cryptography and Computational Number Theory, Walter de Gruyter |

Citations: | 27 - 0 self |

### BibTeX

@INPROCEEDINGS{Teske01square-rootalgorithms,

author = {Edlyn Teske},

title = {Square-Root Algorithms For The Discrete Logarithm Problem (a Survey)},

booktitle = {In Public Key Cryptography and Computational Number Theory, Walter de Gruyter},

year = {2001},

pages = {283--301}

}

### Years of Citing Articles

### OpenURL

### Abstract

The best algorithms to compute discrete logarithms in arbitrary groups (of prime order) are the baby-step giant-step method, the rho method and the kangaroo method. The first two have (expected) running time O( p n) group operations (n denoting the group order), thereby matching Shoup's lower bounds. While the baby-step giant-step method is deterministic but with large memory requirements, the rho and the kangaroo method are probabilistic but can be implemented very space efficiently, and they can be parallelized with linear speed-up. In this paper, we present the state of the art in these methods.

### Citations

2466 | Handbook of Applied Cryptography
- Menezes, Oorschot, et al.
- 1996
(Show Context)
Citation Context ...n key exchange protocol, the ElGamal encryption and signature schemes, the U.S. Government's Digital Signature Algorithm (DSA), and its elliptic curve analogue (ECDSA), rely on the diculty of the DLP =-=[MvOV96]-=-. These and other systems are being deployed on the Internet (to enable secure electronic mail, home banking, and Internet browsers), in thesnancial services industry (in electronic cash applications,... |

302 | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance
- Pohlig, Hellman
(Show Context)
Citation Context ...bability bounded away from zero has to perform at least const p p group operations. Here it is assumed that ord g and its factorization into primes is known. In this case, the Pohlig-Hellman method [=-=PH78]-=- applies which is a generic method to reduce the DLP in a group of order n to DLPs in groups of order p where p runs through all the prime factors of n. So, while Shoup has established ansp p ) lower ... |

230 |
Monte Carlo methods for index computation (mod p
- Pollard
- 1978
(Show Context)
Citation Context ...ric square-root algorithms for the DLP known to date are based on only a few methods: the baby-step giant-step method due to Shanks [Sha71], and the rho method and the kangaroo method, due to Pollard =-=[Pol-=-78]. The baby-step giant-step method is a deterministic method that uses a time-memory trade-o and takes const p ord g group operations and has to store const p ord g group elements. The rho method ... |

146 | Parallel Collision Search with Cryptanalytic Applications
- Oorschot, Wiener
- 1999
(Show Context)
Citation Context ...oreover, the rho method can be eciently parallelized, where storage requirements on a central server are somewhat higher but can eectively be monitored. 4.3. Parallelization. Van Oorschot and Wiener [=-=vOW99]-=- have shown that the rho method can be parallelized with linear speed-up. Assume we are given m processors. On each processor we use the same iterating function, initialize a sequence (y k ) by comput... |

67 | Improving the parallelized Pollard lambda search on anomalous binary curves - Gallant, Lambert, et al. |

61 | Faster attacks on elliptic curve cryptosystems
- Wiener, Zuccherato
- 1999
(Show Context)
Citation Context ...bmitted, and then such a collision also suits to reveal the discrete logarithm. The inverse point strategy has been successfully applied in groups of elliptic curves oversniteselds [ESST98] (see also =-=[WZ98-=-]). A related technique has been applied in the special case of elliptic curves over F 2 nk dened over F 2 n [GLV00, WZ98]. Here, a speed-up up to a factor of p 2k is achieved by assembling the group ... |

51 |
An improved monte carlo factorization algorithm
- Brent
- 1980
(Show Context)
Citation Context ...uation k + xsk l +xsl (mod p 1), from which we can compute x using the Extended Euclidean algorithm if gcd(p 1;sksl ) = 1. Tosnd a match, there is, for example, an ecient algorithm due to Brent [Br=-=e80]-=-. It uses an auxiliary variable, say w, which at each stage of the algorithm holds y j , where j is the largest power of two strictly less than the current index of the sequence k. At the beginning we... |

50 |
Class number, a theory of factorization, and genera
- Shanks
- 1969
(Show Context)
Citation Context ...xpected) O( p n ) group operations to compute the solution. All generic square-root algorithms for the DLP known to date are based on only a few methods: the baby-step giant-step method due to Shanks =-=[Sha7-=-1], and the rho method and the kangaroo method, due to Pollard [Pol78]. The baby-step giant-step method is a deterministic method that uses a time-memory trade-o and takes const p ord g group operati... |

45 |
Bounds for Discrete Logarithms and Related Problems
- Lower
- 1997
(Show Context)
Citation Context ...liptic curve groups (with a randomly chosen elliptic curve) and subgroups ofsniteselds. More precisely, the only known algorithms for these groups are the aforementioned square-root algorithms. Shoup =-=[Sho97-=-] has shown that if p is the largest prime dividing the group order, a generic algorithm to solve the DLP with a probability bounded away from zero has to perform at least const p p group operations.... |

44 | Speeding up Pollard’s rho method for computing discrete logarithms, in Algorithmic Number Theory Seminar ANTS-III
- Teske
- 1998
(Show Context)
Citation Context ... of G = T 1 [ [ T r with roughly equally large sets T s . For this, we take a hash function v : G ! f1; : : : ; rg and dene T s := fy 2 G : v(y) = sg ; s = 1; : : : ; r. A popular example (see [Tes=-=98b-=-]) is the 20-adding walk, which works with r = 20 sets T s and is generated by an iterating function of the form F (y) = y M v(y) , where the multipliers M 1 ; : : : ; M 20 are computed according to t... |

41 | Parallel Algorithms for Integer Factorization
- Brent
(Show Context)
Citation Context ...mputing a random power of g and then proceed as in the serial rho method. However, we look for a match not among the terms of that single sequence (which would give only a speed-up of a factor of p m =-=[Bre90-=-]), but among all terms computed on all m processors. This is done using the distinguished-point method which works as follows: One denes a set D 2 hgi that consists of all group elements that satisfy... |

37 |
Probability Distributions Related to Random Mappings
- Harris
(Show Context)
Citation Context ... the assumption that w 0 2 W is randomly chosen (with respect to the uniform distribution) and F is a random mapping 3 , the expected values for and are both close to p jW j=8 = 0:626::: p jW j ([Ha=-=r60]-=-). The name rho method stems from the picture one obtains when drawing the terms of (w k ), starting at the bottom and ending in a cycle, which shows the Greek letter rho. 3 A random mapping is a mapp... |

32 |
Monopoly and discrete logarithms
- Kangaroos
- 2000
(Show Context)
Citation Context ...ot reveal anything about the discrete logarithm. An analysis of this phenomenon [Tes01] shows that at most 2 useless collisions are expected to occur, independent of the number of processors. Pollard =-=[Pol-=-00] has developed a version of parallelization where useless collisions cannot occur. Here one works with u tame and v wild kangaroos, where u and v are coprime and such that u v m=2 and u + v m. T... |

32 | On random walks for Pollard’s rho method
- Teske
(Show Context)
Citation Context ...ge number of 1:37 p p 1 iterations. In other groups, or for other ways of partitioning (Z=pZ) , they occur even later, after an (experimental) average of 1:56 p n iterations, where n = ord g (see [T=-=es00]-=-). 4.1. Better random walks. Better walks for the rho method have been introduced that yield the same performance as we expect from a random mapping, which in the case of an arbitrary group means a sp... |

30 | Speeding Up the Discrete Log Computation on Curves with Automorphisms
- Duursma, Gaudry, et al.
- 1999
(Show Context)
Citation Context ...elements in equivalence classes via the Frobenius map. Non-trivial automorphisms have also been exploited to speed up the rho method for discrete logarithm computation on certain hyperelliptic curves =-=[DGM99]-=-. 4.4. On the analysis of the running time. The usual heuristic assumption in the analysis of the rho method is that the iterating function is a random mapping, and then the birthday paradoxon can be ... |

28 |
Combinatorial Algorithms
- Kreher, Stinson
- 1998
(Show Context)
Citation Context ...om subset B X, jBj = =2, and repeat the computation. We can eciently compute RB using a minimal change ordering on fY B; jY j = t=2g where any two successive sets dier by only two elements (cf. [KS9=-=9-=-]). Then, working with a precomputed list fg 2 i : i = 0; : : : ; 1g, we can obtain the next term g val(Y ) from the previous one just by multiplying by g 2 j and dividing by g 2 k for some j and k. ... |

28 | Discrete logarithms: the past and the future
- Odlyzko
(Show Context)
Citation Context ...For an excellent survey on the discrete logarithm problem in cryptographically signicant groups such as groups of points on elliptic curves oversniteselds and multiplicative groups ofsniteselds, see [=-=Odl00-=-]. For the moment, we dene the DLP as follows: Let g be a generator of asnite cyclic group denoted by hgi, and let h 2 hgi. Find the least positive integer x such that g x = h. Then we write x = log g... |

23 | Some baby-step giant-step algorithms for the low hamming weight discrete logarithm problem
- Stinson
(Show Context)
Citation Context ...l(Z) ) 1 for all Z X n B with jZj = t=2. Hence, for each B we need to perform at most 4 =2 t=2 + O(t) group operations and at most =2 t=2 table look-ups in a table of size =2 t=2 . Stinson [Sti] shows that this algorithm, which is due to Coppersmith, is expected to succeed after O( p t ) sets B have been considered. Thus, the expected running time is O( p t =2 t=2 ) group operations. A de... |

18 |
jr., A Monte Carlo factoring algorithm with linear storage
- Schnorr, Lenstra
- 1984
(Show Context)
Citation Context ...th Brent's algorithm thesrst match is found after an expected number of 1:97 p n iterations. Modications of Brent's algorithm that require slightly more storage but less iterations can be found in [S=-=L84]-=- and [Tes98a]. Pollard's original application can easily be generalized to any other group. All we need is a rule how to partition the group into 3 disjoint sets of equally large size, which can be do... |

14 |
Random walks supported on random points of Z/nZ. Probability Theory and Related
- Hildebrand
- 1994
(Show Context)
Citation Context ...1 seem to be a good choice despite the fact that they are not random mappings. Indeed, let M 1 ; : : : ; M r be randomly chosen elements in hgi and let n = ord g be prime. Then from Hildebrand's work =-=[Hil-=-94] on random walks on the integers modulo n, Teske [Tes00] concludes that if in the iteration y k+1 = y k M (y k ) the (y k ) are randomly chosen from f1; : : : ; rg, r-adding walks are getting clos... |

8 | A modification of Shanks’ baby-step giant-step algorithm
- Terr
- 2000
(Show Context)
Citation Context ...multiplications. One has at most 2d p x e elements to store, and it requires at most 2d p x e table look-ups. The second approach uses giant steps whose step width is incremented after each baby step =-=[Ter00-=-]. It is based on the following way of representing integers: Lemma 3.2. For every non-negative integer x there are uniquely determined integers j and t with 0 tssuch that x = T j+1 t, where T j is t... |

8 | Computing discrete logarithms with the parallelized kangaroo method
- Teske
- 2001
(Show Context)
Citation Context ... possible in the above situation that kangaroos of the same herd collide. Such a collision is useless, because it does not reveal anything about the discrete logarithm. An analysis of this phenomenon =-=[Tes01]-=- shows that at most 2 useless collisions are expected to occur, independent of the number of processors. Pollard [Pol00] has developed a version of parallelization where useless collisions cannot occu... |

4 |
Attacking elliptic curve cryptosystems using the parallel Pollard rho method, CryptoBytes (The technical newsletter of RSA
- Escot, Sager, et al.
- 1998
(Show Context)
Citation Context ... EDLYN TESKE up to a prime group order of 108 bits have been solved by parallelized attacks distributed over the Internet. The extensive experimental work related to this challenge (see, for example, =-=[ESST98-=-]) conrms the theoretically predicted linear speed-up for the parallelized rho method. 4.3.1. Inverse-point strategy. In certain groups, a speed-up up to a factor of p 2 can be achieved by applying th... |

3 |
Random cayley graphs and the discrete log
- Horwitz, Venkatesan
- 1998
(Show Context)
Citation Context ...r 16 and with a hash function wesnd the same performance as expected from a random mapping, that is, cycles occur after an expected number of 1:25 p n iterations ([Tes00]). Horwitz and Venkatesan [H=-=V]-=- view r-adding walks as random walks on r-regular Cayley graphs over hgi that are generated by r random group elements M 1 ; : : : ; M r . Then solving the DLP with the rho method can be related tosnd... |

3 |
Generating random walks in groups. Ann.-Univ.-Sci.- Budapest.-Sect.-Comput., 6:65–79
- Sattler, Schnorr
- 1985
(Show Context)
Citation Context ...ting the terms of the sequences ( k ) and (sk ). This means that r-adding walks can be computed even if the group order is not known. Indeed, 8-adding walks have beensrst used by Sattler and Schnorr [=-=SS85]-=- to compute element orders. In experiments with cyclic elliptic curve (sub)groups, matches in 20-adding walks occur after an average of 1:26 p n iterations. This is approximately the performance of a ... |

2 | Baby-step giant-step algorithms for non-uniform distributions
- Blackburn, Teske
- 2000
(Show Context)
Citation Context ...[BJT97] and [Ter00] have the advantages that their running times are lower if x n. The points of turnover are x = n=14 in the case of [BJT97] and x = n=6 in the case of [Ter00]. Blackburn and Teske [=-=BT00]-=- took a systematic approach and asked: given the probability distribution for the solution x on N 0 , what is the baby-step giant-step strategy that computes x using the smallest expected number of op... |

1 |
On some computational problems in abelian groups
- Buchmann, Jacobson, et al.
- 1997
(Show Context)
Citation Context ...elative to the discrete logarithm rather than relative to an upper bound on it. We discuss two such approaches, which work with increasing the giant-step width in the course of the algorithm. Thesrst =-=[BJT97-=-] works with doubling the step width at certain intervals. We describe a simplied version, which is based on the following statement: Lemma 3.1. [BJT97, Lemma 2.1] For every positive integer x there a... |

1 |
A space ecient algorithm for group structure computation
- Teske
- 1998
(Show Context)
Citation Context ...algorithm thesrst match is found after an expected number of 1:97 p n iterations. Modications of Brent's algorithm that require slightly more storage but less iterations can be found in [SL84] and [T=-=es98a]-=-. Pollard's original application can easily be generalized to any other group. All we need is a rule how to partition the group into 3 disjoint sets of equally large size, which can be done 10 EDLYN T... |