## On Random Walks For Pollard's Rho Method (2000)

Venue: | Mathematics of Computation |

Citations: | 33 - 5 self |

### BibTeX

@ARTICLE{Teske00onrandom,

author = {Edlyn Teske},

title = {On Random Walks For Pollard's Rho Method},

journal = {Mathematics of Computation},

year = {2000},

volume = {70},

pages = {809--825}

}

### Years of Citing Articles

### OpenURL

### Abstract

. We consider Pollard's rho method for discrete logarithm computation. Usually, in the analysis of its running time the assumption is made that a random walk in the underlying group is simulated. We show that this assumption does not hold for the walk originally suggested by Pollard: its performance is worse than in the random case. We study alternative walks that can be efficiently applied to compute discrete logarithms. We introduce a class of walks that lead to the same performance as expected in the random case. We show that this holds for arbitrarily large prime group orders, thus making Pollard's rho method for prime group orders about 20% faster than before. 1. Introduction Let G be a finite cyclic group, written multiplicatively, and generated by the group element g. We define the discrete logarithm problem (DLP) as follows: given a group element h, find the least non-negative integer x such that h = g x . We write x = log g h and call it the discrete logarithm of h...

### Citations

2724 | S.A Vanstone,"Handbook of Applied Cryptography
- Menezes, Oorschot
- 1997
(Show Context)
Citation Context ...t public-key cryptosystems. Such cryptosystems are, for example, the Diffie-Hellman key exchange protocol, the ElGamal encryption and signature schemes, and the Digital Signature Algorithm (DSA) (cf. =-=[MvOV96]-=-). Originally, they worked with multiplicative groups of finite prime fields. Once elliptic curve cryptosystems were proposed by Koblitz and Miller, analogous practical systems based on the DLP in gro... |

744 |
The Art of Computer Programming, Volume 3: Sorting and Searching
- Knuth
- 1973
(Show Context)
Citation Context ...e based on the unique encoding of each group element as a binary string. Then let v : G ! f1; : : : ; rg ; v(g) = bv (g) \Delta rc + 1 : (2.4) From the theory of multiplicative hash functions we know =-=[Knu73]-=- that among all numbers between 0 and 1, choosing A as a rational approximation of ( p 5\Gamma1)=2 with a sufficiently large denominator (that is, in comparison with the input size) leads to the most ... |

329 | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance
- Pohlig, Hellman
- 1978
(Show Context)
Citation Context ... gives ff i + fi i x j ff j + fi j x mod jGj : Now, if gcd(fi i \Gamma fi j ; jGj) = 1, we get that x = (ff j \Gamma ff i )(fi i \Gamma fi j ) \Gamma1 mod jGj. Due to the method of Pohlig and Hellman =-=[PH78]-=-, in applications the group order jGj is prime, so that it is very unlikely that gcd(fi i \Gamma fi j ; jGj) ? 1 if jGj is large. 2.2. Finding a match. While computing the terms (y i ; ff i ; fi i ), ... |

250 |
Monte Carlo methods for index computation mod p
- Pollard
- 1978
(Show Context)
Citation Context ...h is a subexponential-time algorithm, for the elliptic curve DLP the best algorithms currently known have exponential run time. Among these algorithms we find algorithms based on Pollard's rho method =-=[Pol78]-=-. They take expected time O( p n) group operations to compute log g h, where n denotes the order of g. Their space requirements are negligible, and van Oorschot and Wiener [vOW99] showed that they can... |

159 | Parallel collision search with cryptanalytic applications
- Oorschot, Wiener
- 1999
(Show Context)
Citation Context ...Pollard's rho method [Pol78]. They take expected time O( p n) group operations to compute log g h, where n denotes the order of g. Their space requirements are negligible, and van Oorschot and Wiener =-=[vOW99]-=- showed that they can be efficiently parallelized, which makes the rho method the most powerful method to attack the elliptic curve DLP known to date. In the rho method, an iterating function F : G ! ... |

69 | Improving the parallelized pollard lambda search on anomalous binary curves
- Gallant, Lambert, et al.
- 2000
(Show Context)
Citation Context ...e ratios given in Tables 1 and 2, we find that 1:553=1:759 = 0:88. Remark 3.1. A slightly different idea is used to speed up the rho method in the case of binary anomalous elliptic curves. There (see =-=[GLV], [WZ98]),-=- an equivalence relation on the group of points is established such that the iterating function "lives" on the equivalence classes rather than on the individual elements. Remark 3.2. To expl... |

63 | Faster attacks on elliptic curve cryptosystems
- Wiener, Zuccherato
- 1998
(Show Context)
Citation Context ...s given in Tables 1 and 2, we find that 1:553=1:759 = 0:88. Remark 3.1. A slightly different idea is used to speed up the rho method in the case of binary anomalous elliptic curves. There (see [GLV], =-=[WZ98]), an equi-=-valence relation on the group of points is established such that the iterating function "lives" on the equivalence classes rather than on the individual elements. Remark 3.2. To explain the ... |

53 |
A Monte Carlo method for factorization
- Pollard
- 1975
(Show Context)
Citation Context ... obtains when drawing the terms of (w k ), starting at the bottom and ending in a cycle, the method of solving computational problems by using sequences as in (2.1) is called the rho method . Pollard =-=[Pol75]-=- first applied this result to obtain an efficient and simple algorithm for factoring. Then in [Pol78] he found an algorithm that uses the rho method to compute discrete logarithms in the multiplicativ... |

48 | Speeding up Pollardâ€™s rho method for computing discrete logarithms
- Teske
- 1998
(Show Context)
Citation Context ...the expected delay factor ffi as the ratio E(l(; ))=( + )), where l(; ) denotes the number of steps until a match is found. For our match-finding algorithm, we found experimentally that ffis1:13 (cf. =-=[Tes98c]-=-). This implies that if the iterating function behaves like a random mapping, we expect to find a match after approximately 1:13 \Delta p jGj=2 = 1:416 : : : p jGj (2.2) 4 EDLYN TESKE steps. Let L 0 =... |

41 |
Factorization of the eighth Fermat number
- Brent, Pollard
- 1981
(Show Context)
Citation Context ...1) and (3.2), Pollard [Pol] suggests considering the variance, say V , of the in-degree in the graph corresponding to the iterating function. This method was successfully applied by Brent and Pollard =-=[BP81]-=- for the rho-method for factoring, and works with the conjecture that the expected number of iterations is given as const= p V . (For the case that the set of possible values for the in-degree include... |

41 |
Probability distribution related to random mappings
- Harris
- 1960
(Show Context)
Citation Context ...+ , ks. We callsthe period andsthe preperiod of the sequence (w k ). Under the assumption that w 0 2R W and F is a random mapping, the expected values forsandsare close to p jW j=8 = 0:626::: p jW j (=-=[Har60]-=-). A pair (w i ; w j ) of two terms of the sequence is called a match if w i = w j and i ! j. Because of the picture one obtains when drawing the terms of (w k ), starting at the bottom and ending in ... |

20 |
A Monte Carlo factoring algorithm with linear storage
- Schnorr, Lenstra
- 1984
(Show Context)
Citation Context ...y determined average values for L := number of iterations performed until a match is found p jGj : (2.3) Remark 2.1. The method we use to find a match generalizes a method used by Schnorr and Lenstra =-=[SL84]-=- such that optimal average case performance (experimentally) is achieved. A family of match-finding algorithms with optimal worst case performance is discussed in [SSY82]. If storing a large number of... |

19 |
Random mappings with constraints on coalescence and number of origin
- Arney, Bender
- 1982
(Show Context)
Citation Context ...ations is given as const= p V . (For the case that the set of possible values for the in-degree includes zero and at least one integer greater than one, this conjecture was proved by Arney and Bender =-=[AB82]-=-.) Here, we have V = 1 in the case of (3.1), and V = 2=3 in the case of (3.2), so that the in-degree method predicts that (3.1) requires p 2=3 = 0:82 times as many iterations as (3.2). 8 EDLYN TESKE 1... |

17 | A space efficient algorithm for group structure computation
- Teske
- 1998
(Show Context)
Citation Context ...ormance of a random mapping. In the case of prime group orders, this can be proved by probability theoretic results on random walks in the additive group Z=pZ. This also answers Teske's open question =-=[Tes98b]-=-, and is the content of Section 5. Remark 1.1. We would like to mention a related approach by Horwitz and Venkatesan [HV], who considered rapidly-mixing random walks in Cayley graphs over abelian grou... |

16 |
The complexity of finding cycles in periodic functions
- Sedgewick, Symansky, et al.
- 1982
(Show Context)
Citation Context ...od used by Schnorr and Lenstra [SL84] such that optimal average case performance (experimentally) is achieved. A family of match-finding algorithms with optimal worst case performance is discussed in =-=[SSY82]-=-. If storing a large number of terms is not a problem, distinguished point methods as described in [vOW99] can be more efficient to find matches. 2.3. Partitioning the group. Let T 1 ; : : : ; T r be ... |

14 |
Random walks supported on random points of Z/nZ. Probability Theory and Related
- Hildebrand
- 1994
(Show Context)
Citation Context ... k ), k = 0; 1; 2; : : :, with a random function F : Z=nZ! Z=nZ. In other words, the walk corresponding to the uniform distribution is a random random walk. For the case that n is a prime, Hildebrand =-=[Hil94]-=- has shown that random walks on Z=nZsupported by r points get close to uniformly distributed after a constant multiple of n 2=(r\Gamma1) steps: ON RANDOM WALKS FOR POLLARD'S RHO METHOD 15 Theorem 5.1.... |

12 |
Reliability & Life testing handbook
- Kececioglu
- 1994
(Show Context)
Citation Context ...on of x is given by f(x) = xe \Gammax 2 =2 ([Har60]). This function belongs to a certain Weibull distribution; such distributions are extensively studied in reliability engineering (see, for example, =-=[Kec93]-=-). If we work with a good simulation of a random random walk, it is reasonable to assume that the spread of ( + )= p jGj is similar to the spread of the corresponding Weibull distribution; this agrees... |

5 |
New algorithms for finite abelian groups
- Teske
- 1998
(Show Context)
Citation Context ...imental evidence that when an iterating function yields a mean value of ( + )= p jGj close to the random case, then the variance is close to the variance of the random case, which is 2 \Gamma =2 (see =-=[Tes98a]-=-). Hence, we have to choose the size of the sample space very carefully. We can derive from [Kec93] that, for example, if we work with a sample space of size N = 30 and we get an average ON RANDOM WAL... |

4 |
Random random walks on the integers mod n
- Dai, Hildebrand
(Show Context)
Citation Context ...=nZto be a set such that fa j \Gamma a i : i; j = 1; : : : ; rg generates Z=nZ. It is easy to see that this is the case if and only if gcd(n; a 2 \Gammaa 1 ; : : : ; a r \Gammaa 1 ) = 1. Theorem 5.2 (=-=[DH97]-=-). Let rs2. Let M := fa 1 ; : : : ; a r g be uniformly chosen from all aperiodic subsets of Z=nZwith r pairwise distinct elements. Let ea = (a 1 ; : : : ; a r ), and let p 1 ; : : : ; p r and P e a as... |

4 |
Technische Universitat Darmstadt, LiDIA - a library for computational number theory, version 1.3
- Group
- 1997
(Show Context)
Citation Context ... may differ up to 5%, while choosing N = 10000 produces fairly constant average values for ( + )= p jGj. 2.5. Set-up for our experiments. For our experiments, we use the computer algebra system LiDIA =-=[LiD97]-=-. We work with the multiplicative groups of finite prime fields, with prime-order subgroups of (Z=pZ) , and with prime-order subgroups of groups of points on elliptic curves over finite prime fields. ... |

4 |
Private communications
- Pollard
- 1990
(Show Context)
Citation Context ...d such that the iterating function "lives" on the equivalence classes rather than on the individual elements. Remark 3.2. To explain the difference between the performance of (3.1) and (3.2)=-=, Pollard [Pol]-=- suggests considering the variance, say V , of the in-degree in the graph corresponding to the iterating function. This method was successfully applied by Brent and Pollard [BP81] for the rho-method f... |

3 |
The number of partitions in Pollard rho, Private communication
- Blackburn, Murphy
- 1998
(Show Context)
Citation Context ...ther constant. 1 On the other hand, for r = 3 we do not even obtain a constant average value for L for different ranges of group orders: As the results in Table 4 show, we have 1 Blackburn and Murphy =-=[BM]-=- suggest under certain heuristic assumptions that the relationship between L and r follows the rule L = c \Delta q r r\Gamma1 . Their reasoning matches Brent and Pollard [BP81], who conjectured that w... |

3 |
Random cayley graphs and the discrete log
- Horwitz, Venkatesan
- 1998
(Show Context)
Citation Context ... walks in the additive group Z=pZ. This also answers Teske's open question [Tes98b], and is the content of Section 5. Remark 1.1. We would like to mention a related approach by Horwitz and Venkatesan =-=[HV]-=-, who considered rapidly-mixing random walks in Cayley graphs over abelian groups. They developed an algorithm, which, if the Cayley graph is generated by r = O(log jGj) generators, finds a discrete l... |