## Designing and detecting trapdoors for discrete log cryptosystems (1993)

Venue: | ADVANCES IN CRYPTOLOGY-- CRYPTO '92 |

Citations: | 16 - 0 self |

### BibTeX

@INPROCEEDINGS{Gordon93designingand,

author = {Daniel M. Gordon},

title = {Designing and detecting trapdoors for discrete log cryptosystems},

booktitle = {ADVANCES IN CRYPTOLOGY-- CRYPTO '92},

year = {1993},

pages = {66--75},

publisher = {Springer-Verlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

Using a number field sieve, discrete logarithms modulo primes of special forms can be found faster than standard primes. This has raised concerns about trapdoors in discrete log cryptosystems, such as the Digital Signature Standard. This paper discusses the practical impact of these trapdoors, and how to avoid them.

### Citations

2823 | New directions in cryptography
- Diffie, Hellman
- 1976
(Show Context)
Citation Context ...2 mod p) mod q. The signature is correct if v = r. The only known way to break this system is to find x from g and y (i.e. find the discrete logarithm log g y mod p). Several other schemes (e.g. [3], =-=[6]-=-, [18]) also depend on the difficulty of discrete logarithms. Subexponential algorithms are known for finding discrete logarithms modulo large primes, but the largest prime for which the problem has b... |

2252 |
The Art of Computer Programming
- KNUTH
- 1973
(Show Context)
Citation Context ...p. One may find linear factors of f mod p efficiently by eliminating square factors (dividing by the greatest common divisor of f and f ′ mod p), and then taking the gcd of (x p − x) and f mod p (see =-=[8]-=-). Then X and Y , if they exist, can be found using lattice reduction. The main problem with this is that every polynomial f needs to be considered separately, so a limited range of polynomials can be... |

712 | Factoring polynomials with rational coefficients - Lenstra, Lenstra, et al. - 1982 |

240 | Factoring integers with elliptic curves - Lenstra - 1987 |

115 |
Coin flipping by telephone: a protocol for solving impossible problems
- Blum
- 1982
(Show Context)
Citation Context ...k=3 � 1, 000 · 2 512/k� 2 · 1000 k+1 < 2 −100 . Suppose two people wish to agree on a safe key for the DSS. They can choose a random seed for the random number generator, using a protocol due to Blum =-=[2]-=-. From this they can use the method of Appendix 2 of [21] to create a key which is as likely to be safe as any random key. On the other hand, a central authority might want to announce a key for gener... |

76 | Solving large sparse linear systems over finite fields
- LaMacchia, Odlyzko
- 1991
(Show Context)
Citation Context ...ion over Z/(p − 1) Z using structured Gaussian elimination to reduce the size of the matrix, and then solving a smaller, dense matrix using the conjugate gradient method or Wiedemann’s algorithm (see =-=[10]-=-). This completes the precomputation. To find an individual logarithm, we reduce the problem to finding the logs of medium-sized primes. Choose random values of s and attempt to factor g s y (mod p) u... |

70 | The number field sieve
- Lenstra, Lenstra, et al.
(Show Context)
Citation Context ...e increased by roughly a factor of ten. Another difficulty is dealing with a field of larger discriminant. The problem is finding generators for the unit group and prime ideals in the factor base. In =-=[13]-=-, these are found by searching through algebraic integers of the form � 4 i=0 hiα i , for α a generator of K and small values of hi. For fields generated by polynomials with larger coefficients, this ... |

67 | Discrete logarithms in GF(p) using the number field sieve
- Gordon
- 1993
(Show Context)
Citation Context ...rimes, but the largest prime for which the problem has been solved is 224 bits in length, by LaMacchia and Odlyzko [9], using the Gaussian integer method of Coppersmith, Odlyzko and Schroppel [5]. In =-=[7]-=-, an algorithm is given for finding discrete logarithms using a number field sieve, which is asymptotically faster than other known methods. The general number field sieve is impractical, but a varian... |

39 |
An Interactive Identification Scheme Based on Discrete Logarithms and Factoring
- Brickell, McCurley
- 1992
(Show Context)
Citation Context ...1 y u2 mod p) mod q. The signature is correct if v = r. The only known way to break this system is to find x from g and y (i.e. find the discrete logarithm log g y mod p). Several other schemes (e.g. =-=[3]-=-, [6], [18]) also depend on the difficulty of discrete logarithms. Subexponential algorithms are known for finding discrete logarithms modulo large primes, but the largest prime for which the problem ... |

38 | Computation of discrete logarithms in prime fields
- LaMacchia, Odlyzko
- 1991
(Show Context)
Citation Context ...s. Subexponential algorithms are known for finding discrete logarithms modulo large primes, but the largest prime for which the problem has been solved is 224 bits in length, by LaMacchia and Odlyzko =-=[9]-=-, using the Gaussian integer method of Coppersmith, Odlyzko and Schroppel [5]. In [7], an algorithm is given for finding discrete logarithms using a number field sieve, which is asymptotically faster ... |

30 | A non-interactive public-key distribution system
- Maurer, Yacobi
- 1996
(Show Context)
Citation Context ... give a definite advantage over standard keys, with a few easy precautions in the choosing of p and q it is possible to prevent them, and they do not seem to pose a major problem for such systems. In =-=[15]-=-, Maurer and Yacobi present a public key distribution system, based on computing discrete logarithms modulo a composite number n. The factorization of n is a trapdoor which allows a trusted authority ... |

21 |
Discrete logarithms in GF(p
- Coppersmith, Odlyzko, et al.
- 1986
(Show Context)
Citation Context ... large primes, but the largest prime for which the problem has been solved is 224 bits in length, by LaMacchia and Odlyzko [9], using the Gaussian integer method of Coppersmith, Odlyzko and Schroppel =-=[5]-=-. In [7], an algorithm is given for finding discrete logarithms using a number field sieve, which is asymptotically faster than other known methods. The general number field sieve is impractical, but ... |

4 |
Computation of independent units in number fields by Dirichlet’s method
- Buchmann, Pethő
- 1989
(Show Context)
Citation Context ...lynomials with larger coefficients, this will be impractical. There have been several papers on efficient algorithms to find units and algebraic integers of given norms in general number fields, (see =-=[4]-=-, [16]). The computations are involved, but they only need to be done once for a given f. The matrix equation resulting from the sieving may be solved using intelligent Gaussian elimination to greatly... |

1 |
The factorization of the ninth Fermat number, preprint
- Lenstra, Lenstra, et al.
- 1991
(Show Context)
Citation Context ...nd B (BQ), first-degree primes in OK with norm less than B (BK), a fundamental set of units in OK, and Y . Calculating the primes and units for the field is not difficult when f is, say, x 5 − 2 (see =-=[14]-=-), but will be more difficult for polynomials with larger coefficients. We will discuss this problem in the next section. Call a rational or algebraic integer smooth if its prime factors are all in th... |