A Structural Comparison of the Computational Difficulty of Breaking Discrete Log Cryptosystems

Abstract

The complexity of breaking cryptosystems of which security is based on the discrete logarithm problem is explored. The cryptosystems mainly discussed are the Diffie--Hellman key exchange scheme (DH), the Bellare--Micali noninteractive oblivious transfer scheme (BM), the ElGamal public-key cryptosystem (EG), the Okamoto conference-key sharing scheme (CONF), and the Shamir 3-pass key-transmission scheme (3PASS). The obtained relation among these cryptosystems is that $\mbox{3PASS}\, {\leq_{m}^{\rm FP}}\, \mbox{{CONF}}\, {\leq_{m}^{\rm FP}}\, \mbox{{EG}} \equiv_m^{\rm FP} \mbox{{BM}} \equiv_m^{\rm FP} \mbox{{ DH}},$ where ${\leq_{m}^{\rm FP}}$ denotes the polynomial-time functionally many-to-one reducibility, i.e., a function version of the ${\leq_m^p}$ -reducibility. We further give some condition in which these algorithms have equivalent difficulty. One of such conditions suggest another advantage of the discrete logarithm associated with ordinary elliptic curves.