Algorithms For Discrete Logarithms Research Articles

Efficient quantum algorithms for some instances of the semidirect discrete logarithm problem

The semidirect discrete logarithm problem (SDLP) is the following analogue of the standard discrete logarithm problem in the semidirect product semigroup G⋊End(G)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$G\\rtimes {{\\,\ extrm{End}\\,}}(G)$$\\end{document} for a finite semigroup G. Given g∈G,σ∈End(G)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$g\\in G, \\sigma \\in {{\\,\ extrm{End}\\,}}(G)$$\\end{document}, and h=∏i=0t-1σi(g)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$h=\\prod _{i=0}^{t-1}\\sigma ^i(g)$$\\end{document} for some integer t, the SDLP(G,σ)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$(G,\\sigma )$$\\end{document}, for g and h, asks to determine t. As Shor’s algorithm crucially depends on commutativity, it is believed not to be applicable to the SDLP. For generic semigroups, the best known algorithm for the SDLP is based on Kuperberg’s subexponential time quantum algorithm. Still, the problem plays a central role in the security of certain proposed cryptosystems in the family of semidirect product key exchange. This includes a recently proposed signature protocol called SPDH-Sign. In this paper, we show that the SDLP is even easier in some important special cases. Specifically, for a finite group G, we describe quantum algorithms for the SDLP in G⋊Aut(G)\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$G\\rtimes {\ extrm{Aut}}(G)$$\\end{document} for the following two classes of instances: the first one is when G is solvable and the second is when G is a matrix group and a power of σ\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\sigma $$\\end{document} with a polynomially small exponent is an inner automorphism of G. We further extend the results to groups composed of factors from these classes. A consequence is that SPDH-Sign and similar cryptosystems whose security assumption is based on the presumed hardness of the SDLP in the cases described above are insecure against quantum attacks. The quantum ingredients we rely on are not new: these are Shor’s factoring and discrete logarithm algorithms and well-known generalizations.

Resource analysis and modifications of quantum computing with noisy qubits for elliptic curve discrete logarithms

We estimate the number of physical qubits and execution time by decomposing an implementation of Shor’s algorithm for elliptic curve discrete logarithms into universal gate units at the logical level when surface codes are used. We herein also present modified quantum circuits for elliptic curve discrete logarithms and compare our results with those of the original quantum circuit implementations at the physical level. Through the analysis, we show that the use of more logical qubits in quantum algorithms does not always lead to the use of more physical qubits. We assumed using rotated surface code and logical qubits with all-to-all connectivity. The number of physical qubits and execution time are expressed in terms of bit length, physical gate error rate, and probability of algorithm failure. In addition, we compare our results with the number of physical qubits and execution time of Shor’s factoring algorithm to assess the risk of attack by quantum computers in RSA and elliptic curve cryptography.

Algorithmic aspects of elliptic bases in finite field discrete logarithm algorithms

Elliptic bases, introduced by Couveignes and Lercier in 2009, give an elegant way of representing finite field extensions. A natural question which seems to have been considered independently by several groups is to use this representation as a starting point for discrete logarithm algorithms in small characteristic finite fields.This idea has been recently proposed by two groups working on it, in order to achieve provable quasi-polynomial time for discrete logarithms in small characteristic finite fields.In this paper, we do not try to achieve a provable algorithm but, instead, investigate the practicality of heuristic algorithms based on elliptic bases. Our key idea is to use a different model of the elliptic curve used for the elliptic basis that allows for a relatively simple adaptation of the techniques used with former Frobenius representation algorithms.We have not performed any record computation with this new method but our experiments with the field $ {\mathbb F}_{3^{1345}} $ indicate that switching to elliptic representations might be possible with performances comparable to the current best practical methods.

Quantum Circuit Design for Integer Multiplication Based on Schönhage–Strassen Algorithm

Quantum arithmetic circuits has attracted extensive attention recently since it plays fundamental roles in many applications of quantum computing. Specifically, quantum circuits for integer multiplication are of great significance to various quantum algorithms including Shor’s integer factorization and discrete logarithm algorithm. In this paper, we design a family of quantum circuits for integer multiplication based on the famous classical integer multiplication algorithm, Schönhage-Strassen algorithm. We have made slight modifications to the algorithm to simplify its quantum circuit implementation. As a result, the quantum circuit we designed has gate depth O(log2n). To the best of our knowledge, this is the first poly-logarithmic depth quantum circuit for integer multiplication which keeps the circuit size and the number of ancillary qubits sub-quadratic. Our design has size O(nlognloglogn) counted by elementary quantum gates which is the same as the time complexity of Schönhage-Strassen algorithm, and it consumes O(nlognloglogn) clean ancillary qubits. In addition, we also utilize a weaker version of Schönhage-Strassen algorithm to give a family of circuits which has depth at the same order O(log2n) but with significantly smaller constants, while still keeping the size and number of ancillary qubits sub-quadratic.

Discrete logarithms and primitive roots: Algorithms, properties, and typical solution methods

In mathematics, the logarithm, log_ab, where a(0,1)(1,) and b>0, is always defined as the real number x, such that a^x=b. Moreover, in the field of number theory, a similar concept called the discrete logarithm can be defined as follows: For a given positive integer m(m2), let aN^(+ ) with (a,m)=1, and r is the primitive root of m, x=ind_r a if r^xa (mod m). Here, x is the discrete logarithm. The Discrete Logarithm Problem, which is a famous problem in number theory, is formulized as: For a positive integer b and a prime number p, and a is the primitive root of p, the goal is to find the exact value of i, such that a^ib (mod p), in other words, it is targeted at finding the exact value of ind_a b. The goal of this research is to give several solutions to the Discrete Logarithm Problem, so firstly, some background concept like order and primitive root will be introduced with the proof of some foundational theories of these two concepts, then this essay will give two methods that can solve the Discrete Logarithm Problem called Shanks' Babystep-Giantstep Algorithm and Pohlig-Hellman Discrete Logarithm Algorithm.

Improving the Gaudry–Schost algorithm for multidimensional discrete logarithms

Improving the Gaudry–Schost algorithm for multidimensional discrete logarithms

A simplified approach to rigorous degree 2 elimination in discrete logarithm algorithms

In this paper, we revisit the ZigZag strategy of Granger, Kleinjung and Zumbragel. In particular, we provide a new algorithm and proof for the so-called degree 2 elimination step. This allows us to provide a stronger theorem concerning discrete logarithm computations in small characteristic fields F q k 0 k with k close to q and k0 a small integer. As in the aforementioned paper, we rely on the existence of two polynomi-als h0 and h1 of degree 2 providing a convenient representation of the finite field F q k 0 k .

Imperfect forward secrecy

We investigate the security of Diffie-Hellman key exchange as used in popular Internet protocols and find it to be less secure than widely believed. First, we present Logjam, a novel flaw in TLS that lets a man-in-the-middle downgrade connections to "export-grade" Diffie-Hellman. To carry out this attack, we implement the number field sieve discrete logarithm algorithm. After a week-long precomputation for a specified 512-bit group, we can compute arbitrary discrete logarithms in that group in about a minute. We find that 82% of vulnerable servers use a single 512-bit group, and that 8.4% of Alexa Top Million HTTPS sites are vulnerable to the attack. In response, major browsers have changed to reject short groups. We go on to consider Diffie-Hellman with 768- and 1024-bit groups. We estimate that even in the 1024-bit case, the computations are plausible given nation-state resources. A small number of fixed or standardized groups are used by millions of servers; performing precomputation for a single 1024-bit group would allow passive eavesdropping on 18% of popular HTTPS sites, and a second group would allow decryption of traffic to 66% of IPsec VPNs and 26% of SSH servers. A close reading of published NSA leaks shows that the agency's attacks on VPNs are consistent with having achieved such a break. We conclude that moving to stronger key exchange methods should be a priority for the Internet community.

A variant of the Galbraith–Ruprai algorithm for discrete logarithms with improved complexity

The discrete logarithm problem (DLP) in a group is a fundamental assumption that underpins the security of many systems. Hence evaluating its hardness is important. For efficient implementation of cryptographic algorithms, sometimes groups with additional structures are preferred. However, these structures may be used to obtain faster attacks. By using equivalence classes, Galbraith and Ruprai proposed a faster algorithm to solve the DLP in an interval of size N, with expected running time of $$1.361\sqrt{N}$$ group operations. Liu generalized their algorithm to the 2-dimensional case, which required $$1.450\sqrt{N}$$ group operations. Further, for an elliptic curve with an efficiently computable endomorphism, Liu reduced the complexity to $$1.026\sqrt{N}$$ . In this paper, we propose a variant of the Galbraith–Ruprai algorithm. This variant has average-case asymptotic complexity close to $$1.253\sqrt{N}$$ for sufficiently large N. For certain practical parameters, the complexity is $$1.275\sqrt{N}$$ in the 1-dimensional case and $$1.393\sqrt{N}$$ in the 2-dimensional case. Then we extend the algorithm for the case of larger equivalence classes. In particular, for the 2-dimensional DLP in a rectangle on an elliptic curve with an efficiently computable endomorphism, we reduce the complexity to $$0.985\sqrt{N}$$ for certain fixed parameters. We also discuss some possible further improvements.

Multiple Parallel-Pollard's Rho Discrete Logarithm Algorithm

This paper proposes a discrete logarithm algorithm that remarkably reduces the execution time of Pollard’s Rho algorithm. Pollard’s Rho algorithm computes congruence or collision of α a β b ≡ α A β B (mod ρ) from the initial value a = b = o, only to derive γ from (a+bγ) = (A+Bγ), γ(B-b) = (a-A). The basic Pollard’s Rho algorithm computes χ i = (χ i-1 )², αχ i-1 , βχ i-1 given α a β b ≡ χ(mod ρ), and the general algorithm computes χ i = (χ i-1 )², Mχ i-1 , Nχ i-1 for randomly selected M=α m , N=β n . This paper proposes 4-model Pollard Rho algorithm that seeks βγ = αγ, βγ′ = α(p-1)/2+γ and βγ-1 = α(p-1)-γ) from m = n = ?√n?, (a,b) = (0.0), (1,1). algorithm that seeks β γ = α γ , β γ′ = α (p-1)/2+γ and β γ-1 = α (p-1)-γ ) from m = n = ?√n?, (a,b) = (0.0), (1,1). The proposed algorithm has proven to improve the performance of the (0,0)-basic Pollard’s Rho algorithm by 71.70%.

Public Key Cryptosystem Research Based on Discrete Group

In modern society with Internet rapid development, information system takes digital form of 0 and 1, this information system and public channel are very fragile in the case of without defensive measures, and they are easily attacked and destructed by hackers and intruders. This article is mainly based on the knowledge of discrete logarithm, studies public key cipher algorithm, especially elliptic curve cryptosystem. First this paper introduces the basic concepts and knowledge of cryptography, and discusses the relation between discrete logarithm and public key cryptography algorithms. Finally in detail it discusses elliptic curve cryptosystem, and presents the realization and running effect of encryption system.

Integer factorization and discrete logarithm problems

These are notes for a lecture given at CIRM in 2014, for the Journees Nationales du Calcul Formel. We explain the basic algorithms based on combining congruences for solving the integer factorization and the discrete logarithm problems. We highlight two particular situations where the interaction with symbolic computation is visible: the use of Grobner basis in Joux's algorithm for discrete logarithm in nite eld of small characteristic, and the exact sparse linear algebra tools that occur in the Number Field Sieve algorithm for discrete logarithm in large characteristic.

Quantum addition circuits and unbounded fan-out

We first show how to construct an $O(n)$-depth $O(n)$-size quantum circuit for addition of two $n$-bit binary numbers with no ancillary qubits. The exact size is $7n-6$, which is smaller than that of any other quantum circuit ever constructed for addition with no ancillary qubits. Using the circuit, we then propose a method for constructing an $O(d(n))$-depth $O(n)$-size quantum circuit for addition with $O(n/d(n))$ ancillary qubits for any $d(n) = \Omega(\log n)$. If we are allowed to use unbounded fan-out gates with length $O(n^{\varepsilon})$ for an arbitrary small positive constant $\varepsilon$, we can modify the method and construct an $O(e(n))$-depth $O(n)$-size circuit with $o(n)$ ancillary qubits for any $e(n) = \Omega(\log^* n)$. In particular, these methods yield efficient circuits with depth $O(\log n)$ and with depth $O(\log^* n)$, respectively. We apply our circuits to constructing efficient quantum circuits for Shor's discrete logarithm algorithm.

A Birthday Paradox for Markov chains with an optimal bound for collision in the Pollard Rho algorithm for discrete logarithm

We show a Birthday Paradox for self-intersections of Markov chains with uniform stationary distribution. As an application, we analyze Pollard's Rho algorithm for finding the discrete logarithm in a cyclic group $G$ and find that if the partition in the algorithm is given by a random oracle, then with high probability a collision occurs in $\Theta(\sqrt{|G|})$ steps. Moreover, for the parallelized distinguished points algorithm on $J$ processors we find that $\Theta(\sqrt{|G|}/J)$ steps suffices. These are the first proofs of the correct order bounds which do not assume that every step of the algorithm produces an i.i.d. sample from $G$.

An L(1/3) Discrete Logarithm Algorithm for Low Degree Curves

We present an algorithm for solving the discrete logarithm problem in Jacobians of families of plane curves whose degrees in X and Y are low with respect to their genera. The finite base fields $\mathbb{F}_{q}$ are arbitrary, but their sizes should not grow too fast compared to the genus. For such families, the group structure and discrete logarithms can be computed in subexponential time of $L_{q^{g}}(1/3,O(1))$. The runtime bounds rely on heuristics similar to the ones used in the number field sieve or the function field sieve.

Optimized quantum implementation of elliptic curve arithmetic over binary fields

Shor's quantum algorithm for discrete logarithms applied to elliptic curve groups forms the basis of a ``quantum attack'' of elliptic curve cryptosystems. To implement this algorithm on a quantum computer requires the efficient implementation of the elliptic curve group operation. Such an implementation requires we be able to compute inverses in the underlying field. In \cite{PZ03}, Proos and Zalka show how to implement the extended Euclidean algorithm to compute inverses in the prime field $\GF(p)$. They employ a number of optimizations to achieve a running time of $O(n^2)$, and a space-requirement of $O(n)$ qubits, where $n$ is the number of bits in the binary representation of $p$ (there are some trade-offs that they make, sacrificing a few extra qubits to reduce running-time). In practice, elliptic curve cryptosystems often use curves over the binary field $\GF(2^m)$. In this paper, I show how to implement the extended Euclidean algorithm for polynomials to compute inverses in $\GF(2^m)$. Working under the assumption that qubits will be an `expensive' resource in realistic implementations, I optimize specifically to reduce the qubit space requirement, while keeping the running-time polynomial. The implementation here differs from that in $\cite{PZ03}$ for $\GF(p)$, and we are able to take advantage of some properties of the binary field $\GF(2^m)$. I also optimize the overall qubit space requirement for computing the group operation for elliptic curves over $\GF(2^m)$ by decomposing the group operation to make it ``piecewise reversible'' (similar to what is done in \cite{PZ03} for curves over $\GF(p)$).

Shor's discrete logarithm quantum algorithm for elliptic curves

We show in some detail how to implement Shor's efficient quantum algorithm for discrete logarithms for the particular case of elliptic curve groups. It turns out that for this problem a smaller quantum computer can solve problems further beyond current computing than for integer factorisation. A 160 bit elliptic curve cryptographic key could be broken on a quantum computer using around 1000 qubits while factoring the security-wise equivalent 1024 bit RSA modulus would require about 2000 qubits. In this paper we only consider elliptic curves over GF(p) and not yet the equally important ones over GF(2^n) or other finite fields. The main technical difficulty is to implement Euclid's gcd algorithm to compute multiplicative inverses modulo p. As the runtime of Euclid's algorithm depends on the input, one difficulty encountered is the ``quantum halting problem''.

On asymptotic complexity of computing discrete logarithms over <I>GF</I>(<I>p</I>)

We analyse the modification of an algorithm for finding discrete logarithms over the field GF(p) (p is a prime number) which has been described by the author previously. It is shown that this modification gives the best estimate at the present time of the complexity of finding discrete logarithms over finite prime fields which coincides with the best known estimate of the complexity of factoring integers obtained by D. Coppersmith.

An algorithm for DLP on anomalous elliptic curves over Fp

This paper improves the method of discrete logarithm on anomalous elliptic curves, and establishes an isomorphism from E ( F p ) to F p which can be more easily implemented. Fruthermore, we give an optimized algorithm for discrete logarithm on anomalous elliptic curves E ( F p ).

A subexponential algorithm for discrete logarithms over hyperelliptic curves of large genus over GF( q)

There are well-known subexponential algorithms for finding discrete logarithms over finite fields. However, the methods which underlie these algorithms do not appear to be easily adaptable for finding discrete logarithms in the groups associated with elliptic curves and the Jacobians of hyperelliptic curves, except for very special cases (Menezes et al., IEEE Trans. Inform. Theory 39 (1993) 1639–1646, Okamoto and Sakurai, Lecture Notes in Computer Science, vol. 576, Springer, Berlin, 1991). This has led to the development of cryptographic systems based on the discrete logarithm problem for such groups (Koblitz, Math. Comput. 48 (1987) 203–209, J. Cryptogr. 1 (1989) 139–150, Menezes, Elliptic Curve Public Key Cryptosystems, Kluwer, Dordrecht, 1993, Miller, Lecture Notes in Computer Science, Springer, Berlin, 1986, pp. 417– 426). In this paper a subexponential algorithm is presented for finding discrete logarithms in the group of rational points on the Jacobians of large genus hyperelliptic curves over prime fields. We give a heuristic argument that under certain assumptions, there exists a constant c⩽2.181 such that for g∈ Z >0 and odd prime powers q with log q⩽(2 g+1) 1− ε and 0< ε=o(1), the algorithm computes discrete logarithms in the group of rational points on the Jacobian of a genus g hyperelliptic curve over GF(q) of the form y 2= f( x) with deg( f)=2 g+1, within expected time L q 2 g+1 [1/2, c], or equivalently, L q g [1/2, c′] with c′= 2 c .