We present a generic algorithm for computing discrete logarithms in a finite abelian p-group H, improving the Pohlig-Hellman algorithm and its generalization to noncyclic groups by Teske. We then give a direct method to compute a basis for H without using a relation matrix. The problem of computing a basis for some or all of the Sylow p-subgroups of an arbitrary finite abelian group G is addressed, yielding a Monte Carlo algorithm to compute the structure of G using O(|G|^0.5) group operations. These results also improve generic algorithms for extracting pth roots in G.
A refined non-vanishing of the $p$-adic logarithm of a rational point on an abelian variety
University of Texas at Austin（德克萨斯大学奥斯汀分校）；Princeton University（普林斯顿大学）；Academy of Mathematics and Systems Science, Chinese Academy of Sciences（中国科学院数学与系统科学研究院）
For the free group on n generators we prove that the discrete logarithm is distributed according to the standard Gaussian when the logarithm is renormalized appropriately.
Fix an ordinary abelian variety defined over a finite field. The ideal class group of its endomorphism ring acts freely on the set of isogenous varieties with same endomorphism ring, by complex multiplication. Any subgroup of the class group, and generating set thereof, induces an isogeny graph on the orbit of the variety for this subgroup. We compute (under the Generalized Riemann Hypothesis) some bounds on the norms of prime ideals generating it, such that the associated graph has good expansion properties. We use these graphs, together with a recent algorithm of Dudeanu, Jetchev and Robert …
Let $p>2$ be prime and $g$ a primitive root modulo $p$. We present an argument for the fact that discrete logarithms of the numbers in any arithmetic progression are uniformly distributed in $[1,p]$ and raise some questions on the subject.
We study quotients of principally polarized abelian varieties with real multiplication by Galois-stable finite subgroups and describe when these quotients are principally polarizable. We use this characterization to provide an algorithm to compute explicit cyclic isogenies from kernel for abelian varieties with real multiplication over finite fields. Our algorithm is polynomial in the size of the finite field as well as the degree of the isogeny and is based on Mumford's theory of theta functions and theta embeddings. Recently, the algorithm has been successfully applied to obtain new results …
We extend to logarithmic class groups the results on abelian principalization of tame ray class groups of a number field obtained in a previous article.
We study the discrete logarithm problem for the multiplicative group and for elliptic curves over a finite field by using a lifting of the corresponding object to an algebraic number field and global duality. We introduce the \textit{signature} of a Dirichlet character (in the multiplicative group case) or principal homogeneous space (in the elliptic curve case), which is a measure of the ramification at certain places. We then develop \textit{signature calculus}, which generalizes and refines the index calculus method. Finally, we show the random polynomial time equivalence for these two case…
Déchène has proposed generalized Jacobians as a source of groups for public-key cryptosystems based on the hardness of the Discrete Logarithm Problem (DLP). Her specific proposal gives rise to a group isomorphic to the semidirect product of an elliptic curve and a multiplicative group of a finite field. We explain why her proposal has no advantages over simply taking the direct product of groups. We then argue that generalized Jacobians offer poorer security and efficiency than standard Jacobians.
A new proof is given for the correctness of the powers of two descent method for computing discrete logarithms. The result is slightly stronger than the original work, but more importantly we provide a unified geometric argument, eliminating the need to analyse all possible subgroups of $\mathrm{PGL}_2(\mathbb F_q)$. Our approach sheds new light on the role of $\mathrm{PGL}_2$, in the hope to eventually lead to a complete proof that discrete logarithms can be computed in quasi-polynomial time in finite fields of fixed characteristic.
We establish a connection between semi-primitive roots of the multiplicative group of integers modulo $2^{k}$ where $k\geq 3$, and the logarithmic base in the algorithm introduced by Fit-Florea and Matula (2004) for computing the discrete logarithm modulo $2^{k}$. Fit-Florea and Matula used properties of the semi-primitive root 3 modulo $2^{k}$ to obtain their results and provided a conversion formula for other possible bases. We show that their results can be extended to any semi-primitive root modulo $2^{k}$ and also present a generalized version of their algorithm to find the discrete logar…
We prove that the discrete logarithm problem can be solved in quasi-polynomial expected time in the multiplicative group of finite fields of fixed characteristic. More generally, we prove that it can be solved in the field of cardinality $p^n$ in expected time $(pn)^{2\log_2(n) + O(1)}$.
In this paper, we investigate the asymptotic behavior of the number $s_q(g)$ of isogeny classes of simple abelian varieties of dimension $g$ over a finite field $\mathbb{F}_q$. We prove that the logarithmic asymptotic of $s_q(g)$ is the same as the logarithmic asymptotic of the number $m_q(g)$ of isogeny classes of all abelian varieties of dimension $g$ over $\mathbb{F}_q$. We also prove that $$ \limsup_{g \rightarrow \infty} \frac{s_q(g)}{m_q(g)}=1. $$ This suggests that there are much more simple isogeny classes of abelian varieties over $\mathbb{F}_q$ of dimension $g$ than non-simple ones f…
For $q$ a prime power, the discrete logarithm problem (DLP) in $\mathbb{F}_{q}$ consists in finding, for any $g \in \mathbb{F}_{q}^{\times}$ and $h \in \langle g \rangle$, an integer $x$ such that $g^x = h$. We present an algorithm for computing discrete logarithms with which we prove that for each prime $p$ there exist infinitely many explicit extension fields $\mathbb{F}_{p^n}$ in which the DLP can be solved in expected quasi-polynomial time. Furthermore, subject to a conjecture on the existence of irreducible polynomials of a certain form, the algorithm solves the DLP in all extensions $\ma…
We define three hard problems in the theory of elliptic divisibility sequences (EDS Association, EDS Residue and EDS Discrete Log), each of which is solvable in sub-exponential time if and only if the elliptic curve discrete logarithm problem is solvable in sub-exponential time. We also relate the problem of EDS Association to the Tate pairing and the MOV, Frey-Rück and Shipsey EDS attacks on the elliptic curve discrete logarithm problem in the cases where these apply.
This work presents author's explicit methods of constructing abelian extensions of complete discrete valuation fields. His approach to explicit equations of a cyclic extension of degree p^n which contains a given cyclic extension of degree p is explained.
We analyse the complexity of solving the discrete logarithm problem and of testing the principality of ideals in a certain class of number fields. We achieve the subexponential complexity in $O(L(1/3,O(1)))$ when both the discriminant and the degree of the extension tend to infinity by using techniques due to Enge, Gaudry and Thomé in the context of algebraic curves over finite fields.
Brizolis asked the question: does every prime p have a pair (g,h) such that h is a fixed point for the discrete logarithm with base g? The author and Pieter Moree, building on work of Zhang, Cobeli, and Zaharescu, gave heuristics for estimating the number of such pairs and proved bounds on the error in the estimates. These bounds are not descriptive of the true situation, however, and this paper is a first attempt to collect and analyze some data on the distribution of the actual error in the estimates.
Difficulty of calculation of discrete logarithm for any arbitrary Field is the basis for security of several popular cryptographic solutions. Pohlig-Hellman method is a popular choice to calculate discrete logarithm in finite field $F_p^*$. Pohlig-Hellman method does yield good results if p is smooth ( i.e. p-1 has small prime factors). We propose a practical alternative to Pohlig-Hellman algorithm for finding discrete logarithm modulo prime. Although, proposed method, similar to Pohlig-Hellman reduces the problem to group of orders $p_i$ for each prime factor and hence in worst case scenario …
In the present work, we present a new discrete logarithm algorithm, in the same vein as in recent works by Joux, using an asymptotically more efficient descent approach. The main result gives a quasi-polynomial heuristic complexity for the discrete logarithm problem in finite field of small characteristic. By quasi-polynomial, we mean a complexity of type $n^{O(\log n)}$ where $n$ is the bit-size of the cardinality of the finite field. Such a complexity is smaller than any $L(\varepsilon)$ for $ε>0$. It remains super-polynomial in the size of the input, but offers a major asymptotic improvemen…
We prove formulas for the p-adic logarithm of quaternionic Darmon points on p-adic tori and modular abelian varieties over Q having purely multiplicative reduction at p. These formulas are amenable to explicit computations and are the first to treat Stark-Heegner type points on higher-dimensional abelian varieties.
This paper proposes a new signature scheme based on two hard problems : the cube root extraction modulo a composite moduli (which is equivalent to the factorisation of the moduli, IFP) and the discrete logarithm problem(DLP). By combining these two cryptographic assumptions, we introduce an efficient and strongly secure signature scheme. We show that if an adversary can break the new scheme with an algorithm $\mathcal{A},$ then $\mathcal{A}$ can be used to sove both the DLP and the IFP. The key generation is a simple operation based on the discrete logarithm modulo a composite moduli. The sign…
This paper introduces a new public key cryptosystem based on two hard problems : the cube root extraction modulo a composite moduli (which is equivalent to the factorisation of the moduli) and the discrete logarithm problem. These two hard problems are combined during the key generation, encryption and decryption phases. By combining the IFP and the DLP we introduce a secure and efficient public key cryptosystem. To break the scheme, an adversary may solve the IFP and the DLP separately which is computationally infeasible. The key generation is a simple operation based on the discrete logarith…
We construct cryptographic trilinear maps that involve simple, non-ordinary abelian varieties over finite fields. In addition to the discrete logarithm problems on the abelian varieties, the cryptographic strength of the trilinear maps is based on a discrete logarithm problem on the quotient of certain modules defined through the Néron-Severi groups. The discrete logarithm problem is reducible to constructing an explicit description of the algebra generated by two non-commuting endomorphisms, where the explicit description consists of a linear basis with the two endomorphisms expressed in the …
We prove some new results on the arithmetic of abelian varieties over function fields of one variable over finitely generated (infinite) fields. Among other things, we introduce certain new natural objects `discrete Selmer groups' and `discrete Shafarevich-Tate groups', and prove that they are finitely generated $\Bbb Z$-modules. Further, we prove that in the isotrivial case, the discrete Shafarevich-Tate group vanishes and the discrete Selmer group coincides with the Mordell-Weil group. One of the key ingredients to prove these results is a new specialisation theorem à la Néron for first Galo…
The increased use of cryptography to protect our personal information makes us want to understand the security of cryptosystems. The security of many cryptosystems relies on solving the discrete logarithm, which is thought to be relatively difficult. Therefore, we focus on the statistical analysis of certain properties of the graph of the discrete logarithm. We discovered the expected value and variance of a certain property of the graph and compared the expected value to experimental data. Our finding did not coincide with our intuition of the data following a Gaussian distribution given a la…
This is an introduction to the author theory of cyclic p-extensions of an absolutely unramified complete discrete valuation field K with arbitrary residue field of characteristic p. In this theory a homomorphism is constructed from the p-part of the group of characters of K to Witt vectors over its residue field.
A new algorithms for computing discrete logarithms on elliptic curves defined over finite fields is suggested. It is based on a new method to find zeroes of summation polynomials. In binary elliptic curves one is to solve a cubic system of Boolean equations. Under a first fall degree assumption the regularity degree of the system is at most $4$. Extensive experimental data which supports the assumption is provided. An heuristic analysis suggests a new asymptotical complexity bound $2^{c\sqrt{n\ln n}}, c\approx 1.69$ for computing discrete logarithms on an elliptic curve over a field of size $2…
Cheng and Wan have related the decoding of Reed-Solomon codes to the computation of discrete logarithms over finite fields, with the aim of proving the hardness of their decoding. In this work, we experiment with solving the discrete logarithm over GF(q^h) using Reed-Solomon decoding. For fixed h and q going to infinity, we introduce an algorithm (RSDL) needing O (h! q^2) operations over GF(q), operating on a q x q matrix with (h+2) q non-zero coefficients. We give faster variants including an incremental version and another one that uses auxiliary finite fields that need not be subfields of G…
The discrete logarithm problem (DLP) generalizes to the constrained DLP, where the secret exponent $x$ belongs to a set known to the attacker. The complexity of generic algorithms for solving the constrained DLP depends on the choice of the set. Motivated by cryptographic applications, we study sets with succinct representation for which the constrained DLP is hard. We draw on earlier results due to Erdös et al. and Schnorr, develop geometric tools such as generalized Menelaus' theorem for proving lower bounds on the complexity of the constrained DLP, and construct sets with succinct represent…
This paper is a summary of author's results on finite flat commutative group schemes. The properties of the generic fibre functor are discussed. A complete classification of finite local flat commutative group schemes over mixed characteristic complete discrete valuation rings in terms of their Cartier modules (defined by Oort) is given. We also state several properties of tangent space of these schemes. These results are applied to the study of reduction of Abelian varieties. A finite $p$-adic semistable reduction criterion is formulated. It looks especially nice in the ordinary reduction cas…
We prove a Freiman-type theorem for locally compact abelian groups. If A is a subset of a locally compact abelian group with Haar measure m and m(nA) < n^dm(A) for all n>d log d then we describe A in a way which is tight up to logarithmic factors in d.
The interval discrete logarithm problem is defined as follows: Given some $g,h$ in a group $G$, and some $N \in \mathbb{N}$ such that $g^z=h$ for some $z$ where $0 \leq z < N$, find $z$. At the moment, kangaroo methods are the best low memory algorithm to solve the interval discrete logarithm problem. The fastest non parallelised kangaroo methods to solve this problem are the three kangaroo method, and the four kangaroo method. These respectively have expected average running times of $\big(1.818+o(1)\big)\sqrt{N}$, and $\big(1.714 + o(1)\big)\sqrt{N}$ group operations. It is currently an open…
Recent breakthrough methods \cite{gggz,joux,bgjt} on computing discrete logarithms in small characteristic finite fields share an interesting feature in common with the earlier medium prime function field sieve method \cite{jl}. To solve discrete logarithms in a finite extension of a finite field $\F$, a polynomial $h(x) \in \F[x]$ of a special form is constructed with an irreducible factor $g(x) \in \F[x]$ of the desired degree. The special form of $h(x)$ is then exploited in generating multiplicative relations that hold in the residue class ring $\F[x]/h(x)\F[x]$ hence also in the target res…
In \cite{joux}, Joux devised an algorithm to compute discrete logarithms between elements in a certain subset of the multiplicative group of an extension of the finite field $\mathbb{F}_{p^n}$ in time polynomial in $p$ and $n$. Shortly after, Barbulescu, Gaudry, Joux and Thome \cite{bgjt} proposed a descent algorithm that in $(p n)^{\mathcal{O}(\log n)}$ time projects an arbitrary element in $\mathbb{F}_{p^n}^\times$ as a product of powers of elements in the aforementioned subset. Together, these two algorithms yield a quasi-polynomial time algorithm for computing discrete logarithms in finite…
