Brizolis asked the question: does every prime p have a pair (g,h) such that h is a fixed point for the discrete logarithm with base g? The author and Pieter Moree, building on work of Zhang, Cobeli, and Zaharescu, gave heuristics for estimating the number of such pairs and proved bounds on the error in the estimates. These bounds are not descriptive of the true situation, however, and this paper is a first attempt to collect and analyze some data on the distribution of the actual error in the estimates.
Let $p>2$ be prime and $g$ a primitive root modulo $p$. We present an argument for the fact that discrete logarithms of the numbers in any arithmetic progression are uniformly distributed in $[1,p]$ and raise some questions on the subject.
We study the discrete logarithm problem for the multiplicative group and for elliptic curves over a finite field by using a lifting of the corresponding object to an algebraic number field and global duality. We introduce the \textit{signature} of a Dirichlet character (in the multiplicative group case) or principal homogeneous space (in the elliptic curve case), which is a measure of the ramification at certain places. We then develop \textit{signature calculus}, which generalizes and refines the index calculus method. Finally, we show the random polynomial time equivalence for these two case…
Déchène has proposed generalized Jacobians as a source of groups for public-key cryptosystems based on the hardness of the Discrete Logarithm Problem (DLP). Her specific proposal gives rise to a group isomorphic to the semidirect product of an elliptic curve and a multiplicative group of a finite field. We explain why her proposal has no advantages over simply taking the direct product of groups. We then argue that generalized Jacobians offer poorer security and efficiency than standard Jacobians.
A new proof is given for the correctness of the powers of two descent method for computing discrete logarithms. The result is slightly stronger than the original work, but more importantly we provide a unified geometric argument, eliminating the need to analyse all possible subgroups of $\mathrm{PGL}_2(\mathbb F_q)$. Our approach sheds new light on the role of $\mathrm{PGL}_2$, in the hope to eventually lead to a complete proof that discrete logarithms can be computed in quasi-polynomial time in finite fields of fixed characteristic.
We establish a connection between semi-primitive roots of the multiplicative group of integers modulo $2^{k}$ where $k\geq 3$, and the logarithmic base in the algorithm introduced by Fit-Florea and Matula (2004) for computing the discrete logarithm modulo $2^{k}$. Fit-Florea and Matula used properties of the semi-primitive root 3 modulo $2^{k}$ to obtain their results and provided a conversion formula for other possible bases. We show that their results can be extended to any semi-primitive root modulo $2^{k}$ and also present a generalized version of their algorithm to find the discrete logar…
For $q$ a prime power, the discrete logarithm problem (DLP) in $\mathbb{F}_{q}$ consists in finding, for any $g \in \mathbb{F}_{q}^{\times}$ and $h \in \langle g \rangle$, an integer $x$ such that $g^x = h$. We present an algorithm for computing discrete logarithms with which we prove that for each prime $p$ there exist infinitely many explicit extension fields $\mathbb{F}_{p^n}$ in which the DLP can be solved in expected quasi-polynomial time. Furthermore, subject to a conjecture on the existence of irreducible polynomials of a certain form, the algorithm solves the DLP in all extensions $\ma…
For the free group on n generators we prove that the discrete logarithm is distributed according to the standard Gaussian when the logarithm is renormalized appropriately.
Brizolis asked the question: does every prime p have a pair (g,h) such that h is a fixed point for the discrete logarithm with base g? The first author previously extended this question to ask about not only fixed points but also two-cycles, and gave heuristics (building on work of Zhang, Cobeli, Zaharescu, Campbell, and Pomerance) for estimating the number of such pairs given certain conditions on g and h. In this paper we extend these heuristics and prove results for some of them, building again on the aforementioned work. We also make some new conjectures and prove some average versions of …
In this paper, we study the discrete logarithm problem in the finite fields $\F_{q^n}$ where $n|q-1$. The field is called a Kummer field or a Kummer extension of $\F_q$. It plays an important role in improving the AKS primality proving algorithm. It is known that we can efficiently construct an element $g$ with order greater than $2^n$ in the fields. Let $S_q(\bullet)$ be the function from integers to the sum of digits in their $q$-ary expansions. We present an algorithm that given $g^e$ ($ 0\leq e < q^n $) finds $e$ in random polynomial time, provided that $S_q (e) < n$. We then show that the…
We prove that the discrete logarithm problem can be solved in quasi-polynomial expected time in the multiplicative group of finite fields of fixed characteristic. More generally, we prove that it can be solved in the field of cardinality $p^n$ in expected time $(pn)^{2\log_2(n) + O(1)}$.
The discrete logarithm is a problem that surfaces frequently in the field of cryptography as a result of using the transformation g^a mod n. This paper focuses on a prime modulus, p, for which it is shown that the basic structure of the functional graph is largely dependent on an interaction between g and p-1. In fact, there are precisely as many different functional graph structures as there are divisors of p-1. This paper extracts two of these structures, permutations and binary functional graphs. Estimates exist for the shape of a random permutation, but similar estimates must be created fo…
Brizolis asked the question: does every prime p have a pair (g,h) such that h is a fixed point for the discrete logarithm with base g? The first author previously extended this question to ask about not only fixed points but also two-cycles, and gave heuristics (building on work of Zhang, Cobeli, Zaharescu, Campbell, and Pomerance) for estimating the number of such pairs given certain conditions on $g$ and $h$. In this paper we give a summary of conjectures and results which follow from these heuristics, building again on the aforementioned work. We also make some new conjectures and prove som…
We define three hard problems in the theory of elliptic divisibility sequences (EDS Association, EDS Residue and EDS Discrete Log), each of which is solvable in sub-exponential time if and only if the elliptic curve discrete logarithm problem is solvable in sub-exponential time. We also relate the problem of EDS Association to the Tate pairing and the MOV, Frey-Rück and Shipsey EDS attacks on the elliptic curve discrete logarithm problem in the cases where these apply.
This paper reports on the computation of a discrete logarithm in the finite field $\mathbb F_{2^{30750}}$, breaking by a large margin the previous record, which was set in January 2014 by a computation in $\mathbb F_{2^{9234}}$. The present computation made essential use of the elimination step of the quasi-polynomial algorithm due to Granger, Kleinjung and Zumbrägel, and is the first large-scale experiment to truly test and successfully demonstrate its potential when applied recursively, which is when it leads to the stated complexity. It required the equivalent of about 2900 core years on a …
We analyse the complexity of solving the discrete logarithm problem and of testing the principality of ideals in a certain class of number fields. We achieve the subexponential complexity in $O(L(1/3,O(1)))$ when both the discriminant and the degree of the extension tend to infinity by using techniques due to Enge, Gaudry and Thomé in the context of algebraic curves over finite fields.
Difficulty of calculation of discrete logarithm for any arbitrary Field is the basis for security of several popular cryptographic solutions. Pohlig-Hellman method is a popular choice to calculate discrete logarithm in finite field $F_p^*$. Pohlig-Hellman method does yield good results if p is smooth ( i.e. p-1 has small prime factors). We propose a practical alternative to Pohlig-Hellman algorithm for finding discrete logarithm modulo prime. Although, proposed method, similar to Pohlig-Hellman reduces the problem to group of orders $p_i$ for each prime factor and hence in worst case scenario …
We describe the use of explicit isogenies to translate instances of the Discrete Logarithm Problem (DLP) from Jacobians of hyperelliptic genus 3 curves to Jacobians of non-hyperelliptic genus 3 curves, where they are vulnerable to faster index calculus attacks. We provide explicit formulae for isogenies with kernel isomorphic to $(\ZZ/2\ZZ)^3$ (over an algebraic closure of the base field) for any hyperelliptic genus 3 curve over a field of characteristic not 2 or 3. These isogenies are rational for a positive fraction of all hyperelliptic genus 3 curves defined over a finite field of character…
In the present work, we present a new discrete logarithm algorithm, in the same vein as in recent works by Joux, using an asymptotically more efficient descent approach. The main result gives a quasi-polynomial heuristic complexity for the discrete logarithm problem in finite field of small characteristic. By quasi-polynomial, we mean a complexity of type $n^{O(\log n)}$ where $n$ is the bit-size of the cardinality of the finite field. Such a complexity is smaller than any $L(\varepsilon)$ for $ε>0$. It remains super-polynomial in the size of the input, but offers a major asymptotic improvemen…
The abstract of the original paper was as follows: We explore some questions related to one of Brizolis: does every prime p have a pair (g,h) such that h is a fixed point for the discrete logarithm with base g? We extend this question to ask about not only fixed points but also two-cycles. Campbell and Pomerance have not only answered the fixed point question for sufficiently large p but have also rigorously estimated the number of such pairs given certain conditions on g and h. We attempt to give heuristics for similar estimates given other conditions on g and h and also in the case of two-cy…
This paper proposes a new signature scheme based on two hard problems : the cube root extraction modulo a composite moduli (which is equivalent to the factorisation of the moduli, IFP) and the discrete logarithm problem(DLP). By combining these two cryptographic assumptions, we introduce an efficient and strongly secure signature scheme. We show that if an adversary can break the new scheme with an algorithm $\mathcal{A},$ then $\mathcal{A}$ can be used to sove both the DLP and the IFP. The key generation is a simple operation based on the discrete logarithm modulo a composite moduli. The sign…
This paper introduces a new public key cryptosystem based on two hard problems : the cube root extraction modulo a composite moduli (which is equivalent to the factorisation of the moduli) and the discrete logarithm problem. These two hard problems are combined during the key generation, encryption and decryption phases. By combining the IFP and the DLP we introduce a secure and efficient public key cryptosystem. To break the scheme, an adversary may solve the IFP and the DLP separately which is computationally infeasible. The key generation is a simple operation based on the discrete logarith…
Let $q$ be a prime power, let $\mathbb F_q$ be the finite field with $q$ elements and let $θ$ be a generator of the cyclic group $\mathbb F_q^*$. For each $a\in \mathbb F_q^*$, let $\log_θ a$ be the unique integer $i\in \{1, \ldots, q-1\}$ such that $a=θ^i$. Given polynomials $P_1, \ldots, P_k\in \mathbb F_q[x]$ and divisors $1<d_1, \ldots, d_k$ of $q-1$, we discuss the distribution of the functions $$F_{i}:y\mapsto \log_θP_i(y)\pmod {d_i}, $$ over the set $\mathbb F_q\setminus \cup_{i=1}^k\{y\in \mathbb F_q\,|\, P_i(y)=0\}$. Our main result entails that, under a natural multiplicative conditi…
We present a generic algorithm for computing discrete logarithms in a finite abelian p-group H, improving the Pohlig-Hellman algorithm and its generalization to noncyclic groups by Teske. We then give a direct method to compute a basis for H without using a relation matrix. The problem of computing a basis for some or all of the Sylow p-subgroups of an arbitrary finite abelian group G is addressed, yielding a Monte Carlo algorithm to compute the structure of G using O(|G|^0.5) group operations. These results also improve generic algorithms for extracting pth roots in G.
The discrete logarithm problem (DLP) generalizes to the constrained DLP, where the secret exponent $x$ belongs to a set known to the attacker. The complexity of generic algorithms for solving the constrained DLP depends on the choice of the set. Motivated by cryptographic applications, we study sets with succinct representation for which the constrained DLP is hard. We draw on earlier results due to Erdös et al. and Schnorr, develop geometric tools such as generalized Menelaus' theorem for proving lower bounds on the complexity of the constrained DLP, and construct sets with succinct represent…
The increased use of cryptography to protect our personal information makes us want to understand the security of cryptosystems. The security of many cryptosystems relies on solving the discrete logarithm, which is thought to be relatively difficult. Therefore, we focus on the statistical analysis of certain properties of the graph of the discrete logarithm. We discovered the expected value and variance of a certain property of the graph and compared the expected value to experimental data. Our finding did not coincide with our intuition of the data following a Gaussian distribution given a la…
Recently, several striking advances have taken place regarding the discrete logarithm problem (DLP) in finite fields of small characteristic, despite progress having remained essentially static for nearly thirty years, with the best known algorithms being of subexponential complexity. In this expository article we describe the key insights and constructions which culminated in two independent quasi-polynomial algorithms. To put these developments into both a historical and a mathematical context, as well as to provide a comparison with the cases of so-called large and medium characteristic fie…
The interval discrete logarithm problem is defined as follows: Given some $g,h$ in a group $G$, and some $N \in \mathbb{N}$ such that $g^z=h$ for some $z$ where $0 \leq z < N$, find $z$. At the moment, kangaroo methods are the best low memory algorithm to solve the interval discrete logarithm problem. The fastest non parallelised kangaroo methods to solve this problem are the three kangaroo method, and the four kangaroo method. These respectively have expected average running times of $\big(1.818+o(1)\big)\sqrt{N}$, and $\big(1.714 + o(1)\big)\sqrt{N}$ group operations. It is currently an open…
In the recent breakthrough paper by Barbulescu, Gaudry, Joux and Thom{é}, a quasi-polynomial time algorithm (QPA) is proposed for the discrete logarithm problem over finite fields of small characteristic. The time complexity analysis of the algorithm is based on several heuristics presented in their paper. We show that some of the heuristics are problematic in their original forms, in particular, when the field is not a Kummer extension. We believe that the basic idea behind the new approach should still work, and propose a fix to the algorithm in non-Kummer cases, without altering the quasi-p…
Cheng and Wan have related the decoding of Reed-Solomon codes to the computation of discrete logarithms over finite fields, with the aim of proving the hardness of their decoding. In this work, we experiment with solving the discrete logarithm over GF(q^h) using Reed-Solomon decoding. For fixed h and q going to infinity, we introduce an algorithm (RSDL) needing O (h! q^2) operations over GF(q), operating on a q x q matrix with (h+2) q non-zero coefficients. We give faster variants including an incremental version and another one that uses auxiliary finite fields that need not be subfields of G…
Elliptic bases, introduced by Couveignes and Lercier in 2009, give an elegant way of representing finite field extensions. A natural question which seems to have been considered independently by several groups is to use this representation as a starting point for small characteristic finite field discrete logarithm algorithms. This idea has been recently proposed by two groups working on it, in order to achieve provable quasi-polynomial time for discrete logarithms in small characteristic finite fields. In this paper, we don't try to achieve a provable algorithm but, instead, investigate the p…
A new algorithms for computing discrete logarithms on elliptic curves defined over finite fields is suggested. It is based on a new method to find zeroes of summation polynomials. In binary elliptic curves one is to solve a cubic system of Boolean equations. Under a first fall degree assumption the regularity degree of the system is at most $4$. Extensive experimental data which supports the assumption is provided. An heuristic analysis suggests a new asymptotical complexity bound $2^{c\sqrt{n\ln n}}, c\approx 1.69$ for computing discrete logarithms on an elliptic curve over a field of size $2…
In \cite{joux}, Joux devised an algorithm to compute discrete logarithms between elements in a certain subset of the multiplicative group of an extension of the finite field $\mathbb{F}_{p^n}$ in time polynomial in $p$ and $n$. Shortly after, Barbulescu, Gaudry, Joux and Thome \cite{bgjt} proposed a descent algorithm that in $(p n)^{\mathcal{O}(\log n)}$ time projects an arbitrary element in $\mathbb{F}_{p^n}^\times$ as a product of powers of elements in the aforementioned subset. Together, these two algorithms yield a quasi-polynomial time algorithm for computing discrete logarithms in finite…
Pairing based cryptography is in a dangerous position following the breakthroughs on discrete logarithms computations in finite fields of small characteristic. Remaining instances are built over finite fields of large characteristic and their security relies on the fact that the embedding field of the underlying curve is relatively large. How large is debatable. The aim of our work is to sustain the claim that the combination of degree 3 embedding and too small finite fields obviously does not provide enough security. As a computational example, we solve the DLP on a 170-bit MNT curve, by expl…
Recent breakthrough methods \cite{gggz,joux,bgjt} on computing discrete logarithms in small characteristic finite fields share an interesting feature in common with the earlier medium prime function field sieve method \cite{jl}. To solve discrete logarithms in a finite extension of a finite field $\F$, a polynomial $h(x) \in \F[x]$ of a special form is constructed with an irreducible factor $g(x) \in \F[x]$ of the desired degree. The special form of $h(x)$ is then exploited in generating multiplicative relations that hold in the residue class ring $\F[x]/h(x)\F[x]$ hence also in the target res…
In this paper, we have studied on adapting to asymmetric cryptography power Fibonacci sequence module m . To do this, We have restructed Discreate Logarithm Problem which is one of mathematical difficult problems by using power Fibonacci sequence module m and by means of this sequences, we have made the mathematical difficult problem which is used only in prime modules is also useful for composite modules. Then we have constructed cryptographic system based on this more difficult problem which we have rearranged. Hence, we have obtained a new cryptosystem as ElGamal Cryptosystem. Lastly, we ha…
Fix an ordinary abelian variety defined over a finite field. The ideal class group of its endomorphism ring acts freely on the set of isogenous varieties with same endomorphism ring, by complex multiplication. Any subgroup of the class group, and generating set thereof, induces an isogeny graph on the orbit of the variety for this subgroup. We compute (under the Generalized Riemann Hypothesis) some bounds on the norms of prime ideals generating it, such that the associated graph has good expansion properties. We use these graphs, together with a recent algorithm of Dudeanu, Jetchev and Robert …
The Number Field Sieve (NFS) algorithm is the best known method to compute discrete logarithms (DL) in finite fields $\mathbb{F}\_{p^n}$, with $p$ medium to large and $n \geq 1$ small. This algorithm comprises four steps: polynomial selection, relation collection, linear algebra and finally, individual logarithm computation. The first step outputs two polynomials defining two number fields, and a map from the polynomial ring over the integers modulo each of these polynomials to $\mathbb{F}\_{p^n}$. After the relation collection and linear algebra phases, the (virtual) logarithm of a subset of …
In late 2012 and early 2013 the discrete logarithm problem (DLP) in finite fields of small characteristic underwent a dramatic series of breakthroughs, culminating in a heuristic quasi-polynomial time algorithm, due to Barbulescu, Gaudry, Joux and Thomé. Using these developments, Adj, Menezes, Oliveira and Rodríguez-Henríquez analysed the concrete security of the DLP, as it arises from pairings on (the Jacobians of) various genus one and two supersingular curves in the literature, which were originally thought to be $128$-bit secure. In particular, they suggested that the new algorithms have n…
Let $q=p^r$ be a power of an odd prime $p$. We study binary sequences $σ=(σ_0,σ_1,\ldots)$ with entries in $\{0,1\}$ defined by using the quadratic character $χ$ of the finite field $\mathbb{F}_q$: $$ σ_n=\left\{ \begin{array}{ll} 0,& \mathrm{if}\quad n= 0,\\ (1-χ(ξ_n))/2,&\mathrm{if}\quad 1\leq n< q, \end{array} \right. $$ for the ordered elements $ξ_0,ξ_1,\ldots,ξ_{q-1}\in \mathbb{F}_q$. The $σ$ is Legendre sequence if $r=1$. Our first contribution is to prove a lower bound on the linear complexity of $σ$ for $r\geq 2$. The bound improves some results of Meidl and Winterhof. Our second contr…
As society becomes more reliant on computers, cryptographic security becomes increasingly important. Current encryption schemes include the ElGamal signature scheme, which depends on the complexity of the discrete logarithm problem. It is thought that the functions that such schemes use have inverses that are computationally intractable. In relation to this, we are interested in counting the solutions to a generalization of the discrete logarithm problem modulo a prime power. This is achieved by interpolating to p-adic functions, and using Hensel's lemma, or other methods in the case of singul…
It is well known that the repeated square and multiply algorithm is an efficient way of modular exponentiation. The obvious question to ask is if this algorithm has an inverse which would calculate the discrete logarithm efficiently. The technical hitch is in fixing the right sign of the square root and this is the heart of the discrete logarithm problem over finite fields of characteristic not equal to 2. In this paper a couple of probabilistic algorithms to compute the discrete logarithm over finite fields are given by bypassing this difficulty. One of the algorithms was inspired by the famo…
We construct cryptographic trilinear maps that involve simple, non-ordinary abelian varieties over finite fields. In addition to the discrete logarithm problems on the abelian varieties, the cryptographic strength of the trilinear maps is based on a discrete logarithm problem on the quotient of certain modules defined through the Néron-Severi groups. The discrete logarithm problem is reducible to constructing an explicit description of the algebra generated by two non-commuting endomorphisms, where the explicit description consists of a linear basis with the two endomorphisms expressed in the …
In this paper we find an identity that gives a representation for the logarithm of any two irrational numbers $a, b >1$ in terms of a series whose terms are ratios of elements from the Beatty Sequences generated by these two numbers. We also show that Sturmian sequences can be defined in terms of these ratios. Furthermore, we find an identity for such series that bears a superficial resemblance to (a discrete version of) Frullani's Integral.
The Pollard Rho algorithm is a widely used algorithm for solving discrete logarithms on general cyclic groups, including elliptic curves. Recently the first nontrivial runtime estimates were provided for it, culminating in a sharp O(sqrt(n)) bound for the collision time on a cyclic group of order n. In this paper we show that for n satisfying a mild arithmetic condition, the collisions guaranteed by these results are nondegenerate with high probability: that is, the Pollard Rho algorithm successfully finds the discrete logarithm.
