In cryptography, a discrete logarithm is the number of times a generator of a group must be multiplied by itself to produce a known number. By choosing certain groups, the task of finding a discrete logarithm can be made intractable.

learn more… | top users | synonyms

3
votes
1answer
114 views

How hard are discrete logarithms problems in $\mathbb Z^{*}_{n}$ and $\mathbb Z^{*}_{n^2}$, where $n$ is the RSA $n=pq$

Use the notations form the Wikipedia article Paillier Cryptosystem , assume that the chipertext $c$ and $c^{\lambda} \mod n^2$ are both given, is it possible to compute $\lambda$ easily?
3
votes
1answer
777 views

Why can't I break ElGamal encryption by brute-forcing the secret exponent?

I am doing a course on cryptography on coursera and one of the topics covered was the ElGamal Encryption system. I am using the terms as defined in Wikipedia. Alice publishes $g$ and $g^x$. ...
3
votes
2answers
224 views

Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset

Suppose $g$ is a generator of an order $p$ cyclic group in which discrete logarithm is hard and $p$ is a prime (i.e., given $g^x$ for a random $x \in \{0,1,\ldots, p-1\}$, it is hard to recover $x$ ...
3
votes
1answer
248 views

Stream ciphers based on discrete logs

Blum Blum Shub is a stream cipher that is provably reducible to the difficulty of factoring integers. I'm wondering whether there is a similar construction for discrete logs? For example, I could ...
3
votes
1answer
356 views

some of my confusions about DDH assumption

The wiki defines the decisional Diffie–Hellman assumption as follows: Decisional Diffie–Hellman assumption Consider a (multiplicative) cyclic group $G$ of order $q$, and with generator $g$. The DDH ...
3
votes
2answers
157 views

Finite fields in elliptic curve

I have an elliptic curve defined over finite field where $S_1=aP$ . Is it valid to say that $S_1P$ can also be computed. $P$ is the generator of the group. What my real question is that. Should '$a$' ...
3
votes
1answer
193 views

Chosen ciphertext insecurity in an ElGamal variant

I'm trying to prove something and if I can show that there is a simple way to calculate $(g^a \bmod p)^k$ if I know both $g^k \bmod p$ and $g^a \bmod p$, then (I think) it will help me prove it, but ...
3
votes
1answer
299 views

Generating a valid signature on El-Gamal without knowing the private key

Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$. Also suppose we know ...
3
votes
0answers
33 views

El-Gamal and Lines on Planes

I've been thinking about a geometric picture for El-Gamal. The idea is to understand the set $\{(my^{x},g^x) \mid x \in Z_p\}$ (the set of encryption of $m$ for fixed $g$ and $y$) by taking the ...
3
votes
0answers
56 views

Pollard's Rho - Restricting the random function to the exponents

Pollard's Rho is usually constructed using a function $f:G \rightarrow G$ which behaves 'random enough' in order to detect a collision with Floyd's cycle detection trick. It is easy enough to observe, ...
3
votes
0answers
97 views

Relations between RSA and DLOG, factoring and DLOG

Definition: (The generalized Diffie-Hellman problem) Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$. (1) Is there a known reduction from the GDH problem ...
3
votes
0answers
42 views

Can anyone explain how the modified r-adding walk works?

I was going through a paper titled “Accelerating Pollard's Rho Algorithm on Finite Fields” by Jung Hee Cheon et al. I understand the table(Ml) creation part of it, but after that I somehow fail to ...
3
votes
0answers
115 views

RSA security assumptions - does breaking the DLP also break RSA? [duplicate]

Possible Duplicate: Would the ability to efficiently find Discrete Logs have any impact on the security of RSA? I'm wondering if breaking the DLP, that is the basis for ElGamal and DSA, ...
2
votes
1answer
145 views

Discrete logarithm modulo a smooth number

I am solving the discrete logarithm problem modulo $N$. $N$ is a composite number, I found its factors — lots of small primes and two big primes ($> 2^{50}$). Does the factorization of $N$ somehow ...
2
votes
1answer
256 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
2
votes
2answers
208 views

Given $g$, $b$, $g^{ab}$, is finding $g^a$ a hard problem?

As in the title, given $g$, $g^{ab}$ are big elements in a prime group $Z_p$ and $b$ in prime group $Z_r$ ($p > r$, $g$ is one generator of $Z_p$). $a$ is unknown and also in $Z_r$, is finding ...
2
votes
1answer
101 views

What does signed fixed window method mean in ECC?

I am studying (sliding) window method in Elliptic Curve Cryptography (ECC) but I am confused by the term, signed fixed window method. By the way term is used in a research paper and not in the book ...
2
votes
2answers
1k views

How to test if a number is a primitive root?

How to test if a number is a primitive root, assuming the modulus is a prime? And if not? Is it not enough if the number is relatively prime to the modulus or prime?
2
votes
2answers
221 views

Is there a cumulative commitment scheme?

For a certain application I need a commitment scheme where each user could make a commitment, and a single verification operation could verify all the commitments simultaneously, faster than single ...
2
votes
1answer
43 views

Discrete log accumulator without pairings

Here $g$ is some fixed generator of a discrete log group. I don't want the group to be bilinear for efficiency and BDH-skepticism reasons. Is anyone aware of a discrete log accumulator? What I mean ...
2
votes
1answer
266 views

Proof of correctness of a homomorphic ElGamal sum

Let's suppose we are using the exponential ElGamal as a public-key encryption scheme, so that we encrypt $g^m$ instead of $m$, for some generator $g$. Let $x$ be the private key, and $h=g^x$ be the ...
2
votes
2answers
801 views

ECC algorithm pollard's $\rho$ complexity

One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
2
votes
2answers
86 views

Zero knowledge-proof for discrete log that is not honest-verifier

Take a cyclic group of prime order. The Schnorr-protocol for proving knowledge of the discrete logarithm of some group element is honest-verifier zero-knowledge, meaning that if the verifier chooses ...
2
votes
1answer
236 views

Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?

We have a multiplicative cyclic group $G$ which is a subgroup of $(\mathbb{Z}/n\mathbb{Z})∗$. There are two parties, Alice and Bob: If: Alice knows: $b$ and $x$ such that $x^x = b$; Bob knows: $b$. ...
2
votes
1answer
459 views

How is ElGamal not secure under chosen ciphertext attack, but semantically secure in some cases?

I know that you can create a ciphertext c' using c and then find the corresponding m' for c' which you can use to find m for c. So, doesn't this mean that it is not semantically secure? But I also ...
2
votes
1answer
196 views

Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack

The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
2
votes
2answers
196 views

Is there a way to compare the 923 bit pairing based key with RSA or AES, etc

I've see many articles, most of them basically the same, praising Fujitsu for cracking what is referred to as a 923 bit pairing based encryption. I understand that in comparing RSA to AES you've got ...
2
votes
1answer
247 views

DLP based crypto systems with multiple independent generators

One example of a DLP based crypto system (or rather DDH based crypto system) where the public key parameters include two independent generators of the subgroup, is Cramer Shoup. Since the security ...
2
votes
1answer
151 views

Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
2
votes
1answer
264 views

Finding a solution to a (sort of) discrete logarithm by asking questions

Let $p = kq + 1$ and $q$ be primes such that $log$ $q = n$, $log$ $k = n$ and such that the bit size of every prime factor of $k$ is bounded by $log$ $n$. Let $g$ be a generator of the unique ...
2
votes
0answers
76 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
1
vote
1answer
253 views

Why is “multiplying” $g^x$ and $g^y$ not possible?

The computational Diffie-Hellman problem states that for a cyclic group $G$ of order $p$ and a generator $g$, it is hard to find the value $g^{xy}$ given only $g^x$ and $g^y$ (but easy if either $x$ ...
1
vote
1answer
575 views

Pollard’s Rho Method

I can't get my head around Pollard’s Rho Method for solving discrate log problem I have read in a book: The basic idea is to pseudorandomly generate group elements of the form α^i · β^j ...
1
vote
1answer
328 views

Solving a discrete logarithm using GDlog

I am trying to calculate an $x$, such that $t = g^x \pmod p$ in order to crack a weak ElGamal encryption for university. I found GDlog, but I cant figure out how I can use the input to calculate my ...
1
vote
1answer
298 views

Why do we use 1024 / 160 bit primes in DSA?

I am looking at DSA's parameter generation and don't understand why for $p$ a 1024 bit prime is needed if $q$ is chosen as a $160$ bit prime. I thought that the security of DSA relates on the discrete ...
1
vote
1answer
155 views

Discrete Logarithm (512 bits numbers) - Find exponent parameter

I'm trying to resolve a discrete logarithm equation: $$y = g^x \bmod p$$ Every parameter is a 512-bit number. I know the values for $g$, $y$ and $p$ and I need to find the $x$ value. Finally, I know ...
1
vote
1answer
88 views

Is $(a,g^{ab})$ computationally indistinguishable from $(a, g^c)$?

From wikipedia, the DDH assumption says,given a cyclic group $G$ of order $q$ with generator $g$, $(g^a, g^b, g^{ab})$ looks like $(g^a, g^b, g^c)$ where $a,b,c$ are randomly and independently chosen ...
1
vote
1answer
41 views

Is this discrete log generalization a well known cryptographic assumption?

Assume you have a finite group $\mathbb{G}$ and an integer $n$. Given $g_1,\dots,g_n,t$ chosen uniformly from $\mathbb{G}$, consider the problem of finding a vector $(a_1,\dots,a_n)\in \mathbb{Z}^n$ ...
1
vote
2answers
86 views

Subexponential algorithms for DLP in $\mathbb{Z}_s \times \mathbb{Z}_t$

Consider the accepted answer to the question: Why are elliptic curves better than cyclic groups? It seems to suggest there are subexponential algorithms (i.e., algorithms with running time $$ ...
1
vote
1answer
568 views

How to protect from Silver–Pohlig–Hellman algorithm

I read that Silver–Pohlig–Hellman algorithm solves the discrete logarithm with prime module $p$ in $O(\log^2(p))$ if $p-1$ is a smooth number. This seems pretty fatal for cryptography, since it is a ...
1
vote
1answer
38 views

Degenerate discrete logarithm in binary field

Given a field $\mathbb{F}_{2^n}$, are there any choices of primitive element $g$ that make the discrete logarithm easier for that generator? That is, are there any degenerate cases? For example, if I ...
1
vote
1answer
49 views

In a additive group is it hard to calculate $bg$ given $ag, g, abg$

The ECDH problem defined that given $g,ag,bg$ it is difficult to calculate $abg$. But it is also difficult to calculate $bg$ given $ag,g,abg$. where $g$ is generator and a,b are elements of group.
1
vote
1answer
158 views

Finding discrete logarithm with baby-step-giant-step algorithm

I am trying to use the Baby Step Giant Step algorithm to find discrete logarithm in: $$a^x= B \pmod p$$ with using BSGS: $$x = im+j$$ $$a^j = B a^{-im}$$ where $m = \sqrt{p}$ Wikipedia says: ...
1
vote
1answer
74 views

Security assessment between $g^{a_ix_i+r_i}$ and $g^{x_i+r_i}$ [closed]

Imagine a tagging system whose security requirements imply to learn nothing from the tag about the encoded value. We consider a plaintext space $X \in \mathbb{Z}_p$ and a group $\mathbb{G}$ where ...
1
vote
2answers
82 views

Finding an x such that xP = (11,44) on an elliptic curve

Given the elliptic curve $$E:y^2 = x^3+17x+5 \mod 59$$ with point $P = (4,14)$, how do I find $x$ such that compute $x\cdot P = (11,44)$ Is there a mathematical method to compute $x$, or do I ...
1
vote
1answer
233 views

Generating Diffie-Hellman parameters efficiently

I am working on an Android project for school and I am supposed to do a DHKE (Diffie Hellman Key Exchange). Everything works well. The problem is that it takes a lot of time (really a lot) to ...
1
vote
2answers
307 views

Attacks against El Gamal private key

El Gamal encryption involves picking $(p,g,b)$ which is our public key. We compute $b=a^x$ $mod$ $p$. Here, $x$ is the private key which we don't know. What are some efficient and strong algorithms ...
1
vote
1answer
216 views

Relationship between Elliptic Curve Discrete Log, Integer Discrete Log, and Integer Factorization

I am trying to look into a relation between the following three problems which are widely used to build public crypto systems: Integer Discrete log Elliptic Curve Discrete log Integer Factorization ...
1
vote
1answer
991 views

Reduction of Integer factorization to Discrete logarithm problem

I was reading Eric Bach paper entitles "Discrete logarithms and factoring", in which he states the following reductions: solving the integer factorization problem suffices to solve the discrete ...
1
vote
1answer
109 views

Pohlig-Hellman Algorithm: Adding up the solution via CRT

I have a question about the Pohlig-Hellman Algorithm for the discrete log problem. I understand the concept, but doing the exact calculations I get confused at one point; to illustrate, let's look at ...