# Tag Info

2

Yes, it is equally as difficult; if we assign: $$g' = ag$$ $$a' = a^{-1}$$ $$b' = b$$ Then the restatement of your problem is: given $g' = ag$, $a'g' = g$ and $b'g' = abg$, compute $a'b'g' = bg$, which is exactly the ECDH problem. Now, this assumes that $a$ has an inverse; this is not a problem if the curve order is a prime, and is easy to work around if ...

9

It depends. If the order $m$ of $g$'s group is known and $a$ has an inverse modulo $m$ (which is the case if and only if $a$ is coprime to $m$), then it is easy: Calculate the inverse $b:=a^{-1}\bmod m$ (for instance, using the Euclidean algorithm), and compute the power $(g^a)^b$. By Lagrange's theorem, this equals $g$. However, there are cases for which ...

0

if you know a, you also know $\frac{1}{a}$ then $g=(g^a)^{\frac{1}{a}}$ UPDATE: answering the question for solving $X^r - a = 0$, when r | (p-1). If my analysis is correct: if r | (p-1): the square root algorithm can easily be adapted regarding the form of prime p. If p=2.r.q + 2.r -1: this deterministic case: Let Let \$y_0=a^{\frac{p+1}{2 \times r}} ...

Top 50 recent answers are included