# How does the security of Elliptic curve compare to normal discrete logarithm?

Intro:

EC are often compared with RSA but how about a more safe version of the discrete logarithm?

All 3 can be reduced to the problem:

$$b = g^a \mod{P}$$

In RSA $$P$$ is a product of two primes. To solve the discrete logarithm 'just' a factorization of $$P$$ is required. Different to the two other cases $$a,b$$ is known and $$g$$ is searched.

But if $$P$$ is a prime the problem can get much harder. It depends at the factorization of $$P-1$$ because $$P-1$$ is also equal to the number of different elements.

As far as I know the best choice is a 'safe prime' with $$P = 2 q +1$$ with $$q$$ a prime as well. This discrete logarithm can be solved in $$\mathcal{O}(\sqrt{q})$$ with $$q$$ the biggest prime factor (with Pollard's algorithm).

At EC $$P$$ is a prime as well but the number of elements can be different (but still $$\approx P$$). It can e.g. be determined with Schoof's algorithm. A number of safe elliptic curves can be found at safecurves.cr.yp.to . Tested safe curves had all $$2^3 \cdot q$$ elemnts (with $$q$$ a big prime). Afak solving those will also take $$\mathcal{O}(\sqrt{q})$$ time.

Question:

Given the discrete logarithm solving problem for normal numbers and elliptic curves (mod a prime $$P_i, P_e$$). Given a valid generator $$g_i, g_e$$ and a possible result $$b_i, b_e$$.

$$\text{normal: } b_i = g_i^{a_i} \mod P_i$$ $$\text{elliptic curve: } b_e = g_e^{a_e} \mod P_e$$

Let the elliptic curve have $$N_e = 2^3 \cdot q$$ different elements with $$q$$ a big prime (other variables chosen in that way).

Let $$P_i = 2 \cdot q +1$$

Do both problems have the same solving time of $$\mathcal{O}(\sqrt{q})$$ ?

(we ignore the linear factor of computation time for each single step due to different multiplication time)

Bonus questions:

Which other factor have impact into the solving speed?

BQ1.) The number of elements of some curves from safecurves.cr.yp.to had also the property: $$N_e -1 = 3 \cdot r$$ with $$r$$ a big prime. Does this have any impact?

BQ2.) Has the factorization of $$P_e -1$$ any impact at the security?

BQ3.) Has the factorization of $$q-1$$ any impact at the security? (for normal and EC)

Edit: Update

• It looks like 'number filed sieve' can do better than Pollard's algorithm ($$\mathcal{O}(\sqrt{q})$$). To use it on EC the embedding need to be small -> chose a big one
• besides the safe prime property $$P_i$$ should als be not close to $$p^n$$ with $$p$$ a small prime like $$2,3,..$$

$$\rightarrow$$ assumption: so there is a difference?

• keylength.com/en/compare Mar 4, 2021 at 19:01
• @kelalaka ty4link. But unsure about the naming: I guess symmetric would be AES, But whats the difference between 'Factoring Modulus', 'Discrete Logarithm Key', 'Discrete Logarithm Group'. Mar 4, 2021 at 19:16
• Symmetric is a general name for symmetric ciphers like AES, ChaCha. Factoring Modulus RSA like, the two other is realated to DSA Mar 4, 2021 at 19:20
• Interesting link but as far as I understood DSA is not exactly the same as the described normal discrete log problem. However it also operation at a sub-group generator with an order of 'Discrete Logarithm Key'-bit. This also supports the assumption of same computation time. During checking this links out I also noticed there is a faster method 'number filed sieve' and besides the safe prime property it should als not be close to $p^n$ with $p$ a small prime like $2,3,..$ Will add this Mar 4, 2021 at 21:10
• On the above comment: if one can solve the DLP in $\mathbb Z_p^*$, one can (trivially) solve DSA; for the converse, see this.
– fgrieu
Mar 5, 2021 at 19:09

As far as I know the best choice is a 'safe prime' with $$P=2q+1$$ with $$q$$ a prime as well.

This is the best choice for a given size of $$P$$, but not for a given size of $$q$$. See this.

This discrete logarithm can be solved in $$\mathcal{O}(\sqrt{q})$$ with q the biggest prime factor (with Pollard's (Rho) algorithm).

Essentially yes (minor caveat: $$\mathcal{O}(\sqrt{q})$$ is not effort, but the number of multiplications of integers of size $$P$$, with $$P>q$$, hence the effort grows faster by a factor at least $$\ln P\,\ln\ln P$$). That the DLP can be solved with such method and effort does not imply that such method or effort is needed. And if $$P$$ is a safe prime, there are methods (including the Number Field Sieve) requiring less effort. Again, see this.

Do (DLP in a subgroup of an appropriate Elliptic Curve on one hand, of $$\mathbb Z_P^*$$ on the other hand) have the same solving time of $$\mathcal{O}(\sqrt{q})$$ (group operations, where prime $$q$$ is the order of the subgroup)?

Yes, when using Pollard's Rho algorithm. That algorithm is believed optimum in the Elliptic Curve case, and for $$P$$ large enough in the $$\mathbb Z_P^*$$ case.

No, when $$P$$ is a safe prime (and large enough to make the DLP non-trivial), and using the Number Field Sieve to tackle the DLP in the subgroup of $$\mathbb Z_P^*$$.

Note: I don't know that the Number Field Sieve can be used to solve the DLP in an appropriate Elliptic Curve (sub)group; and it would come as a huge surprise if it was more efficient than Pollard's Rho algorithm.

• as far as I understood EC can be embedded in a $\mathbb{F}_{p^k}$ DLP. If the embedding degree $k$ is small NFS can be used at this. Depending at $k$ it can be faster. see question1 and question2 Mar 5, 2021 at 23:10
• ty for answering this as well. This was the first question and the linked was a 2nd trial but it generally also answering this question. I didn't knew how to proceed with this question. I think I know the difference now (except maybe the relation for some special primes which are somewhere in between those cases but not needed now). Thank you again. Mar 5, 2021 at 23:10