Questions tagged [discrete-logarithm]
In cryptography, a discrete logarithm is the number of times a generator of a group must be multiplied by itself to produce a known number. By choosing certain groups, the task of finding a discrete logarithm can be made intractable.
393
questions
2
votes
1answer
50 views
Weakness in Pohlig-Hellman algorithm
Let's try to solve a discrete logarithm:
$\beta \equiv \alpha ^{x} \bmod \,\, p$
using the Pohlig-Hellman algorithm. Let's suppose that $p-1=tq$, where $q$ is a large prime number. This means that ...
2
votes
1answer
38 views
Identity Based Encryption: Known Random Value
Let's consider a situation whereby:
Alice generates a ciphertext c from a message m using Bob’s ID.
An attacker Carol can get c from the open channel. She knows that c is
generated by using ...
0
votes
0answers
47 views
0
votes
1answer
35 views
For discrete elliptic curves, can you find G, if you are given b and B?
I know you cannot find $b$ if you are given $B$ and $G$, where $B = [b]G$,
but can you find $G$ given $b$ and $B$?
1
vote
0answers
53 views
Elliptic curve discrete logarithm problem
I'd like to know what is the maximum bits of the finite field that we can solve the ECDLP in a "regular" computer in trivial time. Is there any recent data about this?
2
votes
1answer
52 views
How does the order of Q affect the time it takes to solve ECDLP?
I use Sagemath's built-in function discrete_log() to solve ECDLP and according to the documentation it uses Pohling-Hellman algorithm to solve an ECDLP.
This is ...
2
votes
1answer
43 views
Does the discrete log assumption hold if k > p
In discrete log cryptosystems like ElGamal it is noted that the "private key" $k$ should be chosen as any element of the group $G$ i.e. $k < p-1$. Does the integrity of the cryptosystem rely on $k$ ...
1
vote
1answer
36 views
Retrieving correct ciphertext from additive ElGamal
I have been studying additive ElGamal and I think I have the hang of it except the part where the message $M$ must be retrieved by computing the discrete log of $g^M$.
From what I've read, the ...
1
vote
1answer
59 views
How do I interpret the CADO-NFS output for discrete logarithm calculation in GF(p)?
I'm using CADO-NFS to calculate discrete logarithm in a finite field GF(p). The problem is when I type
...
3
votes
1answer
111 views
Attacking any one in many public keys
The problem of finding private key from public key is typically studied in the one-key setup: what's the expected cost of breaking one key (e.g. by factoring a public modulus, or solving a discrete ...
0
votes
1answer
83 views
Group in the context of elliptic curve crypto [duplicate]
I understand that the discrete log problem is defined as
$G^y \bmod p = x$
Speaking generally, $G$ here is a generator for the group zp*, where $G$ is able to ...
0
votes
0answers
49 views
Pollard's Kangaroo: How random does $f$ have to be?
I'm implementing Pollard's kangaroo algorithm as described here.
Wikipedia's description of the protocol says that you should have "a pseudorandom map $f:G\rightarrow S$."
Does anyone know what ...
0
votes
0answers
55 views
DLP instances for given number of congruences
Let $S$ be the set of $k$ congruences of the type $g_{i}^{x_i} \equiv h_i \pmod{n_i}, \quad \forall i,1\leq i \leq k$
What would be the best way to describe such set $S$ with a term in literature. ...
0
votes
1answer
65 views
structure in modular arithmetic
I was playing around with modular arithmetic when I noticed something.
\begin{align}
g^k &= a \bmod n\\
g^{k+0.5(n-1)} &= b \bmod n
\end{align}
Then $a + b = n$, so you can also write
$$g^{...
1
vote
1answer
36 views
Questions regarding random values in Schnorr authentication
In Chapter 21.3 of Schneier, Applied Cryptography I read the following about the Schnorr Authentication Protocol:
To generate a key pair, first choose two primes, $p$ and $q$, such that $q$ is a ...
8
votes
1answer
175 views
Simultaneous Discrete Logarithm with Small Exponent
Given two distinct safe primes $p_1 = 2 \cdot q_1 + 1$, $p_2 = 2 \cdot q_2 +1$, consider the following two instances of the discrete logarithm problem with the same unknown exponent $x$.
$$ g_1^x \...
0
votes
1answer
76 views
Proof Dlog is hard in generic group model
I want to know a proof for why the dlog problem is hard in the generic group model. But i can't find any resources online. Can someone please provide me a link or an explanation?
1
vote
1answer
83 views
Discrete logarithm problem particularly hard for Schnorr groups?
The Wikipedia article on Discrete Logarithm just states without source:
In some cases (e.g. large prime order subgroups of groups ($\mathbb{Z}_p)^×$) there is not only no efficient algorithm known ...
1
vote
1answer
122 views
Finding tetration in a multiplicative group modulo p
I have a variant on the discrete logarithm problem, involving finding tetration in a multiplicative cyclic group of integers modulo a large prime $p$:
$$a = x^x \mod p$$
Where $a$ and $p$ are known, ...
0
votes
2answers
85 views
Why are some group representations much easier to compute discrete logarithm for? [duplicate]
The multiplicative group mod $p$ is isometric to the additive group mod $p-1$, yet computing discrete logarithms in the additive group is easy and completing discrete logarithms in the multiplicative ...
3
votes
1answer
134 views
Does knowing that the exponent is in a certain range help solving discrete log?
given:
$c=g^i \bmod P$
$g$ generator for group with group size $\varphi(P)$
$g,P,\varphi(P)$,c is known by the attacker
He wants to know $i$.
Now the attacker also knows $j,k$ with $j<i<k$
$k-j$...
-1
votes
1answer
73 views
How do discrete logarithm with modulo a prime and a non-prime compare?
Let
$c_N = g^i \mod N$ and $N=p \cdot q$
and
$c_P = f^j \mod P$ and $P$ a prime
We assume $N,P$ has the same bit-length. $P$ is the best type of prime you can choose (e.g. safe prime). $N$ is a ...
2
votes
1answer
86 views
Elliptic Curve Discrete Log in a Composite Ring
Elliptic curves are usually defined over prime rings (fields), but what if we chose a ring of composite order? Let $n = pq$ for $p,q$ large primes. Say I have elliptic curve $y^2 = x^3 + ax + b$ over ...
0
votes
1answer
73 views
Elliptic curve with prime subgroup equal to field size
I am aware that when the equation $\#E(\mathbb{Z}_p) = p$ holds for prime $p$, the elliptic curve is called "anomalous" and is insecure do to "Smart's attack".
Consider the similar case that $E(\...
2
votes
1answer
88 views
Understanding the Definition of Most Significant Bits in the Hidden Number Problem
Boneh's and Venkatesan's "Hardness of computing the most significant bits of secret keys in Diffie-Hellman and related schemes" defines the Hidden Number Problem (HNP). The HNP shows that computing ...
0
votes
2answers
63 views
Bulletproof - Is it possible to do range proof only from public key?
is it possible to proof x in range (2^1,2^64) from xG=Q with bulletproof or something else only from Q? I’m new in this subject, so thanks before.
3
votes
0answers
51 views
Subexponential algorithms that apply only one of factoring and discrete logarithm?
Shor (quantum polynomial), Number Field Sieve (subexponential), Pollard rho (square root) all have both factoring and discrete logarithm over $\mathbb F_p^*$ variants.
What are the subexponential ...
3
votes
1answer
149 views
Why is the NIST recommendation for the private key exponent so much smaller than the modulus?
NIST recommends a 256-bit private key exponent for DLP with a 3072-bit modulus. This question answered how the modulus was chosen/calculated, however, why isn't the private key size closer to the ...
0
votes
2answers
74 views
Verify the discrete log of ECDSA is in range
Is it possible to verify the discrete log in elliptic curve is within range without uncovering it? I need to verify that $x$ is within $1$, $2^{64}$ for $xG=P$.
1
vote
0answers
69 views
How can I prove that the plaintext of an elgamal ciphertext is the discrete log of an element?
Is there any (efficient) method to prove that the plaintext of an ElGamal ciphertext is the discrete log of an element?
In the scenario I concerned, I have an El Gamal key pair $(pk, sk) = (g^y, y)$....
10
votes
0answers
264 views
How Significant is the New Quasi-Polynomial-Time Attack on Fixed Characteristic Discrete Logarithms?
There is a new paper by Kleinjung and Wesolowski on eprint that claims and proves a new attack on the discrete logarithm problem in finite fixed characteristic fields in quasi-polynomial time.
...
1
vote
1answer
96 views
How is the recommended NIST modulus for DLP chosen/calculated?
NIST recommends a 256-bit private key exponent for DLP with a 3072-bit modulus. From this answer it appears that the range of private key numbers is derived by calculating a prime modulus via $2⋅p$ ...
2
votes
1answer
106 views
Pollard's Kangaroo— What is the failure probability (assuming random functions)?
I'm reading Pollard's paper on solving the discrete log problem, i.e. to find $x$ given $y = g^x$, where $g$ is a generator of the group.
He has a Kangaroo Algorithm (page 4) which allows you, if you ...
3
votes
1answer
130 views
What can be said about the self-power map on groups based on DLP?
Introduction
I've been playing with group representation theory some time, concretely representing groups as permutation groups (Cayley's theorem), where the group $G$ has an embedding into the ...
2
votes
1answer
95 views
Bit-strength of discrete logarithm for a group of integers modulo a safe prime
Preliminaries
Let $p$ be a safe prime number.
Let $\mathbb{Z}_p^*$ be the multiplicative group of integers modulo $p$.
We have $\mathbb{Z}_p = \{\,a \in \mathbb{Z} \mid 1 \le a \lt p\,\}$ .
Let $g \...
3
votes
1answer
179 views
What information does $g^x$ reveal about $x$?
Let $p$ be a large prime number. Let $G$ be a subgroup of $\mathbb{Z}_p^*$ with order $q$ - again a large prime. Let $g$ be a generator of $G$.
Consider the following standard protocol for ...
2
votes
2answers
528 views
0
votes
0answers
39 views
Why do they use elliptic curve instead of circle or other simpler curves? [duplicate]
I am curious why people use elliptic curve in cryptography. I know the main requirement is DLP, but elliptic curve is not the only curve with such property. Some of curves seem to be even simpler.
As ...
0
votes
1answer
97 views
What makes the Discrete Logarithm Problem hard?
I am missing a crucial piece of the maths behind the DLP, and I'm hoping someone can give me a really dumbed down answer..
If $h=g^x \bmod p$ and we're working in the group $Z^*_p$, why can I not ...
2
votes
1answer
63 views
How to determine if $\{n \cdot g^a \mod P\}$ and $\{m \cdot g^a \mod P\}$ generate the same sets? (set size < $P-1$)
given some examples $k_{n_i},k_{m_i}$ out of each value set:
$k_{n_i} \in \{n \cdot g^a \mod P\, \forall a \in \mathbb{N}<P\}=G_m$
$k_{m_i} \in \{m \cdot g^a \mod P, \forall a \in \mathbb{N}<P\}...
-1
votes
1answer
80 views
Is there a fast way to solve $k = n \cdot g^a \mod P$? (get $a$ for unknown $n$)
Would a factor besides the normal discrete logarithm problem increase or decrease the solving time?
$k = n \cdot g^a \mod P$
with given $k,g,P$ and the knowledge $P= 2 \cdot N \cdot f+1$, while $...
0
votes
0answers
29 views
Is there any property of the product you can predict before using $n$-times generator $g$ $\mod P$? Can any $n$'th element have a certain property?
Given a value $v$ which is in same group as the generator $g$ modulo prime $P$. The group size is a prime $s$.
$v = g^a \mod P$
Only known values are $v,g,P,s$. Some (possible) computation of other ...
0
votes
1answer
34 views
Which is the fastest way to find a member of a subgroup with known size modulo prime $P$, with know factorization of $P-1$?->$x$ with $x^s \mod P = 1$
Assuming you know the factorization of used prime $P-1$
$P-1 = s \cdot f_2\cdot f_3...f_i$
Now you want to find a member of a subgroup $\mathbb{Z}_s$.
This means any $x$ with
$x^s \equiv 1 \mod P $
...
7
votes
1answer
320 views
How safe is a prime with $P=2 \cdot Q \cdot R \cdot S \cdot t+1$ for discrete logarithm? How to enhance/compare?
To get some certain properties for my use case I need a prime $P$ which has the form:
$P=2\cdot Q \cdot R \cdot S \cdot t+1$
with $Q,R,S,t$ primes as well.
Why that form - Use case
Together with ...
6
votes
1answer
103 views
why a group used in cipher based on DLP must be Abelian group?
I can't understand it because $(g^x)^y=(g^y)^x$ in nonabelian group too.
thank you very much for read my question
-1
votes
1answer
46 views
Is there a way to determine the number of subgroups (with size $s$) while computing $A^b \bmod P$? Constructing a $P$ with $n$ times size $s$?
If you compute $A^b \bmod P$ for all $b$ the set of results $R$ depend at $A$ (and $P$).
$R = \{A^b \bmod P, \forall \space b \in \mathbb{N}\}$
In case $R$ contain all numbers from 1 to $P-1$, it ...
4
votes
1answer
167 views
Could Diffie-Hellman protocol serve as a zero-knowledge proof of knowledge of discrete logarithm?
The Schnorr identification protocol is widely recognized as the simplest ZKPoK of the discrete logarithm (more clearly, Honest-Verifier ZKPoK).
However, I can't figure out why this simple protocol, ...
1
vote
1answer
55 views
Does a different exponent and base but same key help to resolve discrete logarithm?
E.g.:
$k = N^a \mod P$
The attacker knows the prime $P$ and $N$, which is also a prime and
(1.) prime root of $P$ or
(2.) has a cycle size of $s$, so $1 = N^s \mod P$, (and for $\forall s'<s$, $...
1
vote
1answer
93 views
How to compute a discrete logarithm modulo a power of 2?
This question is related to this one. Specifically, assume that we have $p$ = 2048, $m$ = 13 and $c$ = 357.
In this case, $c\ =m^e\ \bmod \ p$.
I know that many algorithms rely on the difficulty of ...
2
votes
1answer
93 views
Discrete logarithm with exponentiation oracle
Suppose $(n, d)$ is an RSA private keypair. We know the public key only (wlog suppose it's $(n, 2^{16}+1)$ and we are given oracle $E$, decryption oracle for $(n, d)$. Is there any efficient algorithm ...
