Two grumpy giants and a baby D. J. Bernstein University of - PDF document

Two grumpy giants and a baby D. J. Bernstein University of Illinois at Chicago Tanja Lange Technische Universiteit Eindhoven

Discrete-logarithm problems Fix a prime ❵ . Input: generator ❣ of group of order ❵ ; element ❤ of same group. Output: integer ❦ ✷ Z ❂❵ such that ❤ = ❣ ❦ , where group is written multiplicatively. “ ❦ = log ❣ ❤ ”. How difficult is computation of ❦ ?

Generic algorithms Will focus on algorithms that work for every group of order ❵ . Allowed operations: neutral element 1; multiplication ❛❀ ❜ ✼✦ ❛❜ . Will measure algorithm cost by counting # multiplications. Success probability: average over groups and over algorithm randomness.

Each group element computed by the algorithm is trivially expressed as ❤ ① ❣ ② for known ( ①❀ ② ) ✷ ( Z ❂❵ ) 2 . 1 = ❤ ① ❣ ② for ( ①❀ ② ) = (0 ❀ 0). ❣ = ❤ ① ❣ ② for ( ①❀ ② ) = (0 ❀ 1). ❤ = ❤ ① ❣ ② for ( ①❀ ② ) = (1 ❀ 0). If algorithm multiplies ❤ ① 1 ❣ ② 1 by ❤ ① 2 ❣ ② 2 then it obtains ❤ ① ❣ ② where ( ①❀ ② ) = ( ① 1 ❀ ② 1 ) + ( ① 2 ❀ ② 2 ).

Slopes If ❤ ① 1 ❣ ② 1 = ❤ ① 2 ❣ ② 2 and ( ① 1 ❀ ② 1 ) ✻ = ( ① 2 ❀ ② 2 ) then log ❣ ❤ is the negative of the slope ( ② 2 � ② 1 ) ❂ ( ① 2 � ① 1 ). (Impossible to have ① 1 = ① 2 : if ① 1 = ① 2 then ❣ ② 1 = ❣ ② 2 so ② 1 = ② 2 , contradiction.) Algorithm immediately recognizes collisions of group elements by putting each ( ❤ ① ❣ ② ❀ ①❀ ② ) into, e.g., a red-black tree. (Low memory? Parallel? Distributed? Not in this talk.)

Baby-step-giant-step (1971 Shanks) Choose ♥ ✕ 1, ♣ typically ♥ ✙ ❵ . Points ( ①❀ ② ): ♥ + 1 “baby steps” (0 ❀ 0) ❀ (0 ❀ 1) ❀ (0 ❀ 2) ❀ ✿ ✿ ✿ ❀ (0 ❀ ♥ ); ♥ + 1 “giant steps” (1 ❀ 0) ❀ (1 ❀ ♥ ) ❀ (1 ❀ 2 ♥ ) ❀ ✿ ✿ ✿ ❀ (1 ❀ ♥ 2 ). Can use more giant steps. Stop when log ❣ ❤ is found.

Performance of BSGS Slope ❥♥ � ✐ from (0 ❀ ✐ ) to (1 ❀ ❥♥ ). Covers slopes � ♥❀ ✿ ✿ ✿ ❀ � 1 ❀ 0 ❀ 1 ❀ 2 ❀ 3 ❀ ✿ ✿ ✿ ❀ ♥ 2 ✠ ✟ , using 2 ♥ � 1 multiplications. Finds all discrete logarithms if ❵ ✔ ♥ 2 + ♥ + 1. ♣ Worst case with ♥ ✙ ❵ : ♣ (2 + ♦ (1)) ❵ multiplications. ♣ (In fact always ❁ 2 ❵ .) ♣ Average case with ♥ ✙ ❵ : ♣ (1 ✿ 5 + ♦ (1)) ❵ multiplications.

Interleaving (2000 Pollard) Improve average case to ♣ (4 ❂ 3 + ♦ (1)) ❵ multiplications: (0 ❀ 0) ❀ (1 ❀ 0) ❀ (0 ❀ 1) ❀ (1 ❀ ♥ ) ❀ (0 ❀ 2) ❀ (1 ❀ 2 ♥ ) ❀ (0 ❀ 3) ❀ (1 ❀ 3 ♥ ) ❀ . . . (0 ❀ ♥ ) ❀ (1 ❀ ♥ 2 ). ❘ 1 0 (2 ① ) 2 ❞① . 4 ❂ 3 arises as

Interleaving (2000 Pollard) Improve average case to ♣ (4 ❂ 3 + ♦ (1)) ❵ multiplications: (0 ❀ 0) ❀ (1 ❀ 0) ❀ (0 ❀ 1) ❀ (1 ❀ ♥ ) ❀ (0 ❀ 2) ❀ (1 ❀ 2 ♥ ) ❀ (0 ❀ 3) ❀ (1 ❀ 3 ♥ ) ❀ . . . (0 ❀ ♥ ) ❀ (1 ❀ ♥ 2 ). ❘ 1 0 (2 ① ) 2 ❞① . 4 ❂ 3 arises as Oops: Have to start with (0 ❀ ♥ ) as step towards (1 ❀ ♥ ). But this costs only ❖ (log ❵ ).

Is BSGS optimal? After ♠ multiplications have ♠ + 3 points in ( Z ❂❵ ) 2 . Can hope for ( ♠ + 3)( ♠ + 2) ❂ 2 different slopes in Z ❂❵ .

Is BSGS optimal? After ♠ multiplications have ♠ + 3 points in ( Z ❂❵ ) 2 . Can hope for ( ♠ + 3)( ♠ + 2) ❂ 2 different slopes in Z ❂❵ . 1994 Nechaev, 1997 Shoup: proof that generic algorithms have success probability ❖ ( ♠ 2 ❂❵ ). Proof actually gives ✔ (( ♠ + 3)( ♠ + 2) ❂ 2 + 1) ❂❵ .

Is BSGS optimal? After ♠ multiplications have ♠ + 3 points in ( Z ❂❵ ) 2 . Can hope for ( ♠ + 3)( ♠ + 2) ❂ 2 different slopes in Z ❂❵ . 1994 Nechaev, 1997 Shoup: proof that generic algorithms have success probability ❖ ( ♠ 2 ❂❵ ). Proof actually gives ✔ (( ♠ + 3)( ♠ + 2) ❂ 2 + 1) ❂❵ . BSGS: at best ✙ ♠ 2 ❂ 4 slopes, taking ♥ ✙ ♠❂ 2. Factor of 2 away from the bound.

The rho method (1978 Pollard, r = 3 “mixed”; many subsequent variants) Initial computation: r uniform random “steps” ( s 1 ❀ t 1 ) ❀ ✿ ✿ ✿ ❀ ( s r ❀ t r ) ✷ ( Z ❂❵ ) 2 . ❖ ( r log ❵ ) multiplications; negligible if r is small. The “walk”: Starting from ( ① ✐ ❀ ② ✐ ) ✷ ( Z ❂❵ ) 2 compute ( ① ✐ +1 ❀ ② ✐ +1 ) = ( ① ✐ ❀ ② ✐ ) + ( s ❥ ❀ t ❥ ) where ❥ ✷ ❢ 1 ❀ ✿ ✿ ✿ ❀ r ❣ is a hash of ❤ ① ✐ ❣ ② ✐ .

Performance of rho Model walk as truly random. Using ♠ multiplications: ✙ ♠ points ( ① ✐ ❀ ② ✐ ); ✙ ♠ 2 ❂ 2 pairs of points; slope ✕ is missed with chance ✙ (1 � 1 ❂❵ ) ♠ 2 ❂ 2 ✙ exp( � ♠ 2 ❂ (2 ❵ )). Average # multiplications 0 exp( � ♠ 2 ❂ (2 ❵ )) ✙ P ✶ ❘ ✶ exp( � ♠ 2 ❂ (2 ❵ )) ❞♠ ✙ 0 ♣ ♣ ♣ = ✙❂ 4 2 ❵ = (1 ✿ 25 ✿ ✿ ✿ ) ❵ . ♣ Better than (4 ❂ 3 + ♦ (1)) ❵ .

Performance of rho Model walk as truly random. Using ♠ multiplications: ✙ ♠ points ( ① ✐ ❀ ② ✐ ); ✙ ♠ 2 ❂ 2 pairs of points; slope ✕ is missed with chance ✙ (1 � 1 ❂❵ ) ♠ 2 ❂ 2 ✙ exp( � ♠ 2 ❂ (2 ❵ )). Average # multiplications 0 exp( � ♠ 2 ❂ (2 ❵ )) ✙ P ✶ ❘ ✶ exp( � ♠ 2 ❂ (2 ❵ )) ❞♠ ✙ 0 ♣ ♣ ♣ = ✙❂ 4 2 ❵ = (1 ✿ 25 ✿ ✿ ✿ ) ❵ . ♣ Better than (4 ❂ 3 + ♦ (1)) ❵ . Don’t ask about the worst case.

Anti-collisions Bad news: The walk is worse than random. Very often have ( ① ✐ +1 ❀ ② ✐ +1 ) = ( ① ✐ ❀ ② ✐ ) + ( s ❥ ❀ t ❥ ) followed later by ( ① ❦ +1 ❀ ② ❦ +1 ) = ( ① ❦ ❀ ② ❦ ) + ( s ❥ ❀ t ❥ ). Slope from ( ① ❦ +1 ❀ ② ❦ +1 ) to ( ① ✐ +1 ❀ ② ✐ +1 ) is not new: same as slope from ( ① ❦ ❀ ② ❦ ) to ( ① ✐ ❀ ② ✐ ) ✿ Repeated slope: “anti-collision”.

♠ 2 ❂ 2 was too optimistic. About (1 ❂r ) ♠ 2 ❂ 2 pairs use same step, so only (1 � 1 ❂r ) ♠ 2 ❂ 2 chances. This replacement model ✮ ♣ ♣ ♣ ( ✙❂ 2 ❂ 1 � 1 ❂r + ♦ (1)) ❵ . ♣ Can derive 1 � 1 ❂r from more complicated 1981 ♣ Brent–Pollard ❱ heuristic. 1998 Blackburn–Murphy: ♣ explicit 1 � 1 ❂r . 2009 Bernstein–Lange: simplified heuristic; q ❥ ♣ 2 1 � P generalized ❥ .

Higher-degree anti-collisions Actually, rho is even worse! Often have ( ① ✐ +1 ❀ ② ✐ +1 )=( ① ✐ ❀ ② ✐ )+( s ❥ ❀ t ❥ ) ( ① ✐ +2 ❀ ② ✐ +2 )=( ① ✐ +1 ❀ ② ✐ +1 )+( s ❤ ❀ t ❤ ) followed later by ( ① ❦ +1 ❀ ② ❦ +1 )=( ① ❦ ❀ ② ❦ )+( s ❤ ❀ t ❤ ) ( ① ❦ +2 ❀ ② ❦ +2 )=( ① ❦ +1 ❀ ② ❦ +1 )+( s ❥ ❀ t ❥ ) so slope from ( ① ❦ +2 ❀ ② ❦ +2 ) to ( ① ✐ +2 ❀ ② ✐ +2 ) is not new. “Degree-2 local anti-collisions”: 1 � 1 ❂r � 1 ❂r 2 + 1 ❂r 3 . ♣ 1 ❂ See paper for more.

Is rho optimal? Allow r to grow slowly with ❵ . (Not quickly: remember cost of initial computation.) ♣ 1 � 1 ❂r ✦ 1. 1 � 1 ❂r � 1 ❂r 2 + 1 ❂r 3 ✦ 1. ♣ Experimental evidence ✮ ♣ ♣ average ( ✙❂ 2 + ♦ (1)) ❵ . But still have many global anti-collisions: slopes appearing repeatedly.

Two grumpy giants and a baby B: (0 ❀ 0)+ ❢ 0 ❀ ✿ ✿ ✿ ❀ ♥ ❣ (0 ❀ 1). G1: (1 ❀ 0)+ ❢ 0 ❀ ✿ ✿ ✿ ❀ ♥ ❣ (0 ❀ ♥ ). G2: (2 ❀ 0) �❢ 0 ❀ ✿ ✿ ✿ ❀ ♥ ❣ (0 ❀ ♥ +1).

Two grumpy giants and a baby B: (0 ❀ 0)+ ❢ 0 ❀ ✿ ✿ ✿ ❀ ♥ ❣ (0 ❀ 1). G1: (1 ❀ 0)+ ❢ 0 ❀ ✿ ✿ ✿ ❀ ♥ ❣ (0 ❀ ♥ ). G2: (2 ❀ 0) �❢ 0 ❀ ✿ ✿ ✿ ❀ ♥ ❣ (0 ❀ ♥ +1). Minor initial cost: (0 ❀ � ( ♥ + 1)).

Two grumpy giants and a baby B: (0 ❀ 0)+ ❢ 0 ❀ ✿ ✿ ✿ ❀ ♥ ❣ (0 ❀ 1). G1: (1 ❀ 0)+ ❢ 0 ❀ ✿ ✿ ✿ ❀ ♥ ❣ (0 ❀ ♥ ). G2: (2 ❀ 0) �❢ 0 ❀ ✿ ✿ ✿ ❀ ♥ ❣ (0 ❀ ♥ +1). Minor initial cost: (0 ❀ � ( ♥ + 1)). As before can interleave: (0 ❀ 0) ❀ (1 ❀ 0) ❀ (2 ❀ 0) ❀ (0 ❀ 1) ❀ (1 ❀ ♥ ) ❀ (2 ❀ � ( ♥ + 1)) ❀ (0 ❀ 2) ❀ (1 ❀ 2 ♥ ) ❀ (2 ❀ � 2( ♥ + 1)) ❀ (0 ❀ 3) ❀ (1 ❀ 3 ♥ ) ❀ (2 ❀ � 3( ♥ + 1)) ❀ . . . (0 ❀ ♥ ) ❀ (1 ❀ ♥ 2 ) ❀ (2 ❀ � ♥ ( ♥ + 1)).

Grumpy performance ♣ For (1 ✿ 5 + ♦ (1)) ❵ mults: ♣ BSGS, with ♥ ✙ 0 ✿ 75 ❵ ♣ or interleaved with ♥ ✙ ❵ , finds (0 ✿ 5625 + ♦ (1)) ❵ slopes.

Grumpy performance ♣ For (1 ✿ 5 + ♦ (1)) ❵ mults: ♣ BSGS, with ♥ ✙ 0 ✿ 75 ❵ ♣ or interleaved with ♥ ✙ ❵ , finds (0 ✿ 5625 + ♦ (1)) ❵ slopes. Truly random walk finds (0 ✿ 6753 ✿ ✿ ✿ + ♦ (1)) ❵ slopes.