Complexity of a determinate algorithm for the discrete logarithm

Nechaev, V. I.

doi:10.1007/bf02113297

Cited by 163 publications

(94 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It can be one of the following: σ (Generic): This means that the adversary doesn't know anything about the structure (representation) of the underlying algebraic group. More precisely this means that all group elements are represented using a random bijective encoding function σ(·) : Z |G| → G and group operations can only be performed via the addition and inversion oracles σ(x + y) ← σ + (σ(x), σ(y)) and σ(−x) ← σ − (x) respectively, which the adversary receives as a black box [15,22,23].…”

Section: Parameters Of Dl-based Assumptionsmentioning

confidence: 99%

Assumptions Related to Discrete Logarithms: Why Subtleties Make a Real Difference

Sadeghi

Steiner

2001

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The security of many cryptographic constructions relies on assumptions related to Discrete Logarithms (DL), e.g., the Diffie-Hellman, Square Exponent, Inverse Exponent or Representation Problem assumptions. In the concrete formalizations of these assumptions one has some degrees of freedom offered by parameters such as computational model, the problem type (computational, decisional) or success probability of adversary. However, these parameters and their impact are often not properly considered or are simply overlooked in the existing literature. In this paper we identify parameters relevant to cryptographic applications and describe a formal framework for defining DL-related assumptions. This enables us to precisely and systematically classify these assumptions. In particular, we identify a parameter, termed granularity, which describes the underlying probability space in an assumption. Varying granularity we discover the following surprising result: We prove that two DLrelated assumptions can be reduced to each other for medium granularity but we also show that they are provably not reducible with generic algorithms for high granularity. Further we show that reductions for medium granularity can achieve much better concrete security than equivalent high-granularity reductions.

show abstract

Section: Parameters Of Dl-based Assumptionsmentioning

confidence: 99%

Assumptions Related to Discrete Logarithms: Why Subtleties Make a Real Difference

Sadeghi

Steiner

2001

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Indeed, Nechaev and then Shoup [19,25] have proven that any probabilistic algorithm that can solve the discrete logarithm with a non-negligible success probability in a group of prime order p requires to perform at least Ω( √ p) group-operations.…”

Section: Theorem 4 (Pohlig-hellmanmentioning

confidence: 99%

Integer factorization and discrete logarithm problems

Gaudry¹

2014

Cours du CIRM

View full text Add to dashboard Cite

“…In a restricted model one assumes that only certain kinds of operations are allowed. Shoup [23], based on the work of Nechaev [20], introduced the concept of generic algorithms which are algorithms that do not exploit any property of the representation of the elements. They proved lower bounds on the complexity of computing discrete logarithms in cyclic groups in the context of generic algorithms.…”

Section: Breaking Rsa Vs Factoringmentioning

confidence: 99%

Breaking RSA Generically Is Equivalent to Factoring

Aggarwal

Maurer

2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We show that a generic ring algorithm for breaking RSA in ZN can be converted into an algorithm for factoring the corresponding RSA-modulus N . Our results imply that any attempt at breaking RSA without factoring N will be non-generic and hence will have to manipulate the particular bit-representation of the input in ZN . This provides new evidence that breaking RSA may be equivalent to factoring the modulus.

show abstract

Complexity of a determinate algorithm for the discrete logarithm

Cited by 163 publications

References 3 publications

Assumptions Related to Discrete Logarithms: Why Subtleties Make a Real Difference

Assumptions Related to Discrete Logarithms: Why Subtleties Make a Real Difference

Integer factorization and discrete logarithm problems

Breaking RSA Generically Is Equivalent to Factoring

Contact Info

Product

Resources

About