Groups from cyclic infrastructures and Pohlig-Hellman in certain infrastructures

Abstract

In discrete logarithm based cryptography, a method by Pohlig and Hellman allows solving the discrete logarithm problem efficiently if the group order is known and has no large prime factors. The consequence is that such groups are avoided. In the past, there have been proposals for cryptography based on cyclic infrastructures. We will show that the Pohlig-Hellman method can be adapted to certain cyclic infrastructures, which similarly implies that certain infrastructures should not be used for cryptography. This generalizes a result by Müller, Vanstone and Zuccherato for infrastructures obtained from hyperelliptic function fields.We recall the Pohlig-Hellman method, define the concept of a cyclic infrastructure and briefly describe how to obtain such infrastructures from certain function fields of unit rank one. Then, we describe how to obtain cyclic groups from discrete cyclic infrastructures and how to apply the Pohlig-Hellman method to compute absolute distances, which is in general a computationally hard problem for cyclic infrastructures. Moreover, we give an algorithm which allows to test whether an infrastructure satisfies certain requirements needed for applying the Pohlig-Hellman method, and discuss whether the Pohlig-Hellman method is applicable in infrastructures obtained from number fields. Finally, we discuss how this influences cryptography based on cyclic infrastructures. Definition 2.1. Let R ∈ R >0 be a positive real number. A cyclic infrastructure (X, d) of circumference R is a non-empty finite set X with an injective map d : X → R/RZ, called the distance function.Definition 2.2. We say that a cyclic infrastructure (X, d) of circumference R is discrete if R ∈ Z and d(X) ⊆ Z/RZ.One can interpret finite cyclic groups as discrete cyclic infrastructures as follows: Let G = g be a finite cyclic group of order m and d : G → Z/mZ be the discrete logarithm map 1 (to the base g), i.e. we have g d(h) = h for every h ∈ g . By 1 The discrete logarithm of an element h ∈ g is sometimes, in particular in Elementary Number Theory, also called the index of h with respect to g.

The infrastructure of a global field of arbitrary unit rank

“…This shows that our new definition is indeed a generalization of the notion of a one-dimensional infrastructure as in Section 3 or [Fon08].…”

“…This interpretation goes back to Lenstra's work in [Len82]. See also [Fon08] for an earlier treatment of (abstract) one-dimensional infrastructures. The infrastructure essentially offers two operations:…”

“…The idea behind f -representations was described in [Fon08] in the one-dimensional case, i.e., for infrastructures obtained from global fields of unit rank one. The concept of f -representations goes back to (f, p)-representations, which were introduced in the context of cryptography in real quadratic number fields by D. Hühnlein and S. Paulus [HP01] and M. J. Jacobson, Jr., R. Scheidler and H. C. Williams [JSW01].…”

Cryptographic aspects of real hyperelliptic curves

“…However, as the infrastructure is not a group, it is not immediately obvious that similar techniques would work in this setting. F o n t e i n [13], [14] showed that the Pohlig-Hellman algorithm can indeed be adapted to solve the infrastructure discrete logarithm problem, and that, consequently, only hyperelliptic curves whose regulator has a large prime divisor should be used for cryptographic purposes. In particular, Fontein described a concept called f -representations, an explicit method of embedding the elements of the infrastructure into a cyclic group of order R that preserves distances.…”

“…Finally, the infrastructure setting was generalized completely by F o n t e i n in [13], [14]. In addition to independently showing how to embed the infrastructure of a real hyperelliptic curve into a group, Fontein interprets the infrastructures of essentially any function field in a very broad context using Arakelov theory and very reasonable basic assumptions.…”