The discrete logarithm problem for exponents of bounded height

Abstract

Let G be a cyclic group written multiplicatively (and represented in some concrete way). Let n be a positive integer (much smaller than the order of G). Let g, h ∈ G. The bounded height discrete logarithm problem is the task of finding positive integers a and b (if they exist) such that a n, b n and g a = h b . (Provided that b is coprime to the order of g,where a/b is a rational number of height at most n. This motivates the terminology.) The paper provides a reduction to the two-dimensional discrete logarithm problem, so the bounded height discrete logarithm problem can be solved using a low-memory heuristic algorithm for the two-dimensional discrete logarithm problem due to Gaudry and Schost. The paper also provides a low-memory heuristic algorithm to solve the bounded height discrete logarithm problem in a generic group directly, without using a reduction to the two-dimensional discrete logarithm problem. This new algorithm is inspired by (but differs from) the GaudrySchost algorithm. Both algorithms use O(n) group operations, but the new algorithm is faster and simpler than the Gaudry-Schost algorithm when used to solve the bounded height discrete logarithm problem. Like the Gaudry-Schost algorithm, the new algorithm can easily be carried out in a distributed fashion.The bounded height discrete logarithm problem is relevant to a class of attacks on the privacy of a key establishment protocol recently published by EMVCo for comment. This protocol is intended to protect the communications between a chip-based payment card and a terminal using elliptic curve cryptography. The paper comments on the implications of these attacks for the design of any final version of the EMV protocol.

Collision of Random Walks and a Refined Analysis of Attacks on the Discrete Logarithm Problem

“…For instance, a parallelized Pollard's Rho method was used in an attack on Certicom's challenge problem ECC2K-130 [2], while an attack based on Gaudry-Schost was used to break a proposed EMVco protocol to replace the chip-and-pin system used in over 1.6 billion payments cards [3].…”

Modified Gaudry-Schost algorithm for the two-dimensional discrete logarithm problem

“…Two-dimensional discrete logarithm problem arises in a number of contexts, for example, in the computation of the group order of the Jacobian of curves [9], in the complexity analysis of solving the discrete logarithm problem for exponents of bounded height [2]. In general case, the Gaudry-Schost algorithm [9] is the most efficient algorithm for solving the two-dimensional discrete logarithm problem.…”