1

This describes a way of proving CDH <=> and Square-DH. The thing I don't get - how to efficiently compute $\operatorname{CDH}(U,V)$ from $\operatorname{CDH}(U,V)^2$. Isn't square root problem is hard in general? (In case of composite order fields for example). As far as I understand computing square root is as hard as factorization of $N$, where $|G| = N$ which can be hard in non prime order group.

So what am I missing here?

zma
  • 43
  • 6
  • Note that the two CDH expressions are not exponents but rather normal field elements, which makes it rather easy for the prime field case (I didn't yet figure it out for the general cyclic group of known order case). – SEJPM Jul 17 '16 at 18:35
  • 1
    Since the proposed reduction relies on computing square roots, it will only work in groups where square roots can be computed, such as any group of known odd order. So you are not missing anything. – K.G. Jul 17 '16 at 19:50
  • I suggest the paper Faster square roots in annoying finite fields from D. Bernstein, where various algorithms for discrete roots in finite fields of arbitrary odd order are discussed – tylo Jul 18 '16 at 12:25
  • Note that the question you linked starts with a false premise: that if you can solve CDH in general (i.e., on uniformly chosen inputs $(g^a,g^b)$), then you can solve it on inputs $(g^a,g^a)$. That is false; it is perfectly possible that you CDH algorithm fails on all inputs $(g^a,g^a)$, even if it succeeds in general. – fkraiem Aug 28 '19 at 17:42

1 Answers1

2

This is a matter of computing square roots in $\mathbb Z/p\mathbb Z$.

  • If $p \equiv 3 \pmod 4$ is prime and $a$ is a quadratic residue so that the Legendre symbol $(a|p) \equiv a^{(p - 1)/2} \pmod p$ is 0 or 1, then $4 \mid p + 1$ and $$\bigl(\pm a^{(p + 1)/4}\bigr)^2 \equiv a^{(p + 1)/2} \equiv a^{(p - 1)/2 + 1} \equiv a^{(p - 1)/2} a \equiv a \pmod p.$$ Consequently, the square roots of $a$ are $\pm a^{(p + 1)/2}$. (If the Legendre symbol $(a|p)$ is -1, then $a$ is not a quadratic residue.)

  • If $p \equiv 5 \pmod 8$ is prime, then either $\pm a^{(p + 3)/8}$ or $\pm a^{(p + 3)/8} 2^{(p - 1)/4}$ are the square roots of $a$, depending on whether $a$ is a quartic residue modulo $p$ or not. Proof left as an exercise for the reader.

  • If $p \equiv 1 \pmod 8$ is prime, then there's no nice closed-form expression or deterministic algorithm for computing square roots in $\mathbb Z/p\mathbb Z$, but the Tonelli–Shanks or Cipolla algorithms can do it in constant expected number of multiplications in $\mathbb Z/p\mathbb Z$.

  • If $p$ is not prime, then finding square roots modulo $p$ is as hard as factoring $p$. But in discrete log systems, we usually worry about prime moduli. Proving relations between DLOG, CDH, SDH, SQRT, and FACTOR for a composite modulus is left as an exercise for the reader.

Squeamish Ossifrage
  • 48,392
  • 3
  • 116
  • 223