2

Here is a DLP exercice

$g = 51234,\; h = 90403 ,\; N = 311 \cdot 359 = 111649$.

Define $r$ as the smallest positive integer with $g^r \equiv h \pmod N$.

Define $s$ as the smallest positive integer with $h^s \equiv g \pmod N$.

(Here, $r=33497$ and $s=27663$ ).

Questions:

If one looses some bits of $(r,s)$ can they be recovered? (do not use brute-force attack)

In other words: with the following information:

$\quad g=51234,\; h=90403,\; N=311 \cdot 359 = 111649\\ \quad r=3@497,\; s=276@3$

how can one recover the missing digits '$@$' ?

Editor's note: It emerged this is part of a complete problem.
The original statement is ambiguous about the minimality of $s$, has a typo in the value of $N$, and uses $\mathrm{gr}$ and $\mathrm{hr}$ where there is now $r$ and $s$, per the notation in this answer.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
  • I think normally this kind of problem is solved by the appropriate application of lattice magic. I also think that maybe some of the RSA-based results of "given a fraction of the private key, recover the full private key" may apply here. – SEJPM Jul 07 '18 at 08:44
  • I observe that given the factorization of $N$, the problem can be solved with $g$ and $h$ unknown, including with $N$ thousands of bits. However I'm uncertain about if that's what the problem's author had in mind. – fgrieu Jul 07 '18 at 09:09

1 Answers1

2

I suppose (for simplicity but it can be generalized I think) that the missings bits of $r$ and $s$ are the least significant bits. So, we have: $$ \begin{array}{lll} r = r_12^u + r_0&\text{with}&g^r \equiv h \pmod N \\ s = s_12^v + s_0&\text{with}&h^s \equiv g \pmod N, \end{array} $$ with $r_0 < 2^u$ and $s_0 < 2^v$ unknown.

Using the relation between $g$ and $h$, we can get the following relation: $$ h^{rs-1} = 1 \mod N. $$ The order of the multiplicative group $\mathbb Z/N\mathbb Z$ is $\varphi(N)$. Given the factorization of $N$, as in your example, this value is known and there exists $k\in\mathbb Z$ such that: $$ rs - 1 = k \varphi(N). $$ Let's call $x$ and $y$ the unknown part of $r$ and $s$ and we look at the precedent equation mod $\varphi(N)$ to get rid of $k$ and we have an equation in two variables: $$ (r_12^u +x)(s_12^v + y) - 1\equiv 0 \mod \varphi(N). $$ If the size of the unknwown part of $r$ and $s$ are not too big, then the Coppersmith technique in two variables (using lattice) may be used to recover those part. Lot of information here.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
corpsfini
  • 36
  • 1
  • To generalize to missing bits in arbitrary position, simply write $r=r_0;2^u+r_1$ with $u$ the position of the rightmost missing bits, unknown $r_0<2^k$ where $k$ is the number of missing bits, and $r_1$ is $r$ with the unknown bits replaced by $0$. When the missing portion is in decimal as in the example, change $2$ to $10$. Interestingly, this does not use the values of $g$ and $h$. When the factorization of $N$ is unknown (and $g$ and $h$ known), solving the DLP by the Baby Step/Giant Step requires effort $O(2^{k/2})$ modular multiplications, and might be simpler. – fgrieu Jul 07 '18 at 19:02