Cryptography Stack Exchange
Cryptography Stack Exchange

Questions tagged [discrete-logarithm]

In cryptography, a discrete logarithm is the number of times a generator of a group must be multiplied by itself to produce a known number. By choosing certain groups, the task of finding a discrete logarithm can be made intractable.

In cryptography, a discrete logarithm is the number of times a generator of a group must be multiplied by itself to produce a known number. By choosing certain groups, the task of finding a discrete logarithm can be made intractable. Many cryptographic primitives and protocols have security reductions to the discrete logarithm or related problems.

While finding discrete logarithms is hard on a classical computer, quantum computers can find them efficiently.

637 questions
34
votes
2 answers

Hardness of finding mutual discrete logarithms of small generators in $\mathbb{Z}_p$

Suppose you want to select a prime $p$ such that finding e.g. $\log_2(3)$ in $\mathbb{Z}_p$ is expected to be either at least as hard as the general Discrete Logarithm Problem in $\mathbb{Z}_p$, or at least both problems infeasible, e.g. because you…
Henrick Hellström
  • 10,406
  • 1
  • 30
  • 58
18
votes
2 answers

Why is the discrete logarithm problem assumed to be hard?

This might be a quite stupid question: since a naive brute force algorithm to solve the discrete logarithm problem will only take O(n) time for a group G with order n, why is it assumed to be hard to solve? Doesn't hard mean no polynomial algorithm…
Boyu Fang
  • 447
  • 1
  • 5
  • 13
13
votes
1 answer

How much do we trust KEA1 Assumption?

Let $$(g,h=g^s,q)$$ be a tuple such that $g$ is a generator for a group $\mathbb{G}$ of ord $q$ and $s$ is uniformly random in $\mathbb{Z}_q$. The knowledge of exponent (KEA1) assumption says that for any adversary $\mathcal{A}(g,h,q)$ that outputs…
AntonioFa
  • 448
  • 4
  • 8
8
votes
2 answers

How to test if a number is a primitive root?

How to test if a number is a primitive root, assuming the $\text{mod}\enspace m$ where $m$ is a prime? And if not? Is it not enough if the number is relatively prime to the modulus or prime? I'll write down what I've done and would like to know if…
Smit Johnth
  • 1,681
  • 4
  • 17
  • 27
8
votes
1 answer

Simultaneous Discrete Logarithm with Small Exponent

Given two distinct safe primes $p_1 = 2 \cdot q_1 + 1$, $p_2 = 2 \cdot q_2 +1$, consider the following two instances of the discrete logarithm problem with the same unknown exponent $x$. $$ g_1^x \equiv y_1 \mod p_1 $$ $$ g_2^x \equiv y_2 \mod p_2…
robertkin
  • 428
  • 2
  • 11
7
votes
5 answers

discrete logarithm equality for independent groups

Given two different safe primes $p_1$, $p_2$ we construct the subgroups $G_1$ of prime order $q_1 = \frac{p_1-1}{2}$ and $G_2$ of prime order $q_2 = \frac{p_2-1}{2}$. Let $g_1$ be a generator of $G_1$ and $g_2$ be a generator of $G_2$. We assume…
raisyn
  • 481
  • 4
  • 15
6
votes
3 answers

Why is NON DISCRETE logarithm problem not hard as the DISCRETE logarithm problem (so computationally hard)?

I've already read this question about the difference between discrete and non discrete logarithms. But I still have problems to clarify my mind about why the Discrete Logarithm Problem is computationally hard while the NON Discrete Logarithm Problem…
ela
  • 347
  • 2
  • 12
5
votes
1 answer

Sage vs. Magma on DLP

Generally speaking, Magma is faster than Sage on several crypto-related computations, however, I have encountered a DLP instance where Sage is significantly faster than Magma. Take the DLP over $GF(p)$ defined as: > p :=…
blah blah
  • 51
  • 2
4
votes
1 answer

calculating a group element in a discrete log problem

An encryption scheme is based on the DLP: $c = a^x mod ~b$, where $x$ is hard to find. How hard is it to find $a$, given all the other values, $c$, $x$ and $b$? Would this make the problem easy to solve? $c^{1/x} = (a^x)^{1/x} mod ~b$ An example…
user123
  • 41
  • 1
4
votes
1 answer

What is the difference between discrete logarithm and natural logarithm?

Why we take (base $e$) and (base 2) in natural and discrete logarithm, respectively? I do not understand the difference between these two concepts.
pftpmlp
  • 77
  • 1
  • 4
4
votes
2 answers

How can I solve the discrete logarithm modulo 2q+1 if I can solve it in the subgroup of order q?

As part of my cryptography course I came across an exercise that neither me or my friends could figure out. The problem statement is as follows: Let $p$ be a large prime of the form $p = 2q + 1$ with $q$ also prime. Let $g$ be a generator of…
bambinoh
  • 43
  • 4
4
votes
0 answers

Is the reverse of the “discrete logarithm problem” equally dificult?

It is not easy to understand why this becomes a hard problem. The discrete logarithm problem as defined here: “any integer k that solves $b^k = \{g\mod{n}\}$ is termed a discrete logarithm” i.e.: Finding an integer $k$ for $b$ and $g$ known in…
user23728
3
votes
1 answer

ElGamal discrete logarithm method to send keys

In my criptography course I was given the following exercise: ElGamal proposed the following digital signature scheme using discrete logarithms over a field $\mathbb{F}_p$, where $p$ is a large prime. Step 1) Everybody agrees on a prime $p$ and a…
Marcos
  • 133
  • 4
3
votes
2 answers

Discrete Logarithm in a specific group

I am considering a setting similar to the one of the Paillier cryptosystem, where we sample two distinct odd primes $p,q$, we set $n=pq$, we generate $a \leftarrow \mathbb{Z}_{n^2}^*$ and finally we set $g = (n+1) a^n \mod{n^2}$. My question now is…
Cip Baetu
  • 31
  • 2
3
votes
2 answers

Probability that an attacker wins the discrete logarithm game when exponents are drawn from a subset

Suppose $g$ is a generator of an order $p$ cyclic group in which discrete logarithm is hard and $p$ is a prime (i.e., given $g^x$ for a random $x \in \{0,1,\ldots, p-1\}$, it is hard to recover $x$ except with $negl(\lambda)$, where $negl(\lambda)$…
user52914
  • 43
  • 6
1
2 3 4 5