![](bg4.png)
Z
p
[x]/<h[x]> where h(x) is an irreducible
polynomial over Z
p
[x] .We extend the ElGamal
public-key cryptosystem to the setting of a finite
field. It is well known that
Z
p
[x]/<h[x]> is a field
whose elements are the
congruence classes
modulo h(x) of polynomials in Z
p
[x] with degree
this field by {a
0
+ a
1
x +…+a
n-1
x
n-1
:a
0
,a
1
,…,a
n-1 Є
Z
p
[x]}to be the complete residue system by A(h(x))
.Note that Z
p
[x]/<h[x]> is of order p
n
and its nonzero
elements from a cyclic group denoted by
U(Z
p
[x]/<h[x]>). The order of U (Z
p
[x]/<h[x]>) is
φ (h(x)) = p
n
-1. Let α(x) be a generator of the cyclic
group U (Z
p
[x]/<h[x]>). The elements in U
(Z
p
[x]/<h[x]>) can be written as a power of the
generator α(x). Hence, U (Z
p
[x]/ <h[x]>) = {e, α (x),
α(x)
2
… α (x)
p^n -1
}.
2.3 ElGamal Cryptosystem over
Quotient Rings of Polynomials
over Finite Fields
The ElGamal public-key cryptosystem is also
extended in the setting of the cyclic group of the
finite quotient ring Z
p
[x]/<f(x)>, where p is an odd
prime, and f(x) is a reducible polynomial of degree n
over Z
p
[x] (Smith, 1985). In this case the ring
Z
p
[x]/<f(x)> is not a field. But according to ElGamal
public-key cryptosystem scheme we are only
interested in the cyclic groups of units of such rings.
Hence, throughout this section we are dealing with
any finite fields of order pⁿ, where p is an odd prime
and n is the degree of the reducible polynomial f(x).
From a recent study on the structure of cyclic finite
fields in (El-Kassar, 2002) by El-Kassar, Chihadi,
and Zentout, we can deduce for any finite field F of
order q=pⁿ, where p is a prime integer, the group of
units U (F[x]/<f(x)>) is cyclic and isomorphic to Zq
-
1
if and only if f(x) is linear. Also, U (F[x]/<f(x)>) is
cyclic and isomorphic to Z
p-1
×Z
p
if and only if f(x) =
h(x) ², where h(x) is linear. Hence, we conclude that
in order that the group of units U (Z
p
[x]/<h(x)>) to
be cyclic, h(x) must be irreducible or a square power
of only one linear irreducible polynomial. That is,
h(x) = h
1
(x) ², where h
1
(x) = ax+b. This means that
U (Z
p
[x]/< (ax+b) ²>) is cyclic. Moreover, we have
that Z
p
[x]/ < (ax+b) ²>≅Z
p
[x]/<x²>. Hence, we can
say that the extension of the ElGamal scheme in this
case turns to apply on the group of units of the ring
Z
p
[x]/<x²>, of order φ(x²)=p²-1. We note that a
polynomial f(x) in Z
p
[x] belongs to the cyclic group
U (Z
p
[x]/<x²>) if and only if (f(x), x) = 1. This is
equivalent to saying that x does not divide f(x),
where f(x) is a linear polynomial. Hence,
U (Z
p
[x]/<x²>) = {c+dx|1≤c≤p-1, 0≤d≤p-1}.
For a detailed look at the algorithms of the
extended ElGamal encryption scheme in the domain
of Gaussian integers, finite fields and over quotient
rings of polynomials over finite fields see (Otrok,
2003).
3 ELGAMAL PUBLIC-KEY
SCHEME ATTACK
In order to attack any protocol that uses ElGamal
public-key encryption scheme we have to solve the
discrete logarithm problem. There are many
algorithms for solving the discrete logarithm
problem. The most popular algorithm is the
Exhaustive Search with its baby-step giant-step
algorithm.
3.1 Exhaustive Search
The most obvious algorithm for the discrete
logarithm problem (Menezes, 1997) is to
successively compute α
0
, α¹, α²… until β is obtained.
This method takes O (n) multiplications, where n is
the order of α, and is therefore inefficient if n is
large (i.e., in cases of cryptographic interest). The
algorithm is as follows:
Algorithm 4: Exhaustive Search
INPUT: a generator α of a cyclic group G of
prime order n, and an element β Є G.
OUTPUT: the discrete logarithm x=log
α
β.
1. Set k=0.
2. Set β=α
k
. If β=x
a
then return k.
3. Set k=k+1, then return with new k; 0≤k≤n-1,
until β=x
a
is reached.
3.1.1 Baby-step Giant-step Algorithm
Let m= [√n], where n is the order of α. The baby-
step giant-step algorithm is a time-memory trade-off
of exhaustive search and is based on the following
observation. If β=α
x
, then one can write x=im+j,
where 0≤i,j≤m. Hence, α
x
=α
im
α
j
, which implies
β(α
-m
)
i
=α
j
. This suggests the following algorithm for
computing the discrete logarithm x=log
α
β.
Algorithm 5: The Baby-step algorithm for
computing discrete logarithms
INPUT: a generator α of a cyclic group G of
order n, and an element β € G.
OUTPUT: the discrete logarithm x=log
α
β.
1. Set m= [√n].
2. Construct a table with entries (j, α
j
) for 0≤j≤m.
Sort this table by second component. (Alternatively,
ICEIS 2004 - INFORMATION SYSTEMS ANALYSIS AND SPECIFICATION
82