![](bg2.png)
G and this means p|(a −b) which implies that a = b
(mod p).
The usefulness of this lemma is to be able to de-
cide on the equality in F
×
p
by looking at the equality in
G. The following algorithm to solve the discrete loga-
rithm problem uses the order of the discrete logarithm
in the multiplicative group of a finite field. This algo-
rithm is also deterministic but this is different from the
baby-step giant-step (Hoffstein et al., 2008) as it uses
the implicit representation with multiplicative group
of a finite field as auxiliary group.
Theorem 1. Let G be an additive cyclic group gen-
erated by P and order of P is a prime p. Let Q = xP
be another given element of G(x is unknown). For a
given divisor d of p −1, let H be the unique subgroup
of F
×
p
of order d. Then, one can decide whether or
not x belongs to H in O(
√
d) steps. Furthermore, if
x belongs to H, the same algorithm will also find the
discrete logarithm x in O(
√
d) steps where each step
is an exponentiation in the group G.
Proof. Since H is a subgroup of the cyclic group F
×
p
,
we assume that it is generated by some element ζ. If
the generator of H is not given to us, we can com-
pute it using a generator of F
×
and d. The proof
of whether x belongs to H or not follows from the
well-known baby-step giant-step algorithm (Hoff-
stein et al., 2008, Proposition 2.22) to compute the
discrete logarithm.
Let n be the smallest integer greater than
√
d.
Then x ∈H if and only if there exists an integer k with
0 ≤k ≤d such that x = ζ
k
(mod p). Note that any in-
teger k between 0 and d can be written as k = an −b
for unique integers a, b with 0 ≤ a,b ≤ n, by division
algorithm. Therefore, x ∈ H if and only if there exist
two integers a,b with 0 ≤ a, b ≤n such that x = ζ
an−b
(mod p), or equivalently ζ
b
x = ζ
n
a
(mod p). Using
the lemma above, we see that x ∈ H if and only if
there exist two integers a,b with 0 ≤a,b ≤n such that
ζ
b
xP = ζ
n
a
P, equivalently ζ
b
Q = (ζ
n
)
a
P as Q = xP.
Now, we create a list
ζ
b
Q : 0 ≤b ≤n
. Then
we generate elements of the form (ζ
n
)
a
P for each in-
teger a in [0,n] and try to find a collision with the ear-
lier list. When there is a collision, i.e., ζ
b
Q = (ζ
n
)
a
P
for some 0 ≤a, b ≤n, it means that x ∈H. Otherwise,
x /∈ H.
Moreover, if x ∈ H then ζ
b
Q = (ζ
n
)
a
P for some
0 ≤a, b ≤n. So, we use the integers a and b to com-
pute ζ
an−b
(mod p) which is nothing but the discrete
logarithm x. Since the two lists require computation
of at most 2n exponentiations, the worst case time
complexity of the algorithm to check whether or not
x ∈ H, as well as to compute x(if x ∈ H) would be
O(n) ≈ O(
√
d) steps. This completes the proof.
2.1 Comparing Our Work with Usual
Baby-step Giant-step Algorithm
The similarity between Theorem 1 and usual baby-
step giant-step is that both use division algorithm.
However, the main difference between the two lies in
its actual application: division algorithm is applied on
the discrete logarithm x in the usual baby-step giant-
step whereas the division algorithm is used on the
exponent k(of the discrete logarithm x) in Theorem
1. Irrespective of the above difference, Theorem 1
works as a generic deterministic attack on DLP(just
like baby-step giant-step) in the sense that such a sub-
group H always exists. For example, one can always
take H = F
×
p
as the worst-case scenario in Theorem
1, and then the(worst-case) complexity of Theorem 1
is O(
√
p −1) = O(
√
p), same as the usual baby-step
giant-step algorithm.
2.2 Practical Implications of the
Deterministic Attack of Theorem 1
The main practical advantage of the attack presented
in Theorem 1 is that the cost of our attack can be
far less than O(
√
p) if it is known to an attacker that
the discrete logarithm x lies in some proper, relatively
smaller subgroup H of F
×
p
. For example, if x lies in H
with |H| ≈
√
p, then the attack in Theorem 1 solves
the DLP in O(
4
√
p) which is a lot faster than the best-
known generic attacks on DLP.
There is another security issue that above theo-
rem brings to the fore. We take the example of NIST
curves defined over prime fields of different size viz.
P-192, P-224, 256, P-384, P-521 and p denotes the
respective prime order of the curves. Since the above
algorithm depends on d and p −1 factors into small
divisors, the above theorem is applicable to each of
the five NIST curves(NIST, 2000). Although, one can
say that probability of randomly chosen secret x being
inside a particular subgroup of F
×
p
can be very small,
the availability of so many divisors d of p −1 of dif-
ferent sizes itself is not a desirable security feature
from the cryptographic point of view and it is always
a sound security practice to exclude any such proba-
bility, however small. Therefore, as a security neces-
sity, it is highly recommended that p −1 should be
of the form k · p
0
for a very small value of k and some
prime p
0
so that above algorithm does not provide any
faster attack on DLP than the generic attacks.
Remark 1. Even though the above algorithm is
generic in nature, it does have a practical signifi-
cance. Our algorithm applies on all the five prime
order NIST curves (NIST, 2000) viz. P-192, P-224,
SECRYPT 2017 - 14th International Conference on Security and Cryptography
402