On the Security of Diffie-Hellman Bits

Boneh and Venkatesan have recently proposed a polynomial time algorithm for recovering a “hidden” element α of a finite field \(\mathbb{F}_p \) of p elements from rather short strings of the most significant bits of the remainder modulo p of αt for several values of t selected uniformly at random from \(\mathbb{F}_p^* \) We use some recent bounds of exponential sums to generalize this algorithm to the case when t is selected from a quite small subgroup of \(\mathbb{F}_p^* \). Namely, our results apply to subgroups of size at least p 1/3+ɛ for all primes p and to subgroups of size at least p ɛ for almost all primes p, for any fixed ɛ > 0. We also use this generalization to improve (and correct) one of the statements of the aforementioned work about the computational security of the most significant bits of the Diffie-Hellman key.