Computing Discrete Logarithms

Let G be a multiplicatively-written finite cyclic group, let g ∈ G be a generator and let h ∈ G. The discrete logarithm problem (DLP) for (G, g, h) is the computational problem of determining an integer x such that h = gx. Note that the integer x is uniquely determined modulo the group order. Just as for the continuous logarithm function, one also writes x = logg h and refers to x as the discrete logarithm of h to the base g. The DLP has been central to public key cryptography ever since its inception by Diffie and Hellman in 1976 [15], and its study can be traced at least as far back as 1801, when discrete logarithms featured in Gauß’ Disquisitiones Arithmeticae, referred to there as indices with respect to a primitive root modulo a prime [23, art. 57– 60]. Indeed, the multiplicative group Fp of the field Fp of integers modulo a prime p is perhaps the most natural example of a group in which the DLP can be posed – which is presumably why Diffie and Hellman used this setting for their famous key agreement protocol – and it is still believed to be hard for well-chosen primes. In general, if the DLP is hard in a particular group then one can instantiate numerous important cryptographic protocols. So the issue at hand is: how hard is it to compute discrete logarithms in various groups? In this chapter we shall describe some cryptographically relevant DLPs and present some of the key ideas and constructions behind the most efficient algorithms known that solve them. Since the topic encompasses such a large volume of literature, for the finite field DLP we limit ourselves to a selection of results reflecting recent advances in fixed characteristic finite fields. We start by briefly recalling the so-called generic algorithms, which do not exploit any representational properties of group elements and may thus be applied to any finite cyclic group, and then recall the more sophisticated approach known as the index calculus method, which may be applied whenever the representation of elements of a group can be imbued with a suitable notion of smoothness. In §2 we introduce elliptic curves and pairings over finite fields and consider various discrete logarithm algorithms. Then in §3 we consider some groups in which the DLP is easier than for the strongest elliptic curves, including some families of weak curves. In §4 we focus on discrete logarithm algorithms for XTR and algebraic tori when defined over extension fields, and finally in §5 we present some of the key insights behind the breakthroughs between 2012 and 2014 that led to the downfall of finite fields of fixed characteristic in cryptography. First, we introduce some useful notation for describing the running time of discrete logarithm algorithms (or equivalently the complexity or hardness of the DLP),