Two grumpy giants and a baby D. J. Bernstein University of - - PDF document

▶

May 21, 2023 277 likes •837 views

Two grumpy giants and a baby D. J. Bernstein University of Illinois at Chicago Tanja Lange Technische Universiteit Eindhoven Discrete-logarithm problems Fix a prime . Input: generator of group of order ; element of same group.

SLIDE 1

Two grumpy giants and a baby

D. J. Bernstein

University of Illinois at Chicago Tanja Lange Technische Universiteit Eindhoven

SLIDE 2

Discrete-logarithm problems Fix a prime ❵. Input: generator ❣

f group of order ❵;

element ❤ of same group. Output: integer ❦ ✷ Z❂❵ such that ❤ = ❣❦, where group is written multiplicatively. “❦ = log❣ ❤”. How difficult is computation of ❦?

SLIDE 3

Generic algorithms Will focus on algorithms that work for every group of order ❵. Allowed operations: neutral element 1; multiplication ❛❀ ❜ ✼✦ ❛❜. Will measure algorithm cost by counting # multiplications. Success probability: average over groups and over algorithm randomness.

SLIDE 4

Each group element computed by the algorithm is trivially expressed as ❤①❣② for known (①❀ ②) ✷ (Z❂❵)2. 1 = ❤①❣② for (①❀ ②) = (0❀ 0). ❣ = ❤①❣② for (①❀ ②) = (0❀ 1). ❤ = ❤①❣② for (①❀ ②) = (1❀ 0). If algorithm multiplies ❤①1❣②1 by ❤①2❣②2 then it obtains ❤①❣② where (①❀ ②) = (①1❀ ②1) + (①2❀ ②2).

SLIDE 5

Slopes If ❤①1❣②1 = ❤①2❣②2 and (①1❀ ②1) ✻= (①2❀ ②2) then log❣ ❤ is the negative

f the slope (②2 ②1)❂(①2 ①1).

(Impossible to have ①1 = ①2: if ①1 = ①2 then ❣②1 = ❣②2 so ②1 = ②2, contradiction.) Algorithm immediately recognizes collisions of group elements by putting each (❤①❣②❀ ①❀ ②) into, e.g., a red-black tree. (Low memory? Parallel? Distributed? Not in this talk.)

SLIDE 6

Baby-step-giant-step (1971 Shanks) Choose ♥ ✕ 1, typically ♥ ✙ ♣ ❵. Points (①❀ ②): ♥ + 1 “baby steps” (0❀ 0)❀ (0❀ 1)❀ (0❀ 2)❀ ✿ ✿ ✿ ❀ (0❀ ♥); ♥ + 1 “giant steps” (1❀ 0)❀ (1❀ ♥)❀ (1❀ 2♥)❀ ✿ ✿ ✿ ❀ (1❀ ♥2). Can use more giant steps. Stop when log❣ ❤ is found.

SLIDE 7

Performance of BSGS Slope ❥♥✐ from (0❀ ✐) to (1❀ ❥♥). Covers slopes ✟ ♥❀ ✿ ✿ ✿ ❀ 1❀ 0❀ 1❀ 2❀ 3❀ ✿ ✿ ✿ ❀ ♥2✠ , using 2♥ 1 multiplications. Finds all discrete logarithms if ❵ ✔ ♥2 + ♥ + 1. Worst case with ♥ ✙ ♣ ❵: (2 + ♦(1)) ♣ ❵ multiplications. (In fact always ❁ 2 ♣ ❵.) Average case with ♥ ✙ ♣ ❵: (1✿5 + ♦(1)) ♣ ❵ multiplications.

SLIDE 8

Interleaving (2000 Pollard) Improve average case to (4❂3 + ♦(1)) ♣ ❵ multiplications: (0❀ 0)❀ (1❀ 0)❀ (0❀ 1)❀ (1❀ ♥)❀ (0❀ 2)❀ (1❀ 2♥)❀ (0❀ 3)❀ (1❀ 3♥)❀ . . . (0❀ ♥)❀ (1❀ ♥2). 4❂3 arises as ❘ 1

0 (2①)2 ❞①.

SLIDE 9

Interleaving (2000 Pollard) Improve average case to (4❂3 + ♦(1)) ♣ ❵ multiplications: (0❀ 0)❀ (1❀ 0)❀ (0❀ 1)❀ (1❀ ♥)❀ (0❀ 2)❀ (1❀ 2♥)❀ (0❀ 3)❀ (1❀ 3♥)❀ . . . (0❀ ♥)❀ (1❀ ♥2). 4❂3 arises as ❘ 1

0 (2①)2 ❞①.

Oops: Have to start with (0❀ ♥) as step towards (1❀ ♥). But this costs only ❖(log ❵).

SLIDE 10

Is BSGS optimal? After ♠ multiplications have ♠ + 3 points in (Z❂❵)2. Can hope for (♠ + 3)(♠ + 2)❂2 different slopes in Z❂❵.

SLIDE 11

Is BSGS optimal? After ♠ multiplications have ♠ + 3 points in (Z❂❵)2. Can hope for (♠ + 3)(♠ + 2)❂2 different slopes in Z❂❵. 1994 Nechaev, 1997 Shoup: proof that generic algorithms have success probability ❖(♠2❂❵). Proof actually gives ✔ ((♠ + 3)(♠ + 2)❂2 + 1)❂❵.

SLIDE 12

Is BSGS optimal? After ♠ multiplications have ♠ + 3 points in (Z❂❵)2. Can hope for (♠ + 3)(♠ + 2)❂2 different slopes in Z❂❵. 1994 Nechaev, 1997 Shoup: proof that generic algorithms have success probability ❖(♠2❂❵). Proof actually gives ✔ ((♠ + 3)(♠ + 2)❂2 + 1)❂❵. BSGS: at best ✙ ♠2❂4 slopes, taking ♥ ✙ ♠❂2. Factor of 2 away from the bound.

SLIDE 13

The rho method (1978 Pollard, r = 3 “mixed”; many subsequent variants) Initial computation: r uniform random “steps” (s1❀ t1)❀ ✿ ✿ ✿ ❀ (sr❀ tr) ✷ (Z❂❵)2. ❖(r log ❵) multiplications; negligible if r is small. The “walk”: Starting from (①✐❀ ②✐) ✷ (Z❂❵)2 compute (①✐+1❀ ②✐+1) = (①✐❀ ②✐) + (s❥❀ t❥) where ❥ ✷ ❢1❀ ✿ ✿ ✿ ❀ r❣ is a hash of ❤①✐❣②✐.

SLIDE 14

SLIDE 15

SLIDE 16

SLIDE 17

SLIDE 18

SLIDE 19

SLIDE 20

SLIDE 21

SLIDE 22

SLIDE 23

SLIDE 24

SLIDE 25

SLIDE 26

SLIDE 27

SLIDE 28

SLIDE 29

SLIDE 30

SLIDE 31

SLIDE 32

SLIDE 33

SLIDE 34

SLIDE 35

SLIDE 36

SLIDE 37

SLIDE 38

SLIDE 39

SLIDE 40

SLIDE 41

SLIDE 42

SLIDE 43

Performance of rho Model walk as truly random. Using ♠ multiplications: ✙ ♠ points (①✐❀ ②✐); ✙ ♠2❂2 pairs of points; slope ✕ is missed with chance ✙ (1 1❂❵)♠2❂2 ✙ exp(♠2❂(2❵)). Average # multiplications ✙ P✶

0 exp(♠2❂(2❵))

✙ ❘ ✶ exp(♠2❂(2❵)) ❞♠ = ♣ ✙❂4 ♣ 2❵ = (1✿25 ✿ ✿ ✿) ♣ ❵. Better than (4❂3 + ♦(1)) ♣ ❵.

SLIDE 44

Performance of rho Model walk as truly random. Using ♠ multiplications: ✙ ♠ points (①✐❀ ②✐); ✙ ♠2❂2 pairs of points; slope ✕ is missed with chance ✙ (1 1❂❵)♠2❂2 ✙ exp(♠2❂(2❵)). Average # multiplications ✙ P✶

0 exp(♠2❂(2❵))

✙ ❘ ✶ exp(♠2❂(2❵)) ❞♠ = ♣ ✙❂4 ♣ 2❵ = (1✿25 ✿ ✿ ✿) ♣ ❵. Better than (4❂3 + ♦(1)) ♣ ❵. Don’t ask about the worst case.

SLIDE 45

Anti-collisions Bad news: The walk is worse than random. Very often have (①✐+1❀ ②✐+1) = (①✐❀ ②✐) + (s❥❀ t❥) followed later by (①❦+1❀ ②❦+1) = (①❦❀ ②❦) + (s❥❀ t❥). Slope from (①❦+1❀ ②❦+1) to (①✐+1❀ ②✐+1) is not new: same as slope from (①❦❀ ②❦) to (①✐❀ ②✐)✿ Repeated slope: “anti-collision”.

SLIDE 46

♠2❂2 was too optimistic. About (1❂r)♠2❂2 pairs use same step, so only (1 1❂r)♠2❂2 chances. This replacement model ✮ ( ♣ ✙❂2❂ ♣ 1 1❂r + ♦(1)) ♣ ❵. Can derive ♣ 1 1❂r from more complicated 1981 Brent–Pollard ♣ ❱ heuristic. 1998 Blackburn–Murphy: explicit ♣ 1 1❂r. 2009 Bernstein–Lange: simplified heuristic; generalized q 1 P

❥ ♣2 ❥.

SLIDE 47

Higher-degree anti-collisions Actually, rho is even worse! Often have (①✐+1❀ ②✐+1)=(①✐❀ ②✐)+(s❥❀ t❥) (①✐+2❀ ②✐+2)=(①✐+1❀ ②✐+1)+(s❤❀ t❤) followed later by (①❦+1❀ ②❦+1)=(①❦❀ ②❦)+(s❤❀ t❤) (①❦+2❀ ②❦+2)=(①❦+1❀ ②❦+1)+(s❥❀ t❥) so slope from (①❦+2❀ ②❦+2) to (①✐+2❀ ②✐+2) is not new. “Degree-2 local anti-collisions”: 1❂ ♣ 1 1❂r 1❂r2 + 1❂r3. See paper for more.

SLIDE 48

Is rho optimal? Allow r to grow slowly with ❵. (Not quickly: remember cost of initial computation.) ♣ 1 1❂r ✦ 1. ♣ 1 1❂r 1❂r2 + 1❂r3 ✦ 1. Experimental evidence ✮ average ( ♣ ✙❂2 + ♦(1)) ♣ ❵. But still have many global anti-collisions: slopes appearing repeatedly.

SLIDE 49

Two grumpy giants and a baby B: (0❀ 0)+❢0❀ ✿ ✿ ✿ ❀ ♥❣(0❀ 1). G1: (1❀ 0)+❢0❀ ✿ ✿ ✿ ❀ ♥❣(0❀ ♥). G2: (2❀ 0)❢0❀ ✿ ✿ ✿ ❀ ♥❣(0❀ ♥+1).

SLIDE 50

Two grumpy giants and a baby B: (0❀ 0)+❢0❀ ✿ ✿ ✿ ❀ ♥❣(0❀ 1). G1: (1❀ 0)+❢0❀ ✿ ✿ ✿ ❀ ♥❣(0❀ ♥). G2: (2❀ 0)❢0❀ ✿ ✿ ✿ ❀ ♥❣(0❀ ♥+1). Minor initial cost: (0❀ (♥ + 1)).

SLIDE 51

Two grumpy giants and a baby B: (0❀ 0)+❢0❀ ✿ ✿ ✿ ❀ ♥❣(0❀ 1). G1: (1❀ 0)+❢0❀ ✿ ✿ ✿ ❀ ♥❣(0❀ ♥). G2: (2❀ 0)❢0❀ ✿ ✿ ✿ ❀ ♥❣(0❀ ♥+1). Minor initial cost: (0❀ (♥ + 1)). As before can interleave: (0❀ 0)❀ (1❀ 0)❀ (2❀ 0)❀ (0❀ 1)❀ (1❀ ♥)❀ (2❀ (♥ + 1))❀ (0❀ 2)❀ (1❀ 2♥)❀ (2❀ 2(♥ + 1))❀ (0❀ 3)❀ (1❀ 3♥)❀ (2❀ 3(♥ + 1))❀ . . . (0❀ ♥)❀ (1❀ ♥2)❀ (2❀ ♥(♥ + 1)).

SLIDE 52

Grumpy performance For (1✿5 + ♦(1)) ♣ ❵ mults: BSGS, with ♥ ✙ 0✿75 ♣ ❵

r interleaved with ♥ ✙

♣ ❵, finds (0✿5625 + ♦(1))❵ slopes.

SLIDE 53

Grumpy performance For (1✿5 + ♦(1)) ♣ ❵ mults: BSGS, with ♥ ✙ 0✿75 ♣ ❵

r interleaved with ♥ ✙

♣ ❵, finds (0✿5625 + ♦(1))❵ slopes. Truly random walk finds (0✿6753 ✿ ✿ ✿ + ♦(1))❵ slopes.

SLIDE 54

Grumpy performance For (1✿5 + ♦(1)) ♣ ❵ mults: BSGS, with ♥ ✙ 0✿75 ♣ ❵

r interleaved with ♥ ✙

♣ ❵, finds (0✿5625 + ♦(1))❵ slopes. Truly random walk finds (0✿6753 ✿ ✿ ✿ + ♦(1))❵ slopes. Two grumpy giants and a baby, with ♥ ✙ 0✿5 ♣ ❵, find (0✿71875 + ♦(1))❵ slopes.

SLIDE 55

Grumpy performance For (1✿5 + ♦(1)) ♣ ❵ mults: BSGS, with ♥ ✙ 0✿75 ♣ ❵

r interleaved with ♥ ✙

♣ ❵, finds (0✿5625 + ♦(1))❵ slopes. Truly random walk finds (0✿6753 ✿ ✿ ✿ + ♦(1))❵ slopes. Two grumpy giants and a baby, with ♥ ✙ 0✿5 ♣ ❵, find (0✿71875 + ♦(1))❵ slopes. Also better average case than rho.