Advances in Cryptology — CRYPTO '97

Volume 1294 of the series Lecture Notes in Computer Science pp 249-263


A key recovery attack on discrete log-based schemes using a prime order subgroup

  • Chae Hoon LimAffiliated withInformation and Communications Research Center, Future Systems, Inc.
  • , Pil Joong LeeAffiliated withDept. of Electronic and Electrical Engineering, Pohang University of Science and Technology (POSTECH)


Consider the well-known oracle attack: somehow one gets a certain computation result as a function of a secret key from the secret key owner and tries to extract some information on the secret key. This attacking scenario is well understood in the cryptographic community. However, there are many protocols based on the discrete logarithm problem that turn out to leak many of the secret key bits from this oracle attack, unless suitable checkings are carried out. In this paper we present a key recovery attack on various discrete log-based schemes working in a prime order subgroup. Our attack may reveal part of, or the whole secret key in most Diffie-Hellman-type key exchange protocols and some applications of ElGamal encryption and signature schemes.