Hard Instances of the Constrained Discrete Logarithm Problem

  • Ilya Mironov
  • Anton Mityagin
  • Kobbi Nissim
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4076)


The discrete logarithm problem (DLP) generalizes to the constrained DLP, where the secret exponent x belongs to a set known to the attacker. The complexity of generic algorithms for solving the constrained DLP depends on the choice of the set. Motivated by cryptographic applications, we study explicit construction of sets for which the constrained DLP is hard. We draw on earlier results due to Erdös et al. and Schnorr, develop geometric tools such as generalized Menelaus’ theorem for proving lower bounds on the complexity of the constrained DLP, and construct explicit sets with provable non-trivial lower bounds.


Bipartite Graph Generic Algorithm Generic Complexity Discrete Logarithm Discrete Logarithm Problem 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. [BC63]
    Bose, R.C., Chowla, S.: Theorems in the additive theory of numbers. Comment. Math. Helv. 37, 141–147 (1962–1963)CrossRefMathSciNetGoogle Scholar
  2. [BHP01]
    Baker, R.C., Harman, G., Pintz, J.: The difference between consecutive primes. II. Proc. London Math. Soc. 83(3), 532–562 (2001)MATHCrossRefMathSciNetGoogle Scholar
  3. [Bol98]
    Bollobás, B.: Modern graph theory. Graduate texts in mathematics, vol. 184. Springer, Heidelberg (1998)MATHGoogle Scholar
  4. [CLP05]
    Coron, J.-S., Lefranc, D., Poupard, G.: A new baby-step giant-step algorithm and some applications to cryptanalysis. In: Rao, J.R., Sunar, B. (eds.) CHES 2005. LNCS, vol. 3659, pp. 47–60. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  5. [CLS03]
    Chateauneuf, M., Ling, A., Stinson, D.R.: Slope packings and coverings, and generic algorithms for the discrete logarithm problem. J. Comb. Designs 11(1), 36–50 (2003)MATHCrossRefMathSciNetGoogle Scholar
  6. [CW77]
    Carter, L., Wegman, M.N.: Universal classes of hash functions. In: STOC 1977, pp. 106–112 (1977)Google Scholar
  7. [EN77]
    Erdös, P., Newman, D.J.: Bases for sets of integers. J. Number Theory 9(4), 420–425 (1977)MATHCrossRefMathSciNetGoogle Scholar
  8. [GS80]
    Graham, R.L., Sloane, N.J.A.: On additive bases and harmonious graphs. SIAM J. Algebraic and Discrete Methods 1, 382–404 (1980)MATHCrossRefMathSciNetGoogle Scholar
  9. [Guy04]
    Guy, R.K.: Unsolved Problems in Number Theory, 3rd edn. Springer, Heidelberg (2004)MATHGoogle Scholar
  10. [Hei93]
    Heiman, R.: A note on discrete logorithms with special structure. In: Rueppel, R.A. (ed.) EUROCRYPT 1992. LNCS, vol. 658, pp. 454–457. Springer, Heidelberg (1993)CrossRefGoogle Scholar
  11. [HHÖ04]
    Haanpää, H., Huima, A., Östergård, P.R.J.: Sets in ℤn with distinct sums of pairs. Discrete Applied Mathematics 138(1–2), 99–106 (2004)MATHCrossRefMathSciNetGoogle Scholar
  12. [HS03]
    Hoffstein, J., Silverman, J.H.: Random small Hamming weight products with applications to cryptography. Discrete Applied Mathematics 130(1), 37–49 (2003)MATHCrossRefMathSciNetGoogle Scholar
  13. [Knu97]
    Knuth, D.E.: Seminumerical Algorithms, 3rd edn. The Art of Computer Programming, vol. 2. Addison-Wesley, Reading (1997)Google Scholar
  14. [Nec94]
    Nechaev, V.I.: Complexity of a determinate algorithm for the discrete logarithm. Math. Notes 55(2), 165–172 (1994)CrossRefMathSciNetGoogle Scholar
  15. [NV05]
    Naor, A., Verstraëte, J.: A note on bipartite graphs without 2k-cycles. Probability, Combinatorics and Computing 14(5–6), 845–849 (2005)MATHCrossRefGoogle Scholar
  16. [O’B02]
    O’Bryant, K.: Sidon Sets and Beatty Sequences. PhD thesis, U. of Illinois in Urbana-Champaign (2002)Google Scholar
  17. [O’B04]
    O’Bryant, K.: A complete annotated bibliography of work related to Sidon sequences. Electr. J. Combinatorics, DS11 (July 2004)Google Scholar
  18. [Odl00]
    Odlyzko, A.M.: Discrete logarithms: The past and the future. Des. Codes Cryptography 19(2/3), 129–145 (2000)MATHCrossRefMathSciNetGoogle Scholar
  19. [Pol78]
    Pollard, J.M.: Monte Carlo methods for index computation (mod p). Mathematics of Computation 32, 918–924 (1978)MATHCrossRefMathSciNetGoogle Scholar
  20. [Pol00]
    Pollard, J.M.: Kangaroos, monopoly and discrete logarithms. J. Cryptology 13(4), 437–447 (2000)MATHCrossRefMathSciNetGoogle Scholar
  21. [Ruz93]
    Ruzsa, I.Z.: Solving a linear equation in a set of integers. Part I. Acta Arith. 65, 259–282 (1993)MATHMathSciNetGoogle Scholar
  22. [Sch80]
    Schwartz, J.T.: Fast probabilistic algorithms for verification of polynomial identities. J. ACM 27(4), 701–717 (1980)MATHCrossRefGoogle Scholar
  23. [Sch01]
    Schnorr, C.-P.: Small generic hardcore subsets for the discrete logarithm. Inf. Process. Lett. 79(2), 93–98 (2001)MATHCrossRefMathSciNetGoogle Scholar
  24. [Sha71]
    Shanks, D.: Class number, a theory of factorization, and genera. In: Lewis, D.J. (ed.) 1969 Number Theory Institute, Providence, Rhode Island. Proceedings of Symposia in Pure Mathematics, vol. 20, pp. 415–440. American Mathematical Society (1971)Google Scholar
  25. [Sho97]
    Shoup, V.: Lower bounds for discrete logarithms and related problems. In: Fumy, W. (ed.) EUROCRYPT 1997. LNCS, vol. 1233, pp. 256–266. Springer, Heidelberg (1997)Google Scholar
  26. [Sin38]
    Singer, J.: A theorem in finite projective geometry and some applications to number theory. Trans. Amer. Math. Soc. 43, 377–385 (1938)MATHCrossRefMathSciNetGoogle Scholar
  27. [SJ04]
    Sella, Y., Jakobsson, M.: Constrained and constant ratio hash functions (manuscript, 2004)Google Scholar
  28. [Sti02]
    Stinson, D.R.: Some baby-step giant-step algorithms for the low Hamming weight discrete logarithm problem. Math. Comput. 71(237), 379–391 (2002)MATHMathSciNetGoogle Scholar
  29. [SWD96]
    Schirokauer, O., Weber, D., Denny, T.F.: Discrete logarithms: The effectiveness of the index calculus method. In: Cohen, H. (ed.) ANTS 1996. LNCS, vol. 1122, pp. 337–361. Springer, Heidelberg (1996)Google Scholar
  30. [Tes01]
    Teske, E.: Square-root algorithms for the discrete logarithm problem (a survey). In: Public-Key Cryptography and Computational Number Theory, pp. 283–301 (2001)Google Scholar
  31. [vOW99]
    van Oorschot, P.C., Wiener, M.J.: Parallel collision search with cryptanalytic applications. J. Cryptology 12(1), 1–28 (1999)MATHCrossRefMathSciNetGoogle Scholar
  32. [Yac98]
    Yacobi, Y.: Fast exponentiation using data compression. SIAM J. Comput. 28(2), 700–703 (1998)MATHCrossRefMathSciNetGoogle Scholar
  33. [Zar51]
    Zarankiewicz, K.: Problem P 101. Colloq. Math. 2, 301 (1951)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Ilya Mironov
    • 1
  • Anton Mityagin
    • 2
  • Kobbi Nissim
    • 3
  1. 1.SVC-5Microsoft CorpUSA
  2. 2.Department of Computer Science and EngineeringUniversity of CaliforniaLa JollaUSA
  3. 3. Ramat-GanIsrael

Personalised recommendations