On the Security of Diffie-Hellman Bits

Abstract

Boneh and Venkatesan have recently proposed a polynomial time algorithm for recovering a “hidden” element α of a finite field $\mathbb{F}_p$ of p elements from rather short strings of the most significant bits of the remainder modulo p of αt for several values of t selected uniformly at random from $\mathbb{F}_p^*$ We use some recent bounds of exponential sums to generalize this algorithm to the case when t is selected from a quite small subgroup of $\mathbb{F}_p^*$. Namely, our results apply to subgroups of size at least p ^1/3+ɛ for all primes p and to subgroups of size at least p ^ɛ for almost all primes p, for any fixed ɛ > 0. We also use this generalization to improve (and correct) one of the statements of the aforementioned work about the computational security of the most significant bits of the Diffie-Hellman key.