Pollard-Type Methods

Discrete Logarithms

3.4. Pollard-Type Methods

So we obtain a match wheni=4andj=4, which means that x=4+11·4=48,

which we can verify to be the correct answer to the earlier discrete logarithm problem by computing 64⁴⁸ (mod607) =182.

3.4. Pollard-Type Methods

The trouble with the Baby-Step/Giant-Step method is that, although its run time is bounded by O(√p), it requiredO(√p) space. In practice this space requirement is more of a hindrance than the time requirement. Hence, one could ask whether one could trade the large space requirement for a smaller space requirement, but still obtain a time complexity ofO(√p)? Well we can, but we will now obtain only an expected running time rather than an absolute bound on the running time;

thus technically we obtain a Las Vegas-style algorithm as opposed to a deterministic one. There are a number of algorithms which achieve this reduced space requirement all of which are due to ideas of Pollard.

3.4.1. Pollard’s Rho Algorithm: Suppose f :S → S is a random mapping between a set S and itself, where the size ofSisn. Now pick a random valuex0∈Sand compute

xi+1←f(xi) fori≥0.

We consider the valuesx₀, x₁, x₂, . . .as a deterministic random walk. By this statement we mean that each stepxi+1=f(xi) of the walk is a deterministic function of the current positionxi, but we are assuming that the sequence x₀, x₁, x₂, . . . behaves as a random sequence would. Another name for a deterministic random walk is a pseudo-random walk.

The goal of many of Pollard’s algorithms is to find a collision in a random mapping like the one above, where a collision is finding a pair of valuesxi andxj withi=j such that

xi=xj.

From the birthday paradox from Section 1.4.2, we obtain a collision after an expected number of π·n/2

iterations of the mapf. Hence, finding a collision using the birthday paradox in a naive way would requireO(√

n) time andO(√

n) memory. But this large memory requirement is exactly the problem with the Baby-Step/Giant-Step method we were trying to avoid.

But, sinceS if finite, we must eventually obtainxi=xjforsomevalues ofiandj, and so x_i+1=f(x_i) =f(x_j) =x_j+1.

Hence, the sequence x₀, x₁, x₂, . . . , will eventually become cyclic. If we “draw” such a sequence then it looks like the Greek letter rho,ρ. In other words there is a cyclic part and an initial tail. It can be shown, using much the same reasoning as for the birthday bound above, that for a random mapping, the tail has expected length

π·n/8, whilst the cycle also has expected length π·n/8.

It is this observation which will allow us to reduce the memory requirement to constant space.

To find a collision and make use of the rho shape of the random walk, we use a technique called Floyd’s cycle-finding algorithm: Given (x1, x2) we compute (x2, x4) and then (x3, x6) and so on, i.e. given the pair (x_i, x_2i) we compute

(xi+1, x2i+2) = (f(xi), f(f(x2i))).

We stop when we find

x_m=x_2m.

If the tail of the sequence x0, x1, x2, . . . has length λand the cycle has length μ then it can be shown that we obtain such a value ofmwhen

m=μ·(1 +λ/μ). Sinceλ < m≤λ+μwe see that

m=O(√ n),

and this will be an accurate complexity estimate if the mappingf behaves suitably like a random function. Hence, we can detect a collision with virtually no storage.

This is all very well, but we have not shown how to relate this to the discrete logarithm problem.

LetGdenote a group of ordernand let the discrete logarithm problem be given by h=g^x.

We partition the group into three setsS1,S2,S3, where we assume 1 ∈ S2, and then define the following random walk on the groupG,

xi+1←f(xi)=

⎧⎪

⎨

⎪⎩

h·x_i x_i∈S₁, x²_i x_i∈S₂, g·x_i x_i∈S₃.

The condition that 1∈S₂is to ensure that the functionf has no stationary points. In practice we actually keep track of three pieces of information

(xi,ai,bi)∈G×Z×Z where

ai+1←

⎧⎪

⎨

⎪⎩

ai xi∈S1, 2·ai (modn) xi∈S2, ai+ 1 (modn) xi∈S3, and

b_i+1←

⎧⎪

⎨

⎪⎩

bi+ 1 (modn) xi∈S1, 2·bi (modn) xi∈S2, bi xi∈S3. If we start with the triple

(x0,a0,b0) = (1,0,0) then we have, for alli,

log_g(xi) =ai+bi·log_g(h) =ai+bi·x.

Applying Floyd’s cycle-finding algorithm we obtain a collision, and so find a value ofmsuch that xm=x2m.

This leads us to deduce the following equality of discrete logarithms am+bm·x=am+bm·log_g(h)

= log_g(xm)

= log_g(x_2m)

=a_2m+b_2m·log_g(h)

=a2m+b2m·x.

Rearranging we see that

(b_m−b_2m)·x=a_2m−a_m,

3.4. POLLARD-TYPE METHODS 61

and so, ifbm=b2m, we obtain

x= a2m−am

bm−b2m

(modn).

The probability that we havebm=b2m is small enough to be ignored for largen. Thus the above algorithm will find the discrete logarithm in expected timeO(√

n).

Pollard’s Rho Example: As an example consider the subgroup G of F^∗607 of order n = 101 generated by the elementg=64and the discrete logarithm problem

h=122=64^x. We define the setsS1,S2,S3as follows:

S1={x∈F^∗607:x≤201}, S₂={x∈F^∗607: 202≤x≤403}, S₃={x∈F^∗607: 404≤x≤606}. Applying Pollard’s Rho method we obtain the following data

i x_i a_i b_i x_2i a_2i b_2i

0 1 0 0 1 0 0

1 122 0 1 316 0 2

2 316 0 2 172 0 8

3 308 0 4 137 0 18

4 172 0 8 7 0 38

5 346 0 9 309 0 78

6 137 0 18 352 0 56

7 325 0 19 167 0 12

8 7 0 38 498 0 26

9 247 0 39 172 2 52

10 309 0 78 137 4 5

11 182 0 55 7 8 12

12 352 0 56 309 16 26

13 76 0 11 352 32 53

14 167 0 12 167 64 6

So we obtain a collision, using Floyd’s cycle-finding algorithm, whenm= 14. We see that g⁰·h¹²=g⁶⁴·h⁶

which implies

12·x=64+6·x (mod101).

Consequently

x= 64

12−6 (mod101) =78.

3.4.2. Pollard’s Lambda Method: Pollard’s Lambda method is like the Rho method, in that we use a deterministic random walk and a small amount of storage to solve the discrete logarithm problem. However, the Lambda method is particularly tuned to the situation where we know that the discrete logarithm lies in a certain interval

x∈[a, . . . ,b].

In the Rho method we used one random walk, which turned into the shape of the Greek letter ρ, whilst in the Lambda method we use two walks which end up in the shape of the Greek letter lambda, i.e. λ, hence giving the method its name. Another name for this method is Pollard’s Kangaroo method as it was originally described with the two walks being performed by kangaroos.

Let w=b−adenote the length of the interval in which the discrete logarithm xis known to lie. We define a set

S={s₀, . . . ,s_k−1}

of integers in non-decreasing order. The meanm of the set should be around N = √

w. It is common to choose

si= 2ⁱfor 0≤i<k, which implies that the mean of the set is

2^k k, and so we choose

k≈ 1

2 ·log₂(w).

We divide the group up intok setsS_i, fori= 0, . . . ,k−1, and define the following deterministic random walk:

xi+1=xi·g^sj ifxi∈Sj.

We first compute the deterministic random walk starting from the end of the intervalg0=g^b by setting

g_i+1=g_i·g^sj ifg_i∈S_j, fori= 1, . . . ,N =√

w. We also setc0=b andci+1=ci+sj (modq). We storegN and notice that we have computed the discrete logarithm ofg_N with respect tog,

c_N = log_g(g_N).

We now compute our second deterministic random walk, starting from the point in the interval corresponding to the unknownx; we seth0=h=g^x and compute

hi+1=hi·g^sj ifhi∈Sj. We also setd₀=0andd_i+1=d_i+s_j (modq). Notice that we have

log_g(h_i) =x+d_i.

If the path of theh_iever meets that of the path of theg_ithen theh_i will carry on the path of the gi, and so eventually reach the pointgN. Thus, we are able to find a valueM wherehM equals our stored pointg_N. We then have

cN = log_g(gN) = log_g(hM) =x+dM, and so the solution to our discrete logarithm problem is given by

x=cN−dM (modq).

If we do not get a collision then we can increaseN and continue both walks in a similar manner until a collision does occur.

The expected running time of this method is √

w and again the storage can be seen to be constant. The Lambda method can be used when the discrete logarithm is only known to lie in

3.4. POLLARD-TYPE METHODS 63

the full interval [0, . . . ,q−1]. But in this situation, whilst the asymptotic complexity is the same as the Rho method, the Rho method is better due to the implied constants.

Pollard’s Lambda Example: As an example we again consider the subgroupGofF^∗607of order n=101generated by the elementg=64, but now we look at the discrete logarithm problem

h=524=64^x.

We are given that the discrete logarithmxlies in the interval [60, . . . ,80]. As our set of multipliers s_iwe takes_i=2ⁱ fori= 0,1,2,3. The subsets S₀, . . . ,S₃ofGwe define by

Si={g∈G:g (mod 4) =i}.

We first compute the deterministic random walkgi and the discrete logarithms ci = log_g(gi), for i= 0, . . . ,N =√

80−40= 4.

i g_i c_i 0 151 80 1 537 88 2 391 90 3 478 98

4 64 1

Now we compute the second deterministic random walk i hi di= log_g(hi)−x

0 524 0

1 151 1

2 537 9

3 391 11

4 478 19

5 64 23

Hence, we obtain the collisionh₅=g₄ and so

x=1−23 (mod101) =79.

Note that examining the above tables we see that we had earlier collisions between our two walks.

However, we are unable to use these since we do not storeg0,g1,g2org3. We have only stored the value ofg₄.

3.4.3. Parallel Pollard’s Rho: In real life when we use random-walk-based techniques to solve discrete logarithm problems we use a parallel version, to exploit the computing resources of a number of sites across the Internet. Suppose we are given the discrete logarithm problem

h=g^x

in a groupGof prime orderq. We first decide on an easily computable function H :G−→ {1, . . . ,k},

where k is usually around 20. Then we define a set of multipliers mi. These are produced by generating random integersai,bi∈[0, . . . ,q−1] and then setting

mi=g^ai·h^bi.

To start a deterministic random walk we pick randoms0,t0∈[0, . . . ,q−1] and compute g₀=g^s0·h^t0,

the deterministic random walk is then defined on the triples (gi,si,ti) where g_i+1=g_i·m_H(g

i), si+1=si+a_H(g

i) (modq), ti+1=ti+b_H(gi) (modq).

Hence, for everygiwe record the values ofsi andtisuch that gi=g^si·h^ti.

Suppose we havemprocessors: each processor starts a different deterministic random walk from a different starting position using the same algorithm to determine the next element in the walk.

When another processor, or even the same processor, meets an element of the group that has been seen before then we obtain an equation

g^si·h^ti=g^sj·h^tj

which we can solve for the discrete logarithmx. Hence, we expect that afterO(

(π·q)/(2·m²)) iterations of these parallel walks we will find a collision and so solve the discrete logarithm problem.

However, as described this means that each processor needs to return every element in its com- puted deterministic random walk to a central server which then stores all the computed elements.

This is highly inefficient as the storage requirements will be very large, namelyO(

(π·q)/2). We can reduce the storage to any required value as follows: We first define a functiondon the group

d:G−→ {0,1}

such thatd(g) = 1 around 1/2^t of the time for any g ∈ G. The function d is often defined by returningd(g) = 1 if a certain subset oft of the bits representing the group elementg∈Gare set to zero for example. The elements inGfor whichd(g) = 1 will be called distinguished.

It is only the distinguished group elements that are now transmitted back to the central server.

This means that we expect the deterministic random walks to need to continue another 2^t steps before a collision is detected between two deterministic random walks. Hence, the computing time now becomes

O

(π·q)/(2·m²)/+ 2^t

, whilst the storage becomes

O

(π·q)/2^2·t+1 .

This allows the storage to be reduced to any manageable amount, at the expense of a little extra computation. We do not give an example, since the method only really becomes useful asqbecomes large (sayq>2²⁰).