TY - GEN

T1 - Solving a DLP with auxiliary input with the ρ-algorithm

AU - Sakemi, Yumi

AU - Izu, Tetsuya

AU - Takenaka, Masahiko

AU - Yasuda, Masaya

PY - 2012/3/15

Y1 - 2012/3/15

N2 - The discrete logarithm problem with auxiliary input (DLPwAI) is a problem to find a positive integer α from elements G, αG, α d G in an additive cyclic group generated by G of prime order r and a positive integer d dividing r -1. In 2011, Sakemi et al. implemented Cheon's algorithm for solving DLPwAI, and solved a DLPwAI in a group with 128-bit order r in about 131 hours with a single core on an elliptic curve defined over a prime finite field which is used in the TinyTate library for embedded cryptographic devices. However, since their implementation was based on Shanks' Baby-step Giant-step (BSGS) algorithm as a sub-algorithm, it required a large amount of memory (246 GByte) so that it was concluded that applying other DLPwAIs with larger parameter is infeasible. In this paper, we implemented Cheon's algorithm based on Pollard's ρ-algorithm in order to reduce the required memory. As a result, we have succeeded solving the same DLPwAI in about 136 hours by a single core with less memory (0.5 MByte).

AB - The discrete logarithm problem with auxiliary input (DLPwAI) is a problem to find a positive integer α from elements G, αG, α d G in an additive cyclic group generated by G of prime order r and a positive integer d dividing r -1. In 2011, Sakemi et al. implemented Cheon's algorithm for solving DLPwAI, and solved a DLPwAI in a group with 128-bit order r in about 131 hours with a single core on an elliptic curve defined over a prime finite field which is used in the TinyTate library for embedded cryptographic devices. However, since their implementation was based on Shanks' Baby-step Giant-step (BSGS) algorithm as a sub-algorithm, it required a large amount of memory (246 GByte) so that it was concluded that applying other DLPwAIs with larger parameter is infeasible. In this paper, we implemented Cheon's algorithm based on Pollard's ρ-algorithm in order to reduce the required memory. As a result, we have succeeded solving the same DLPwAI in about 136 hours by a single core with less memory (0.5 MByte).

UR - http://www.scopus.com/inward/record.url?scp=84858036337&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84858036337&partnerID=8YFLogxK

U2 - 10.1007/978-3-642-27890-7_8

DO - 10.1007/978-3-642-27890-7_8

M3 - Conference contribution

AN - SCOPUS:84858036337

SN - 9783642278891

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 98

EP - 108

BT - Information Security Applications - 12th International Workshop, WISA 2011, Revised Selected Papers

T2 - 12th International Workshop on Information Security Applications, WISA 2011

Y2 - 22 August 2011 through 24 August 2011

ER -