Collision of Random Walks and a Refined Analysis of Attacks on the Discrete Logarithm Problem

Abstract

Abstract. Some of the most efficient algorithms for finding the discrete logarithm involve pseudo-random implementations of Markov chains, with one or more "walks" proceeding until a collision occurs, i.e. some state is visited a second time. In this paper we develop a method for determining the expected time until the first collision. We use our technique to examine three methods for solving discrete-logarithm problems: Pollard's Kangaroo, Pollard's Rho, and a few versions of Gaudry-Schost. For the Kangaroo method we prove new and fairly precise matching upper and lower bounds. For the Rho method we prove the first rigorous non-trivial lower bound, and under a mild assumption show matching upper and lower bounds. Our Gaudry-Schost results are heuristic, but improve on the prior limited understanding of this method. We also give results for parallel versions of these algorithms.

Recent progress on the elliptic curve discrete logarithm problem

“…It is worth noting that most papers on the Pollard rho and kangaroo algorithms rely on heuristic assumptions. One issue that has received a lot of attention is the effect on the running time due to the number of partitions used to define the walk: A first heuristic was proposed by Brent and Pollard in the context of integer factorisation; Blackburn and Murphy [11] rediscovered this idea in the case of the rho algorithm for the ECDLP; Section 3 of Bernstein and Lange [8] discusses a refinement of the idea for rho; Kijima and Montenegro [79] give a derivation of it and prove rigorous results for both the rho and kangaroo algorithms (and more). Experimental results confirm the analysis in those papers, but it is a challenging and interesting task to minimise the use of heuristics but still get good results about these algorithms.…”

Multiple Discrete Logarithm Problems with Auxiliary Inputs

“…Several literatures focus on this rigour of pseudo-random function used in Pollard's algorithm. For further details on this, refer to [9].…”