Generic Hardness of the Multiple Discrete Logarithm Problem

Abstract

Abstract. We study generic hardness of the multiple discrete logarithm problem, where the solver has to solve n instances of the discrete logarithm problem simultaneously. There are known generic algorithms which perform O( √ np) group operations, where p is the group order, but no generic lower bound was known other than the trivial bound. In this paper we prove the tight generic lower bound, showing that the previously known algorithms are asymptotically optimal. We establish the lower bound by studying hardness of a related computational problem which we call the search-by-hyperplane-queries problem, which may be of independent interest.

Recent progress on the elliptic curve discrete logarithm problem

“…The algorithms in [6,7] solve the ECDLP instances sequentially whereas the approach in [38] are simultaneously solved together. Kuhn and Struik conjectured an Ω( √ rL) lower bound on the complexity of solving L instances of the ECDLP in the same group, and this was recently proved in the generic group model by Yun [118].…”

Multiple Discrete Logarithm Problems with Auxiliary Inputs

“…It would be also interesting to determine the lower bound complexity the generic group model for solving the multiple DLPwAI. A very recent result [19] showed that at least Ω( √ L • p) group operations are required to solve the L multiple DLP in the generic group model. Recall that the generic lower bound for the DLPwAI is Ω( p/d).…”

“…In multiple discrete logarithm problem, an algorithm [11] computes L discrete logarithms in time O( √ L • p) for L p 1/4 . Recently, it is proven that this algorithm is optimal in the sense that it requires at least Ω( √ L • p) group operations to solve the multiple DLP in the generic group model [19].…”

Indistinguishable Proofs of Work or Knowledge

“…, y k are distinct. As shown in [Yun15], the probability that an adversary A can solve the k puzzles with less than Θ( √ k · 2 h ) group operations is negligible. Hence, there exists a constant α > 0 such that, with 1−negl(λ) probability, we have (2 log 3 λ ) and h > log 4 λ, we have for sufficiently large λ ∈ N:…”