Multiple Discrete Logarithm Problems with Auxiliary Inputs

Abstract

Let g be an element of prime order p in an abelian group and let α1, . . . , αL ∈ Zp for a positive integer L. First, we show that, if g, g α i , andLet f ∈ Fp[x] be a polynomial of degree d and let ρ f be the number of rational points over Fp on the curve determined by f (x) − f (y) = 0. Second, if g, g α i , g α 2 i , . . . , g α d i are given for any d ≥ 1, then we propose an algorithm that solves all αi's in O(max{ L • p 2 /ρ f , L • d}) group exponentiations with O( L • p 2 /ρ f ) storage. In particular, we have explicit choices for a polynomial f when d | p ± 1, that yield a running time of O( L • p/d) whenever L ≤ p c•d 3 for some constant c.