Speeding up Pollard's rho method for computing discrete logarithms

Abstract

In Pollard's rho method, an iterating function f is used to define a sequence (yi) by yi+l = f(yi) for i = 0, 1, 2,..., with some starting value yo. In this paper, we define and discuss new iterating functions for computing discrete logarithms with the rho method. We compare their performances in experiments with elliptic curve groups. Our experiments show that one of our newly defined functions is expected to reduce the number of steps by a factor of approximately 0.8, in comparison with Pollard's originally used function, and we show that this holds independently of the size of the group order. For group orders large enough such that the run time for precomputation can be neglected, this means a real-time speed-up of more than 1.2. IntroductionLet G be a finite cyclic group, written multiplicatively, and generated by the group element g. Given an element h in G, we wish to find the least non-negative number x such that g~ = h. This problem is the discrete logarithm problem (DLP) in G, and x is the discrete logarithm of h to the base g. We write x = logg h. We write (g) to denote the cyclic group generated by g, and [(g)t, or IG[, to denote the order of g, which is the least positive number x such that gX = 1. An efficient method to solve the DLP is based on the rho method: Assume we are given a function f : G -+ G. We select a starting value Y0 E G and then compute the sequence (yi) formed by the rule yi+l -~ f(Yi), for i = 0, 1, 2,....Since G is finite, this sequence is ultimately periodic so that there exist two uniquely determined smallest integers # _> 0 and )~ _> 1 such that Yi = Yi+a for all i >_ ~. We call # the preperiod and )~ the period of (Yi) and any pair (yi,Yj) with Yi = yj and i r j a match. If the function f, which we refer to as the iterating function, is a random function in the sense that each of the [G] Ivl functions f : G -+ G is equally probable, the expected value for )~ + # is close to ~/r]G]/2 = 1.253 iv/~. Pollard [12] showed how this theory can be applied to solve the DLP in expected run time O(x/IG ] ) multiplications in G.Pollard's algorithm [12] is generic in the sense that it can be applied to any group for which the following is satisfied.

New Collisions to Improve Pollard’s Rho Method of Solving the Discrete Logarithm Problem on Elliptic Curves

“…This implies these collisions not only have always occurred but the probability of a collision has also significantly increased if it compared with original method. It can be concluded that the proposed improved method will be better than the original pollard's Rho method and these alternative collisions can also be applied to previo us proposed improvements such that dividing the group into about 20 sets (Teske, 1998;2001). …”

“…Despite the fact that there are several attacking methods to resolve ECDLP, Pollard's Rho method (Pollard, 1980) not only is at present known as the fastest algorithm to resolve the discrete logarithm problem on elliptic curves, but its parallelized variant as well because its mathematical operations is less than other methods like Baby-Step Giant-Step (Shanks, 1971). This encourages researchers to utilise from automorphism of the group (Duursma et al, 1990), random walk on certain equivalence classes (Wiener and Zuccherato, 1999;Gallant et al, 2000), parallelization (Oorschot and Wiener, 1999), iteration function (Teske, 1998;2001), negation map (Wang and Zhang, 2012) or cycle detection (Brent, 1980;Cheon et al, 2012;Ezzouak et al, 2014) to improve this attacking method. This paper will provide a new approach by using the theorem that proposed by (Sadkhan and Neamah, 2011) to improve Pollard's Rho method which use alternative collisions to resolve the ECDLP.…”

Collision of Random Walks and a Refined Analysis of Attacks on the Discrete Logarithm Problem

“…Montenegro, Kim, and Tetali [9] showed that for Pollard's Rho walk τ = O(log 3 N ), while Hildebrand [8,18] showed that for Teske's additive walk τ = O * (N 2/(r−1) ). A slightly weaker notion of mixing should be used for Teske's process when r < 6, but we do not consider it here.…”

The Full Cost of Cryptanalytic Attacks

“…However, each processor could be working to find a different discrete logarithm as long as the iterating function used by all processors does not depend on the group element whose logarithm is sought. This requirement is satisfied by an iterating function f : G → G suggested by Teske [18], where G is partitioned into about 20 disjoint sets T i , each set is assigned a fixed randomly chosen group element g xi with known logarithm x i , and f (y) = yg xi if y ∈ T i .…”