离散对数

split; |p − 1
| hK where hK is the class number of K α: fundamental unit of K (with mild conditions at p and ) u, v: places of K with u| and v|p Then there is a χ ∈ H 1(K, Z/ Z) ramified at u and v and unramified at all other finite places. χ corresponds to a unique cyclic extension of degree over K which is ramified at u and v and unramified at all other finite places.
k
• hard – not solvable in polynomial time
• not NP-hard either
5
Discrete exponentiation is easy (O(log ) group operations) Discrete-log seems hard for many groups, in varying degrees depending on G DL for generic G: √
19
→
invl
Q/Z → 0
K ∗/K ∗ ↓ ∗ ∗ Kv /Kv
H 1(K, Z/ Z) → Br(K)[ ] ↓ ↓ × H 1(Kv , Z/ Z) → Br(Kv )[ ] ×
0 → Br(K) → ⊕v Br(Kv ) For χ ∈ H 1(K, Z/ Z) and α ∈ K ∗, 0=
Length of problem O(log pn) for Fpn .
8
Diffie-Hellman Key Exchange: to establish a shared secret over an insecure channel Alice generates a random number a and sends g a to Bob Bob generates a random number b and sends g b to Alice Shared secret: g ab Alice: (g b)a Bob: (g a)b
1 O(log 2
1 p log log 2来自p)time algorithm
2. Number field sieve and function field sieve methods give
n n eO(log 3 p log log 3 p ) 1 2
time algorithms ( n << log p vs n >> log p)
v
Σv invv
→
Q/Z → 0
< χ, α >v .
20
χ ∈ H 1(Q, Z/ Z) ramified at p,
Q ⊂ K ⊂ Q(µp), [K : Q] =
µ (Fp) =< g > q: odd prime different from p; q = g a (mod p). 0 =
v
< χ, q >v
16
K = Qp(β), b = β. χ such that χ(σ) = i iff σ(β)/β = ζ i. For σ = θ(a), < χ, a >= i iff χ(θ(a)) = i iff (b, a) = ζ i (norm residue symbol) b may not be easily determined. b may even be too large to be ”written down” (||b|| may be proportional to , exponential in log ) ζ i → i is a DL computation
15
−1}
Choose χ that corresponds to the field K of extension degree , Qp ⊂ K ⊂ Qp(µp). Then G = subgroup generated by χ and µ (Fp) pair perfectly under <, >. Efficient computation of < χ, α >= χ(θ(α)) would imply DL is easy.
Z/ Z ⊗ G → G a ⊗ g b → (g b)a
10
DL and pairing DL over a cyclic group G of order is equivalent to computing any isomorphism from G ⊗ G → Z/ Z. The CDH problem is equivalent to computing any isomorphism from G ⊗ G to G. Mauer (’94): CDH is equivalent to DL, given an elliptic curve over F with #E(F ) smooth.
13
DL ; pairing DL ; local duality DL ; global duality (including Index Calculus as a special case)
14
DL and local class field |p − 1 ∼ Q∗/Q∗ = µ (Fp) × {1, p, ..., p p p Tate local duality. ∼ <, >: H 1(Qp, Z/ Z) × Q∗/Q∗ → Br(Qp)[ ] = Z/ Z p p is a perfect pairing of finite groups. For χ ∈ H 1(Qp, Z/ Z) and α ∈ Q∗, p < χ, α >= χ(θ(α)). θ : Q∗ → Gab Artin map p
11
DL over a cyclic group G of order is equivalent to computing any isomorphism from G ⊗ G → Z/ Z. f : G ⊗ G → Z/ Z efficient ⇒ fa : G → Z/ Z efficient ⇒ DL/G easy DL/G easy ⇒ efficient G → Z/ Z ⇒ G ⊗ G → G efficient ⇒ efficient G ⊗ G → G → Z/ Z
On the Discrete Logarithm Problem
Ming-Deh Huang University of Southern California
1
Most of the subexponential time algorithms for the discrete-log problem rely on the index calculus principle. However there are other interesting angles for studying the problem. We will explore its connection with
= < χp , q > + < χq , q > = a < χp, g > + < χq , q > . logg q ≡ − < χq , g >−1< χq , q > (mod )
21
Index calculus revisited b := g a mod p =
i i qi .
e
0 =
• arithmetic duality
• class field theoretic computation
2
Discrete Logarithm Problem (DL) G: a finite cyclic group α: a generator of G β∈G To compute a positive integer n so that β = αn (β = nα in additive notation). In cryptography, the order of G is a large prime . Primary examples of G: subgroups of F∗, E(Fq ). q
3
DL is the basis of many public-key cryptosystems: Key establishment – Diffie-Hellman Key exchange protocol Encryption scheme – El Gamal Digital signature – Digital Signature Algorithm (DSA) Elliptic Curve Cryptography (ECC)
17
Theorem There is no efficient algorithm for computing Tate local duality unless DL/F∗ can be efficiently solved. p
18
DL and global duality Frey (2000): “Hasse’s results on Brauer groups make it possible, at least in theory, to lift the problem [of discrete logarithm] to global fields ... and it may well be that his celebrated sequence for global fields K and its completions Kl : 0 → Br(K) → ⊕l Br(Kl ) can play an important role.” Nguyen (2001): Brauer group computation and Index calculus Huang and Raskind (04–10): Global duality and DL