How long does it take to catch a wild kangaroo?

TL;DR

This paper introduces probabilistic tools to analyze the expected intersection time of two independent random walks on integers, leading to a precise analysis of Pollard's Kangaroo method for discrete logarithms.

Contribution

It provides the first sharp analysis of a non-trivial Birthday attack and generalizes the step size assumption in Pollard's Kangaroo method.

Findings

Expected time for Pollard's Kangaroo method is (2+o(1))√(b−a).

Methods resolve a conjecture by extending step sizes to powers of any fixed n.

Analysis applies to random walks on integers and cryptographic discrete log problems.

Abstract

We develop probabilistic tools for upper and lower bounding the expected time until two independent random walks on $\ZZ$ intersect each other. This leads to the first sharp analysis of a non-trivial Birthday attack, proving that Pollard's Kangaroo method solves the discrete logarithm problem $g^x=h$ on a cyclic group in expected time $(2+o(1))\sqrt{b-a}$ for an average $x\in_{uar}[a,b]$. Our methods also resolve a conjecture of Pollard's, by showing that the same bound holds when step sizes are generalized from powers of 2 to powers of any fixed $n$.