The discrete logarithm problem over prime fields: the safe prime case. The Smart attack, non-canonical lifts and logarithmic derivatives

TL;DR

This paper explores the discrete logarithm problem over prime fields in the safe prime case, linking it to the concept of logarithmic derivatives to potentially inform cryptographic analysis.

Contribution

It introduces a novel connection between the discrete logarithm problem and logarithmic derivatives specifically for safe prime fields.

Findings

Establishes a theoretical link between discrete logs and logarithmic derivatives.

Provides insights into the structure of safe prime fields in cryptography.

Suggests new avenues for cryptanalysis based on this connection.

Abstract

In this brief note we connect the discrete logarithm problem over prime fields in the safe prime case to the logarithmic derivative.

Equations

$$a_0^{n_p}\equiv b_0\mathrm{mod}p.$$

$$a_0^{n_{p}p}\equiv b_0^p\mathrm{mod}{p}^2$$

$$(a_0+a_{1}p{)}^{n_p}\equiv (b_0+b_{1}p)\mathrm{mod}{p}^2.$$

$$n_p\equiv \frac{(b_1-{\beta }_{n_p})/b_0}{a_1/a_0}\mathrm{mod}p$$

$$a_0^{n_p}\equiv b_0+{\beta }_{n_p}p\mathrm{mod}{p}^2.$$

$$a_0^n\equiv b_0\mathrm{mod}pq.$$

$$(a_0+a_{1}pq{)}^n\equiv (b_0+b_{1}pq)\mathrm{mod}{p}^2{q}^2.$$

$$(a_0+a_{1}pq{)}^{q\varphi (q)}\equiv 1\mathrm{mod}{p}^2{q}^3.$$

$$a_0^n+n{a}_0^{n-1}{a}_{1}pq\equiv b_0+b_{1}pq\mathrm{mod}{p}^2{q}^2.$$

$$a_0^n\equiv b_0+{\beta }_{n}pq\mathrm{mod}{p}^2{q}^2,$$

$${\beta }_n+n\frac{b_0}{a_0}{a}_1\equiv b_1\mathrm{mod}pq.$$

$$(a_0+(a_1+k)pq{)}^n\equiv (b_0+(b_1+l))pq)\mathrm{mod}{p}^2{q}^2.$$

$$(a_0+a_{1}pq{)}^n+n(a_0+a_{1}pq{)}^{n-1}kpq\equiv (b_0+b_{1}pq)+lpq\mathrm{mod}{p}^2{q}^2$$

$$n\equiv \frac{l_1/b_0}{k_1/a_0}\mathrm{mod}q.$$

$$n\equiv \frac{l/b_0}{k/a_0}\mathrm{mod}pq.$$

$$n\equiv \frac{d{b}_0/b_0}{d{a}_0/a_0}\mathrm{mod}q.$$

$$n\equiv \frac{d{b}_0/b_0}{d{a}_0/a_0}\mathrm{mod}pq.$$

$${\left({\left(a_0+(a_1+k)pq\right)}^{pq\varphi (q)}\right)}^n\equiv {\left(b_0+(b_1+l))pq\right)}^{pq\varphi (q)}\mathrm{mod}{p}^3{q}^3,$$

$$1+n(q(a_0)+\frac{(a_1+k)}{a_0}\varphi (q))p^2{q}^2)\equiv 1+(q(b_0)+\frac{(b_1+l)}{b_0}\varphi (q))p^2{q}^2\mathrm{mod}{p}^3{q}^3.$$

$$x^{\varphi (n)}\equiv 1+q(x)n\mathrm{mod}{n}^2.$$

$$\lambda(n)=~{}\left\{\begin{array}[]{ll}\phi(p^{r}),{}&{\rm~{}if~{}}n=p^{r}\\ 2^{r-2},&{\rm~{}if~{}}n=2^{r},~{}r\geq 3\\ lcm(\lambda(p_{1}^{r_{1}}),\lambda(p_{2}^{r_{2}}),\cdots,\lambda(p_{k}^{r_{k}})),&{\rm~{}if~{}}n=p_{1}^{r_{1}}p_{2}^{r_{2}}\cdots p_{k}^{r_{k}}\end{array}\right.$$

$$x^{pq\varphi (q)}\equiv 1+q(x)p^2{q}^2\mathrm{mod}{p}^3{q}^3.$$

$$a_0^{n_p}\equiv b_0\mathrm{mod}pq.$$

$$\left(\frac{b_0}{p}\right)=\left(\frac{b_0}{q}\right).$$

$$\begin{array}[]{lccccl}a_{0}^{n}&\equiv&a_{0}^{n_{p}}&\equiv&b_{0}{\rm{~{}mod~{}}}p&{\rm{~{}and}}\\ a_{0}^{n}&\equiv&a_{0}^{n_{q}}&\equiv&b_{0}{\rm{~{}mod~{}}}q&~{}~{}\,.\end{array}$$

$$n$$

$$2=gcd(p-1,q-1)|(n_p-n_q).$$

$$n_p\equiv n_q\mathrm{mod}2.$$

$$(a_0+a_{1}pq{)}^n\equiv (b_0+b_{1}pq)\mathrm{mod}{p}^2{q}^2,$$

$$a_1=-\frac{q(a_0))a_0}{\varphi (q)}\mathrm{and}{b}_1=-\frac{q(b_0))b_0}{\varphi (q)}\mathrm{mod}pq.$$

Full text

Key words: Discrete logarithm, Hensel lift, Group extension

MSC2010: 11A07, 11T71, 11Y16, 14G50, 68Q25, 94A60

1 Introduction and the Main Idea

Let $a_{0}$ be a primitive root of a prime number $p>2$. We know that for every $b_{0}\in\left\{1,2,\cdots,p-1\right\}$ there exists a unique integer $n_{p}$ modulo $p-1$ satisfying

[TABLE]

$n_{p}$ is called the discrete logarithm or index of $b_{0}$ to the base $a_{0}$ modulo $p$. In [4] the authors got the Teichmüller expansion using Hensel lifting of the discrete logarithm problem (1). This is got by raising both sides to the power $p$:

[TABLE]

which can be written as

[TABLE]

The Iwasawa logarithm of a $p$-adic number $x$ is defined as $\frac{1}{p-1}\log x^{p-1}$. As this vanishes for a Teichmüller character the solution $n_{p}$ could not be found out, but a formula

[TABLE]

was obtained where $\beta_{n_{p}}$ is the carry

[TABLE]

Kontsevich [7] and Riesel [10] point out that the difficulty arises because the problem is stated modulo $p$ and the solution is needed modulo $p-1$. Hence we go to the discrete logarithm problem modulo the composite modulus $p(p-1)$. In this connection, see Bach [1].

In this paper we consider primes $p$ of the form $2q+1$ where $q$ is a prime number. $p$ is called a safe prime as it is believed that the discrete logarithm problem is computationally difficult in this case when $p$ is ‘large’.

From (1) we can go to the discrete logarithm problem

[TABLE]

(See Lemma 1.) From the assumptions made in Lemma 1 $a_{0}$ generates a subgroup of order $q\phi(q)$ modulo $pq$. Hensel lifting the problem modulo $p^{2}q^{2}$ we get

[TABLE]

The order of the group generated by $a_{0}+a_{1}pq$ remains as $q\phi(q)$ modulo $p^{2}q^{2}$. Also

[TABLE]

(See Lemma 2.) Expanding (7) using the binomial theorem, we get

[TABLE]

Writing

[TABLE]

will give

[TABLE]

Here $\beta_{n}$ is the carry of $a_{0}^{n}$ modulo $p^{2}q^{2}$ and note that $n$ and $\beta_{n}$ are the two unknowns in the above linear congruence.

The summary of what we have done so far is that there are three problems when we try to solve the discrete logarithm problem modulo $p$:

The problem is given modulo $p$ and the solution is needed modulo $p-1$. 2. 2.

The Iwasawa logarithm of the Teichmüller expansion modulo $p^{2}$ is 0 3. 3.

The binomial theorem on the Teichmüller expansion modulo $p^{2}$ gives ’carry’.

We overcome the first problem by going modulo $pq$. The fact that we cannot get $n$ arises from two possibilities being blocked as in the modulo $p$ case. The analogue of the Teichmüller expansion does not have a non-zero logarithm (see (8)) and if the binomial theorem is used, a carry occurs as in the case of mod $p$, see (11).

However if we can construct a non-canonical lift modulo $p^{2}q^{2}$ then the problems dissolve. Thus solving the discrete logarithm problem is equivalent to the construction of a non-canonical lift.

The non-canonical lifts exist and can be written in the form

[TABLE]

When $k=k_{1}p$ for some $k_{1}\not\equiv 0$ mod $q$, then $l=l_{1}p$ for some $l_{1}$mod $q$. In this case the order of the group is $q\phi(q)$. For the other $k$ and $l$ modulo $pq$ the order of the group will be $pq\phi(q)$. On expanding (12) using the binomial theorem, one gets

[TABLE]

and using (7)

[TABLE]

in the first case and

[TABLE]

in the second case.

If we use the notation $da_{0}$ for $k_{1}$ and $db_{0}$ for $l_{1}$ then

[TABLE]

and if we use the notation $da_{0}$ for $k$ and $db_{0}$ for $l$ then

[TABLE]

Thus $n$ can be thought of as the logarithmic derivative. The non-canonical extensions (modulo $p^{2}q^{2}$) of the subgroup generated by $a_{0}$ mod $pq$ are labeled by $da_{0}$. As $p=2q+1$, once we get $n$ mod $q$, $n$ mod $p-1$ would be either $n$ or $n+q$ mod $p-1$.

Note that we can get (16) and (17) by raising (12) to the powers $q\phi(q)$ and $pq\phi(q)$ respectively. In the second case we get

[TABLE]

which on expanding and using the notation in Section 2 will give

[TABLE]

Using the formula for $a_{1}$ and $b_{1}$ one gets (17). This way of getting $n$ is analogous to the attack on anomalous elliptic curves by Smart [13], Semaev [12], Satoh and Araki [11].

We would like to comment that derivatives of numbers have been studied historically for a long time starting from Kummer [6], [15], A. Weil (expanded by Kawada) [8] and more recently by A. Buium [2]. Hence the problem which is standing in isolation studied only by cryptologists gets connected to mainstream algebra and number theory. This was a complete surprise to the authors which is why we have written this brief note to bring it to the attention of experts in these areas.

2 Lemmas

We need some definitions and notations before we prove our lemmas. In [9] Lerch defined the Fermat quotient for a composite modulus. Let $x$ be such that $gcd(x,n)=1.$ Then $q(x)$ defined by

[TABLE]

is called the Fermat quotient of $x$ modulo $n$. We do not use the Euler’s $\phi$-function but we use Carmichael’s $\lambda$ function. $\lambda(n)$ is defined as follows [3]. $\lambda(2)=1$, $\lambda(4)=2$ and

[TABLE]

When $n=p^{2}q^{2}$ where $p=2q+1$ $q$ is a prime, $\phi(p^{2}q^{2})=2pq^{2}\phi(q)$ and $\lambda(p^{2}q^{2})=pq\phi(q)$. In other words the order of the group of units modulo $p^{2}q^{2}$ is $\phi(p^{2}q^{2})$ whereas the order of the largest cyclic group modulo $p^{2}q^{2}$ is $\lambda(p^{2}q^{2})$. Hence we define $q(x)$ by the congruence

[TABLE]

Lemma 1

Let $a_{0}$ be a primitive root of $p$ and $q$. Let $gcd(b_{0},~{}q)=1$. Then the congruence $a_{0}^{n}\equiv b_{0}{\rm{~{}mod~{}}}p$ can be extended to

[TABLE]

if and only if the Legendre symbols

[TABLE]

Proof. $a_{0}^{n}\equiv b_{0}{\rm{~{}mod~{}}}pq$ if and only if

[TABLE]

This happens if and only if

[TABLE]

This is possible if and only if

[TABLE]

by Chinese Remainder theorem. That is

[TABLE]

In other words $b_{0}$ is a quadratic residue or nonresidue modulo $p$ and $q$ simultaneously. That is $\left(\frac{b_{0}}{p}\right)=\left(\frac{b_{0}}{q}\right).$

Lemma 2

If $a_{0}^{n}\equiv b_{0}{\rm{~{}mod~{}}}pq$ holds then

[TABLE]

where

[TABLE]

Proof We want $a_{1}$ and $b_{1}$ to satisfy (30). Using the carry notation

[TABLE]

we get the equation

[TABLE]

Taking the power $pq\phi(q)$ on both sides of (31)

[TABLE]

and using (22) we get

[TABLE]

Comparing (32) and (34) will give the desired values of $a_{1}$ and $b_{1}$.

Remark 1. Note that $a_{1}$ and $b_{1}$ can be calculated in polynomial time and the order of $(a_{0}+a_{1}pq)$ is $q\phi(q)$ modulo $p^{2}q^{2}$.

Remark 2. Note that the Legendre symbols in (24) can be calculated in polynomial time.

Remark 3. We are given $b_{0}$ mod $p$. If (24) fails for the given $b_{0}$ we can check the same for $b_{0}+kp$ for $k=1,2,3\cdots$ until the condition is satisfied or we can multiply $b_{0}$ by $a_{0}^{k}$ for some $k$ and check the condition. In the first case $n_{p}$ does not change and in the second case $n_{p}$ becomes $n_{p}+k$ modulo $p-1$ or

Remark 4. We can take $b_{0}^{2}$ mod $pq$ and consider the new discrete logarithm problem

[TABLE]

or

Remark 5. We can even relax the conditions in Lemma 1 as in our earlier preprint [5] as follows. Let $gcd(a_{0},q)=1$ and $gcd(b_{0},q)=1$. Let $a_{0}$ be a primitive root of $p$ and let $a_{0}$ and $b_{0}$ satisfy $a_{0}^{n}\equiv b_{0}{\rm{~{}mod~{}}}p$. Then

[TABLE]

In this case the formulae corresponding to (16) and (17) would be

[TABLE]

and

[TABLE]

3 Conclusion

For the composites $p^{2}q^{2}$ the Euler function $\phi(p^{2}q^{2})=2pq^{2}\phi(q)$ and the Carmichael function $\lambda(p^{2}q^{2})=pq\phi(q)$ are not equal. Also $\lambda(p^{2}q^{2})|\phi(p^{2}q^{2})$ and hence many non-canonical lifts exist. As is well known this would involve a suitable choice of polynomial for lifting. Recall that the polynomials are $x^{p-1}-1$ and $x^{pq\phi(q)}-1$ in the cases of Teichmüller lifting modulo $p^{2}$ and $p^{2}q^{2}$ respectively. This attack can be generalized to elliptic curve discrete logarithm problem over prime fields where $q$ will be connected to the order of the group. See [14] for various ways of lifting the elliptic curve discrete logarithm problem.