A Subexponential Quantum Algorithm for the Semidirect Discrete Logarithm Problem

TL;DR

This paper introduces the first subexponential quantum algorithm for the Semidirect Discrete Logarithm Problem, revealing its complexity and connection to group actions, which impacts the security of group-based cryptography in the quantum era.

Contribution

It provides the first dedicated security analysis of SDLP and links it to group actions, enabling a subexponential quantum algorithm for solving SDLP.

Findings

SDLP can be solved with a subexponential quantum algorithm.

The complexity of SDLP is now classified as subexponential.

Implications for the security of group-based cryptography against quantum attacks.

Abstract

Group-based cryptography is a relatively unexplored family in post-quantum cryptography, and the so-called Semidirect Discrete Logarithm Problem (SDLP) is one of its most central problems. However, the complexity of SDLP and its relationship to more well-known hardness problems, particularly with respect to its security against quantum adversaries, has not been well understood and was a significant open problem for researchers in this area. In this paper we give the first dedicated security analysis of SDLP. In particular, we provide a connection between SDLP and group actions, a context in which quantum subexponential algorithms are known to apply. We are therefore able to construct a subexponential quantum algorithm for solving SDLP, thereby classifying the complexity of SDLP and its relation to known computational problems.