Pollard's rho algorithm for logarithms: Difference between revisions

Revision as of 07:05, 26 December 2006

Revision as of 23:39, 1 January 2007

Line 1:

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

'''Pollard's rho algorithm for logarithms''' is an algorithm for solving the [[discrete logarithm]] problem analogous to [[Pollard's rho algorithm]] for solving the [[Integer factorization]] problem.

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

[[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]][[Image:Father_Dougal.jpg]]

The goal is to compute <math>\gamma</math> such that <math>\alpha ^ \gamma = \beta</math>, where <math>\beta</math> belongs to the [[Group (mathematics)|group]] <math>G</math> generated by <math>\alpha</math>. The algorithm computes integers <math>a</math>, <math>b</math>, <math>A</math>, and <math>B</math> such that <math>\alpha^a \beta^b = \alpha^A \beta^B</math>. Assuming, for simplicity, that the underlying group is cyclic of order <math>n</math>, we can calculate <math>\gamma</math> as a solution of the equation <math>(B-b)\gamma = (a-A) \pmod{n}</math>.

== WOW TED! ==

To find the needed <math>a</math>, <math>b</math>, <math>A</math>, and <math>B</math> the algorithm uses [[Floyd's cycle-finding algorithm]] to find a cycle in the sequence <math>x_i = \alpha^{a_i} \beta^{b_i}</math>, where the function <math>f: x_i \mapsto x_{i+1}</math> is assumed to be random-looking and thus is likely to enter into a loop after approximately <math>\sqrt{\frac{\pi n}{2}}</math> steps. One way to define such a function is to use the following rules: Divide <math>G</math> into three subsets (not necessarily [[subgroup]]s) of approximately equal size: <math>G_0</math>, <math>G_1</math>, and <math>G_2</math>. If <math>x_i</math> is in <math>G_0</math> then double both <math>a</math> and <math>b</math>; if <math>x_i \in G_1</math> then increment <math>a</math>, if <math>x_i \in G_2</math> then increment <math>b</math>.

All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.All work and no play makes jack a dully boy. Drink feck arse.

==Algorithm==

Let <math>G</math> be a cyclic group of prime order <math>p</math>, and given <math>a,b\in G</math>, and a partition <math>G = G_0\cup G_1\cup G_2</math>, let <math>f:G\to G</math> be a map

<math>

f(x) = \left\{\begin{matrix}

b\cdot x & x\in G_0\\

x^2 & x\in G_1\\

a\cdot x & x\in G_2

\end{matrix}\right.

</math>

and define maps <math>g:G\times\mathbb{Z}\to\mathbb{Z}</math> and <math>h:G\times\mathbb{Z}\to\mathbb{Z}</math> by

<math>

g(x,n) = \left\{\begin{matrix}

n & x\in G_0\\

2n \bmod p & x\in G_1\\

n+1 \bmod p & x\in G_2

\end{matrix}\right.

</math>

<math>

h(x,n) = \left\{\begin{matrix}

n+1 \bmod p & x\in G_0\\

2n \bmod p & x\in G_1\\

n & x\in G_2

\end{matrix}\right.

</math>

:'''Inputs''' ''a'' a generator of ''G'', ''b'' an element of ''G''

:'''Output''' An integer ''x'' such that ''a^x = b'', or failure

:# Initialise ''a₀'' &larr; 0

:#::''b₀'' &larr; 0

:#::''x₀'' &larr; 1 &isin; ''G''

:#::''i'' &larr; 1

:# ''x_i'' &larr; ''f(x_i-1)'', ''a_i'' &larr; ''g(x_i-1,a_i-1)'', ''b_i'' &larr; ''h(x_i-1,b_i-1)''

:#''x_2i'' &larr; ''f(f(x_2i-2))'', ''a_2i'' &larr; ''g(f(x_2i-2),g(x_2i-2,a_2i-2))'', ''b_2i'' &larr; ''h(f(x_2i-2),h(x_2i-2,b_2i-2))''

:# If ''x_i'' = ''x_2i'' then

:## ''r'' &larr; ''b_i'' - ''b_2i''

:## If r = 0 return failure

:## x &larr; ''r^-1''(''a_2i'' - ''a_i'') mod ''p''

:## return x

:# If ''x_i'' &ne; ''x_2i'' then ''i'' &larr; ''i+1'', and go to step 2.

==Example==

Consider, for example, the group generated by 2 modulo <math>N=1019</math> (the order of the group is <math>n=1018</math>, 2

generates the group of units modulo 1019). The algorithm is implemented by the following [[C++]] program:

#include <stdio.h>

const int n = 1018, N = n + 1; // N = 1019 -- prime

const int alpha = 2; // generator

const int beta = 5; // 2^{10} = 1024 = 5 (N)

void new_xab(int& x, int& a, int& b){

switch(x%3){

case 0: x = x*x % N; a = a*2 % n; b = b*2 % n; break;

case 1: x = x*alpha % N; a = (a+1) % n; break;

case 2: x = x*beta % N; b = (b+1) % n; break;

}

}

int main(){

int x=1, a=0, b=0;

int X=x, A=a, B=b;

for(int i = 1; i < n; ++i){

new_xab(x, a, b);

new_xab(X, A, B); new_xab(X, A, B);

printf("%3d %4d %3d %3d %4d %3d %3d\n", i, x, a, b, X, A, B);

if(x == X) break;

}

return 0;

}

The results are as follows (edited):

i x a b X A B

------------------------------

1 2 1 0 10 1 1

2 10 1 1 100 2 2

3 20 2 1 1000 3 3

4 100 2 2 425 8 6

5 200 3 2 436 16 14

6 1000 3 3 284 17 15

7 981 4 3 986 17 17

8 425 8 6 194 17 19

..............................

48 224 680 376 86 299 412

49 101 680 377 860 300 413

50 505 680 378 101 300 415

51 1010 681 378 1010 301 416

That is <math>2^{681} 5^{378} = 1010 = 2^{301} 5^{416} \pmod{1019}</math> and so <math>(416-378)\gamma = 681-301 \pmod{1018}</math>, for which <math>\gamma_1=10</math> is a solution as expected. As <math>n=1018</math> is not prime, there is another solution <math>\gamma_2=519</math>, for which <math>2^{519} = 1014 = -5\pmod{1019}</math> holds.

==References==

* J. Pollard, ''Monte Carlo methods for index computation mod p'', Mathematics of Computation, Volume 32, 1978.

* Alfred J. Menezes, Paul C. van Oorschot, and Scott A. Vanstone, [http://www.cacr.math.uwaterloo.ca/hac/about/chap3.pdf Handbook of Applied Cryptography, Chapter 3], 2001.

[[category:logarithms]]