Better Random Walks for Pollard's Rho Method

We consider Pollard's rho method for discrete logarithm computation. In the analysis of its running time, the crucial assumption is made that a random walk in the underlying group is simulated. We show that this assumption does not exactly hold for the walk originally suggested by Pollard. We study alternative walks that can be eeciently applied to compute discrete logarithms. We introduce a class of walks that, in experiments, lead to the same performance as expected in the random case. We show that this holds for arbitrarily large prime group orders, under a much weaker assumption than before.