Cryptanalysis in Prime Order Subgroups of Z

Many cryptographic protocols and cryptosystems have been proposed to make use of prime order subgroups of Z n where n is the product of two large distinct primes. In this paper we analyze a number of such schemes. While these schemes were proposed to utilize the diiculty of factoring large integers or that of nding related hidden information (e.g., the order of the group Z n), our analyzes reveal much easier problems as their real security bases. We itemize three classes of security failures and formulate a simple algorithm for factoring n with a disclosed non-trivial factor of (n) where the disclosure is for making use of a prime order subgroup in Z n. The time complexity of our algorithm is O(n 1=4 =f) where f is a disclosed subgroup order. To factor such n of length up to 800 bits with the subgroup having a secure size against computing discrete logarithm, the new algorithm will have a feasible running time on use of a trivial size of storage.