Notes in Computer Science 4004

Let g be an element of prime order p in an abelian group and α ∈ Zp. We show that if g, g, and g d are given for a positive divisor d of p − 1, we can compute the secret α in O(log p · ( p/d + √ d)) group operations using O(max{ p/d, √ d}) memory. If gαi (i = 0, 1, 2, . . . , d) are provided for a positive divisor d of p + 1, α can be computed in O(log p · ( p/d+ d)) group operations using O(max{ p/d, √ d}) memory. This implies that the strong Diffie-Hellman problem and its related problems have computational complexity reduced by O( √ d) from that of the discrete logarithm problem for such primes. Further we apply this algorithm to the schemes based on the DiffieHellman problem on an abelian group of prime order p. As a result, we reduce the complexity of recovering the secret key from O( √ p) to O( p/d) for Boldyreva’s blind signature and the original ElGamal scheme when p− 1 (resp. p+ 1) has a divisor d ≤ p (resp. d ≤ p) and d signature or decryption queries are allowed.