The Discrete Logarithm Problem as an Optimization Task: A First Study

Transcription

1 The Dscrete Logarthm Problem as an Optmzaton Task: A Frst Study E.C. Laskar (1,3), G.C. Meletou (2,3), M.N. Vrahats (1,3) (1) Department of Mathematcs, Unversty of Patras, GR Patras, Greece, (2) A.T.E.I. of Eprus, P.O. Box 110, GR Arta, Greece, (3) Unversty of Patras Artfcal Intellgence Research Center (UPAIRC), Unversty of Patras, GR Patras, Greece Emal: elena@math.upatras.gr, gmelet@teep.gr, vrahats@math.upatras.gr Abstract Most of the contemporary cryptographc systems are based on mathematcal problems whose solutons are generally ntractable n polynomal tme; such problems are the dscrete logarthm problem and the nteger factorzaton problem. In ths contrbuton we consder the dscrete logarthm problem as an Integer Programmng Problem. Two Evolutonary Computaton methods, namely the Partcle Swarm Optmzaton and the Dfferental Evoluton algorthm, as well as the Random Search technque, are employed as a frst approach to tackle ths new Integer Programmng Problem. Results ndcate that ths new approach s promsng. 1 Introducton Cryptography s ndspensable n numerous developng felds, such as electronc transactons, e-commerce, e- busness, e-votng and others, and has thus become a key technology for the emergng nformaton technologes socety. A number of hard and complex computatonal problems have been motvated by publc key cryptography. The assumpton that these problems are n general computatonally ntractable n polynomal tme forms the bass of the relablty of contemporary cryptosystems. Such problems are the nteger factorzaton problem related to the RSA cryptosystem; the ndex computaton or the dscrete logarthm problem related to the El Gamal cryptosystem, as well as, to the Dffe Hellman key exchange; knapsack problems, and others [2, 4, 19, 20]. These problems orgnate from dfferent felds of mathematcs, ncludng computatonal algebra, computatonal number theory, probablty, mathematcal logc, Dophantne complexty, algebrac geometry, etc. The algebrac structures whch are used for the representaton of cryptosystems are fnte felds, Z p or GF (p, k), rngs Z N and fnte groups, ncludng groups derved from ellptc curves. In general, computaton on such structures s very hard. For example, n a fnte feld we cannot fnd a non-trval topology, whch renders t a topologcal feld (that s makng addton and multplcaton contnuous functons). The same holds for a non trval order or a non trval dstance. Concepts lke near, greater than, less than, approxmaton, convergence have no meanng n a fnte feld. Ths s one of the reasons why fnte felds are appled n cryptography. Tradtonal computatonal tools are desgned for the approxmaton of real (complex) numbers, or functons, and therefore cannot be drectly appled to computatons over fnte felds. The dscrete logarthm problem (DLP) s defned as follows: gven a prme p, a generator α of Z p, and an element β Z p, fnd the nteger x, 0 x p 2, such that α x β (mod p). 1

2 The frst efforts for the soluton of the DLP led to the development of algorthms lke Shanks s baby step gant step algorthm, Pollard s rho algorthm and ther varants [15, 16, 22], whch were later classfed as generc. These algorthms requre at most O(p 1/2 ) group operatons and they are optmal snce O(p 1/2 ) has been proved to be a lower bound for generc algorthms [24]. Non generc algorthms, namely the ndex calculus algorthms, have also been developed. These algorthms acheve a subexponental runnng tme and the Number Feld Seve verson [7] s the asymptotcally fastest known method for the computaton of the dscrete logarthms n prme felds. Its runnng tme s gven by L p [1/3, (64/9)(1/3)], where L p [ν, δ] = exp((δ + o(1))(log p) ν (log log p) 1 ν ). A survey of the current state of the art n dscrete logarthms can be found n [11, 12]. In ths contrbuton we consder the DLP as an Integer Programmng Problem (IPP) and a frst approach to tackle t through Evolutonary Computaton methods and Random Search. Evolutonary Computaton algorthms are stochastc optmzaton methods that nvolve algorthmc mechansms nspred by natural evoluton and socal behavor respectvely. They can handle problems that nvolve dscontnuous objectve functons and dsjont search spaces [5, 9, 21]. Commonly encountered paradgms of such methods are Genetc Algorthms (GA), Evoluton Strateges (ES), Dfferental Evoluton algorthm (DE) and the Partcle Swarm Optmzaton (PSO). GA and ES are based on the prncples of natural evoluton. On the other hand, PSO s based on the smulaton of socal behavor. Optmzaton technques for real search spaces can be appled on Integer Programmng problems through slght modfcaton. Usually, the optmum soluton s determned by roundng off the real optmum values to the nearest nteger [18]. Early approaches n the drecton of Evolutonary Algorthms for Integer Programmng problems are reported n [6, 8]. In ths paper we study the performance of two Evolutonary Computaton methods, namely PSO and DE, as well as the Random Search technque to solve the DLP. The rest of the paper s organzed as follows. In Secton 2 the PSO and DE algorthms are brefly descrbed. In Secton 3 the formulaton of the DLP as an optmzaton problem s gven and expermental results are reported. In Secton 4 conclusons and nsghts for further work are derved. 2 The Evolutonary Computaton methods consdered For completeness purposes, n ths secton we brefly descrbe the two Evolutonary Computaton methods. PSO s a populaton based algorthm that explots a populaton of ndvduals, to search promsng regons of the functon space. In ths context, the populaton s called swarm and the ndvduals are called partcles. Each partcle moves wth an adaptable velocty wthn the search space, and retans n ts memory the best poston t ever encountered. In the global varant of the PSO the best poston ever attaned by all ndvduals of the swarm s communcated to all the partcles. In the local varant, each partcle s assgned to a neghborhood consstng of a prespecfed number of partcles. In ths case, the best poston ever attaned by the partcles that comprse the neghborhood s communcated among them [3]. Assume a D dmensonal search space, S R D, and a swarm of N partcles. The th partcle s n effect a D dmensonal vector X = (x 1, x 2,..., x D ). The velocty of ths partcle s also a D dmensonal vector, V = (v 1, v 2,..., v D ). The best prevous poston ever encountered by the th partcle s a pont n S, denoted by P = (p 1, p 2,..., p D ). Assume g, to be the ndex of the partcle that attaned the best prevous poston among all the ndvduals of the swarm. Then, accordng to the constrcton factor verson of PSO the swarm s manpulated usng the followng equatons [1]: ( ( V (t+1) = χ V (t) + c 1 r 1 P (t) + c 2 r 2 ( P (t) g ) + ) ), (1) X (t+1) = X (t) + V (t+1), (2) where = 1, 2,..., N; χ s the constrcton factor; c 1 and c 2 denote the cogntve and socal parameters respectvely; r 1, r 2 are random numbers unformly dstrbuted n the range [0, 1]; and t, stands for the counter of teratons. 2

3 The value of the constrcton factor s typcally obtaned through the formula χ = 2κ/ 2 φ φ 2 4φ, for φ > 4, where φ = c 1 + c 2, and κ = 1. Dfferent confguratons of χ as well as a theoretcal analyss of the dervaton of the above formula, can be found n [1]. In a dfferent verson of PSO, a parameter called nerta weght, s used, and the swarm s manpulated accordng to the formulae [3, 9, 23]: ( V (t+1) = wv (t) + c 1 r 1 P (t) +c 2 r 2 ( P (t) g ) + ), (3) X (t+1) = X (t) + V (t+1), (4) where = 1, 2,..., N; and w s the nerta weght, whle all other varables are the same as n the constrcton factor verson. There s no explct formula for the determnaton of the factor w, whch controls the mpact of the prevous hstory of veloctes on the current one. However, snce a large nerta weght facltates global exploraton (searchng new areas), whle a small one tends to facltate local exploraton, (fne tunng the current search area) t appears ntutvely appealng to ntally set t to a large value and to gradually decrease t to obtan more refned solutons. The superorty of ths approach aganst the selecton of a constant nerta weght, has been expermentally verfed [23]. Thus, an ntal value around 1.2 and a gradual declne toward 0.1 can be consdered as a good choce for w. Proper fne tunng of the parameters c 1 and c 2, results n faster convergence and allevaton of local mnma. As default values, c 1 = c 2 = 2 have been proposed, but expermental results ndcate that alternatve confguratons, dependng on the problem at hand, can produce superor performance [9, 13]. Typcally, the swarm and the veloctes, are ntalzed randomly n the search space. For unform random ntalzaton n a multdmensonal search space, a Sobol Sequence Generator can be used [17]. Recently, the performance of the PSO method for the IPP was studed n [10] wth very promsng results. The DE algorthm has been developed by Storn and Prce [25]. It s a parallel drect numercal search method, whch utlzes N, D dmensonal parameter vectors x,g, = 1,..., N, as a populaton for each teraton (generaton) of the algorthm. The ntal populaton s taken to be unformly dstrbuted n the search space. At each generaton, the mutaton and crossover (recombnaton) operators are appled on the ndvduals, gvng rse to a new populaton, whch s subsequently subjected to the selecton phase. Accordng to the mutaton operator, for each vector x,g, = 1,..., N, a mutant vector s generated through the equaton: v,g+1 = x r1,g + F (x r2,g x r3,g), (5) where r 1, r 2, r 3 {1,..., N}, are mutually dfferent random ndexes, and, F (0, 2]. The ndexes r 1, r 2, r 3, also need to dffer from the current ndex,. Consequently, to apply mutaton, N must be greater than, or equal to, 4. Followng the mutaton phase, the crossover operator s appled on the populaton. Thus, a tral vector, u,g+1 = (u 1,G+1, u 2,G+1,..., u D,G+1 ), (6) s generated, where, { vj,g+1,f (randb(j) CR) or j = rnbr(), u j,g+1 = x j,g, f (randb(j) > CR) and j rnbr(), (7) where, j = 1, 2,..., D; randb(j), s the j th evaluaton of a unform random number generator n the range [0, 1]; CR s the (user specfed) crossover constant n the range [0, 1]; and, rnbr() s a randomly chosen ndex from the set {1, 2,..., D}. To decde whether or not the vector u,g+1 wll be a member of the populaton of the next generaton, t s compared to the ntal vector x,g. Thus, { u,g+1, f f(u x,g+1 =,G+1 ) < f(x,g ), x,g, otherwse. The procedure descrbed above s consdered as the standard varant of the DE algorthm. Dfferent mutaton and crossover operators have been appled wth promsng results [25]. In order to classfy the dfferent varants, the scheme DE/x/y/z s used, where x specfes the mutated vector ( rand for randomly selected ndvdual or best for selecton of the best ndvdual); y s the number of dfference vectors used; and, z denotes the crossover scheme (the scheme descrbed here s due to ndependent bnomal experments, and thus, t s denoted as bn ) [25]. Accordng to ths descrpton scheme, the DE 3

4 f(x) Fgure 1: Plot of the functon f(x) = α x β (mod p), for p = 101, α = 2 and β = 34. varant descrbed above s denoted as DE/rand/1/bn. One hghly benefcal scheme that deserves specal attenton s the DE/best/2/bn scheme, where v,g+1 = x best,g + F (x r1,g + x r2,g x r3,g x r4,g). The usage of two dfference vectors seems to mprove the dversty of the populaton, f N s large enough. 3 Problem formulaton and expermental results The dscrete logarthm problem (DLP) can be formulated as the mnmzaton of a functon where f : Z p {0, 1,..., p 1}, f(x) = α x β x (mod p), p s a gven prme, α s the generator of Z p and β Z p also gven. The global mnmum of the functon f s zero and the correspondng global mnmzer s the dscrete logarthm of β to base α modulo p. Thus, the DLP s transformed to an IPP on a bounded set. The global mnmzer of f s unque snce α s a generator. Notce that the value of f for a gven nteger x can be easly obtaned by the repeated square and multply algorthm for exponentatons n Z n [11]. Although, the DLP can be consdered as an one-dmensonal mnmzaton problem, t s not an easy task. The functon f produced by the DLP exhbts almost pseudo random behavor. For example, an llustraton of the functon f for p = 101, α = 2 and β = 34 s gven n Fg. 1. Furthermore, the safety of the cryptosystems based on the DLP requres large encrypton keys. The sze of the encrypton keys s proportonal to the number of dgts of the prme number p of the DLP. Thus, n the mnmzaton of f we are mostly nterested n large prmes p whch make the optmzaton procedure qute dffcult. An optmzaton algorthm capable of fndng the global mnmzer of f for large prmes p wth the smallest cost, suffces to break all the cryptosystems based on the correspondng dscrete logarthms. The two Evolutonary Computaton methods consdered, were appled on the DLP by roundng off real values to the nearest nteger. The global and local PSO varants of both the nerta weght and the constrcton factor versons, as well as the DE/rand/1/bn and DE/best/2/bn varants of the DE algorthm, have been used. Random Search technque has also been tested. For the velocty of the PSO method a lower bound V mn = 1 has been set to prevent premature convergence to local mnma. All populatons were constraned n the feasble regon of the problem. The performance of the methods was nvestgated for prme numbers p, n p = 1009 to p = For each prme number p consdered, 100 ndependent runs were performed and the correspondng results are exhbted n Tables 1,2. Concernng the notaton used n the Tables; PSOGW corresponds to the global varant of PSO method wth nerta weght; PSOGC s the global varant of PSO wth constrcton factor; PSOLW s PSO s local varant wth nerta weght; PSOLC s PSO s local varant wth constrcton factor, DE1 corresponds to the DE/rand/1/bn and DE2 to the DE/best/2/bn varants of DE method. Random Search results are denoted as RS. A run s consdered to be successful f the algorthm has dentfed the global mnmzer wthn a prespecfed number of functon evaluatons. Two functon evaluaton thresholds are mposed, log 2 2 p and log 3 2 p. The success rates of each algorthm consdered, that s the proporton of the tmes t acheved the global mnmzer wthn the prespecfed thresholds, are reported n the Tables. From the percentage c% of success rates reported, t s clear that the DLP can be broken f 100/c tmes the correspondng threshold functon evaluatons are performed. In Fg. 2 4

5 the total computatonal cost requred to break the DLP for varous prmes s exhbted n logarthmc scale. Success rate for Problem Method log 2 2 p log3 2 p PSOGW 7% 61% PSOGC 6% 63% p = 1009 PSOLW 3% 55% α = 11 PSOLC 7% 60% β = 337 DE1 4% 37% DE2 1% 45% RS 15% 68% PSOGW 4% 60% PSOGC 7% 68% p = 2003 PSOLW 5% 63% α = 5 PSOLC 6% 63% β = 668 DE1 5% 23% DE2 1% 24% RS 9% 46% PSOGW 3% 20% PSOGC 2% 21% p = 3001 PSOLW 3% 17% α = 14 PSOLC 2% 18% β = 1001 DE1 1% 15% DE2 1% 8% RS 3% 36% PSOGW 3% 28% PSOGC 3% 14% p = 4001 PSOLW 2% 27% α = 3 PSOLC 3% 15% β = 1334 DE1 1% 8% DE2 1% 10% RS 2% 33% PSOGW 1% 20% PSOGC 2% 35% p = 9973 PSOLW 2% 15% α = 11 PSOLC 3% 28% β = 3324 DE1 1% 11% DE2 0% 5% RS 5% 21% Table 1: Success rates of each method for two dfferent thresholds of functon evaluatons for p = 1009 to p = Conclusons Most of the contemporary cryptographc systems are based on mathematcal problems whose solutons are generally ntractable n polynomal tme. The dscrete logarthm problem s one of these problems and s related to the El Gamal cryptosystem and to the Dffe Hellman key exchange. In ths paper the dscrete logarthm problem s formulated as an Integer Programmng Problem whch s further addressed as a mnmzaton task. For ths purpose two Evolutonary Computaton methods, the Partcle log 10 (100 threshold / c) log 10 (p) Fgure 2: Computatonal cost requred to break the DLP for varous prmes, n logarthmc scale. Success rate for Problem Method log 2 2 p log3 2 p PSOGW 1% 23% PSOGC 1% 20% p = PSOLW 1% 24% α = 5 PSOLC 1% 20% β = 3336 DE1 1% 10% DE2 0% 6% RS 2% 27% PSOGW 0% 3% PSOGC 1% 7% p = PSOLW 0% 3% α = 6 PSOLC 1% 5% β = DE1 0% 4% DE2 0% 2% RS 1% 3% PSOGW 0% 2% PSOGC 0% 2% p = PSOLW 0% 2% α = 6 PSOLC 0% 3% β = DE1 0% 2% DE2 0% 0% RS 0% 2% PSOGW 0% 1% PSOGC 0% 2% p = PSOLW 0% 1% α = 2 PSOLC 0% 2% β = DE1 0% 0% DE2 0% 0% RS 0% 0% Table 2: Success rates of each method for two dfferent thresholds of functon evaluatons for p = to p = Swarm Optmzaton and the Dfferental Evoluton algorthm, as well as Random Search technque, were used. Evolutonary Computaton technques have the advantage 5

6 that they do not requre gradent nformaton and can operate on dscontnuous and dsjont search spaces [13]. The performance of these methods was tested on several nstances of the problem and the obtaned results ndcate that ths problem can be confronted n tme no more than subexponental. A sgnfcant advantage of these methods s that they can be readly parallelzed thereby reducng sgnfcantly the tme requred for ther executon [14]. Ths paper presents the frst results of an ongong research effort. Numerous ssues reman unresolved. Most mportantly the performance of the algorthms on very large prme numbers need to be nvestgated. References [1] M. Clerc and J. Kennedy, The partcle swarm exploson, stablty, and convergence n a multdmensonal complex space, IEEE Trans. Evol. Comput. 6 (2002), no. 1, [2] W. Dffe and M.E. Hellman, New drectons n cryptography, IEEE Transactons on Informaton Theory IT-22 (1976), no. 6, [3] R.C. Eberhart, P. Smpson, and R. Dobbns, Computatonal ntellgence pc tools, Academc Press, [4] T. ElGamal, A publc key cryptosystem and a sgnature scheme based on dscrete logarthms, IEEE Transactons on Informaton Theory 31 (1985), no. 4, [5] D.B. Fogel, Evolutonary computaton: Towards a new phlosophy of machne ntellgence, IEEE Press, Pscataway, NJ, [6] D.A. Gall, A practcal multfactor optmzaton crteron, Recent Advances n Optmzaton Technques (T.P. Vogl, ed.), 1966, pp [7] D. Gordon, Dscrete logarthms n GF(p) usng the number feld seve, SIAM J. Dscrete Math. 6 (1993), [8] R.C. Kelahan and J.L. Gaddy, Applcaton of the adaptve random search to dscrete and mxed nteger optmzaton, Internatonal Journal for Numercal Methods n Engnnerng 12 (1978), [9] J. Kennedy and R.C. Eberhart, Swarm ntellgence, Morgan Kaufmann Publshers, [10] E.C. Laskar, K.E. Parsopoulos, and M.N. Vrahats, Partcle swarm optmzaton for nteger programmng, Proceedngs of the IEEE 2002 Congress on Evolutonary Computaton (Hawa, HI), IEEE Press, 2002, pp [11] A. Menezes, P. van Oorschot, and S. Vanstone, Handbook of appled cryptography, CRC Press seres on dscrete mathematcs and ts applcatons, CRC Press, [12] A. Odlyzko, Dscrete logarthms: The past and the future, Desgns, Codes, and Cryptography 19 (2000), no. 2 3, [13] K.E. Parsopoulos and M.N. Vrahats, Recent approaches to global optmzaton problems through partcle swarm optmzaton, Natural Computng 1 (2002), [14] V.P. Plaganakos and M.N. Vrahats, Parallel evolutonary tranng algorthms for hardware frendly neural networks, Natural Computng 1 (2002), [15] J.M. Pollard, Monte carlo methods for ndex computaton (mod p), Mathematcs of Computaton 32 (1978), no. 143, [16], Kangaroos, monopoly and dscrete logarthms, Journal of Cryptology 13 (2000), [17] W.H. Press, S.A. Teukolsky, W.T. Vetterlng, and B.P. Flannery, Numercal recpes n fortran 77, Cambrdge Unversty Press, [18] S.S. Rao, Engneerng optmzaton theory and practce, Wley Eastern, New Delh, [19] R.L. Rvest, A. Shamr, and L. Adleman, A method for obtanng dgtal sgnatures and publc key cryptosystems, Communcatons of the ACM 21 (1978), [20] B. Schneer, Appled cryptography, second ed., John Wley and Sons, Inc., New York, [21] H.-P. Schwefel, Evoluton and optmum seekng, Wley, New York, [22] D. Shanks, Class number, a theory of factorzaton, and genera, In Proceedngs of Symposum n Pure Mathematcs, vol. 20, Amercan Mathematcal Socety, 1971, pp [23] Y. Sh and R.C. Eberhart, A modfed partcle swarm optmzer, Proc. IEEE Conference on Evolutonary Computaton (Anchorage, AK), IEEE Servce Center, [24] V. Shoup, Lower bounds for dscrete logarthms and related problems, Lecture Notes n Computer Scence 1233 (1997), [25] R. Storn and K. Prce, Dfferental evoluton a smple and effcent heurstc for global optmzaton over contnuous spaces, J. Global Optmzaton 11 (1997),