Shank's Baby-Step Giant-Step Attack Extended To Discrete Log with Lucas Sequences

Size: px

Start display at page:

Download "Shank's Baby-Step Giant-Step Attack Extended To Discrete Log with Lucas Sequences"

Suzanna Debra Harper
5 years ago
Views:

1 IOSR Joural of Mathematics (IOSR-JM e-issn: , -ISSN: X. Volume, Issue Ver. I (Ja. - Feb. 06, PP Shak's Baby-Ste Giat-Ste Attack Exteded To Discrete Log with Lucas Sequeces P.Auradha Kameswari, T. Suredra, B.Ravitheja 3 Deartmet of Mathematics/ Adhra Uiversity/Visakhaatam, Adhra Pradesh/Idia Deartmet of Mathematics/ GITAM Uiversity /Visakhaatam, Adhra Pradesh/Idia 3 Deartmet of Mathematics/ Adhra Uiversity/Visakhaatam, Adhra Pradesh/Idia Abstract: The grous of much attetio for which the Diffie - Hellma roblem may be hard ad used securely are the multilicative grou F, (Z/Z ad the grou of ratioal oits o a ellitic curve over a fiite field. These grous ivolve large key sizes or exesive arithmetic oeratios. I this aer we cosider the grou of Lucas sequeces ad describe the geeralizatio of discrete log roblem to the grou of Lucas sequeces ad adat the baby-ste giat-ste algorithm to the geeralizatio. For the comutatios we imlemet fast comutig methods roosed by Smith. Key word: Discrete Log Problem, Lucas Sequeces, Public Key Crytograhy. I. Itroductio The develomet of ublic key crytograhy due to Diffie ad Hellma is based o usig Discrete Logarithm as oe way fuctio. The Discrete Logarithm roblem i fiite fields F is based o the fact that is cyclic ad if g is ay geerator every elemet of F is g a for some o egative iteger a. For the discrete log roblem i (Z/Z we cosider the geerator g of a cyclic subgrou or a rimitive root g mod. More geerally the discrete log roblem may be discussed i ay grou with the grou law i lace of multilicatio. I this aer we first discuss the discrete log roblem i the fiite grous of the form DOI: / Page F F or (Z/Z ad some of its attacks ad the describe the discrete log i grou L(, N of Lucas sequeces ad look at the ossible extesio of the Baby-Giat extesio.[, 4]. Discrete Log Problem Public key crytograhy based o the difficulty of discrete log roblem due to Diffie- Hellma is a rotocol used for key exchage i a classical crytosystem ad also used i ublic key crytosystems like ElGamal crytosystem... Defiitio Let G be a fiite grou of the form (Z/Zor F ad b be a fixed elemet of G, if y is ay elemet of G of the form y = b x for some x. The the roblem of fidig the x give y is called the discrete logarithm roblem. We write x log y ad x is called discrete logarithm of y to the base b.[].. Examle Let G = Z 7 b ad take b=3 the geerator of Z 7 q the the discrete log of 3 to base 3 i such that 3 x 3(mod7, ote for x=4, 3 4 3(mod7...3 Examle Let G = Z for = 999 ad take b = 3 the geerator of G the the discrete log of 45 to base 3 is x such that 3 x 45(mod999. Note i this examle comutig that x = 789 is difficult but comutig (mod999 is easy by adatig the modular exoetiatio method.. Diffie-Hellma Key Exchage The Diffie-Hellma rotocol works as follows. A ad B wish to agree o a commo secret key to commuicate over a isecure chael. A chooses a large rime ad a iteger g such that - ad a iteger a{0,,.-} radomly, the he comutes g a mod ad makes (, g, g a ublic. B chooses a iteger b{0,,. -}radomly, the he comutes g b mod ad makes (, g, g b ublic. The they agree uo the k = g ab mod as the commo shared secret key. To comute the discrete log there are algorithms likes Trial exoetiatio, Shaks Baby -Ste Gait- Ste Method, Pollard's method, Pohlig-hellma method, Idex calculus method etc. I this aer we describe Z 7 is x

2 Shak's Baby-Ste Giat-Ste Attack Exteded To Discrete Log With Lucas Sequeces Shaks Baby -Ste Gait-Ste Method for discrete log i F or (Z/Z ad the describe the imlemetatio of Shaks Baby -Ste Gait-Ste Method to discrete log with lucas sequeces. This gives a wider crossectioal view i the study of attacks o exteded discrete logarithms. The earliest method for fidig the discrete logarithm x from =g x (DLP is to check whether x = 0,,,3, satisfy DLP. If oe of these x values satisfy the Discrete Logarithm is foud. This is the Trial exoetiatio. It eeds eumeratio of x - multilicatios ad x comarisos i the grou ad the three elemets x, g ad g x eed to be stored.[8, ].. Examle The Discrete Logarithm of 3 to the base 5 i (Z/07Z with eumeratio of 09 multilicatios modulo 07 yields x = Shaks Baby-Ste Giat-Ste Algorithm A otable develomet of eumeratio is the Shaks Baby-ste Giat-Ste algorithm. This algorithm eeds less umber of grou oeratios but storage should be greater. This algorithm is described as follows. Set where is the grou order ad write the ukow Discrete Logarithm as x = qm + r, 0 r < m. Thus r is the remaider ad q is the quotiet of the divisio of x by m. The Baby-ste Giat-ste algorithm calculates q ad r. DOI: / Page We have g qm+r = g x = (g m q = g -r We first comute the set of Baby-stes B = {(g -r, r: 0 r < m} ad if we fid a air (, r i the set B; the g -r = (i.e. =g r, the we ca set x = r with the smallest of such x. If such a air ot foud, we determie = g m. The we check for q =,, 3, if the grou elemet q is the first comoet of a elemet i B, that is we check if there is a air ( q, r i B, ad whe it is true, we have g -r = q = g qm =g qm+r Therefore x = qm + r is the discrete logarithm ad the elemets of q, q=,,3,... are kow as Giat stes. We should comare each q with all first comoets of the Baby-Ste set B. To make this comariso effective, the elemets of B are stored i a hash table where the key is the first elemet. If we use a hash table, the a costat umber of comarisos are sufficiet to check whether a grou elemet comuted as a giat-ste is a first comoet of a baby-ste. Therefore, the followig result is easy to verify that the baby-ste giat-ste algorithm requires O( G multilicatios ad comarisos i G. It eeds storage for O( G elemets of G. Time ad sace requiremets of the Baby-ste giat-ste algorithm are aroximately G. If G > 60,the comutig discrete logarithms with the baby-ste giat-ste algorithm is still ifeasible.[8].3. Examle Determie the Discrete Logarithm of 3 to the base 7 i (Z/7Z. We have =g x (mod7 ad m = 7 = 4. i.e. = 3, g = 7. The Baby-ste is B = {(g -r, r: 0 r < m} B = {(37 -r, r: 0 r < 4} = {(3,0,(5,,(6,,(,3} Therefore (g -r, r = (, 3 (g -3, 3 = (, 3 g -3 = 3(7-3 = 37 3 (mod7 x = 3 is the discrete log of 3 to the base 7. I this examle there is o eed to go for Giat-ste, because solutio is foud i Baby-ste itself..3. Examle Determie the Discrete Logarithm of 3 to the base 5 i (Z/9Z. We have = g x (mod9 ad m = 9 = 4.

3 Shak's Baby-Ste Giat-Ste Attack Exteded To Discrete Log With Lucas Sequeces i.e. = 3, g = 5. The Baby-ste is B = {(g -r, r: 0 r < m} = {(35 -r, r: 0r<4} = {(3,0,(,,(0,,(,3} Here we do ot fid a air (,r, so we have to determie q = g mq, where q =,,3, q = 5 4q (mod 9 The Giat-stes are 3, 7,, We have (, i the baby-ste set. Therefore, g = + 9Z. Sice has bee foud as the third giat-ste, we obtai g 34 = g - g 34+ =. x = 34 + = 3 is the discrete log of 3 to the base Observatio To comute Baby-ste set, 4 multilicatios mod 9 were ecessary, where as to comute giat stes, 3 multilicatios mod 9 were ecessary. II. Lucas Sequeces Lucas sequeces are widely used i crytograhy. There are RSA like Elgamal like crytosystems based o Lucas sequeces. Lucas sequeces are also used i the crytaalytic study.[5]. Itroducig Lucas sequeces.. Defiitio Let a ad b be two itegers ad a root of the olyomial x -ax + b i Q( for = a -4b a o square, writig a ad its cojugate a we have + = a, = b, - = ad the Lucas sequeces {V (a,b} ad {U (a,b}, 0 are defied as V b U b. Lucas Sequeces Satisfy The Followig Relatios. V (a,b = (V (a,b b. V - (a,b = V (a,bv - (a,b ab - 3. V + (a,b = a(v (a,b -bv (a,bv - (a,b ab 4. (V (a,b = (U (a,b +4b 5. V km (a,b = V k (V m (a,b, b k 6. U km (a,b = U k (V m (a,b, b k U m (a,b 7. V k+m (a,b = (V k(a,bv m (a,b+ U k (a,bu m (a,b 8. U k+m (a,b = (U k(a,bv m (a,b+ U m (a,b V k (a,b.3 Modular Comutatios With The Lucas Sequeces e N... e r r.3. Defiitio [3,5] Let, s odd rimes ad defie the fuctio i e S(N=lcm i i ( i (. i i The followig theorem is a aalogue to Euler Fermat theorem. r e er.3. Theorem For N... ad i does ot divide, the U V S ( N t S ( N t U V 0 0 mod N 0 mod N r for some it eger t ad i does ot divide. DOI: / Page

4 Shak's Baby-Ste Giat-Ste Attack Exteded To Discrete Log With Lucas Sequeces.4 Grou Structure o Lucas Sequece Let N be a iteger with gcd(,n= ad write V k for V k (a,, cosider the set L(,N={( V k, U k mod N: k0} the for all (V k, (V m,u m L(,N we (V,U (V,U =(V,U modn. k k m m k+m k+m defie a oeratio o L(,N as follows.4. Theorem L(,N forms a abelia grou with resect to oeratio defied as (V k (V m,u m =(V k+m +m Proof. is closed L(,N is closed w.r.t follows by defiitio. is associative For ay (V k, U k, (V m, U m, (V l, U l L(, N we have by the defiitio (V k+m +m (V l,u l =(V (k+m+l,u (k+m+l (V k+m +m (V l,u l =(V k+(m+l +(m+l Therefore L(,N is associative. 3.(V 0 is the idetity =(V k (V m+l,u m+l modn For ay (V k, U k L(,N we have (V 0, U 0 L(,N such that (V k (V 0 =(V k+0 +0 =(V k Therefore (V 0 is the Idetity. 4. Iverse of (V k =(V 0 (V k For ay (V k, U k L(,N, we have (V( S(N-k, U( S(N-k L(,N, is the iverse of (V k ad (V k (V (S(N-k,U (S(N-k =(V k+(s(n-k +(S(N-k modn =(V ks(n S(N modn = (,0 by theorem.3. =(V 0 modn Therefore (V (s(n-k,u (s(n-k is the iverse of (V k 5. is commutative (V m,u m (V,U =(V m+,u m+ =(V +m,u +m =(V,U m (V m,u Therefore L(,N is a abelia grou. III. Fast Comutatio Method For V e We describe the fast comutatio method to comute V suggested by P.Smith for Lucas sequeces, e this method directly leads to the comutatio of V e with o ambiguity of addig or doublig at each stage right from V by usig the above recursive formulas. [3,] We give a algorithm for this fast comutatio i this sectio. t For ay iteger m, we have the biary exressio give as e= x t-i,x =,x =0 or, for i 0. i 0 i t=0 DOI: / Page

5 Shak's Baby-Ste Giat-Ste Attack Exteded To Discrete Log With Lucas Sequeces k Let e = k x k-i, for 0 k t, the e i t =e, e 0 =. i=0 ek if xk 0 3. Theorem e k+ = ek if xk ek if xk 0 3. Remark e k+ + = (ek if xk ek if xk 0 e k+ - = ek if xk. 3.3 Remark V e are comuted by evaluatig V ek for k=0,,...,t by usig recursive formulas for V er +,V e r - ad V er for r k. We give i the followig a algorithm for fast comutatio method for comutig the Lucas sequeces V e (a, mod N. Let a be a iteger modulo N, we iitialize with V (a,=a to obtai the result V e (a,. 3.4 Algorithm t Ste : Write the biary exressio of e as e= x t-i,x =. i 0 i=0 Ste : Iitialize the values V =V (a, c V c+ =V - V c - = Ste 3: For i from 0 to t do c c c- c V c V c IV. V c V c V c V V c V c V c- V c if x i = the c c+ c- c V c+ V Vc VcV c V V c V c V c V c+ V c V c else c c c c Discrete Log with Lucas Sequeces Let L(, N be the grou of Lucas sequeces with D=a -4 mod, the for ay (,L(, N if =V m (a give ad a to fid m is the Discrete Log roblem of Lucas sequeces ad m may be called the discrete log of to the base a.[6] 4. Exteded Diffie Hellma Protocol With Lucas Sequeces L(, N be a grou of Lucas sequeces for =a -4 mod N.. A ad B geerate m, Z S(N the secret keys resectively ad calculate their resective ublic keys P A adp B as P A =V m (a ad P B =V (a.. A ad B exchage their ublic keys (a,p A ad (a,p B. DOI: / Page

6 Shak's Baby-Ste Giat-Ste Attack Exteded To Discrete Log With Lucas Sequeces 3. A receives P from B ad calculates K = V (P =V (V (a=v (a. B m B m m 4. B receives P from A ad calculates K = V (P =V (V (a=v (a=v (a. A A m m m 5. The A ad B agree uo K=V (a as the shared secret key. m 4. To Exted Shak s Baby-ste Giat-Ste attack o Discrete Log roblem with Lucas Sequeces The attacker ca gather the shared secret key if he comutes m or from the ublic iformatio P A or P B, so we emloy Shak s Baby-ste Giat-ste method to the Discrete Log roblem with Lucas sequeces as follows. I this method we comute m from the ublic key V m (a. Let =S(N be the order of the grou L(,N ad t= for =S(N. Now by divisio algorithm for t ad m we write the ukow discrete logarithm as m=qt+r, for 0r<t. Thus r is the remaider ad q is the quotiet of the divisio of m by t. The Baby-ste Giatste algorithm calculates q ad r. We have V m (a = V tq+r (a =, ow by grou oeratio å o L(, N we have V tq+r (a = V tq å Vr(a= V tq = å (Vr (a - We first comute the set of Baby-Stes B = ( å (Vr (a -, r: 0r<t ad if we fid a air (V 0,r i B, if exists the a (V r (a - V 0 mod N V 0 å (Vr (a mod N (V r (a mod N the take m=r ad V m (a== V r (a ad if such air i B is ot foud we determie =V t (a ad evaluate V q ( for all q=,,3, util for some q there is a air ( V (, r i B for some r, the we have V q (= å (Vr (a - =V q ( å (Vr (a =V q (V t (a V r (a =V qt (a V r (a =V qt+r (a =V m (a therefore m=qt+r is the discrete log of to base a. q 4.. Examle Let N=7 ad a=5 the =a -4 = 5-4 = ad S(N=N-( /N=7-=6. I L(,N give = to fid the discrete log of to the base 5. We have t= = 6=4 ad by divisio algorithm m = tq+r, 0r < t i.e. m = 4q + r; r = 0,, or 3. To fid V (a=a, we have to fid V m 4q+r (a=, i this cotext we comute the airs ( å Vr (a -, r i B for r=0,,,3; ad a=5. We have (V r (a - =V (S(N-r ad usig the fast comutig method V 0 (5=;(V 0 (5 - =V 0 (5= V (5=5;(V (5 - =V 5 (5=5 V (5=6;(V (5 - =V 4 (5=6 V 3 (5=8;(V 3 (5 - =V 3 (5=8 B ={ ( å ( V (5,0; ( å ( V (5,; ( å( V (5,;( å ( V (5,3 } 0 å å 5 4 ( ( V (5,0; ( ( V (5,; 3 ={ 0 ( å ( V (5,; ( å ( V3(5,3 }. Now we ca comute these values usig the roduct V V =V i the grou (L( k m k+m,n; ad aly the formula V (, km a b ( Vk b Vm b Uk b Um b DOI: / Page

7 Shak's Baby-Ste Giat-Ste Attack Exteded To Discrete Log With Lucas Sequeces by comutig the corresodig U s by usig formula i V b U b 4b. So, for a=5 we have =4; ad U V 0 (5= 0 (5-4 = -4 4 =0(mod7=0 V b U U V 5 (5 = 5 (5-4 = = 4 =(mod7= DOI: / Page b 4b 4 ( U 4 (5 V 8(mod U V 3 (5= 3 (5-4 = = 60 4 =5(mod7=5. Therefore U 0 (5=0;U 5 (5=;U 4 (5=5;U 3 (5=7, ow from the formula of V k+m (a,b,wehave å V0 (5 = å ( (mod7 å V5 (5 = å 5 ( (mod7 5 å V4 (5 = å 6 ( (mod7 å V3 (5 = å 8 ( (mod7 B={ ( V, r: r=0,,,3}={(,0, (5,, (,, (,3} r The air (V 0,r does ot exists i B, so we take =V t (a= V 4 (5=0 ad evaluate V q ( for all q=,,3, util for some q there is a air ( V (, r i B for some r, we have V (0 0( mod7 0; V (0 ( mod7 5 for q, r. Therefore m tq r 4. 9, also V 9 (5. q V. Coclusio The geeralizatio of discrete log roblem to Lucas sequeces is obtaiig a ±k from v k. mod as a root of the irreducible olyomial x -v k (a,x+ over F of degree ad retrievig k from a ±k i.e. it is a discrete log roblem i F. The discrete log roblem with Lucas sequeces is origially cosidered as equivalet to roblems with Dickso olyomials. I this aer we deicted the discrete log roblem o Lucas sequeces as geeralizatio of discrete log roblem to grou of Lucas sequeces ad adat the Shak s Babyste Giat-ste attack ad described the fast comutatio method with a algorithm that may be used i the comutatios of Lucas sequeces. Refereces Joural aers []. W. Diffie ad M.E. Hellma, New directios i crytograhy", IEEE Tras. Iform. Theory, IT-(6: , 976. []. T. ElGamal, A ublic key crytosystem ad a sigature scheme based o discrete logarithms", IEEE Tras. Iform. Theory, 3(4:469-47, 985. [3]. Marc Gysi, The Discrete Logarithm Problem for Lucas Sequeces ad a New Class of Weak RSA Moduli", The Uiversity of Wollogog, NSW 5. [4]. Peter J. Smith ad Michael J.J. Leo, A New Public Key System", LUC Parters, Aucklad UiServices Ltd, The Uiversity of Aucklad, Private Bag 909m Aucklad, New Zealad. [5]. B.Ravitheja, RSA-Like Crytosystem based o the Lucas Sequece", dissertatio, 05.

8 Shak's Baby-Ste Giat-Ste Attack Exteded To Discrete Log With Lucas Sequeces [6]. P.J.Smith, G.J.J.Leo, LUC: a ew ublic key crytosystem", Nith IFIP Symoiusm o Comuter Sciece Security, Elsevier Sciece Publictios ( Books [7]. Tom M. Aostol, Itroductio to Aalytic Number Theory", Sriger-Verlag, New York Ic. [8]. J. Buchma, Itroductio to crytograhy", Sriger-Verlag 00. [9]. P.B.Bhattacharya, S.K. Jai, S.R. Nagaul Basic Abstract Algebra", d editio, Cambridge Uiversity ress. [0]. A.J.Meezes, P.C. va Oorschot, ad S.A. Vastoe, Had book of Alied Crytograhy." CRC Press Series o Discrete Mathematics ad its Alicatios. CRC Press, Boca Rato, FL, 997. With a foreword by Roald L. Rivest. []. Neal Koblitz A course i umber theory ad crytograhy ISBN ,SPIN ". []. Sog Y. Ya, Number Theory for comutig", d editio, Sriger, ISBN: Proceedigs i Paers [3]. G. Maze, C. Moico, ad J. Rosethal, A ublic key crytosystem based o actios by semigrous". I the roceedigs of the 00 IEEE Iteratioal Symosium o Iformatio Theory, age XY, Lausae, Switzerlad, 00. DOI: / Page

Chapter 2. Finite Fields (Chapter 3 in the text)

Chapter 2. Finite Fields (Chapter 3 in the text) Chater 2. Fiite Fields (Chater 3 i the tet 1. Grou Structures 2. Costructios of Fiite Fields GF(2 ad GF( 3. Basic Theory of Fiite Fields 4. The Miimal Polyomials 5. Trace Fuctios 6. Subfields 1. Grou Structures