Score:3

Common exponent problem related to discrete logarithms assuming Diffie Hellman oracle

ru flag

Let $g$ be a generator of multiplicative group mod $p$ a prime.

Suppose we know $$g^{a+km_1}\bmod p$$ $$g^{b-km_2}\bmod p$$ $$g^{a+k'm_3}\bmod p$$ $$g^{b-k'm_4}\bmod p$$ where $m_2m_3-m_4m_1=\phi(p)$ where $\phi$ is Totient and $a,b,k,k'$ are the only unknown and all of $a$ through $m_4$ are of size $\sqrt p$ (we know $m_1$ through $m_4$ over $\mathbb Z$) can we identify $g^a$, $g^b$ in polynomial time?

We are allowed to assume a Diffie Hellman oracle?

poncho avatar
my flag
Is this a homework assignment? Or, is this a 'hard problem' you came up with when analyzing a crypto protocol?
Turbo avatar
ru flag
It is a hard problem... I am unable to make progress. I do not know if it has a solution.
kelalaka avatar
in flag
hard problem == Homework assingment?
Turbo avatar
ru flag
"I do not know if it has a solution" == research.
Score:2
my flag

Well, one obvious observation is that, if we call the four revealed values $C_1, C_2, C_3, C_4$ (so $C_1 = g^{a+km_1}$), then:

$$C_1^{-m_4} \cdot C_2^{m_3} \cdot C_3^{m_2} \cdot C_4^{-m_1} = (g^a)^{m_2-m_4} \cdot (g^b)^{m_3-m_1}$$

This can be used to distinguish a guess of $g_a, g_b$ from the correct values; hence if "can we identify" means "distinguish", then yes, we can do that.

I don't know if there is a way to add a second observation which would allow you to recover the $g^a, g^b$ values.

Daniel S avatar
ru flag
That's a necessary condition on $g^a$ and $g^b$, but not a sufficient one. For example the pair $g^{a+m_3-m_1}$ and $g^{b-m_2+m_4}$ would also pass this test.
Turbo avatar
ru flag
What if we assume DH oracle? I think it may not be necessary though.
Daniel S avatar
ru flag
@Turbo A DH oracle will not change the fact that there is a large family of solutions that pass poncho's test and any other test that relies on exponentiating and multiplying the $C_i$. Indeed this family allows us to take any arbitrary value for $g^a$ and find putative values for $g^b$, $g^k$ and $g^{k'}$ that pass all such tests.
Turbo avatar
ru flag
@DanielS But DH operations are not BB.. so may be there is hope?
Turbo avatar
ru flag
I think it should be $C_1^{m_4} \cdot C_2^{m_3} \cdot C_3^{m_2} \cdot C_4^{m_1} = (g^a)^{m_2+m_4} \cdot (g^b)^{m_3+m_1}$ in Poncho's approach. Or else the problem gets trivially solved.
Turbo avatar
ru flag
@DanielS It is unclear to me why DH cannot give benign relations as in Poncho's errored identity. Following works if Poncho's identity held.
Turbo avatar
ru flag
$$C_1^{-m_4} \cdot C_2^{m_3} \cdot C_3^{m_2} \cdot C_4^{-m_1} = (g^a)^{m_2-m_4} \cdot (g^b)^{m_3-m_1}\equiv(g^a)^{m_2-m_4} \cdot (g^{bm_1})^{\frac{m_3-m_1}{m_1}}$$ $$\equiv(g^a)^{m_2-m_4} \cdot (g^{am_2+bm_1})^{\frac{m_3-m_1}{m_1}}\cdot (g^{-am_2})^{\frac{m_3-m_1}{m_1}}$$ $$\equiv(g^a)^{m_2-m_4-m_2\frac{m_3-m_1}{m_1}} \cdot (g^{am_2+bm_1})^{\frac{m_3-m_1}{m_1}}\bmod p$$ $$\implies g^a\equiv\Big((C_1^{-m_4} \cdot C_2^{m_3} \cdot C_3^{m_2} \cdot C_4^{-m_1})\cdot(g^{am_2+bm_1})^{\frac{m_3-m_1}{m_1}}\Big)^{\frac1{m_2-m_4-m_2\frac{m_3-m_1}{m_1}}}\bmod p$$
Turbo avatar
ru flag
@poncho Perhaps DH can give identities which help.
Daniel S avatar
ru flag
The point here is that your first five equations give a system of four unknowns with three constraints so that there is an infinite family of solutions to the five equations. A DH oracle will allow you to form polynomial identities rather than just linear identities, but if the identities are based on the system of five equations all non-causal solutions will also satisfy them.
Turbo avatar
ru flag
@DanielS I see. What do you mean by non-causal solutions?
Turbo avatar
ru flag
@DanielS also note given $a+km$ we can get $a$ through modular arithmetic.. but here we have $g^{a+km}\bmod p$.
Daniel S avatar
ru flag
Let us [continue this discussion in chat](https://chat.stackexchange.com/rooms/134667/discussion-between-daniel-s-and-turbo).
Score:1
ru flag

I think not. If we could extend such a construction to black box group, it would give a $q^{1/4}$ method for solving discrete logarithms in that group. Also note that if the size constraint on $a$, $b$, $k$ and $k'$ is removed, the problem is not well-defined (there may be multiple solutions even in the constrained case; I'm not sure).

Multiple solutions if size constraints are ignored

Generically we can consider this isomorphic to a linear algebra problem in the exponents. We write $c_1=a+km_1$, $C_i=g^c_i\mod p$ and so forth. By multiplying terms $C_iC_j$ or exponentiating terms $C_i^d$ we can add $c_i+c_j$ or multiply our unknown exponents by constants $dc_i$, so that we can find $g^x$ where $x$ is an arbitrary linear combinations of these $c_i$ (a Diffie-Hellman oracle would allow us to form $g^y$ where $y$ is an arbitrary polynomial expressions in the $c_i$). Restricting ourselves to such linear combinations (as would be the case for a black box group), the problem becomes to find a linear combination of our $c_i$ that is equal to $a$ or $b$.

We have the system $$\left(\matrix{1&0&m_1&0\\ 0&1&0&-m_2\\ 1&0&m_3&0\\ 0&1&0&-m_4}\right)\left(\matrix{a\\ b\\ k\\ k'}\right)=\left(\matrix{c_1\\ c_2\\c_3\\c_4}\right)\pmod{\phi(p)}$$ if we write $M$ for the 4x4 matrix and $\mathbf c$ for the right hand vector, we might hope to find our linear combination from $M^{-1}\mathbf c$. However we see that $$\mathrm{det}(M)=m_1m_4-m_2m_3\equiv 0\pmod{\phi(p)}$$ so that our matrix is not invertible.

High school linear algebra now tells us that we either have no solutions or many solutions. The fact that our construction defines one solution tells us that there are many solutions. A little row reduction tells us that $m_2c_1+m_1c_2-m_3c_3-m_1c_4\equiv 0\pmod{\phi(p)}$. In particular then if e.g. $m_1$ is coprime to $\phi(p)$, we can determine $C_4$ given $C_1$, $C_2$ and $C_3$ and so the 4th equation grants us no additional information. In the absence of further degeneracy, it follows that we can, for example, choose an arbitrary $g^a$ and then find $g^k\equiv(C_1/g^a)^{1/m_1}\pmod p$, $g^b\equiv C_2(g^k)^{m_2}\pmod p$ and $g^{k'}\equiv(C_3/g^a)^{1/m_3}$ that produce the $C_1$, $C_2$, $C_3$ and $C_4$ that we are presented with. However, the $a$, $b$, $k$ and $k'$ associated with these will not necessarily meet the size constraints.

A no-go in the black box model

Now suppose that we can extended such a solver to a black box multiplicative group. Suppose that we are given a discrete logarithm problem for the generator $g$ of order $q$ and the element $C_1$ is such a group. We choose an arbitrary $m_1$ and by a counting argument there is a strong probability that $c_1$ can be written in the form $c_1\equiv a+km_1\pmod q$ with $a,k\le q^{1/2}$. Write $d=[q^{1/2}]$. We now call our solver with $C_1=C_1$, $C_2=g^d/C_1$, $C_3=C_1g^{m_1}$ and $C_4=g^d/C_3$ and $m_1=m_2=m_3=m_4$ (corresponding to the values $b=d-a$ and $k'=k+1$ which satisfy the size constraints). Our solver will return $g^a$ from which we can recover $a$ using the baby-steps/giant-steps method in $O(\root 4\of q)$ steps. Similarly we can recover $g^k=(C_1/g^a)^{1/m_1}$ and $k$ in another $O(\root 4\of q)$ steps. This allows us to compute $c_1$ with $O(\root 4\of q)$ group operations which is not possible for a black box group.

Daniel S avatar
ru flag
Yes, $\sqrt q$ is possible to compute $c_1$, but $\root 4\of q$ is not. Recall that $c_1$ is arbitrary and we have a contradiction.
Turbo avatar
ru flag
What is $C_1$ and what is $c_1$? Are they same?
Daniel S avatar
ru flag
@Turbo as in the first part $C_1=g^c_1\mod p$. The argument does not preclude some use of the structure of $\mathbb Z/p\mathbb Z$, but does mean that to recover $g^a$ we must do something other than raise the $C_i$ to powers and multiply.
Daniel S avatar
ru flag
You could use the general number field sieve to recover $c_1$ (not polynomial time, but certainly subexponential) and then use lattice basis reduction to find $a, k\approx\sqrt p$ such that $a+km_1\equiv c_1\pmod p$.
Turbo avatar
ru flag
$m_1m_4-m_2m_3=0$ here and not $\lambda(p)$.
Turbo avatar
ru flag
Is $\neq\lambda(p)$ an issue to the lower bound you are proving?
Daniel S avatar
ru flag
The condition $m_1m_4-m_2m_3\equiv 0\pmod{\phi(p0}$ includes the case $m_1m_4-m_2m_3=\phi(p)=\lambda(p)$ and so all of the above still stands in the specific case.
Turbo avatar
ru flag
Yes agree. But in your situation $m_1=\dots=m_4$ provides $m_1m_4-m_2m_3=0$ exactly while I require $\lambda(p)$ exactly. $m_1m_4-m_2m_3=0\implies m_1m_4-m_2m_3\equiv0\bmod\lambda(p)$ but not $m_1m_4-m_2m_3=\lambda(p)$.
Turbo avatar
ru flag
the black box lower bound works only if you work with group elements mod p. But a,k are not group elements mod p.
Turbo avatar
ru flag
I think the bb lower bound is invalid. You are getting the final exponent through intermediate objects which are a,k and these are not group elements mod p. Refer https://crypto.stackexchange.com/questions/99282/does-generic-group-black-box-model-prohibit-msb-of-discrete-logarithm?noredirect=1&lq=1 where instead of a,k we employ man which is not group element mod p. Can you double check and compare with msb answer to tell what is different?
Daniel S avatar
ru flag
I don't think anything is different: a putative algorithm to solve MSB of the discrete logarithm of a BB group is not possible as it would beat the $q^{1/2}$ bound, likewise a putative algorithm to solve your problem in a BB group is not possible as it too would beat the $q^{1/2}$ bound.
Turbo avatar
ru flag
The point made there is MSB is not BB box group element. Likewise in here a,k are not BB box group elements. Are you certain of your bound?
Daniel S avatar
ru flag
MSB, $a$ and $k$ are all defined as components of the index of a cyclic group element and so all exist in the black box context.
Turbo avatar
ru flag
then what is the point made there? I don't get it. It says going through msb is in play because msb is not a group element.
Daniel S avatar
ru flag
The point here is that just as the MSB oracle does not exist for a BB group, an oracle for your problem does not exist for a BB group.
Turbo avatar
ru flag
Is the BB lower bound only for deterministic algorithms or does it apply to randomized algorithms as well?
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.