Score:1

The hardness of deducing z (\in Z/pZ) from z^l and l

jp flag

I am writing to request information about the difficulty of finding z in Z/pZ (where p is a large prime) given z^l and l. I am working on a project that involves this problem, and I am interested in learning more about its complexity.

Specifically, I would like to ask for your insights on the following:

  1. Is there any known efficient algorithm to find z given z^l and l?
  2. Is the problem of finding z given z^l and l considered a hard problem in computational complexity theory?

I would be grateful for any insights or resources that you can share on this matter. Thank you for your time and consideration.

Daniel S avatar
ru flag
HINT: Consider the case $\ell=3$.
Score:0
ru flag

This is trivial if $\gcd(\ell, p - 1) = 1$, and I assume it's easy otherwise, but I won't try to remove that restriction.

Recall Fermat's little theorem: $z^{p - 1} \equiv 1 \pmod p$. Let $\ell_{inv} = \ell^{-1} \pmod{p - 1}$, which exists as long as $\gcd(\ell, p - 1) = 1$.

Then, $(z^\ell)^{\ell_{inv}} \equiv z^{\ell \cdot \ell_{inv}} \equiv z^{k (p - 1) + 1} \pmod p$, for some $k \in \mathbb{Z}$, since $\ell \cdot \ell_{inv} \equiv 1 \pmod{p - 1}$.

Going on, $z^{k (p - 1) + 1} \equiv z^{k (p - 1)} z \equiv (z^{p - 1})^k z \pmod p$.

But by FLT, $z^{p - 1} \equiv 1 \pmod p$, so $(z^{p - 1})^k z \equiv 1^k z \equiv z \pmod p$. Thus, you have recovered $z$.

Numerical example in PARI/GP:

\\ Generation
? p = nextprime(random(2^31))
%1 = 1546275799
? z = random(p)
%2 = 879788114
? l = random(); while(gcd(l, p-1) != 1, l = random()); l
%3 = 1247963869
? zl = lift(Mod(z,p)^l)
%4 = 815723813

\\ Attack given only l, zl, p
? linv = lift(Mod(l, p-1)^(-1))
%5 = 914277349
? z_rec = lift(Mod(zl, p)^linv)
%6 = 879788114
? z == z_rec
%7 = 1

Just for completeness: the inversion modulo $p - 1$ has $O(p^2)$ complexity using a binary gcd, and the exponentiation to recover $z$ has complexity $O(p^3)$ if you use any non-naïve exponentiation algorithm, even the simplest algorithms such as left-right or right-left exponentiation, and even if you use the schoolbook multiplication algorithm. Indeed, it's the same cost as computing $z^l \pmod p$ itself, so it's as easy to break as it is to generate the parameters themselves.

Daniel S avatar
ru flag
In the case $\mathrm{gcd}(\ell,p-1)>1$ there is not a unique solution, though all solutions are easy enough to identify.
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.