Scribd
Upload
33 views15 pages

Cryptography: Number Theory 4

The document discusses cyclic groups and their properties. A cyclic group G has an element g that can generate the entire group via exponentiation. If such a generating element g exists, G is called cyclic. The discrete logarithm problem involves finding the exponent that generates a given group element h from a fixed generator g. The document also introduces the computational and decisional Diffie-Hellman problems and how they relate to the discrete logarithm assumption. Prime order subgroups of groups like Zp* are commonly used in cryptography due to the presumed hardness of the discrete logarithm problem within them.

Uploaded by

Alex
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
33 views15 pages

Cryptography: Number Theory 4

The document discusses cyclic groups and their properties. A cyclic group G has an element g that can generate the entire group via exponentiation. If such a generating element g exists, G is called cyclic. The discrete logarithm problem involves finding the exponent that generates a given group element h from a fixed generator g. The document also introduces the computational and decisional Diffie-Hellman problems and how they relate to the discrete logarithm assumption. Prime order subgroups of groups like Zp* are commonly used in cryptography due to the presumed hardness of the discrete logarithm problem within them.

Uploaded by

Alex
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 15

Cryptography

 
Number  theory  4  
Cyclic  groups  
•  Let  G  be  a  finite  group  of  order  m  (wri:en  
mul<plica<vely)  
•  Let  g  be  an  element  of  G  
•  Consider  the  set  {g0,  g1,  …}  
–  We  know  gm  =  1  =  g0,  so  the  set  has  ≤  m  elements  
–  If  the  set  has  m  elements,  then  it  is  all  of  G  !  
•  In  this  case,  we  say  g  is  a  generator  of  G  
•  If  G  has  a  generator,  we  say  G  is  cyclic  
Examples  
•  ℤN  
–  Cyclic  (for  any  N);  1  is  always  a  generator:  
   {0,  1,  2,  …,  N-­‐1}  

•  ℤ8  
–  Is  3  a  generator?  
{0,  3,  6,  1,  4,  7,  2,  5}  –  yes!  
–  Is  2  a  generator?  
{0,  2,  4,  6}  –  no!  
Important  examples  
•  Theorem:  Any  group  of  prime  order  is  cyclic,  
and  every  non-­‐iden<ty  element  is  a  generator  

•  Theorem:  If  p  is  prime,  then  ℤ*p  is  cyclic  (of  


order  p-­‐1)  
Uniform  sampling  
•  Given  group  G  of  order  m  and  generator  g,  
easy  to  sample  a  uniform  element  h∈G:  
–  Choose  uniform  x∈{0,  …,  m-­‐1};  set  h  :=  gx  
Discrete-­‐logarithm  problem  
•  Fix  cyclic  group  G  of  order  m,  and  generator  g  
•  We  know  that  {g0,  g1,  …,  gm-­‐1}  =  G  
–  For  every  h∈G,  there  is  a  unique  x∈ℤm  s.t.  gx  =  h  
–  Define  loggh  to  be  this  x  –  the  discrete  logarithm    
of  h  with  respect  to  g  (in  the  group  G)  

•  Dlog  problem  in  G:  Given  g,  h,  compute  loggh  


•  Dlog  assump<on  in  G:  Solving  the  discrete  log  
problem  in  G  is  hard  
Discrete-­‐logarithm  problem  
•  Let  G  be  a  group-­‐genera<on  algorithm  
–  On  input  1n,  outputs  a  cyclic  group  G,  its  order  q  
(with  ǁqǁ=n),  and  a  generator  g  

•  For  algorithm  A,  define  exp’t  DlogA,G(n):  


–  Compute  (G,  q,  g)  ←  G(1n)  
–  Choose  uniform  h∈G  
–  Run  A(G,  q,  g,  h)  to  get  x  
–  Experiment  evaluates  to  1  if  gx  =  h  
Discrete-­‐logarithm  problem  
•  The  discrete-­‐logarithm  problem  is  hard  
rela9ve  to  G  if  for  all  PPT  algorithms  A,  
                               Pr[DlogA,G(n)=1]  ≤  negl(n)  
Diffie-­‐Hellman  problems  
•  Fix  group  G  with  generator  g  
•  Define  DHg(h1,  h2)  =  DHg(gx,  gy)  =  gxy  
•  Computa9onal  Diffie-­‐Hellman  (CDH)  problem:  
–  Given  g,  h1,  h2,  compute  DHg(h1,  h2)  
•  Decisional  Diffie-­‐Hellman  (DDH)  problem:  
–  Given  g,  h1,  h2,  dis<nguish  the  correct  DHg(h1,  h2)  
from  a  uniform  element  of  G  
DDH  problem  
•  Let  G  be  a  group-­‐genera<on  algorithm  
–  On  input  1n,  outputs  a  cyclic  group  G,  its  order  q  
(with  ǁqǁ=n),  and  a  generator  g  

•  The  DDH  problem  is  hard  rela<ve  to  G  if  for  all  
PPT  algorithms  A:  
 |  Pr[A(G,  q,  g,  gx,  gy,  gz)=1]  –  Pr[A(G,  q,  g,  gx,  gy,  gxy)=1]  |  ≤  
ε(n)  
Rela<ng  the  Diffie-­‐Hellman  problems  
•  Rela<ve  to  G:  
–  If  the  discrete-­‐logarithm  problem  is  easy,  so  is  the  
CDH  problem  
–  If  the  CDH  problem  is  easy,  so  is  the  DDH  problem  

–  I.e.,  the  DDH  assump<on  is  stronger  than  the  CDH  


assump<on  
–  I.e.,  the  CDH  assump<on  is  stronger  than  the  dlog  
assump<on  
Group  selec<on  
•  For  cryptographic  applica<ons,  best  to  use  
prime-­‐order  groups  
–  The  dlog  problem  is  “easier”  if  the  order  of  the  
group  has  small  prime  factors  

•  Two  common  choices  of  groups…  


Group  selec<on  
•  Prime-­‐order  subgroup  of  ℤ*p,  p  prime  
–  E.g.,  p  =  tq  +  1  for  q  prime  
–  Take  the  subgroup  of  tth  powers,  i.e.,    
G  =  {  [xt  mod  p]|  x  ∈  ℤ*p  }  
•  This  is  a  group  
•  It  has  order  (p-­‐1)/t  =  q  
•  Since  q  is  prime,  the  group  is  cyclic  

–  More  generally,  prime-­‐order  subgroup  of  the  


mult.  group  of  a  finite  field  (of  large  characteris<c)  
Group  selec<on  
•  Prime-­‐order  subgroup  of  an  ellip9c  curve  
group  
–  Details  omi:ed…  

•  For  our  purposes,  we  will  usually  describe  


algorithms  in  “abstract”  groups  
–  So  can  ignore  details  of  the  underlying  group  
–  So  can  instan<ate  with  any  (appropriate)  group  
Next  <me  
•  Choosing  parameters  

You might also like