Prime Numbers

5.2 Monte Carlo methods 233
computing x2i+2,a2i+2,b2i+2 from x2i,a2i,b2i. The principal work is in the
calculation of the (xi)and(x2i) sequences, requiring 3 modular multiplications
to travel from the i-th stage to the (i + 1)-th stage. As with the Pollard rho
method for factoring, space requirements are minimal.
[Teske 1998] describes a somewhat more complicated version of the rho
method for discrete logs, with 20 branches for the iterating function at each
point, rather than the 3 described above. Numerical experiments indicate that
her random walk gives about a 20% improvement.
The rho method for discrete logarithms can be easily distributed to many
processors, as described in connection with the lambda method below.
5.2.3 Pollard lambda method for discrete logarithms
In the same paper where the rho method for discrete logarithms is described,
[Pollard 1978] also suggests a “lambda” method, so called because the “λ”
shape evokes the image of two paths converging on one path. The idea is
to take a walk from t, the group element whose discrete logarithm we are
searching for, and another from T , an element whose discrete logarithm we
know. If the two walks coincide, we can figure the discrete logarithm of t.
Pollard views the steps in a walk as jumps of a kangaroo, and so the algorithm
is sometimes referred to as the “kangaroo method.” When we know that the
discrete logarithm for which we are searching lies in a known short interval, the
kangaroo method can be adapted to profit from this knowledge: We employ
kangaroos with shorter strides.
One tremendous feature of the lambda method is that it is relatively
easy to distribute the work over many computers. Each node in the network
participating in the calculation chooses a random number r and begins a
pseudorandom walk starting from t r ,wheret is the group element whose
discrete logarithm we are searching for. Each node uses the same easily
computed pseudorandom function f : G → S, whereS is a relatively small
set of integers whose mean value is comparable to the size of the group G.
The powers g s for s ∈ S are precomputed. Then the “walk” starting at t r is
w0 = t r , w1 = w0g f(w0) , w2 = w1g f(w1) , ....
If another node, choosing r ′ initially and walking through the sequence
w ′ 0,w ′ 1,w ′ 2,..., has a “collision” with the sequence w0,w1,w2,..., that is,
w ′ i = wj for some i, j, then
So if t = g l ,then
t r′
g f(w′ 0 )+f(w′ 1 )+···+f(w′ i−1 ) = t r g f(w0)+f(w1)+···+f(wj−1) .
(r ′ j−1
i−1
− r)l ≡ f(wµ) − f(w ′ ν) (mod n),
µ=0
where n is the order of the group.
ν=0