Prime Numbers

234 Chapter 5 EXPONENTIAL FACTORING ALGORITHMS
The usual case where this method is applied is when the order n is prime,
so as long as the various random numbers r chosen at the start by each node
are all distinct modulo n, then the above congruence can be easily solved for
the discrete logarithm l. (This is true unless we have the misfortune that the
collision occurs on one of the nodes; that is, r = r ′ . However, if the number of
nodes is large, an internodal collision is much more likely than an intranodal
collision.)
It is also possible to use the pseudorandom function discussed in Section
5.2.2 in connection with the lambda method. In this case all collisions are
useful: A collision occurring on one particular walk with itself can also be used
to compute our discrete logarithm. That is, in this collision event, the lambda
method has turned itself into the rho method. However, if one already knows
that the discrete logarithm that one is searching for is in a small interval, the
above method can be used, and the time spent should be about the square
root of the interval length. However, the mean value of the set of integers in
S needs to be smaller, so that the kangaroos are hopping only through the
appropriate interval.
A central computer needs to keep track of all the sequences on all the
nodes so that collisions may be detected. By the birthday paradox, we expect
a collision when the number of terms of all the sequences is O( √ n). It is clear
that as described, this method has a formidable memory requirement for the
central computer. The following idea, described in [van Oorschot and Wiener
1999] (and attributed to J.-J. Quisquater and J.-P. Delescaille, who in turn
acknowledge R. Rivest) greatly mitigates the memory requirement, and so
renders the method practical for large problems. It is to consider so-called
distinguished points. We presume that the group elements are represented
by integers (or perhaps tuples of integers). A particular field of length k of
binary digits will be all zero about 1/2 k of the time. A random walk should
pass through such a distinguished point about every 2 k steps on average.
If two random walks ever collide, they will coincide thereafter, and both
will hit the next distinguished point together. So the idea is to send only
distinguished points to the central computer, which cuts the rather substantial
space requirement down by a factor of 2 −k .
A notable success is the March 1998 calculation of a discrete logarithm
in an elliptic-curve group whose order is a 97-bit prime n; see [Escott et al.
1998]. A group of 588 people in 16 countries used about 1200 computers over
53 days to complete the task. Roughly 2 · 10 14 elliptic-curve group additions
were performed, with the number of distinguished points discovered being
186364. (The value of k in the definition of distinguished point was 30, so
only about one out of each billion sequence steps was reported to the main
computer.) In 2002, an elliptic-curve discrete logarithm (EDL) extraction was
completed with a 109-bit (= 33-decimal-digit) prime; see the remarks following
Algorithm 8.1.8.
For discrete logarithms in the multiplicative group of a finite field we
have subexponential methods (see Section 6.4), with significantly larger cases
being handled. The current record for discrete logarithms over Fp is a 2001