Prime Numbers

5.3 Baby-steps, giant-steps 235
calculation, by A. Joux and R. Lercier, where p is the 120-decimal-digit prime
⌊10 119 π⌋ + 207819. They actually found two discrete logs in this field for the
generator 2, namely the DL for t = ⌊10 119 e⌋ and the DL for t +1. Their
method was based on the number field sieve.
More recent advances in the world of parallel-rho methods include a
cryptographic-DL treatment [van Oorschot and Wiener 1999] and an attempt
at parallelization of actual Pollard-rho factoring (not DL) [Crandall 1999d].
In this latter regard, see Exercises 5.24 and 5.25. For some recent advances in
the DL version of the rho method, see [Pollard 2000] and [Teske 2001]. There
is also a very accessible review article on the general DL problem [Odlyzko
2000].
5.3 Baby-steps, giant-steps
Suppose G = 〈g〉 is a cyclic group of order not exceeding n, and suppose t ∈ G.
We wish to find an integer l such that g l = t. We may restrict our search for l
to the interval [0,n− 1]. Write l in base b, whereb = ⌈ √ n⌉. Thenl = l0 + l1b,
where 0 ≤ l0,l1 ≤ b − 1. Note that g l1b = tg −l0 = th l0 ,whereh = g −1 .
Thus, we can search for l0,l1 by computing the lists g 0 ,g b ,...,g (b−1)b
and th 0 ,th 1 ,...,th b−1 and sorting them. Once they are sorted, one passes
through one of the lists, finding where each element belongs in the sorted
order of the second list, with a match then being readily apparent. (This idea
is laid out in pseudocode in Algorithm 7.5.1.) If g ib = th j , then we may take
l = j + ib, and we are through.
Here is a more formal description:
Algorithm 5.3.1 (Baby-steps, giant-steps for discrete logarithms). We
are given a cyclic group G with generator g, an upper bound n for the order of G,
and an element t ∈ G. This algorithm returns an integer l such that g l = t. (It
is understood that we may represent group elements in some numerical fashion
that allows a list of them to be sorted.)
1. [Set limits]
b = ⌈ √ n⌉;
h = g −1 b ; // Via Algorithm 2.1.5, for example.
2. [Construct lists]
A = g i : i =0, 1,...,b− 1 ;
B = th j : j =0, 1,...,b− 1 ;
3. [Sort and find intersection]
Sort the lists A, B;
Find an intersection, say g i = th j ; // Via Algorithm 7.5.1.
return l = i + jb;
Note that the hypothesis of the algorithm guarantees that the lists A, B will
indeed have a common element. Note, too, that it is not necessary to sort
both lists. Suppose, say, that A is generated and sorted. As the elements of