Prime Numbers

252 Chapter 5 EXPONENTIAL FACTORING ALGORITHMS
for some integer k ∈ [0,d− 1], where d =gcd(a, n) andu is a solution to the
extended-Euclid relation au + nv = d.
This exercise shows that finding a logarithm for a nontrivial power of t is,
if d is not too large, essentially equivalent to the original DL problem.
5.5. Suppose G is a finite cyclic group, you know the group order n, and
you know the prime factorization of n. Show how the Shanks baby-steps,
giant-steps method of Section 5.3 can be used to solve discrete logs in G in
O √ p ln n operations, where p is the largest prime factor of n. Give a similar
bound for the space required.
5.6. As we have seen in the chapter, the basic Shanks baby-steps, giantsteps
procedure can be summarized thus: Make respective lists for baby steps
and giant steps, sort one list, then find a match by sequentially searching
through the other list. As we know, solving g l = t (where g is a generator of
the cyclic group of order n and t is an element) can be effected in this way
in O(n 1/2 ln n) operations (comparisons). But there is a so-called hash-table
construction that heuristically alters this complexity (albeit slightly) and in
practice works quite efficiently. A summary of such a method runs as follows:
(1) Construct the baby-step list, but in hash-table form.
(2) On each successive giant step look up (rapidly) the corresponding hashtable
entry, seeking a match.
The present exercise is to work through—by machine—the following example
of an actual DL solution. This example, unlike the fundamental Algorithm
5.3.1, uses some tricks that exploit the way machines tend to function,
effectively reducing complexity in this way. For the prime p =2 31 − 1and
an explicitly posed DL problem, say to solve
g l ≡ t (mod p),
we proceed as follows. Reminiscent of Algorithm 5.3.1 set b = ⌈ √ p⌉, but
in addition choose a special parameter β =2 12 to create a baby-steps “hash
table” whose r-th row, for r ∈ [0,β−1], consists of all those residues g j mod p,
for j ∈ [0,b−1], that have r =(g j mod p) modβ. That is, the row of the hash
table into which a power g j mod p is inserted depends only on that modular
power’s low lg β bits. Thus, in about √ p multiplies (successively, by g) we
construct a hash table of β rows. As a check on the programming effort, for a
specific choice g =7the(r = 1271)-th row should appear as
((704148727, 507), (219280631, 3371), (896259319, 4844) ...),
meaning, for example,
7 507 mod p = 704148727 = (...010011110111)2,
7 3371 mod p = 219280631 = (...010011110111)2,
and so on. After the baby-steps hash table is constructed, you can run through
giant-step terms tg −ib for i ∈ [0,b− 1] and, by inspecting only the low 12 bits