Prime Numbers

6.4 Index-calculus method for discrete logarithms 303
information that might be used profitably for DL computations. We have
seen in this chapter the ubiquitous role of smooth numbers as an aid to
factorization. In some groups sense can be made of saying that a group element
is smooth, and when this is the case, it is often possible to perform DLs via
a subexponential algorithm. The basic idea is embodied in the index-calculus
method.
We first describe the index-calculus method for the multiplicative group
of the finite field Fp, wherep is prime. Later we shall see how the method can
be used for all finite fields.
The fact that subexponential methods exist for solving DLs in the
multiplicative group of a finite field have led cryptographers to use other
groups, the most popular being elliptic-curve groups; see Chapter 7.
6.4.1 Discrete logarithms in prime finite fields
Consider the multiplicative group F ∗ p,wherep is a large prime. This group is
cyclic, a generator being known as a primitive root (Definition 2.2.6). Suppose
g is a primitive root and t is an element of the group. The DL problem for F ∗ p
is, given p, g, t to find an integer l with g l = t. Actually, l is not well-defined
by this equation, the integers l that work form a residue class modulo p − 1.
We write l ≡ log g t (mod p − 1).
What makes the index-calculus method work in F ∗ p is that we do not
have to think of g and t as abstract group elements, but rather as integers,
and we may think of the equation g l = t as the congruence g l ≡ t
(mod p). The index-calculus method consists of two principal stages. The first
stage involves gathering “relations.” These are congruences g r ≡ p r1
1 ···prk
k
(mod p), where p1,...,pk are small prime numbers. Such a congruence gives
rise to a congruence of discrete logarithms:
r ≡ r1 log g p1 + ···+ rk log g pk (mod p − 1).
If there are enough of these relations, it may then be possible to use linear
algebra to solve for the various logg pi. After this precomputation, which is
the heart of the method, the final discrete logarithm of t is relatively simple.
If one has a relation of the form gRt ≡ p τ1
1 ···pτk k (mod p), then we have that
log g t ≡−R + τ1 log g p1 + ···+log g pk (mod p − 1).
Both kinds of relations are found via random choices for the numbers r, R. A
choice for r givesrisetosomeresidueg r mod p, which may or may not factor
completely over the small primes p1,...,pk. Similarly, a choice for R gives rise
to the residue g R t mod p. By taking residues closest to 0 and allowing a factor
−1 in a prime factorization, a small gain is realized. Note that we do not have
to solve for the discrete logarithm of −1; it is already known as (p − 1)/2. We
summarize the index-calculus method for F ∗ p in the following pseudocode.