Security Analysis of the Strong Diffie-Hellman Problem [chapter]

Jung Hee Cheon
2006 Lecture Notes in Computer Science  
Let g be an element of prime order p in an abelian group and α ∈ Zp. We show that if g, g α , and g α d are given for a positive divisor d of p−1, we can compute the secret α in O(log p·( p/d+ √ d)) group operations memory. This implies that the strong Diffie-Hellman problem and its related problems have computational complexity reduced by O( √ d) from that of the discrete logarithm problem for such primes. Further we apply this algorithm to the schemes based on the Diffie-Hellman problem on an
more » ... abelian group of prime order p. As a result, we reduce the complexity of recovering the secret key from O( √ p) to O( p/d) for Boldyreva's blind signature and the original ElGamal scheme when p − 1 (resp. p + 1) has a divisor d ≤ p 1/2 (resp. d ≤ p 1/3 ) and d signature or decryption queries are allowed.
doi:10.1007/11761679_1 fatcat:rtjmtgc5xzcfncfq5wnevfnqym