Security analysis of the Strong Diffie-Hellman problem

Abstract. Let g be an element of prime order p in an abelian group and α ∈ Zp. We show that if g, gα, and gαd are given for a positive divisor d of p − 1, we can compute the secret α in O(log p · (p/d + √d)) group operations using O(max{p/d,√d}) memory. If gαi (i = 0, 1, 2,..., d) are provided for a positive divisor d of p + 1, α can be computed in O(log p · (p/d + d)) group operations using O(max{p/d,√d}) mem-ory. This implies that the strong Diffie-Hellman problem and its related problems have computational complexity reduced by O( d) from that of the discrete logarithm problem for such primes. Further we apply this algorithm to the schemes based on the Diffie-Hellman problem on an abelian group of prime order p. As a result, we re-duce the complexity of recovering the secret key from O( p) to O( p/d) for Boldyreva’s blind signature and the original ElGamal scheme when p − 1 (resp. p + 1) has a divisor d ≤ p1/2 (resp. d ≤ p1/3) and d signature or decryption queries are allowed