3

Suppose you can solve DLOG in arbitrary groups. Then I give you the challenge of solving DLOG$(a,1)$ over the group $\mathbb{Z}_n^*$, where $a$ is some arbitrary integer and $n$ is some integer to be factored.

Your answer gives me the order of $a$, which is (probabilistically) enough to factor $n$.

Thus, factoring reduces to DLOG over multiplicative groups of modular integers of unknown order.

I've never seen this mentioned, though, so I'm wondering if there is some flaw in this reasoning.

Sam Jaques
  • 1,808
  • 9
  • 13

1 Answers1

7

You aren't missing anything. It is well known that if you can compute a discrete log in $\mathbb{Z}_n^*$, you can factor $n$. The more traditional way of showing that is using the discrete log oracle to allow you to compute square roots (which also directly gives a probabilistic factoring method), but your way works too.

However, we're more interested in discrete logs in $\mathbb{Z}_p^*$ where $p$ is prime (because that's what we use in practice), and there's no known reduction for that.

poncho
  • 154,064
  • 12
  • 239
  • 382