It is well known that both $g^x$ and $x^2$ are computational hardness problems in certain rings. But I wonder if the composition of them is still hard? Namely, given $(g, g^x, x^2)$ in a ring $Z_n$ where $n$ is a composite number of secret factorization, is it hard to get $x$?
Asked
Active
Viewed 77 times
1 Answers
1
This is essentially equivalent to factoring $n$.
From the composition you have given it is obvious that this is at most as hard as the easier of the two instances of the hard problems. So let's look at both of them.
Computing square roots over composite rings. This one is known to be equivalent to factoring the ring modulus.
Computing discrete logarithms over composite rings. This one is more intriguing. It is known that if you can compute prime-based discrete logarithm (for all the prime factors) and factor, then you can compute the discrete logarithm over the composite ring. It is also known that if you can compute the discrete logarithm over composite rings, then you can factor the modulus.
If you wanted the composition to be more like "you need to break both instances", then you should formulate it as, "given $(g,g^y,x^2)$ with $x,y\in\mathbb Z_n$ with $n$ having a secret semi-prime factorization, find $(x,y)$".
SEJPM
- 46,697
- 9
- 103
- 214