5

I've seen from the SafeCurve criteria that one should try to avoid small complex multiplication field discriminant as it can speedup the discret log computation via the Polard Rho method.

However, I cannot find any information about how this additional information can improve the rho method. Especially, the SafeCurve page seems quite vague, mentioning that we do not know for sure if a small Discriminant (even really tiny like 3 for example) can lead to disastrous consequences or not. May someone explain how this particular structure can (in some cases) improve the rho method?

Binou
  • 448
  • 5
  • 14

1 Answers1

4

I first recall some basics on the discrete logarithm problem and the Pollard-rho algorithm before answering you question.

The discrete logarithm problem

Given a point $P$ of prime order $q$ on an elliptic curve, and $Q$ a point in the subgroup generated by $P$, then there exists $k$ such that $Q = kP$ where $0\leq k < q$.

The discrete logarithm of $Q$ in base $P$ is $k$, and the discrete logarithm problem is finding $k$ knowing $P$ and $Q$

The Pollard-rho algorithm

The Pollard-rho algorithm on a generic group of prime order $q$ has a complexity of $\sqrt{\pi q/2}$.

The principle of it is to construct a sequence of points by posing $R_0 = a_0P+b_0Q$ with random integers $a_0$ and $b_0$, then using a function $f$ that acts as a pseudo-random walk to obtain the sequence of points: $$ R_{i+1} = f(R_i) = a_{i+1} P + b_{i+1} Q. $$ Eventually, there will be will a point $R_j$ that is equal to a previous point $R_i$ in the sequence. Then, we deduce that: $$ k \equiv (a_i - a_j)(b_j-b_i)^{-1} \mod q, $$ if, of course, $(b_j-b_i)$ is invertible (but that will be the case with a high probability).

Now, the birthday paradox gives the aforementioned complexity.

Speeding-up rho

On elliptic curves, it is easy to compute $-P$ from $P=(x,y)$ since $-P=(x,-y)$. Then, we can regroup all the points of the curve by pairs $\{P,-P\}$.

Instead of looking for a collision between a point $R_i$ and $R_j$ in the sequence, we look for a collision on their $x$-coordinate. The discrete logarithm will be found if we have $R_i = \pm R_j$.

It is as if the search has not been done on all the points, but only on half of them. Then the value $q$ in the complexity is replaced by $q/2$, which gives the complexity of $\sqrt{q\pi/4}$ (which you will find the corresponding page on the website SafeCurves).

Speeding-up rho further

What we did above is possible because we have the map (called endomorphism) $[-1]$: $$ \begin{array}{rrcl} [-1]: & E & \longrightarrow & E \\ & (x,y) & \longmapsto & (x,-y) \end{array} $$ that sends a point of the elliptic curve $E$ to its opposite. We can see that if we apply it twice, we go back to the original point. We say this map has order $2$, and that is why we could grouped by pairs. And it is easy to compute.

Now the question is: does there exist other such maps easy to compute that could be used to speed-up rho by a greated factor?

The answer is yes. For instance, the curve secp256k1 has the following endomorphism: $$ \begin{array}{rrcl} \phi: & \texttt{secp256k1} & \longrightarrow & \texttt{secp256k1} \\ & (x,y) & \longmapsto & (\beta x,y) \end{array} $$ where $\beta$ is an element of order $3$ (it satisfies $\beta^3=1$ with $\beta \neq 1$) in the finite field of the curve. Then we have: $$ (x,y) \mapsto (\beta x, y) \mapsto (\beta^2 x, y) \mapsto (\beta^3 x, y) = (x,y), $$ which means the order of $\phi$ is $3$.

Then we can group the points of the curve by group of three: $\{ P, \phi(P), \phi^2(P)\}$. We choose one of three points as a representant (such as the point that has the smallest $x$-coordinate viewed as an integer). Instead of searching a collision in Pollard-rho on $q$ points, we search a collision on $q/3$ representants. From this, we deduce that on this curve we can divide by a factor $\sqrt 3$ the complexity of Pollard-rho. Combined with the previous speed-up, this gives a complexity of $\sqrt{q\pi/12}$.

Relation with the CM-field discriminant

The key is that we want an endomorphism easy to compute, otherwise it would not be useful to speed-up Pollard-rho. As we can see, those two examples given above are pretty simple. It is because their degree is $1$, which means the rational functions to compute the coordinates of $\phi(P)$ are polynomials of degree $1$.

There is a relation between the CM-field discriminant the existence of an endomorphism of small degree. In the case of the curve secp256k1, the fact that this discriminant is $-3$ is directly related to the endomorphism $\phi$ with this formula: $$ \left(\frac{1+i\sqrt 3}{2}\right)\left(\frac{1 - i\sqrt 3}{2}\right) = 1, $$ which means that there is a non-trivial endomorphism of degree $1$, that is the one given above.

I hope I gave some elements to answer your question. I will try to expand and correct some points later.