Fixed-parameter complexity and cryptography

Abstract

We discuss the issue of the parameterized computational complexity of a number of problems of interest in cryptography. We show that the problem of determining whether an n-digit number has a prime divisor less than or equal to n ^k can be solved in expected time f(k)n ³ by a randomized algorithm that employs elliptic curve factorization techniques (this result depends on an unproved but plausible number-theoretic conjecture). An analogous computational problem concerning discrete logarithms is directly relevant to some proposed cryptosystem implementations. Our result suggests caution about implementations which fix a parameter such as the size or Hamming weight of keys. We show that several parameterized problems of relevance to cryptography, including k-Subset Sum, k-Perfect Code, and k-Subset Product are likely to be intractable with respect to fixed-parameter complexity. In particular, we show that they cannot be solved in time f(k)n ^α, where α is independent of k, unless a similar result holds for the well-studied and apparently resistant k-Clique problem.