On the Semidirect Discrete Logarithm Problem in Finite Groups

Abstract

We present an efficient quantum algorithm for solving the semidirect discrete logarithm problem ($\textsf{SDLP}$) in any finite group. The believed hardness of the semidirect discrete logarithm problem underlies more than a decade of works constructing candidate post-quantum cryptographic algorithms from non-abelian groups.  We use a series of reduction results to show that it suffices to consider $\textsf{SDLP}$ in finite simple groups. We then apply the celebrated Classification of Finite Simple Groups to consider each family. The infinite families of finite simple groups admit, in a fairly general setting, linear algebraic attacks providing a reduction to the classical discrete logarithm problem. For the sporadic simple groups, we show that their inherent properties render them unsuitable for cryptographically hard $\textsf{SDLP}$ instances, which we illustrate via a Baby-Step Giant-Step style attack against $\textsf{SDLP}$ in the Monster Group.

Our quantum $\textsf{SDLP}$ algorithm is fully constructive, up to the computation of maximal normal subgroups, for all but three remaining cases that appear to be gaps in the literature on constructive recognition of groups; for these cases $\textsf{SDLP}$ is no harder than finding a linear representation. We conclude that $\textsf{SDLP}$ is not a suitable post-quantum hardness assumption for any choice of finite group.

Appendix: Finding Maximal Normal Subgroups

The task of finding a maximal normal subgroup depends on the particular implementation of the black-box group G. In general, if we know the particular structure of the group G, we may be able to recover them immediately from it. This can be done even with little knowledge, since from any subgroup S we can construct the smallest normal subgroup containing it via computing the normal closure $\langle S^G \rangle$ in linear time as explained in [3].

In the literature, several techniques are known to solve this task more systematically, via computing a composition series, in this way the first element in the series (starting from G) is our desired normal subgroup. However, this branch of literature typically wishes to achieve much stronger results, in particular without using quantum computers - we do not impose this limitation upon ourselves. To perform this calculation, aided by a quantum computer, we can:

• Use [25] if every non-Abelian composition factor of G possesses a faithful permutation representation of degree polynomial in the input size;

• Otherwise, [1, Theorem 1.1] gives us a quasi-composition series for G. Note that [1] requires a superset of the primes dividing the order of the group |G| to solve the problem of computing order of group elements, with a quantum computer we can solve both these tasks. This result provides a quasi-composition chain $\{1\} \triangleleft G_{m-1} \triangleleft \cdots \triangleleft G_1 \triangleleft G$, and tells us if $G/G_1$ is abelian, or simple and nonabelian. In the latter case, we have found a maximal normal subgroup $N = G_1$. In the former case, if $A = G/G_1$ has the unique encoding property, we can use [26, Theorem 6] on it, since abelian groups are solvable, i.e. $\nu (G) =1$, and the procedure runs in quantum polynomial time. In this way we get the maximal normal subgroup $A_1 \triangleleft A$ from the composition series, and $A_1 G_1$ will be a maximal normal in G by the correspondence theorem. However, the general results from [1], does not immediately imply the unique-encoding property requested, so additional work may be required to solve this problem for the general case, even if in more concrete cases this may be practical.

In general, we do not expect that these problems should be of some fundamental computational difficulty. We leave the full resolution of the computation of maximal normal subgroups to further work.