Computing discrete logarithms using 𝒪((log q)²) operations from {+,-,×,÷,&}

A.1 Vanishing coefficients

It is

and for w=⌈(u-1)/2⌉ there are I1 and I2 with

Going from i=0 to w and taking always the value 2⁢i is the same as going from i=0 to 2⁢w and picking only the even values. Hence, we can use the indicator function 𝟣i⁢even and without loss of generality we assume u-1 is even:

Thus, it holds

Hence all odd coefficients vanish. The case for K2 is analogous.

A.2 Example

For further clarity, we add short examples for some of the key computation steps of our approach using a toy setup. We set

1. q=37,g=5,

2. (g,r,q)=(5,19,37).

It follows from q/2<p=2t<q that p=32. In order to solve (g,r,q), we compute (p,r,q) and (p,g,q), which allows us to derive the solution of (g,r,q). However, in this example we only show how to compute (p,r,q), since the case (p,g,q) is analogous and deriving the solution of (g,r,q) is standard. The solution for (p,r,q)=(32,19,37) is 7 since 327≡19⁢(mod⁡37).

It is |𝔾g|=18 and |𝔾p|=36=u, hence 𝔾g⊂𝔾p. The integer Q37,36⁢(32) in base-32 representation is equal to

Since p is a primitive root in ℤq*, the largest coefficient k¯ is k¯=31=p-1, and hence we get b=1, see Section 4.3. Now we can compute |SQ37,36⁢(32)⁢(32)| via Corollary 4:

Thus, k¯=31 only appears once. Next, we compute the r¯∈𝔾p via

Since |SQ37,36⁢(32)⁢(32)|=1, we have i=0 and hence

The coefficient k^ that is associated with the target residue r=19 is

The next step is to apply the cyclic shift to shift k¯ to k^:

which is equal to

Now, the largest coefficient 31 is at the position of the former coefficient 9. Its position (starting from the largest monomial) is now, due to the cyclic shift, equal to the solution for (32,19,37), i.e., x=7=36-29.

To actually compute the position x, we split the Q←37,36⁢(32) into

Next, we test which integer does contain the coefficient 31. We add 𝖱32,18 and test if a carry occurs. For Q←(1) it is

i.e., no carry occurs in this case, but

Hence Q←(2) contains the coefficient and we keep Q←(2) and drop Q←(1). So the position of the coefficient 31 must be somewhere in the interval [18,35]. This procedure is repeated with Q←(2) as the input integer until the position of 31 is determined. Note that the final output is then |Qq,u⁢(p)|p minus the computed position, in this case 36-29=7. Algorithm 2 considers that by reducing the bounds in the opposite way, but only for minor technical reasons.