[Paper Review] On the success probability of the quantum algorithm for the short DLP

Martin Ekerå|arXiv (Cornell University)|Sep 4, 2023

Quantum Computing Algorithms and ArchitectureComputer Science3 citations

TL;DR

This paper proves a tight lower bound on the success probability of Ekerå–Håstad's quantum algorithm for solving the short discrete logarithm problem (DLP) in groups of unknown order. By optimizing classical post-processing using meet-in-the-middle techniques, the authors show that success probabilities exceeding $1 - 10^{-10}$ are achievable with only $3m$ quantum group operations, making the algorithm practical for cryptanalyzing Diffie–Hellman in safe-prime groups and RSA via reduction to short DLP.

ABSTRACT

Ekerå and Håstad have introduced a variation of Shor's algorithm for the discrete logarithm problem (DLP). Unlike Shor's original algorithm, Ekerå-Håstad's algorithm solves the short DLP in groups of unknown order. In this work, we prove a lower bound on the probability of Ekerå-Håstad's algorithm recovering the short logarithm $d$ in a single run. By our bound, the success probability can easily be pushed as high as $1 - 10^{-10}$ for any short $d$. A key to achieving such a high success probability is to efficiently perform a limited search in the classical post-processing by leveraging meet-in-the-middle techniques. Asymptotically, in the limit as the bit length $m$ of $d$ tends to infinity, the success probability tends to one if the limits on the search space are parameterized in $m$. Our results are directly applicable to Diffie-Hellman in safe-prime groups with short exponents, and to RSA via a reduction from the RSA integer factoring problem (IFP) to the short DLP.

Motivation & Objective

• To establish a rigorous lower bound on the success probability of Ekerå–Håstad's quantum algorithm for the short DLP in a single run.
• To demonstrate that the classical post-processing can be made efficient and practical using meet-in-the-middle techniques.
• To show that the success probability can be pushed to $1 - 10^{-10}$ while keeping quantum operations bounded at $3m$ for bit length $m$ of the discrete logarithm.
• To extend the applicability of the algorithm to real-world cryptosystems like RSA and Diffie–Hellman in safe-prime groups via known reductions.
• To provide asymptotic guarantees that the success probability tends to one as $m \to \infty$ when post-processing complexity grows polynomially in $m$.

Proposed method

• Derives a lower bound on the success probability of the Ekerå–Håstad algorithm by analyzing the probability distribution of quantum measurement outcomes.
• Introduces a meet-in-the-middle strategy in classical post-processing to efficiently search over candidate solutions within bounded parameter ranges.
• Uses lattice-based analysis and bounds on the number of valid $(j,k)$ pairs to estimate the probability of observing useful measurement outcomes.
• Applies a combination of Lemmas 1 and 2 to derive a composite lower bound on success probability, taking the maximum of two derived bounds to ensure robustness.
• Parameterizes the search space using $\Delta$, $t$, and $\tau$ to balance success probability and classical post-processing complexity.
• Demonstrates that with appropriate parameter selection, the post-processing complexity remains $O(\text{poly}(m))$, enabling practical feasibility on classical computers.

Experimental results

Research questions

• RQ1 What is the minimum success probability of Ekerå–Håstad's quantum algorithm for solving the short DLP in a single run?
• RQ2 Can the classical post-processing be optimized to make the algorithm practical for real-world parameter sizes?
• RQ3 What parameter choices ensure that the success probability reaches $1 - 10^{-10}$ while keeping quantum operations at $3m$?
• RQ4 How does the success probability behave asymptotically as the bit length $m$ of the discrete logarithm tends to infinity?
• RQ5 To what extent can the assumption $r \geq 2^{m+\ell} + (2^\ell - 1)d$ be relaxed without compromising the analysis?

Key findings

• The success probability of the Ekerå–Håstad algorithm in a single run is bounded below by a value that can be driven to $1 - 10^{-10}$ through optimal parameter selection.
• By employing meet-in-the-middle techniques in classical post-processing, the algorithm remains practical even for large $m$, with post-processing complexity bounded by $O(\text{poly}(m))$.
• For any short $d$, the success probability exceeds $99\%$ when performing at most $3m$ quantum group operations, matching the performance of prior simulation-based analysis in [5].
• When $\Delta = 0$, the success probability can be pushed to $1 - 10^{-10}$ with feasible classical post-processing on standard hardware.
• Asymptotically, the success probability tends to one as $m \to \infty$ if $\Delta$, $t$, and $\tau$ are chosen such that post-processing complexity grows polynomially in $m$.
• The reduction from RSA integer factoring to short DLP remains valid, and the new bounds allow for improved estimates of success probability in RSA cryptanalysis.