How to solve multiple short-exponent discrete logarithm problem

Abstract

Let G be a group of prime order p with a generator g. It is known that one can find x1,..., xL from gx1,..., gxL in time (Formula presented.). On the other hand, suppose that 0 ≤ x < w. Then Pollard’s kangaroo algorithm (or Pollard’s lambda algorithm) can find x from gx in time (Formula presented.). It is used in the decryption algorithm of the homomorphic encryption scheme of Boneh, Goh and Nissim. Now suppose that 0 ≤ xi < w for i=1,..., L. This paper shows that we can find x1,...,xL from gx1,...,gxL in time (Formula presented.). We further show an application of our algorithm to the model of preprocessing.