A note on discrete logarithms with special structure

Abstract

Many cryptographic systems assume the computational difficulty of the discrete logarithm (DL) problem. In order to accelerate such practical systems, it was proposed to use logarithms of special structure, such as small Hamming weight. How difficult is the underlying restricted DL problem? By rephrasing Shanks’ method we provide a close to square-root algorithm for such problems.