If $g \in \mathbb{Z}/p\mathbb{Z}$ has prime order $q$, how well-distributed are the powers of $g$ modulo $q$?

45 Views Asked by At

More precisely: the powers of $g$, when identified with coset representatives from $\{1,\cdots,p-1\}$, consists of $q$ distinct integers. If these integers are all reduced modulo $q$ to the set $\{0,1,\cdots,q-1\}$, how well-distributed are the results? Is it possible that this reduction even gives a bijection in some cases?

To emphasize: I'm not asking about powers of an integer modulo $q$, but rather powers of an element of $\mathbb{Z}/p\mathbb{Z}$, where each power is lifted in the usual way to $\mathbb{Z}$. If you like, using programming notation, I'm interested in $g^e \% p \% q$, where $g$ is an integer. It is first reduced mod $p$ and then reduced mod $q$. The assumption is that $g \not\equiv 1 \pmod{p}$, but that $g^q \equiv 1 \pmod{p}$.

For context: the reason that I ask comes from the Digital Signature Algorithm. Without going into details, the integrity of a signature appears to come in part from the difficulty of solving a variation of the discrete logarithm problem: given the element $g$ (known to have prime order $q$), and a value $a \in \{0,1,\cdots,q-1\}$, it should be computationally difficult to find a power of $q$ that reduces (modulo $q$) to $a$. If reduction modulo $q$ is a bijection (when restricted to the powers of $g$), or at least if it has few collisions, than solving this problem is as hard as the usual discrete logarithm problem. But it seems to be important that these residues are well-distributed.