Why is the discrete log problem intractable?

532 Views Asked by At

I have read the other questions on SE on this subject and they were not helpful to me, partially because I am not familiar with advanced mathematical notation.

Let me explain the way I'm thinking of it:

Given 3^X mod < gigantic number > = 12, why is it intractable to find X?

If we know X is an integer, can you not simply do 3^1 mod gigantic number, yes/no, 3^2 mod gigantic number, yes/no, 3^3 and so on? This is only two operations per iteration so I would think a computer could make it up to a sufficiently large value of 3^X fairly fast. I guess what I'm thinking is that no matter how big < gigantic number > is, 3^X will outpace it fast as X grows, so surely there can only be a few thousand possible values for X before one of them is correct.

I know I'm dead wrong about this and thinking of it completely wrong. I'm just not clear where my mistake is.

1

There are 1 best solutions below

4
On BEST ANSWER

While you are wrong, it's for interesting reasons. Which is the best kind of wrong. While $3^x$ certainly does grow fast, there's no known way to predict where it will end up mod $p$ for some large prime $p$. As an example to prove this (and maybe help guide your research into the subject) every prime has what's known as a primitive root. We say $n$ is a primitive root for $p$ if for every $x <p$, we have $n^x$ is distinct modulo $p$. In other words, $x\mapsto n^x$ is a permutation of integers modulo $p$.

I won't prove the existence of primitive roots here (mostly because I no longer remember the proof) but the point is that if you pick a bad base, you may be stuck computing a lot of powers before you get the one you want. So the heart of the problem is that you may have to make a computation for each $x<p$. Furthermore, modulo equality of integers itself is a more expensive operation than just multiplication. So you'd have to do a more careful analysis to figure exactly what is expensive.

Cleverly, one can actually use primitive roots to compute discrete logarithms! But finding primitive roots is very hard. Finding primitive roots is an open question. How would you find a primitive root for a large prime?

Aside: here's how you use primitive roots to do logarithms. Let's say $Z_p$ is the integers mod $p$, where $p$ is prime, and $n$ is the primitive root of $p$. Then let $f:Z_p \to Z_p$ by $f(x)=n^x$. Then let $g$ be its inverse. We know $g$ exists because $n$ is the primitive root. Then to solve $$ a^x \equiv b $$ It's enough to solve

$$ n^{g(a)x}\equiv n^{g(b)} $$

And then it's enough to solve $$ g(a)x\equiv g(b) $$ So we get $x\equiv g(a)^{-1} g(b)$