1. Relationships among the Computational Powers of Breaking Dis-hog Cryptosystems K.SAKURAI † H.SHIZUYA (Kyushu Uni) (Tohoku Uni) EUROCRYPTO ‘95 † Partially supported by HARA Com. Fund.

2. Contents １． Introduction ２． Discrete Log. Problem and Diffie-Hellman Problem ３． Main Theorem ４． (A part of) Proof ： DH v.s 3 PASS ５． Special DL ６． Concluding Remarks Certified DL Ordiney Elliptic DL

3. Discrete Logarithm Problem p : prime g : base (0<g<p) y : 0<y ≦ p satisfying

4. Diffie-Hellman Problem Partially Positive [B.den Boer Eurocry. ’ 88] [U.Maurer CRYPTO ’ 94]

5. Open Problems

6. Discrete Logarithm Problem p : prime g : base (0<g<p) y : 0<y ≦ p satisfying NP NP-complete P ① DL ∈ NP ② DL ∈ P ③ DL ∈ Co-NP Maybe DL ∈ NPC

7. Modern Cryptography Public-key Crypto Key Distribution Digital Signatures ・・・ Computationally Hard Problems Knapsack. Fact. Disc. Log. ・・・

8. Cryptosystems over DL Dis-Log

9. DH (Key Exchange scheme) Input : (p,q,A,B) Output : c (p,q)

10. EG (Secret message Transfer) Input : (p,q,y,c,c ) Output : m (p,q,y) Bob ’ s Public-key

11. CONF (Key Transfer for conference system) Input : (p,q,A,B) Output : c (p,q) Note:

12. Theorem : Expected poly-Time Turing equivalent DH : Diffie-Hellman’s Key Exchange EG : ElGamal Public-key Crypto 3PASS : (Shamir’s) 3 pass Key-Transmission CONF : Okamoto’s Conference Key Exch. BM : Bellare-Micali’s Non-Interactive Oblivious Transfer

13. Theorem Special Cases ① Certified DL ② Elliptic DL Mocklus given with ♯ E =“prime”

14. Another Advantage of Ordiney Elliptic-Curve Cryptosystems ♯ E=prime ① One Advantage [MOV] attack Super singular Curve Ordiney Curve ② provably as secure as

15. Conclusion Certified DL. Elliptic DL with ♯ E=prime Another Advantage of Ordinary Elliptic DL

16. Another Advantage of Ordinary Elliptic-Curve Cryptosystems ♯ E=prime ① One Advantage [MOV] attack Super singular Ordinary ② provably as secure as

17. Diffie-Hellman Problem No efficient method for solving DH than computing DL. (Partially) Positive Answer [B.den Boer Eurocry. ’ 88] Small prime factor [U.Mauer CRYPTO ’94] More Extended Result

18. the same security [Sakurai-Sizuya ’94] Theorem

19. DH (Key Exchange scheme) (p,q) DH(p,q,A,B)=c

20. 3PASS 3PASS(p,X,Y,Z)=S p mod p-1 mod p

21. Outline of Argument

23. Input : (p,g,A,B) S : = ⊥ while (S= ⊥ ) do Expected ♯ of while-loop END while Output C

25. Elliptic DL with ♯ E=prime