Re: Dig. Cash Question.

[smb@research.att.com]

	I'm reading the paper that was announced on this list about
	Digital Cash last week.  It was writen by Stefan Brands.  I
	think I have a strong Math background, but I don't know what is
	meant by a "descrete log" in a group G.  I understand what a
	group is.  I just don't know what properties an element, a,
	would have if it were the log sub p of e.  Can someone help
	me.  Otherwise, this is a very interesting article.  Thanx in
	advance.

You might want to fix your mailer; according to the strict letter of
RFC822, human-readable names shouldn't contain periods unless quoted....

Anyway -- suppose that in some group, you know that a^n=b, where a
and b are members of the group, and n is an integer.  a^n indicates
the group operation iterated n times.  The discrete log problem is
recovering n, given ``a'' and a^n=b.

In some groups, this is a very hard problem.  The group most commonly
used in cryptography is the field GF(p), i.e., the field of integers
modulo p, where p is some large number, preferably a prime, and ``a''
is a ``primitive root'' of the field.  The problem is thus to find
n, given ``a'' and a^n modulo p.  Other instances of discrete log
are useful as well; NeXT, for example, uses the same basic equation
in a field over some family of elliptic curves.  Their much-ballyhooed
invention was to find a set of such curves for which the exponentiation
operation can be performed very efficiently.

Oddly enough, solving discrete log in GF(p) seems to be vaguely akin
to factoring.  p doesn't have to be a prime, but you can use smaller
numbers if it is.  Early attempts used 2^n, since that makes the
modulus operation trivial, but if you do that, you need such a large
n that it doesn't pay.  For p a prime, 512 bits is probably secure now,
though possibly not against NSA.  1024 bits is likely to be secure
forever, barring major theoretical breakthroughs.


		--Steve Bellovin