The discrete log is very discreet

In this paper we consider the one-way function fg,N(X) = gX (modN) , where N is a Blum integer. We prove that under the commonly assumed intractabili ty of factoring Blum integers, almost all its bits are individually hard, and half of them are simultaneously hard. As a result, fg,N can be used in efficient pseudo-random bit generators and multi-bit commitment schemes, where messages can be drawn according to arbi trary probabil i ty distributions. 1 I n t r o d u c t i o n A function f(x) is one-way if it is easy to compute but hard to invert. One-way functions have numerous cryptographic applications in public-key cryptosystems, pseudo-random bit generation, commitment schemes and so on. Several explicit constructions of one-way functions have been suggested under some plausible number-theoretic assumptions. One such candidate is the exponentiation function fg,p(X) = gX (modP) , where P is a prime and g is a generator of Z~, (IBM]). Its inverse is the discrete logarithm function, for which no efficient algorithms have been found. Another problem that is considered to be highly intractable is that of factoring a number which is the product of two large primes. Among the one-way functions that are based on the difficulty of factoring are the RSA / Rabin functions ([RSA], [Ra]), as well as the quardratic residuosity problem Permission to copy without fee all or part of this material is granted provided that the copies are not made or distributed for direct commercial advantage, the ACM copyright notice and the title of the publication and its date appear, and notice is given that copying is by permission of the Association for Computing Machinery. To copy otherwise, or to republish, requires a fee and/or specific permission. and its related root extracting function ([BBS]). An interesting property of one-way functions is the existence of hard bits in the argument which cannot be computed by any family of polynomial-size Boolean circuits with 1/2-t-1/poly probabil i ty of success. This notion was extensively investigated in the early 1980's, culminating in proofs that some specific bits in these number theoretic functions (usually the most significant or the least significant O(log n) bits of the n-bit argument) are individually hard ([BM], [ACGS], [BBS]), and that those O(log n) bits are also simultaneously hard ([LW], [ACGS], [VV]). All the subsequent efforts to extend the techniques to prove the individual or simultaneous security of O(n) bits in these number theoretic functions failed. Goldreich and Levin [GL] have shown that every one-way function has at least a logarithmic number of hard bits. Extending their result to prove that more bits are hard without imposing any assumptions on the one-way function is conjectured to be impossible, since a function may be one-way and still depend only on a small fraction of its bits. Explicit constructions of one-way functions for which all the bits are secure do exist, but they rely on the composition of hard bits from many one-way flmctions (rather than on a single application of a natural function, e.g. in the probabilistic encryption functions of [GM], [BG]). Besides its theoretical significance, proving a oneway function to have many simultaneously hard bits can improve the efficiency of many cryptographic schemes. Very recently Impagliazzo and Naor ([IN]) have introduced an efficient pseudo-random bit generator based on the combinatorial one-way function corresponding to the subset sum problem. Their novel construction makes it possible to obtain O(n) pseudorandom output bits from each application of the function on random inputs, but does not necessarily imply that the input bits of the function are individually or simultaneously hard, leaving the problem of constructing a natural function with O(n) secure bits © 1990 ACM 089791-361-2/90/0005/0405 $1.50 405 open. In this paper we consider the well known one-way function fg,g(X) = gX ( m o d g ) , where N is a Blum integer. We prove that under the sole assumption that factoring Blum integers is difficult, almost all its bits are individually hard, and the lower half of them are simultaneously hard. As a result, fg,N can be used in efficient pseudo-random bit generators with O(n)-bi t output per stage and in mult i-bi t commitment schemes, in which the messages can be drawn according to arbi trary probabil i ty distributions. We also quote the recent improvements of Johan Hastad [Ha] who extended our techniques to prove that indeed all the bits of fgjv are hard and that the upper half of the bits are also simultaneously hard. The paper is organized as follows: In section 2 we give the various definitions and assumptions used. In section 3 we deal with the individual bits security of fg,N and in section 4 with the simultaneous bit security. We present some applications of our enhanced security results in section 5 and discuss several extensions of our work in section 6. 2 P r e l i m i n a r i e s Let N = P . Q, where P , Q are distinct odd primes, and let n be the binary size of N. Let Z~v be the multiplicative group containing the elements in [1, N] that are relatively prime to N. The order of an element g E Z~v , ordg(g), is the smallest c > 1 such tha t gC = 1 (modN) . We denote maxgezT~ {ordN(g)} by ON. Clearly: ON = lcm(P 1, Q 1) < ( P 1)(Q 1) 2 We refer to any g as a generator despite the fact that no g can generate all the elements in Z~v for composite N. De f in i t i on : For a given g let G C Z~v be the set of elements generated by it, i.e.: G = {Zlthere exists X e Z~v s.t. Z = gX (modN)} Note that the number of elements in G equals ordN(g). Def in i t i on : Fix a constant k. A high order g is an element for which: 1 . ( p _ l ) ( Q 1 ) . ordN(g) >__ -~ A careful counting argument , for which we gratefully acknowledge Noga Alon, shows that a substantial fraction of the elements in Z~v have high order: P r o p o s i t i o n 1: Let P and Q be randomly chosen primes of equal size, N = P . Q, and g a randomly chosen element in Z~v , then: ( ) 1 . ( p _ l ) ( Q _ l ) < 0 Pr ordN(g) < ~ The proof will appear in the full version of this paper. D e f i n i t i o n : Let g E Z~v • The exponentiation modulo composite function is defined by: fg,N(X) -~ gX ( m o d g ) . Its inverse, the discrete log modulo composite, is defined only for Z E G by: