O26 — Discrete logarithm versus Diffie–Hellman key distribution

Definitions and mathematical statement

Let $p$ be prime and let $g$ be a primitive root modulo $p$. On elements $u=g^x$ and $v=g^y$ of $\mathbb F_p^\times$, the computational Diffie--Hellman operation returns \[ \operatorname{DH}(p,g,u,v)=g^{xy}\pmod p. \] This value is well defined: changing either exponent by a multiple of $\operatorname{ord}_p(g)$ does not change the output. The exponents themselves are not included in an oracle query.

Is discrete logarithm modulo primes randomized polynomial-time reducible to this operation? More explicitly, seek a uniform classical probabilistic oracle algorithm which, given $p,g,b$ with arbitrary nonzero base $g$ and $b\in\langle g\rangle$, outputs an exponent $z\ge0$ satisfying $g^z=b$ with probability at least $2/3$, within a fixed polynomial in the binary input length. It may make adaptive Diffie--Hellman queries; both their number and their encoding lengths must obey polynomial bounds.

The oracle returns the group element $g^{xy}$, not the product $xy$ as an integer and not either logarithm. The oracle promise requires a primitive base; arbitrary subgroup bases do not receive guaranteed answers. Off-promise calls may give arbitrary replies or no response, which a reduction must tolerate. The reduction may perform ordinary modular arithmetic and use its own random bits, but cannot assume an independently supplied factorization or logarithm oracle.

The reverse computational direction is immediate from knowing logarithms; the problem asks for the stated direction from Diffie--Hellman computation to logarithm recovery. A successful reduction must handle each promised input, rather than only favorable primes or average inputs.

Short English statement

Is solving prime-field discrete logarithms no harder, up to randomized polynomial-time reduction, than computing Diffie–Hellman shared group elements?

Sources

• S1 ULAM.AI and the UnsolvedMath Contributors, supplied problems.json, record 8400030 (AMR-083-0030), AMR Open Problem Lists. Catalogue identity and source transcription; CC BY 4.0. https://huggingface.co/datasets/ulamai/UnsolvedMath.
• S2 Adleman & McCurley - Open Problems in Number Theory Complexity II (1994), O26, p18 / LNCS p308. Original source indexed by AMR-083-0030. https://mccurley.org/papers/open.ps.gz.