Discrete Logarithm in Fp\mathbb{F}_p: Shank's Baby-Step Giant-Step

17 Dec 2021


§ Motivation

Given the DLP, gxphg^x \equiv_p h, we can inspect the case when ordp(g)=q\text{ord}_p(g) = q where qPq \in \mathbb{P}.

§ The Algorithm

Shank's Baby-Step Giant-Step Algorithm

Let g(Zp)×g \in \left(\mathbb{Z}_p\right)^\times be an element such that N=ordp(g)2N = \text{ord}_p(g) \geq 2.

  1. Let n=1+Nn = 1 + \left\lfloor\sqrt{N}\right\rfloor.
  2. Create two lists, where all elements are in ZN\mathbb{Z}_N.
    • List 1: 1,g,g2,g3,,gn1, g, g^2, g^3, \dots, g^n
    • List 2: h,hgn,hg2n,,hgn2h, hg^{-n}, hg^{-2n}, \dots, hg^{-n^2}
  3. Check for values that satisfy giNhgjng^i \equiv_N hg^{-jn}.
  4. The value x=i+jnx = i + jn is a sol'n to gxphg^x \equiv_p h.

Shank's runs in O(nlogn)\mathcal{O}\left(n\log n\right) time[^1] and in O(n)\mathcal{O}\left(\sqrt{n}\right) space.