7 ms·
A Las Vegas algorithm to solve the elliptic curve discrete logarithm problem [pdf]
- sokoloff 10y agoWe don't have to (and shouldn't, IMO) American-ize "Monte Carlo" Edit: TIL that they are different. (Thanks for the explanations below! esp: gmfawcett and 1001101)
- protonfish 10y agoI guess you could use "stochastic" but that isn't nearly as clear and descriptive as "Monte Carlo"
- 1001101 10y agoLas Vegas = Always Correct, Probably Fast Monte Carlo = Probably Correct, Always Fast
- hyperbovine 10y agoSince when is Monte Carlo fast :-)
- snovv_crash 10y agoMore often than not, it is faster than figuring out the exact solution, if an exact solution exists. Things like having a piecewise distribution somewhere in your problem make Monte Carlo several orders of magnitude easier to implement.
- hyperbovine 10y agoThe depends a lot of the dimension of the space you're trying to integrate over, and in any case, (vanilla) Monte Carlo is trivial to implement. I was more poking fun at the very different way theorists and practitioners view classes certain algorithms. "Deterministic running time" is not a particularly strong guarantee, in practice.
- thomasahle 10y agoI think people would probably call an algorithm that is "Probably Correct, Probably Fast" Monte Carlo as well.
- funkaster 10y agoAdding speed to the classification is misleading. It might be better to state: - Las Vegas: Correct, Time unbounded - Monte Carlo: Not always correct, Time bounded edit: format
- kccqzy 10y agoAs pointed out already, a Las Vegas algorithm might have bounded but non-deterministic time.
- gmfawcett 10y agoI had the same initial reaction, but it seems that they are not the same thing: https://en.wikipedia.org/wiki/Las_Vegas_algorithm https://en.wikipedia.org/wiki/Las_Vegas_algorithm
- teraflop 10y agoIt's not just an Americanization. "Las Vegas" and "Monte Carlo" are technical terms with specific, different meanings. A Monte Carlo algorithm runs in a deterministic amount of time, and computes a probabilistic (approximate) result. For example: Monte Carlo numerical integration, or Miller-Rabin primality testing. A Las Vegas algorithm takes a non-deterministic amount of time, but is guaranteed to return a correct result. For example: quicksort with a random choice of pivot.
- tgb 10y agoI don't see why quick sort with a random pivot takes a non deterministic amount of time.
- rdtsc 10y ago> I don't see why quick sort with a random pivot takes a non deterministic amount of time. Because it might sort faster or slower depending on how the pivot gets picked. But you'd get the sorted list in the end. A Monte Carlo solution might run for 5 seconds but you might get a partially sorted list only.
- tgb 10y agoAh I see thanks. I was thinking the claim was that it might take an unbounded amount of time.
- rawnlq 10y agoThere's a popular interview question that has a las vegas algorithm as a solution. It's a more illustrative example since it takes an unbounded amount of time. Let's say you want to simulate a 1/3-biased coin with a fair coin. One solution is to flip the fair coin twice, then output heads if you get HH, output tails if you get TH or HT, otherwise retry (if TT). Then this process is guaranteed to always output heads with 1/3 probability and tails with 2/3 probability if it ever ends. The runtime complexity is unbounded since you can keep getting TT forever but the expected runtime is constant.
- 19eightyfour 10y agoI think in general the technique of introducing some slack in the form of partitions and then constraining those using some property of the specific problem space, in this case linear relations of whether those points lie on some curve, is very strong and has general applicability. Sort of like branch and bound. It's nice to see that this author started with a general idea that wasn't that fast, and then used a lot of clever details to improve the implementation of that same idea over a number of years.
- ecdh 10y agoUh, wait a second. Is Elliptic Curve Diffie Hellman broken now? Does this work on curves used in TLS?
- brohee 10y agoNot remotely practical against curves in actual use...
- brohee 10y agoInteresting, but no more. The commonly used curve P-256 has the prime order 115792089210356248762697446949407573529996955224135760342422259061068512044369. From the paper "The largest group of elliptic group of prime order that we tested is 129159847, in which a discrete logarithm problem was solved.".
- PaulAJ 10y agoThanks. I was just about to ask.
- dvdkhlng 10y agoThe paper closes with > However, we felt that computing the determinant for all possible sub matrices is a bottleneck for this algorithm and ways should be found to make this more efficient. That last step is obviously of exponential complexity in the parameters r and t. I wonder whether the algorithm's total run-time becomes more acceptable when that last step is replaced by a polynomial-complexity computation. To me it looks like an O(log(n)*n³) algorithm should be feasible, by replacing the submatrix-determinants with operations on determinants on large matrices that are generated in a way that ensures det=0 when any of the sub-matrices has det=0. Unfortunately I don't really understand enough about the remainder of the paper to actually see how the useful the algorithm would be with that "bottleneck" removed.
- dvdkhlng 10y agoToo late to edit my comment, but for correctness' sake: the algorithm as described is exponential in k (and thus n), not r and t.
- eximius 10y agoWhat is the estimated complexity of this attack? It is not clear to me how to use the probability of success formula for an arbitrary keysize.
- hpsineqepsi 10y agoThis algorithm is slower than existing approaches (Pollard's rho); the ridiculously small "largest group" that the author considered can be easily tackled in a split second with even inefficient general algorithms such as Shank's. It's surprising that such a boring non-result made it to the front page of HN.
- brohee 10y agoAs I understand it, their implementation is in Sage, which can't really be considered optimized. Is their method inherently slower than Pollard's rho, or is it an implementation issue?
- kafkaesq 10y agoIt's surprising that such a boring non-result Just because it (currently) only works on a small modulus doesn't make it a "boring non-result". It's the concept that matters.