[Math] Properties of the Discrete Logarithm Problem

congruencesdiscrete mathematicselementary-number-theorynumber theoryproof-verification

I am self-studying Hoffstein's An Introduction to Mathematical Cryptography, and this is problem 2.3 (p. 107-08).

Let $p$ be a prime and $g$ an element in $\mathbb{F}_p^*$ with order $r$.

(a) Suppose that $x=a$ and $x=b$ are both integer solutions to the equation $g^x \equiv h \pmod{p}$. Prove that $a\equiv b \pmod{p-1}$.

(b) Prove that $\log_g(h_1h_2)\equiv \log_g(h_1)+\log_g(h_2) \pmod{r}$ for all $h_1,h_2 \in \mathbb{F}_p^*$ such that $g^x \equiv h_1 \pmod{p}$ and $g^x \equiv h_2 \pmod{p}$ have integer solutions.

(c) Prove that $\log_g (h^n) \equiv n \log_g(h) \pmod{r}$ for all $h \in \mathbb{F}_p^*$ such that $g^x \equiv h \pmod{p}$ has an integer solution and $n \in \mathbb{Z}$.

My attempt: Feedback highly appreciated

(a) The way to think of a primitive root is that $g$ is a generator in $\pmod{p}$ if and only if the function $f(x) \equiv g^x \pmod{p}$ is a bijection over the domain $\mathbb{F}_p^*=\{1,2,\dots, p-1\}$. Thus our question comes down to prove:

$$g^{p-1} \equiv 1 \pmod{p}$$

which is exceedingly convenient as it is covered by Fermat's Little Theorem.

Now, since $g$ is a primitive root it follows that if $a \not b$ and $a \in \mathbb{F}_p^*$ then $b=a+(p-1)k$ (for some $k \in \mathbb{Z}$). We have $g^{b}\equiv g^{a+(p-1)k} \pmod{p} \equiv g^{a}\left(g^{p-1} \right)^k \pmod{p} \equiv g^{a}$. which is the same as $a \equiv b \pmod{p-1} $.

(b) For the next problem
We have that $g^{\log_g (h_1)+\log_g (h_2)} \pmod{p} \equiv g^{\log_g (h_1)}g^{\log_g (h_2)} \pmod{p} \equiv h_1\cdot h_2$

(c) We use the technique of mathematical induction. It is eminently clear that this is true for the base case $k=1$. Let us thus assume that the result holds for all $k$ up to $k=n-1$. We now show that this implies that it also holds for $k=n$. We have that:
\begin{align*}
g^{\log_g (h^{n})} &=g^{\log_g (h^{(n-1)+1})} \\
&=g^{\log_g(h^{n-1}h)} \\
&=g^{\log_g(h^{n-1})}g^{\log_g(h)} \tag{$\log_g(h_1h_2)\equiv \log_g(h_1)+\log_g(h_2)$} \\
&=g^{(n-1)\log_g(h)}g^{\log_g(h)} \tag{Induction Assumption} \\
&=g^{n\log_g(h)} \tag{Addition Property of Exponential}
\end{align*}
which means that it holds for the induction step as well. This completes the proof.

Best Answer

Yes, the given proof is correct if you are given that $g$ is a generator.

However the question does not require (or assume) that $g$ is a generator, but merely that $g$ is some element of order $r$. The largest effect this has on your proof is in your part (a).

For a generic $g$ of order $r$, you are trying to show that necessarily $r \mid (p-1)$. If $r$ does not divide $(p-1)$ then $p-1 = qr + R$ for some remainder $R$ satisfying $0 < R < r$. Then $$ g^{p-1} = g^{qr} g^R \equiv 1 \cdot g^R \pmod{p}.$$ By Fermat's Little Theorem, we know that $g^{p-1} \equiv 1 \bmod p$, so we see that $$ g^R \equiv 1 \pmod p.$$ But this contradicts the fact that $r$ is the order of $g$, as $R < r$. This is a contradiction, and so $r \mid (p-1)$.

As an aside, this is a corollary of Lagrange's Theorem, viewing $\mathbb{F}_p^\times$ as a group --- then $r = \# \langle g \rangle {\big|} \# \mathbb{F}_p^\times = p-1$.

Your work for (b) and (c) adapt naturally to a completed part (a).

Related Question