A Nonuniform Algorithm for the Hidden Number Problem in Subgroups

Boneh and Venkatesan have proposed a polynomial time algorithm in a non-uniform model for recovering a ”hidden” element α ∈ IFp, where p is prime, from very short strings of the most significant bits of the residue of αt modulo p for several randomly chosen t ∈ IFp. Here we modify the scheme and amplify the uniformity of distribution of the ‘multipliers’ t and thus extend this result to subgroups of IFp, which are more relevant to practical usage. As in the work of Boneh and Venkatesan, our result can be applied to the bit security of Diffie–Hellman related encryption schemes starting with subgroups of very small size, including all cryptographically interesting subgroups.