On the Classical Hardness of the Semidirect Discrete Logarithm Problem in Finite Groups

TL;DR

The paper investigates the classical hardness of the semidirect discrete logarithm problem (SDLP) in finite groups, motivated by quantum results that undermine SDLP's resistance and by the need to compare its classical hardness to standard DLP. It shows that group-base SDLP reduces to a generalized DLP (GDLP) in the semidirect product $G \rtimes \mathrm{Aut}(G)$ and provides a concrete adaptation of the Baby-Step Giant-Step algorithm, solving it in $O(\sqrt{r})$ time/space where $r$ is the cycle period. Through theoretical analysis and SageMath experiments across platform groups $\mathbb{F}_p^*$, $E(\mathbb{F}_p)$, and $\mathbb{F}_p^n$, the work reveals highly platform-dependent classical hardness: SDLP is comparable to DLP in finite fields, trivially easy on elliptic curves due to bounded automorphism groups, and potentially harder than DLP in elementary abelian groups depending on eigenstructure. The results challenge the assumption that semidirect (non-abelian) structure inherently yields greater classical hardness and emphasize careful platform selection and novel approaches for post-quantum cryptographic design.

Abstract

The semidirect discrete logarithm problem (SDLP) in finite groups was proposed as a foundation for post-quantum cryptographic protocols, based on the belief that its non-abelian structure would resist quantum attacks. However, recent results have shown that SDLP in finite groups admits efficient quantum algorithms, undermining its quantum resistance. This raises a fundamental question: does the SDLP offer any computational advantages over the standard discrete logarithm problem (DLP) against classical adversaries? In this work, we investigate the classical hardness of SDLP across different finite group platforms. We establish that the group-case SDLP can be reformulated as a generalized discrete logarithm problem, enabling adaptation of classical algorithms to study its complexity. We present a concrete adaptation of the Baby-Step Giant-Step algorithm for SDLP, achieving time and space complexity $O(\sqrt{r})$ where $r$ is the period of the underlying cycle structure. Through theoretical analysis and experimental validation in SageMath, we demonstrate that the classical hardness of SDLP is highly platform-dependent and does not uniformly exceed that of standard DLP. In finite fields $\mathbb{F}_p^*$, both problems exhibit comparable complexity. Surprisingly, in elliptic curves $E(\mathbb{F}_p)$, the SDLP becomes trivial due to the bounded automorphism group, while in elementary abelian groups $\mathbb{F}_p^n$, the SDLP can be harder than DLP, with complexity varying based on the eigenvalue structure of the automorphism. Our findings reveal that the non-abelian structure of semidirect products does not inherently guarantee increased classical hardness, suggesting that the search for classically hard problems for cryptographic applications requires more careful consideration of the underlying algebraic structures.