Provable Collisions in the Pollard Rho Algorithm for DLOG
The Pollard Rho algorithm for solving discrete logarithms works by iterating 3 types of group operations, finding a repeated value (collision), and then obtaining the desired exponent from the collision. It heuristically takes O(sqrt(p)) steps to find a collision, where p is the (prime) group order, and the collision is likewise expected to be nontrivial with probability 1-1/p. However, very little is known rigorously about the runtime of this algorithm. We prove a result using expander graphs that the collision time is O(sqrt(p)(logp)3) with probability arbitrarily close to one. The method also gives a result about the final step (of extracting the exponent from the collision) for almost all values of p. [Joint work with Ramarathnam Venkatesan, Microsoft Research ]