Beyond Sequential Walks: Parallelizing the GA-Dlog Problem
摘要
The Group Action Discrete Logarithm (GA-dlog) problem is a central hardness assumption in isogeny-based cryptography, forming the basis of protocols such as CSIDH and its variants. The current state-of-the-art algorithm of May and Ostuzzi (PKC 2025) combines large-scale precomputation with collision-finding walks. However, a key limitation of their approach is that its theoretical success probability is loosely bounded. In this work, we first revisit the May–Ostuzzi framework and provide a refined analysis of its success probability, proving tighter bounds that closely match experimental behaviour. Next, we propose a new algorithmic framework that supports parallelization in both the Precomputation and Online Phases. By decomposing the group into structured components and restricting random walks to coset-like subsets, our method distributes efficiently across multiple cores. For a typical instantiation with group size N and \(\varDelta \) available cores, the May–Ostuzzi algorithm with a hint of size \(N^{1/3}\) requires precomputation time \(\tfrac{N^{2/3}}{\varDelta }\) (using parallel computation) and online time \(N^{1/3}\) . Our method improves these costs when the group contains a direct-summand subgroup of order \(N_1 \le \varDelta ^{3/2}\) , reducing the hint size to \(\bigl \lceil \tfrac{N_1}{\varDelta } \bigr \rceil \tfrac{N^{1/3}}{N_1^{1/3}}\) , the precomputation cost to \(\bigl \lceil \tfrac{N_1}{\varDelta } \bigr \rceil \tfrac{N^{2/3}}{N_1^{2/3}\varDelta }\) , and the online cost to \(\tfrac{N^{1/3}}{N_1^{1/3}}\) . This yields an efficient reduction in both time and memory requirements under realistic parallel computation models.