Hard Instances of the Constrained Discrete Logarithm Problem

Ilya Mironov, Anton Mityagin, Kobbi Nissim

The discrete logarithm problem (DLP) generalizes to the constrained DLP, where the secret exponent $x$ belongs to a set known to the attacker. The complexity of generic algorithms…