As an important special case, which is used as a subroutine in the general algorithm (see below), the Pohlig–Hellman algorithm applies to
groups whose order is a
prime power. The basic idea of this algorithm is to iteratively compute the -adic digits of the logarithm by repeatedly "shifting out" all but one unknown digit in the exponent, and computing that digit by elementary methods.
(Note that for readability, the algorithm is stated for cyclic groups — in general, must be replaced by the subgroup generated by , which is always cyclic.)
Input. A cyclic group of order with generator and an element .
The algorithm computes discrete logarithms in time complexity
, far better than the
baby-step giant-step algorithm's when is large.
The general algorithm
In this section, we present the general case of the Pohlig–Hellman algorithm. The core ingredients are the algorithm from the previous section (to compute a logarithm modulo each prime power in the group order) and the
Chinese remainder theorem (to combine these to a logarithm in the full group).
(Again, we assume the group to be cyclic, with the understanding that a non-cyclic group must be replaced by the subgroup generated by the logarithm's base element.)
Input. A cyclic group of order with generator , an element , and a prime factorization .
Using the algorithm above in the group , compute such that .
Solve the simultaneous congruence
The Chinese remainder theorem guarantees there exists a unique solution .
Return .
The correctness of this algorithm can be verified via the
classification of finite abelian groups: Raising and to the power of can be understood as the projection to the factor group of order .
Complexity
The worst-case input for the Pohlig–Hellman algorithm is a group of prime order: In that case, it degrades to the
baby-step giant-step algorithm, hence the worst-case time complexity is . However, it is much more efficient if the order is smooth: Specifically, if is the prime factorization of , then the algorithm's complexity is