Semidirect Discrete Logarithm Problem (SDLP)

• SDLP is a cryptographic challenge defined by applying an endomorphism iteratively to a base element to produce a cyclic structure in semidirect products.
• It underlies protocols like Semidirect Product Key Exchange and digital signature schemes by exploiting abelian cyclic actions for secure key derivation.
• Research shows that SDLP’s complexity is platform-dependent, with quantum attacks ranging from subexponential to polynomial time, necessitating careful parameter choices.

Searching arXiv for recent and foundational papers on the Semidirect Discrete Logarithm Problem. The Semidirect Discrete Logarithm Problem (SDLP) is a discrete-logarithm analogue arising from semidirect products and, more specifically, from iterated application of an endomorphism or automorphism to a base element. In the formulation analyzed in "A Subexponential Quantum Algorithm for the Semidirect Discrete Logarithm Problem" (Battarbee et al., 2022), one fixes a finite (semi)group $G$, an endomorphism $\phi \in \mathrm{End}(G)$, and defines

$$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$

Given $(g,\phi)$ and $s(g,\phi,x)$, the task is to recover $x$. SDLP is central to semidirect-product-based cryptography, especially Semidirect Product Key Exchange (SPKE), and has been studied as a candidate hard problem in group-based post-quantum cryptography. Research over the last several years has substantially clarified its complexity: in general “easy” semigroup families it admits a subexponential quantum algorithm via reductions to group actions and the Abelian Hidden Shift Problem (Battarbee et al., 2022); in several important group settings it is even solvable in quantum polynomial time (Imran et al., 2023); and its classical hardness in finite groups is strongly platform-dependent rather than uniformly stronger than ordinary discrete logarithms (Arif et al., 7 Aug 2025).

1. Formal definitions and algebraic framework

The basic semidirect-product formulation begins with a finite (semi)group $G$ and an endomorphism $\phi \in \mathrm{End}(G)$. With a single generator $t$ acting via $\phi$, one defines

$\phi \in \mathrm{End}(G)$0

where $\phi \in \mathrm{End}(G)$1 is the $\phi \in \mathrm{End}(G)$2-fold iterate of $\phi \in \mathrm{End}(G)$3 (Battarbee et al., 2022). An equivalent formulation used in (Battarbee et al., 2022) works in the holomorph-like structure $\phi \in \mathrm{End}(G)$4 with multiplication

$\phi \in \mathrm{End}(G)$5

In this formulation,

$\phi \in \mathrm{End}(G)$6

so the first component is exactly the generalized exponentiation map $\phi \in \mathrm{End}(G)$7 (Battarbee et al., 2022).

The precise SDLP definition in (Battarbee et al., 2022) takes as input a public (semi)group $\phi \in \mathrm{End}(G)$8, its public endomorphism semigroup $\phi \in \mathrm{End}(G)$9, a public pair $$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$0, and an output value $$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$1 for uniformly random $$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$2 in the natural exponent range induced by the orbit $$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$3. The problem is to recover $$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$4 from $$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$5 (Battarbee et al., 2022).

A closely related group-only convention appears in "SPDH-Sign: towards Efficient, Post-quantum Group-based Signatures" (Battarbee et al., 2023), where $$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$6 is endowed with the multiplication

$$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$7

and one writes

$$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$8

Despite notational differences, the operative object is the same: a nonstandard exponentiation process in which the base element is twisted by iterates of an endomorphism or automorphism before multiplication (Battarbee et al., 2022, Battarbee et al., 2023).

The semigroup perspective is broader. "Quantum computation of discrete logarithms in semigroups" (Childs et al., 2013) defines semigroup discrete logarithm for powers $$s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.$$9 and observes that semidirect products $(g,\phi)$0 inherit the same eventual periodicity structure. In that framework, SDLP appears as a semigroup discrete-log instance in a singly generated subsemigroup of a semidirect product (Childs et al., 2013).

2. Structural properties: exponent sequences, tail-and-cycle decomposition, and induced actions

A central structural result in (Battarbee et al., 2022) is that for fixed $(g,\phi)$1 the set

$(g,\phi)$2

has a tail-and-cycle decomposition. Specifically, there exist integers $(g,\phi)$3 and $(g,\phi)$4 such that $(g,\phi)$5 has size $(g,\phi)$6 and splits into a tail

$(g,\phi)$7

and a cycle

$(g,\phi)$8

(Battarbee et al., 2022). This mirrors the classical eventually periodic structure of powers in finite semigroups studied by Childs and Ivanyos (Childs et al., 2013), but here the sequence is built from iterated endomorphism-twisted products rather than ordinary powers.

The key algebraic identity underlying both protocol correctness and algorithm design is the splitting lemma

$(g,\phi)$9

valid for all $s(g,\phi,x)$0 (Battarbee et al., 2022). The paper packages this as a “star” operation

$s(g,\phi,x)$1

which satisfies

$s(g,\phi,x)$2

(Battarbee et al., 2022). In the group-only treatment of (Battarbee et al., 2023), the analogous identity is written

$s(g,\phi,x)$3

and becomes the basis for a group action on the cycle.

The decisive consequence is that the cycle carries a free and transitive cyclic group action. In the notation of (Battarbee et al., 2022), if $s(g,\phi,x)$4 and $s(g,\phi,x)$5 are the index and period corresponding to $s(g,\phi,x)$6, then $s(g,\phi,x)$7 acts freely and transitively on $s(g,\phi,x)$8 via

$s(g,\phi,x)$9

(Battarbee et al., 2022). In the group setting of (Battarbee et al., 2023), if $x$0 is the smallest positive integer with $x$1, then $x$2 is a free, transitive group action (Battarbee et al., 2023). This places SDLP in the language of commutative group actions and hard homogeneous spaces, which is the conceptual bridge enabling reductions to standard quantum-hidden-shift machinery (Battarbee et al., 2022).

A common misconception is that SDLP’s noncommutative ambient structure precludes the emergence of exploitable abelian structure. The results of (Battarbee et al., 2022) show the opposite: although the original semidirect-product exponentiation is not ordinary abelian exponentiation, the eventual cycle supports an abelian action by $x$3, and this is sufficient for reduction to Group Action DLog and then Abelian Hidden Shift.

3. Role in cryptography: SPKE, SPDH-Sign, and the security assumptions they invoke

SDLP is central to the family of semidirect-product-based protocols originating with Habeeb et al., especially the Semidirect Product Key Exchange (SPKE) (Battarbee et al., 2022). In the presentation of (Battarbee et al., 2022), SPKE operates as follows: public parameters are $x$4, $x$5, $x$6, and $x$7; one party sends $x$8 and the other sends $x$9; both derive the shared key

$G$0

and the splitting lemma implies

$G$1

(Battarbee et al., 2022). Security therefore depends directly on the hardness of recovering $G$2 or $G$3 from public SDLP instances.

"SPDH-Sign" (Battarbee et al., 2023) develops a digital-signature construction from the group-action viewpoint. There, the cycle $G$4 and the free transitive action of $G$5 support an identification scheme SPDH-ID and its Fiat–Shamir transform SPDH-Sign (Battarbee et al., 2023). Public keys take the form $G$6 with

$G$7

and signatures reveal responses to challenge bits in a Sigma-protocol-style interaction (Battarbee et al., 2023). The paper gives security bounds in terms of SDLP hardness: for the identification scheme, the eavesdropping advantage is bounded by $G$8 where $G$9 is an SDLP advantage; for signatures in the random oracle model, the EUF-CMA bound is expressed in terms of $\phi \in \mathrm{End}(G)$0, $\phi \in \mathrm{End}(G)$1, the period $\phi \in \mathrm{End}(G)$2, and SDLP hardness (Battarbee et al., 2023).

These schemes were initially motivated by the idea that SDLP, unlike ordinary DLP, had no known reduction to the Hidden Subgroup Problem and might therefore plausibly resist quantum attacks (Battarbee et al., 2022). That posture has changed substantially. The dedicated quantum analysis of (Battarbee et al., 2022) and the polynomial-time algorithms of (Imran et al., 2023) now show that any security claim based on generic hardness of SDLP must be qualified by platform class and adversarial model.

A related point is that SDLP and semidirect Computational Diffie–Hellman (SCDH) are not fully interchangeable at present. (Battarbee et al., 2022) records the reduction SDLP $\phi \in \mathrm{End}(G)$3 GADLP and cites Montgomery–Zhandry’s quantum equivalence of GADLP and GACDH, while noting that the precise equivalence between SDLP and SCDH remains open. This suggests that protocol reductions must be read carefully: the hardness of one semidirect-action problem does not automatically settle the hardness of the others (Battarbee et al., 2022).

4. Quantum algorithms and complexity classification

The primary general quantum classification of SDLP is given in (Battarbee et al., 2022). For “easy families” of semigroups $\phi \in \mathrm{End}(G)$4—where $\phi \in \mathrm{End}(G)$5 is polynomial in $\phi \in \mathrm{End}(G)$6 and multiplication and endomorphism evaluation cost $\phi \in \mathrm{End}(G)$7—the paper provides a subexponential quantum algorithm for SDLP with time and query complexity

$\phi \in \mathrm{End}(G)$8

and constant success probability (Battarbee et al., 2022).

The reduction proceeds in stages. First, the period $\phi \in \mathrm{End}(G)$9 of the cycle is recovered by a Shor-style period-finding subroutine. The algorithm prepares

$t$0

measures the second register, and with probability at least $t$1 lands in the cycle, causing the first register to collapse to an $t$2-periodic superposition. Applying the QFT over $t$3 and continued fractions recovers $t$4 with success probability at least $t$5; the total running time is $t$6 (Battarbee et al., 2022). Given $t$7, the index $t$8 is found by binary search using the invariance test $t$9, for total time $\phi$0 (Battarbee et al., 2022).

Second, SDLP reduces to the Group Action DLog Problem (GADLP) on the action $\phi$1, with at most one oracle query and total classical overhead $\phi$2 (Battarbee et al., 2022). Third, GADLP reduces to an Abelian Hidden Shift Problem (AHSP) over $\phi$3 by defining injective functions

$\phi$4

so that

$\phi$5

for the hidden shift $\phi$6 (Battarbee et al., 2022).

At that point, known hidden-shift algorithms apply. Kuperberg yields time and query complexity $\phi$7 with quantum space $\phi$8, while Regev yields time

$\phi$9

with polynomial space (Battarbee et al., 2022). Since $\phi \in \mathrm{End}(G)$00 in easy families, this gives the final $\phi \in \mathrm{End}(G)$01 complexity classification (Battarbee et al., 2022).

A second line of work, "Efficient quantum algorithms for some instances of the semidirect discrete logarithm problem" (Imran et al., 2023), shows that this subexponential classification is not the end of the story in group settings. For finite groups $\phi \in \mathrm{End}(G)$02, the paper proves quantum polynomial-time algorithms in two important cases: when $\phi \in \mathrm{End}(G)$03 is solvable, and when $\phi \in \mathrm{End}(G)$04 is a matrix group such that some polynomially bounded power $\phi \in \mathrm{End}(G)$05 is an inner automorphism (Imran et al., 2023). The solvable-group algorithm recursively descends a $\phi \in \mathrm{End}(G)$06-invariant composition series and reduces SDLP on elementary abelian factors to linear-algebraic discrete logarithm problems handled by Shor-type routines (Imran et al., 2023). The matrix-inner algorithm embeds the action into a linear operator on $\phi \in \mathrm{End}(G)$07, reduces to an orbit problem, then to a matrix-power problem $\phi \in \mathrm{End}(G)$08, and finally to discrete logarithm in finite fields (Imran et al., 2023).

This yields a refined picture. General SDLP in easy semigroup families is quantumly subexponential by (Battarbee et al., 2022), but large and practically relevant subclasses of group-based instances collapse further to quantum polynomial time (Imran et al., 2023). Accordingly, claims that SDLP is generically post-quantum because Shor’s standard DLP algorithm does not directly apply are no longer sustainable (Battarbee et al., 2022, Imran et al., 2023).

5. Comparison with semigroup discrete logarithm and other related problems

The relationship between SDLP and ordinary semigroup discrete logarithm is subtle. (Childs et al., 2013) proves that discrete logarithms in arbitrary finite black-box semigroups can be computed efficiently on a quantum computer by identifying the tail-and-cycle structure of $\phi \in \mathrm{End}(G)$09 and then applying Shor’s discrete-log machinery inside the cyclic group formed by the cycle elements. In that black-box semigroup model, semidirect products $\phi \in \mathrm{End}(G)$10 are included, and the paper states that SDLP, viewed as a semigroup DLP in the semidirect product, inherits this efficient quantum attack (Childs et al., 2013).

By contrast, (Battarbee et al., 2022) analyzes a different SDLP formulation centered on recovering the exponent from the first component $\phi \in \mathrm{End}(G)$11 alone rather than from the full semidirect-product element $\phi \in \mathrm{End}(G)$12. This difference is crucial. When the full pair is available, semigroup discrete-log techniques can exploit the cyclic subgroup or subsemigroup generated by $\phi \in \mathrm{End}(G)$13 directly (Childs et al., 2013). When only the first component is exposed, the second component $\phi \in \mathrm{End}(G)$14 is hidden, and the problem becomes a group-action/vectorization problem rather than an ordinary semigroup DLP, leading to the hidden-shift reduction of (Battarbee et al., 2022).

This distinction helps clarify an apparent tension in the literature. It is not that one paper says SDLP is polynomial-time quantumly easy and another says it is merely subexponential for the same input model. Rather, the problems differ in what part of $\phi \in \mathrm{End}(G)$15 is given. The first-component-only version central to SPKE and the dedicated study of (Battarbee et al., 2022) reduces to GADLP and AHSP; the full-element semigroup discrete-log version falls within the scope of (Childs et al., 2013).

Related hardness notions also behave differently in semigroups. (Childs et al., 2013) shows that a shifted semigroup discrete log problem, $\phi \in \mathrm{End}(G)$16, reduces to the dihedral hidden subgroup problem and has best-known quantum time $\phi \in \mathrm{End}(G)$17, while constructive membership with $\phi \in \mathrm{End}(G)$18 generators in black-box abelian semigroups has quantum query complexity $\phi \in \mathrm{End}(G)$19 (Childs et al., 2013). This suggests a broader lesson: semigroup generalizations of discrete logarithm bifurcate into problems that remain easy quantumly and others whose hardness aligns with hidden-shift or dihedral-HSP phenomena.

The tropical semidirect-product setting studied in "On the tropical discrete logarithm problem and security of a protocol based on tropical semidirect product" (Muanalifah et al., 2020) offers another contrast. There, public messages reduce to tropical matrix expressions of the form

$\phi \in \mathrm{End}(G)$20

and the critical-column periodicity given by CSR expansion enables efficient exponent recovery in important cases (Muanalifah et al., 2020). This is not the same algebraic SDLP as in (Battarbee et al., 2022), but it reinforces the broader point that semidirect-product-inspired constructions often expose periodic structures that are cryptanalytically exploitable.

6. Classical hardness, platform dependence, and security implications

The most detailed current analysis of classical hardness in finite groups appears in "On the Classical Hardness of the Semidirect Discrete Logarithm Problem in Finite Groups" (Arif et al., 7 Aug 2025). That paper reformulates group-case SDLP as a generalized discrete logarithm problem in the semidirect product:

$\phi \in \mathrm{End}(G)$21

where

$\phi \in \mathrm{End}(G)$22

with $\phi \in \mathrm{End}(G)$23 (Arif et al., 7 Aug 2025). This enables an adaptation of Baby-Step Giant-Step (BSGS) with time and space complexity $\phi \in \mathrm{End}(G)$24, where $\phi \in \mathrm{End}(G)$25 is the period of the underlying cycle (Arif et al., 7 Aug 2025).

The analysis is explicitly platform-dependent. In finite fields $\phi \in \mathrm{End}(G)$26, automorphisms have the form $\phi \in \mathrm{End}(G)$27, and the period satisfies

$\phi \in \mathrm{End}(G)$28

so SDLP is classically comparable to generic DLP and does not uniformly exceed its hardness (Arif et al., 7 Aug 2025). In elliptic curves $\phi \in \mathrm{End}(G)$29, the bounded automorphism group implies $\phi \in \mathrm{End}(G)$30, making SDLP trivial in constant time (Arif et al., 7 Aug 2025). In elementary abelian groups $\phi \in \mathrm{End}(G)$31, however, SDLP can be substantially harder than standard DLP: if $\phi \in \mathrm{End}(G)$32 is not an eigenvalue of the acting matrix $\phi \in \mathrm{End}(G)$33, then BSGS runs in $\phi \in \mathrm{End}(G)$34, while if $\phi \in \mathrm{End}(G)$35 is an eigenvalue, the bound becomes $\phi \in \mathrm{End}(G)$36 (Arif et al., 7 Aug 2025).

These findings undermine a recurring intuition that the non-abelian semidirect structure inherently strengthens classical hardness. (Arif et al., 7 Aug 2025) states instead that the non-abelian structure of semidirect products does not inherently guarantee increased classical hardness. This suggests that classical security claims for SDLP-based cryptography require platform-specific evidence rather than generic appeals to noncommutativity.

The quantum implications are even sharper. (Battarbee et al., 2022) translates the best-known quantum attack on SDLP over proposed easy platforms into complexity roughly $\phi \in \mathrm{End}(G)$37 when the tunable prime modulus satisfies $\phi \in \mathrm{End}(G)$38. The paper notes that targeting 128-bit quantum security against Kuperberg-type attacks would require $\phi \in \mathrm{End}(G)$39 on the order of $\phi \in \mathrm{End}(G)$40 bits, implying platform sizes far beyond practical ranges on matrix platforms such as $\phi \in \mathrm{End}(G)$41 (Battarbee et al., 2022). This suggests very conservative parameterization would be necessary and would likely render currently proposed SDLP instantiations impractical.

The cryptographic consequences are therefore differentiated by setting. For semidirect-product key exchange and signature schemes instantiated in solvable groups or in matrix groups with polynomially small-power inner automorphisms, (Imran et al., 2023) gives quantum polynomial-time attacks. For broader easy semigroup families, (Battarbee et al., 2022) provides subexponential hidden-shift attacks. For certain group instantiations, classical hardness may also be weaker than hoped or even trivial (Arif et al., 7 Aug 2025). A plausible implication is that any viable SDLP-based design would need to move away from the currently best-understood group families and possibly away from groups altogether, although (Battarbee et al., 2022) notes that whether non-easy semigroups materially change the complexity landscape remains open.

7. Open questions and research directions

Several open problems remain central. One concerns the relationship between SDLP and semidirect Computational Diffie–Hellman. (Battarbee et al., 2022) establishes SDLP $\phi \in \mathrm{End}(G)$42 GADLP and notes the quantum equivalence GADLP $\phi \in \mathrm{End}(G)$43 GACDH from Montgomery–Zhandry, but the precise equivalence between SDLP and SCDH is still open. This matters for interpreting the security of SPKE-like constructions whose correctness and shared-key derivation are naturally phrased in Diffie–Hellman terms.

A second question concerns the boundary between subexponential and polynomial-time quantum algorithms. (Imran et al., 2023) shows that solvable groups and broad classes of matrix groups admit quantum polynomial-time attacks, while (Battarbee et al., 2022) gives only subexponential attacks in general easy semigroup families. Determining whether additional natural group or semigroup classes also collapse to polynomial-time quantum algorithms remains a major structural problem.

A third issue is parameter realism and concrete cryptanalysis. (Battarbee et al., 2022) emphasizes that constants hidden in $\phi \in \mathrm{End}(G)$44 and implementation overheads for Kuperberg- or Regev-type methods are important for actual security estimates. (Arif et al., 7 Aug 2025) likewise shows that classical hardness depends delicately on the automorphism order, fixed-point structure, and eigenvalue behavior of the platform action. More concrete analyses could narrow the remaining uncertainty about borderline parameter regimes.

A fourth research direction concerns algebraic platform design. (Imran et al., 2023) suggests that many matrix-group candidates, especially over odd characteristic, fall within the reach of structure algorithms that expose $\phi \in \mathrm{End}(G)$45-invariant series and matrix-inner reductions. (Battarbee et al., 2022) asks whether there are platform designs in which the cycle structure is harder to expose or in which residual $\phi \in \mathrm{End}(G)$46-structure obstructs the AHSP pathway. This suggests that future constructions, if any, would need to avoid the abelian-action skeleton that current attacks exploit.

Finally, there is a broader conceptual synthesis with hard homogeneous spaces and group-action cryptography. (Battarbee et al., 2022) explicitly places SDLP in the lineage of commutative action-based problems; (Battarbee et al., 2023) builds a signature scheme directly from that action viewpoint. This suggests that SDLP should be understood less as an exotic noncommutative analogue of ordinary DLP and more as a specialized vectorization problem induced by an eventually cyclic action. That reframing has been one of the literature’s most consequential clarifications.

In contemporary understanding, SDLP is neither uniformly intractable nor uniformly analogous to ordinary discrete logarithm. Its difficulty depends on exactly what information is exposed, on the algebraic class of the underlying platform, and on whether the adversary is classical or quantum. The modern literature has replaced early intuition with a more precise classification: first-component SDLP in easy semigroup families is quantumly subexponential (Battarbee et al., 2022); broad structured group instances are quantumly polynomial-time (Imran et al., 2023); full semigroup discrete logarithm in semidirect products can already be quantumly efficient in the black-box model (Childs et al., 2013); and classical hardness varies sharply by platform (Arif et al., 7 Aug 2025).