---
title: Semidirect Discrete Logarithm Problem (SDLP)
url: https://www.emergentmind.com/topics/semidirect-discrete-logarithm-problem-sdlp
type: topic
---

# Semidirect Discrete Logarithm Problem (SDLP)

Searching arXiv for recent and foundational papers on the Semidirect Discrete Logarithm Problem.
The Semidirect Discrete Logarithm Problem (SDLP) is a discrete-logarithm analogue arising from semidirect products and, more specifically, from iterated application of an endomorphism or automorphism to a base element. In the formulation analyzed in "A Subexponential Quantum Algorithm for the Semidirect Discrete Logarithm Problem" [2209.02814], one fixes a finite (semi)group $G$, an endomorphism $\phi \in \mathrm{End}(G)$, and defines
$$
s(g,\phi,x):=\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g.
$$
Given $(g,\phi)$ and $s(g,\phi,x)$, the task is to recover $x$. SDLP is central to semidirect-product-based cryptography, especially Semidirect Product Key Exchange (SPKE), and has been studied as a candidate hard problem in group-based post-quantum cryptography. Research over the last several years has substantially clarified its complexity: in general “easy” semigroup families it admits a subexponential quantum algorithm via reductions to group actions and the Abelian Hidden Shift Problem [2209.02814]; in several important group settings it is even solvable in quantum polynomial time [2312.14028]; and its classical hardness in finite groups is strongly platform-dependent rather than uniformly stronger than ordinary discrete logarithms [2508.05048].

## 1. Formal definitions and algebraic framework

The basic semidirect-product formulation begins with a finite (semi)group $G$ and an endomorphism $\phi \in \mathrm{End}(G)$. With a single generator $t$ acting via $\phi$, one defines
$$
(g,t^a)(h,t^b)=(g\cdot \phi^a(h),t^{a+b}),
$$
where $\phi^a$ is the $a$-fold iterate of $\phi$ [2209.02814]. An equivalent formulation used in [2209.02814] works in the holomorph-like structure $G\times \mathrm{End}(G)$ with multiplication
$$
(g,\phi)\cdot(g',\phi')=(\phi'(g)\cdot g',\phi\circ \phi').
$$
In this formulation,
$$
(g,\phi)^x=(\phi^{x-1}(g)\cdot \ldots \cdot \phi(g)\cdot g,\phi^x),
$$
so the first component is exactly the generalized exponentiation map $s(g,\phi,x)$ [2209.02814].

The precise SDLP definition in [2209.02814] takes as input a public (semi)group $G$, its public endomorphism semigroup $\mathrm{End}(G)$, a public pair $(g,\phi)\in G\times \mathrm{End}(G)$, and an output value $s(g,\phi,x)$ for uniformly random $x$ in the natural exponent range induced by the orbit $\{s(g,\phi,i):i\in \mathbb{N}\}$. The problem is to recover $x$ from $((g,\phi),s(g,\phi,x))$ [2209.02814].

A closely related group-only convention appears in "SPDH-Sign: towards Efficient, Post-quantum Group-based Signatures" [2304.12900], where $G\ltimes \mathrm{Aut}(G)$ is endowed with the multiplication
$$
(g,\phi)(g',\phi')=(\phi'(g)g',\phi'\phi),
$$
and one writes
$$
(g,\phi)^x=(s_{g,\phi}(x),\phi^x), \qquad
s_{g,\phi}(x)=\phi^{x-1}(g)\cdots \phi(g)\,g.
$$
Despite notational differences, the operative object is the same: a nonstandard exponentiation process in which the base element is twisted by iterates of an endomorphism or automorphism before multiplication [2209.02814, 2304.12900].

The semigroup perspective is broader. "Quantum computation of discrete logarithms in semigroups" [1310.6238] defines semigroup discrete logarithm for powers $g^1,g^2,\ldots$ and observes that semidirect products $S\rtimes_\phi T$ inherit the same eventual periodicity structure. In that framework, SDLP appears as a semigroup discrete-log instance in a singly generated subsemigroup of a semidirect product [1310.6238].

## 2. Structural properties: exponent sequences, tail-and-cycle decomposition, and induced actions

A central structural result in [2209.02814] is that for fixed $(g,\phi)$ the set
$$
\mathcal{X}=\{s(g,\phi,i):i\in \mathbb{N}\}
$$
has a tail-and-cycle decomposition. Specifically, there exist integers $n$ and $r$ such that $\mathcal{X}$ has size $n+r-1$ and splits into a tail
$$
\mathcal{T}=\{g,\ldots,s(g,\phi,n-1)\}
$$
and a cycle
$$
\mathcal{C}=\{s(g,\phi,n),\ldots,s(g,\phi,n+r-1)\}
$$
[2209.02814]. This mirrors the classical eventually periodic structure of powers in finite semigroups studied by Childs and Ivanyos [1310.6238], but here the sequence is built from iterated endomorphism-twisted products rather than ordinary powers.

The key algebraic identity underlying both protocol correctness and algorithm design is the splitting lemma
$$
\phi^x(s(g,\phi,y))\cdot s(g,\phi,x)=s(g,\phi,x+y),
$$
valid for all $x,y\in \mathbb{N}$ [2209.02814]. The paper packages this as a “star” operation
$$
i\ast s(g,\phi,j):=\phi^i(s(g,\phi,j))\cdot s(g,\phi,i),
$$
which satisfies
$$
i\ast s(g,\phi,j)=s(g,\phi,i+j)
$$
[2209.02814]. In the group-only treatment of [2304.12900], the analogous identity is written
$$
\phi^j(s_{g,\phi}(i))\,s_{g,\phi}(j)=s_{g,\phi}(i+j),
$$
and becomes the basis for a group action on the cycle.

The decisive consequence is that the cycle carries a free and transitive cyclic group action. In the notation of [2209.02814], if $n$ and $r$ are the index and period corresponding to $(g,\phi)$, then $\mathbb{Z}_r$ acts freely and transitively on $\mathcal{C}$ via
$$
[j]_r \circ s(g,\phi,i+n)=s(g,\phi,(i+j)\bmod r+n)
$$
[2209.02814]. In the group setting of [2304.12900], if $n$ is the smallest positive integer with $s_{g,\phi}(n)=1$, then $(\mathbb{Z}_n,\mathcal{X}_{g,\phi},\circledast)$ is a free, transitive group action [2304.12900]. This places SDLP in the language of commutative group actions and hard homogeneous spaces, which is the conceptual bridge enabling reductions to standard quantum-hidden-shift machinery [2209.02814].

A common misconception is that SDLP’s noncommutative ambient structure precludes the emergence of exploitable abelian structure. The results of [2209.02814] show the opposite: although the original semidirect-product exponentiation is not ordinary abelian exponentiation, the eventual cycle supports an abelian action by $\mathbb{Z}_r$, and this is sufficient for reduction to Group Action DLog and then Abelian Hidden Shift.

## 3. Role in cryptography: SPKE, SPDH-Sign, and the security assumptions they invoke

SDLP is central to the family of semidirect-product-based protocols originating with Habeeb et al., especially the Semidirect Product Key Exchange (SPKE) [2209.02814]. In the presentation of [2209.02814], SPKE operates as follows: public parameters are $G$, $g\in G$, $\phi\in \mathrm{End}(G)$, and $N=|\{s(g,\phi,i)\}|$; one party sends $A=s(g,\phi,x)$ and the other sends $B=s(g,\phi,y)$; both derive the shared key
$$
K_A=\phi^x(B)\cdot A,\qquad K_B=\phi^y(A)\cdot B,
$$
and the splitting lemma implies
$$
K_A=K_B=s(g,\phi,x+y)
$$
[2209.02814]. Security therefore depends directly on the hardness of recovering $x$ or $y$ from public SDLP instances.

"SPDH-Sign" [2304.12900] develops a digital-signature construction from the group-action viewpoint. There, the cycle $\mathcal{X}_{g,\phi}$ and the free transitive action of $\mathbb{Z}_n$ support an identification scheme SPDH-ID and its Fiat–Shamir transform SPDH-Sign [2304.12900]. Public keys take the form $(X_i,Y_i)$ with
$$
Y_i=[s_i]_n\circledast X_i,
$$
and signatures reveal responses to challenge bits in a Sigma-protocol-style interaction [2304.12900]. The paper gives security bounds in terms of SDLP hardness: for the identification scheme, the eavesdropping advantage is bounded by $\sqrt{\varepsilon}+2^{-N}$ where $\varepsilon$ is an SDLP advantage; for signatures in the random oracle model, the EUF-CMA bound is expressed in terms of $Q_s$, $Q_{ro}$, the period $n$, and SDLP hardness [2304.12900].

These schemes were initially motivated by the idea that SDLP, unlike ordinary DLP, had no known reduction to the Hidden Subgroup Problem and might therefore plausibly resist quantum attacks [2209.02814]. That posture has changed substantially. The dedicated quantum analysis of [2209.02814] and the polynomial-time algorithms of [2312.14028] now show that any security claim based on generic hardness of SDLP must be qualified by platform class and adversarial model.

A related point is that SDLP and semidirect Computational Diffie–Hellman (SCDH) are not fully interchangeable at present. [2209.02814] records the reduction SDLP $\to$ GADLP and cites Montgomery–Zhandry’s quantum equivalence of GADLP and GACDH, while noting that the precise equivalence between SDLP and SCDH remains open. This suggests that protocol reductions must be read carefully: the hardness of one semidirect-action problem does not automatically settle the hardness of the others [2209.02814].

## 4. Quantum algorithms and complexity classification

The primary general quantum classification of SDLP is given in [2209.02814]. For “easy families” of semigroups $\{G_p\}$—where $|G_p|$ is polynomial in $p$ and multiplication and endomorphism evaluation cost $O((\log p)^2)$—the paper provides a subexponential quantum algorithm for SDLP with time and query complexity
$$
2^{O(\sqrt{\log p})}
$$
and constant success probability [2209.02814].

The reduction proceeds in stages. First, the period $r$ of the cycle is recovered by a Shor-style period-finding subroutine. The algorithm prepares
$$
\frac{1}{\sqrt{M}}\sum_{k=0}^{M-1}|k\rangle |s(g,\phi,k)\rangle,
$$
measures the second register, and with probability at least $1/2$ lands in the cycle, causing the first register to collapse to an $r$-periodic superposition. Applying the QFT over $\mathbb{Z}_M$ and continued fractions recovers $r$ with success probability at least $4/\pi^2$; the total running time is $O((\log p)^3)$ [2209.02814]. Given $r$, the index $n$ is found by binary search using the invariance test $r\ast s(g,\phi,\mathrm{mid})=s(g,\phi,\mathrm{mid})$, for total time $O((\log p)^4)$ [2209.02814].

Second, SDLP reduces to the Group Action DLog Problem (GADLP) on the action $(\mathbb{Z}_r,\mathcal{C},\circ)$, with at most one oracle query and total classical overhead $O((\log p)^4)$ [2209.02814]. Third, GADLP reduces to an Abelian Hidden Shift Problem (AHSP) over $\mathbb{Z}_r$ by defining injective functions
$$
f_A([x]_r)=[x]_r\circ s(g,\phi,n+i),\qquad
f_B([x]_r)=[x]_r\circ s(g,\phi,n+j),
$$
so that
$$
f_B([x]_r)=f_A([x+k]_r)
$$
for the hidden shift $[k]_r$ [2209.02814].

At that point, known hidden-shift algorithms apply. Kuperberg yields time and query complexity $2^{O(\sqrt{\log r})}$ with quantum space $2^{O(\log r)}$, while Regev yields time
$$
e^{\sqrt{2}+o(1)\sqrt{\ln r\,\ln\ln r}}
$$
with polynomial space [2209.02814]. Since $r=\mathrm{poly}(p)$ in easy families, this gives the final $2^{O(\sqrt{\log p})}$ complexity classification [2209.02814].

A second line of work, "Efficient quantum algorithms for some instances of the semidirect discrete logarithm problem" [2312.14028], shows that this subexponential classification is not the end of the story in group settings. For finite groups $G$, the paper proves quantum polynomial-time algorithms in two important cases: when $G$ is solvable, and when $G\leq GL_d(\mathbb{F}_q)$ is a matrix group such that some polynomially bounded power $\sigma^k$ is an inner automorphism [2312.14028]. The solvable-group algorithm recursively descends a $\sigma$-invariant composition series and reduces SDLP on elementary abelian factors to linear-algebraic discrete logarithm problems handled by Shor-type routines [2312.14028]. The matrix-inner algorithm embeds the action into a linear operator on $M_d(\mathbb{F}_q)$, reduces to an orbit problem, then to a matrix-power problem $B=A^t$, and finally to discrete logarithm in finite fields [2312.14028].

This yields a refined picture. General SDLP in easy semigroup families is quantumly subexponential by [2209.02814], but large and practically relevant subclasses of group-based instances collapse further to quantum polynomial time [2312.14028]. Accordingly, claims that SDLP is generically post-quantum because Shor’s standard DLP algorithm does not directly apply are no longer sustainable [2209.02814, 2312.14028].

## 5. Comparison with semigroup discrete logarithm and other related problems

The relationship between SDLP and ordinary semigroup discrete logarithm is subtle. [1310.6238] proves that discrete logarithms in arbitrary finite black-box semigroups can be computed efficiently on a quantum computer by identifying the tail-and-cycle structure of $g,g^2,g^3,\ldots$ and then applying Shor’s discrete-log machinery inside the cyclic group formed by the cycle elements. In that black-box semigroup model, semidirect products $S\rtimes_\phi T$ are included, and the paper states that SDLP, viewed as a semigroup DLP in the semidirect product, inherits this efficient quantum attack [1310.6238].

By contrast, [2209.02814] analyzes a different SDLP formulation centered on recovering the exponent from the first component $s(g,\phi,x)$ alone rather than from the full semidirect-product element $(s(g,\phi,x),\phi^x)$. This difference is crucial. When the full pair is available, semigroup discrete-log techniques can exploit the cyclic subgroup or subsemigroup generated by $(g,\phi)$ directly [1310.6238]. When only the first component is exposed, the second component $\phi^x$ is hidden, and the problem becomes a group-action/vectorization problem rather than an ordinary semigroup DLP, leading to the hidden-shift reduction of [2209.02814].

This distinction helps clarify an apparent tension in the literature. It is not that one paper says SDLP is polynomial-time quantumly easy and another says it is merely subexponential for the same input model. Rather, the problems differ in what part of $(g,\phi)^x$ is given. The first-component-only version central to SPKE and the dedicated study of [2209.02814] reduces to GADLP and AHSP; the full-element semigroup discrete-log version falls within the scope of [1310.6238].

Related hardness notions also behave differently in semigroups. [1310.6238] shows that a shifted semigroup discrete log problem, $x=yg^a$, reduces to the dihedral hidden subgroup problem and has best-known quantum time $2^{O(\sqrt{\log r})}$, while constructive membership with $k\ge 2$ generators in black-box abelian semigroups has quantum query complexity $\tilde{\Theta}(N^{\frac12-\frac1{2k}})$ [1310.6238]. This suggests a broader lesson: semigroup generalizations of discrete logarithm bifurcate into problems that remain easy quantumly and others whose hardness aligns with hidden-shift or dihedral-HSP phenomena.

The tropical semidirect-product setting studied in "On the tropical discrete logarithm problem and security of a protocol based on tropical semidirect product" [2101.02781] offers another contrast. There, public messages reduce to tropical matrix expressions of the form
$$
A=V\otimes F^{\otimes t},
$$
and the critical-column periodicity given by CSR expansion enables efficient exponent recovery in important cases [2101.02781]. This is not the same algebraic SDLP as in [2209.02814], but it reinforces the broader point that semidirect-product-inspired constructions often expose periodic structures that are cryptanalytically exploitable.

## 6. Classical hardness, platform dependence, and security implications

The most detailed current analysis of classical hardness in finite groups appears in "On the Classical Hardness of the Semidirect Discrete Logarithm Problem in Finite Groups" [2508.05048]. That paper reformulates group-case SDLP as a generalized discrete logarithm problem in the semidirect product:
$$
u^t v^t = w,
$$
where
$$
u=(g,\sigma),\qquad v=(1,\sigma^{-1}),\qquad w=(h,\mathrm{id}),
$$
with $h=s_{g,\sigma}(t)$ [2508.05048]. This enables an adaptation of Baby-Step Giant-Step (BSGS) with time and space complexity $O(\sqrt{r})$, where $r$ is the period of the underlying cycle [2508.05048].

The analysis is explicitly platform-dependent. In finite fields $\mathbb{F}_p^\*$, automorphisms have the form $\phi_k:x\mapsto x^k$, and the period satisfies
$$
r \le \mathrm{ord}_{p-1}(k)\cdot \gcd(k-1,p-1),
$$
so SDLP is classically comparable to generic DLP and does not uniformly exceed its hardness [2508.05048]. In elliptic curves $E(\mathbb{F}_p)$, the bounded automorphism group implies $r\le |\mathrm{Aut}(E)|\le 24$, making SDLP trivial in constant time [2508.05048]. In elementary abelian groups $\mathbb{F}_p^n$, however, SDLP can be substantially harder than standard DLP: if $1$ is not an eigenvalue of the acting matrix $A$, then BSGS runs in $O(p^{n/2})$, while if $1$ is an eigenvalue, the bound becomes $O(p^{n/2+1})$ [2508.05048].

These findings undermine a recurring intuition that the non-abelian semidirect structure inherently strengthens classical hardness. [2508.05048] states instead that the non-abelian structure of semidirect products does not inherently guarantee increased classical hardness. This suggests that classical security claims for SDLP-based cryptography require platform-specific evidence rather than generic appeals to noncommutativity.

The quantum implications are even sharper. [2209.02814] translates the best-known quantum attack on SDLP over proposed easy platforms into complexity roughly $2^{O(\sqrt{\lambda})}$ when the tunable prime modulus satisfies $p\approx 2^\lambda$. The paper notes that targeting 128-bit quantum security against Kuperberg-type attacks would require $\lambda$ on the order of $16{,}384$ bits, implying platform sizes far beyond practical ranges on matrix platforms such as $M_3(\mathbb{Z}_p)$ [2209.02814]. This suggests very conservative parameterization would be necessary and would likely render currently proposed SDLP instantiations impractical.

The cryptographic consequences are therefore differentiated by setting. For semidirect-product key exchange and signature schemes instantiated in solvable groups or in matrix groups with polynomially small-power inner automorphisms, [2312.14028] gives quantum polynomial-time attacks. For broader easy semigroup families, [2209.02814] provides subexponential hidden-shift attacks. For certain group instantiations, classical hardness may also be weaker than hoped or even trivial [2508.05048]. A plausible implication is that any viable SDLP-based design would need to move away from the currently best-understood group families and possibly away from groups altogether, although [2209.02814] notes that whether non-easy semigroups materially change the complexity landscape remains open.

## 7. Open questions and research directions

Several open problems remain central. One concerns the relationship between SDLP and semidirect Computational Diffie–Hellman. [2209.02814] establishes SDLP $\to$ GADLP and notes the quantum equivalence GADLP $\leftrightarrow$ GACDH from Montgomery–Zhandry, but the precise equivalence between SDLP and SCDH is still open. This matters for interpreting the security of SPKE-like constructions whose correctness and shared-key derivation are naturally phrased in Diffie–Hellman terms.

A second question concerns the boundary between subexponential and polynomial-time quantum algorithms. [2312.14028] shows that solvable groups and broad classes of matrix groups admit quantum polynomial-time attacks, while [2209.02814] gives only subexponential attacks in general easy semigroup families. Determining whether additional natural group or semigroup classes also collapse to polynomial-time quantum algorithms remains a major structural problem.

A third issue is parameter realism and concrete cryptanalysis. [2209.02814] emphasizes that constants hidden in $2^{O(\sqrt{\log r})}$ and implementation overheads for Kuperberg- or Regev-type methods are important for actual security estimates. [2508.05048] likewise shows that classical hardness depends delicately on the automorphism order, fixed-point structure, and eigenvalue behavior of the platform action. More concrete analyses could narrow the remaining uncertainty about borderline parameter regimes.

A fourth research direction concerns algebraic platform design. [2312.14028] suggests that many matrix-group candidates, especially over odd characteristic, fall within the reach of structure algorithms that expose $\sigma$-invariant series and matrix-inner reductions. [2209.02814] asks whether there are platform designs in which the cycle structure is harder to expose or in which residual $\phi$-structure obstructs the AHSP pathway. This suggests that future constructions, if any, would need to avoid the abelian-action skeleton that current attacks exploit.

Finally, there is a broader conceptual synthesis with hard homogeneous spaces and group-action cryptography. [2209.02814] explicitly places SDLP in the lineage of commutative action-based problems; [2304.12900] builds a signature scheme directly from that action viewpoint. This suggests that SDLP should be understood less as an exotic noncommutative analogue of ordinary DLP and more as a specialized vectorization problem induced by an eventually cyclic action. That reframing has been one of the literature’s most consequential clarifications.

In contemporary understanding, SDLP is neither uniformly intractable nor uniformly analogous to ordinary discrete logarithm. Its difficulty depends on exactly what information is exposed, on the algebraic class of the underlying platform, and on whether the adversary is classical or quantum. The modern literature has replaced early intuition with a more precise classification: first-component SDLP in easy semigroup families is quantumly subexponential [2209.02814]; broad structured group instances are quantumly polynomial-time [2312.14028]; full semigroup discrete logarithm in semidirect products can already be quantumly efficient in the black-box model [1310.6238]; and classical hardness varies sharply by platform [2508.05048].

Source: https://www.emergentmind.com/topics/semidirect-discrete-logarithm-problem-sdlp