Function: znlog
Section: number_theoretical
C-Name: znlog0
Prototype: GGDG
Help: znlog(x,g,{o}): return the discrete logarithm of x in
 (Z/nZ)* in base g. If present, o represents the multiplicative
 order of g. Return [] if no solution exist.
Doc: This functions allows two distinct modes of operation depending
 on $g$:

 \item if $g$ is the output of \tet{znstar} (with initialization),
 we compute the discrete logarithm of $x$ with respect to the generators
 contained in the structure. See \tet{ideallog} for details.

 \item else $g$ is an explicit element in $(\Z/N\Z)^*$, we compute the
 discrete logarithm of $x$ in $(\Z/N\Z)^*$ in base $g$. The rest of this
 entry describes the latter possibility.

 The result is $[]$ when $x$ is not a power of $g$, though the function may
 also enter an infinite loop in this case.

 If present, $o$ represents the multiplicative order of $g$, see
 \secref{se:DLfun}; the preferred format for this parameter is
 \kbd{[ord, factor(ord)]}, where \kbd{ord} is the order of $g$.
 This provides a definite speedup when the discrete log problem is simple:
 \bprog
 ? p = nextprime(10^4); g = znprimroot(p); o = [p-1, factor(p-1)];
 ? for(i=1,10^4, znlog(i, g, o))
 time = 163 ms.
 ? for(i=1,10^4, znlog(i, g))
 time = 200 ms. \\ a little slower
 @eprog

 The result is undefined if $g$ is not invertible mod $N$ or if the supplied
 order is incorrect.

 This function uses

 \item a combination of generic discrete log algorithms (see below).

 \item in $(\Z/N\Z)^*$ when $N$ is prime: a linear sieve index calculus
 method, suitable for $N < 10^{50}$, say, is used for large prime divisors of
 the order.

 The generic discrete log algorithms are:

 \item Pohlig-Hellman algorithm, to reduce to groups of prime order $q$,
 where $q | p-1$ and $p$ is an odd prime divisor of $N$,

 \item Shanks baby-step/giant-step ($q < 2^{32}$ is small),

 \item Pollard rho method ($q > 2^{32}$).

 The latter two algorithms require $O(\sqrt{q})$ operations in the group on
 average, hence will not be able to treat cases where $q > 10^{30}$, say.
 In addition, Pollard rho is not able to handle the case where there are no
 solutions: it will enter an infinite loop.
 \bprog
 ? g = znprimroot(101)
 %1 = Mod(2,101)
 ? znlog(5, g)
 %2 = 24
 ? g^24
 %3 = Mod(5, 101)

 ? G = znprimroot(2 * 101^10)
 %4 = Mod(110462212541120451003, 220924425082240902002)
 ? znlog(5, G)
 %5 = 76210072736547066624
 ? G^% == 5
 %6 = 1
 ? N = 2^4*3^2*5^3*7^4*11; g = Mod(13, N); znlog(g^110, g)
 %7 = 110
 ? znlog(6, Mod(2,3))  \\ no solution
 %8 = []
 @eprog\noindent For convenience, $g$ is also allowed to be a $p$-adic number:
 \bprog
 ? g = 3+O(5^10); znlog(2, g)
 %1 = 1015243
 ? g^%
 %2 = 2 + O(5^10)
 @eprog
Variant: The function
 \fun{GEN}{znlog}{GEN x, GEN g, GEN o} is also available

