LemmaStatement: Literature-sourcedProof: AI-adaptedPipeline-generatedjudge pass (gpt-6-luna)

How statement and proof provenance work

The first chip identifies the source of the statement or construction; the second identifies the source of its local proof or verification.

Literature-sourced: the exact statement appears in a cited source; only wording and notation differ.
AI-adapted: a semantically identical restatement of literature-sourced material, modulo indexing, notation, and boundary cases adopted by the library.
AI-generated: a genuinely novel statement formulated by AI, with no source for the claim itself.

These labels describe origin, not correctness: citations and verification chips remain separate evidence.

Cyclic discrete logarithm hides a rank-one subgroup

Statement

Let $G = ⟨ g ⟩$ have exact order $q \geq 2$ , let $x = g^{a}$ , and define $f : Z_{q} \times Z_{q} \to G$ by $f (u, v) = g^{u} x^{v}$ . Then

f (u, v) = f (u^{'}, v^{'}) ⟺ (u - u^{'}, v - v^{'}) \in H, H : = ⟨ (- a, 1) ⟩ .

Thus the fibers of $f$ are exactly the additive cosets of the rank-one subgroup $H$ in the finite abelian group $Z_{q}^{2}$ .

Facts & Assumptions

Given: A cyclic group $G = ⟨ g ⟩$ of exact order $q \geq 2$ , $x = g^{a}$ , and $u, v, u^{'}, v^{'} \in Z_{q}$ .

[F1]

The cyclic discrete-log instance has $ord (g) = q$ and $x = g^{a}$ for a unique $a \in {0, \dots, q - 1}$ (Finite cyclic discrete-logarithm problem and costed encoding).

[F2]

The additive hidden-subgroup promise defines a fiber by the relation that two inputs differ by an element of the subgroup (Finite abelian hidden-subgroup promise and output encoding).

[F3]

Integer powers in a group satisfy the product and exponent laws (Exponent laws in a group: $g^{m + n} = g^{m} g^{n}$ and $(g^{m})^{n} = g^{m n}$ for all $m, n \in Z$ , and $(g h)^{n} = g^{n} h^{n}$ when $g$ and $h$ commute).

Proof

1.1givenF1F3algebra

If $f (u, v) = f (u^{'}, v^{'})$ , then cancellation and $x = g^{a}$ give $g^{u - u^{'}} x^{v - v^{'}} = e$ , hence $g^{(u - u^{'}) + a (v - v^{'})} = e$ . Since $g$ has exact order $q$ by [F1], this is equivalent to $(u - u^{'}) + a (v - v^{'}) \equiv 0 (m o d q)$ .

2.1F2step 1.1F3algebra∎

Put $t = v - v^{'} \in Z_{q}$ . The congruence in step 1.1 is equivalent to $u - u^{'} = - a t$ , so $(u - u^{'}, v - v^{'}) = t (- a, 1) \in H$ . Conversely, if the difference is $t (- a, 1)$ , then $(u - u^{'}) + a (v - v^{'}) = 0$ in $Z_{q}$ , and [F3] gives $f (u, v) = f (u^{'}, v^{'})$ .

Depends on

Used by

Dependency tree · two levels

27 results within two dependency steps of this one, each drawn at its shortest distance from it. An arrow runs from a result to what uses it, so the chart reads left to right and ends at this result, which carries a heavier outline. Every node is a link to that result. Click elsewhere on the chart to enlarge it.

Sources

Andrew M. Childs, Lecture Notes on Quantum Algorithms (17 April 2025) (standard reference, not scraped)
Ronald de Wolf, Quantum Computing: Lecture Notes, arXiv:1907.09415v6 (standard reference, not scraped)