We review the well-known relation between Lucas sequences and exponentiation. This leads to the observation that certain public-key cryptosystems that are based on the use of Lucas sequences have some elementary properties their re-inventors were apparently not aware of. In particular, we present a chosen-message forgery for ‘LUC’ (cf. [21; 25]), and we show that ‘LUCELG’and ‘LUCDIF’ (cf. [22, 261) are vulnerable to subexponential time attacks.This provesthat various claimsthat were made about Lucas-based cryptosystems are incorrect.
Daniel Bleichenbacher, Wieb Bosma, Arjen K. Lenstr