In group theory, a branch of mathematics, the baby-step giant-step is a meet-in-the-middle algorithm for computing the discrete logarithm or order of an element in a finite abelian group by Daniel Shanks. The discrete log problem is of fundamental importance to the area of public key cryptography.

Many of the most commonly used cryptography systems are based on the assumption that the discrete log is extremely difficult to compute; the more difficult it is, the more security it provides a data transfer. One way to increase the difficulty of the discrete log problem is to base the cryptosystem on a larger group.

The algorithm is based on a space–time tradeoff. It is a fairly simple modification of trial multiplication, the naive method of finding discrete logarithms.

Given a cyclic group ${\displaystyle G}$ of order ${\displaystyle n}$, a generator ${\displaystyle \alpha }$ of the group and a group element ${\displaystyle \beta }$, the problem is to find an integer ${\displaystyle x}$ such that

The baby-step giant-step algorithm is based on rewriting ${\displaystyle x}$:

Therefore, we have:

The algorithm precomputes ${\displaystyle \alpha ^{j}}$ for several values of ${\displaystyle j}$. Then it fixes an ${\displaystyle m}$ and tries values of ${\displaystyle i}$ in the right-hand side of the congruence above, in the manner of trial multiplication. It tests to see if the congruence is satisfied for any value of ${\displaystyle j}$, using the precomputed values of ${\displaystyle \alpha ^{j}}$.

Input: A cyclic group G of order n, having a generator α and an element β.