Pollard's Kangaroo (Lambda) Method is used to solve the Discrete Logarithm problem: given the generator g of a cyclic group G and an element h∈ G solve for exponent x such that g^x=h. In cryptography x is a secret message and h is the encrypted message.

The basic principle is the same as for the Kruskal Count card trick. Suppose it is known that x∈ [a,b] for some interval. Pick a value y∈ [a,b] for the tame kangaroo to start from. Set Y₀=g^y, look up a jump size δ₀ determined by Y₀ (given by a hash function), and set Y₁=Y₀*g^δo=g^y+δo. Repeat this procedure from Y₁. After some moderate number of steps a "trap" is placed, at state T=g^t=g^{y+∑ δ_i}. Next, consider the "wild kangaroo" starting from X₀=h=g^x, look up a jump size Δ₀ and set X₁=X₀*g^Δo=g^x+Δo. Repeat until X_k=T, in which case g^{x+∑ Δ_i} = T = g^t, and so x ≡ t - ∑ Δ_i   mod ord(g).

The following gives an interactive illustration of the method.

Description of Methods:
• Trap: Pollard's original method. Tame kangaroo starts at g^c, takes some number of jumps, places a trap. Wild kangaroo then starts jumping.
• Dist. Points: Distinguished points method. Wild and tame kangaroos take one step each. Repeat until one kangaroo hits a spot visited by the other.
• Tame Trail: Clearer demo of Dist Points when |G| >> c. Tame kangaroo jumps until reaches "end" of group. Then wild kangaroo starts jumping.

We use the common choice of Δ = 2^k where k∈_uar [0,d] such that Δ ≈ 0.5√c.