As far I understand, when it comes to finite fields, Pollard rho and Pollard’s lambda are still the best algorithm for solving discrete logarithms in a multiplicative subgroup/suborder….
Index calculus methods like nfs can be made to target multiplicative subgroups, but they don’t work in multiplicative subgroups : given a finite fields with a very large characteristic which is enough larger than the target subgroup, they can have an higher complexity than using a Pollard’s method.
Therefore, if we discard quantum computers and Oracle based situations, there’s no known sub‑exponential algorithm that can take real advantage from knowledge the solution of a specific discrete logarithm is below a specific integer.
This even lead to cryptographic systems where the publicly known and used finite field’s order is relatively small for a would be sub‑exponential algorithm but the finite field itself is too large for index calculus (still used today).
Now, is it because of lack of research or is there a reason in number theory that prevents creating an algorithm having at least a $<\sqrt{\text{multiplicative subgroup}}$ time and space complexity ?
