  The discrete logarithm problem (DLP) generalizes to the constrained DLP,
where the secret exponent $x$ belongs to a set known to the attacker. The
complexity of generic algorithms for solving the constrained DLP depends on the
choice of the set. Motivated by cryptographic applications, we study sets with
succinct representation for which the constrained DLP is hard. We draw on
earlier results due to Erd\"os et al. and Schnorr, develop geometric tools such
as generalized Menelaus' theorem for proving lower bounds on the complexity of
the constrained DLP, and construct sets with succinct representation with
provable non-trivial lower bounds.
