Does DCRA imply factoring?

Determine whether an algorithm that efficiently computes discrete cube roots modulo a 3-RSA modulus N on average (i.e., solves the Discrete Cube Root Assumption for inputs (x, N)) yields a polynomial-time algorithm for factoring N. Equivalently, prove or refute that solving the discrete cube root problem for 3-RSA integers implies the ability to factor the modulus.

Background

The paper discusses cryptographic constructions used to obtain classical–quantum learning separations. In settings based on discrete cube roots (DCR) modulo 3-RSA integers, Shor’s algorithm for factoring provides quantum access to the modulus’s prime factors, which then makes DCR easy; hence factoring implies the ability to solve DCR.

However, whether the converse holds—namely, whether efficiently solving DCR on average implies factoring—remains unresolved. Clarifying this relationship would impact the foundations of cryptographic assumptions used in learning-separation constructions and determine the strength of DCR-based hardness relative to factoring.