The multiple number field sieve for medium- and high-characteristic finite fields

AbstractIn this paper we study the discrete logarithm problem in medium- and high-characteristic finite fields. We propose a variant of the number field sieve (NFS) based on numerous number fields. Our improved algorithm computes discrete logarithms in $\def \xmlpi #1{}\def \mathsfbi #1{\boldsymbol {\mathsf {#1}}}\let \le =\leqslant \let \leq =\leqslant \let \ge =\geqslant \let \geq =\geqslant \def \Pr {\mathit {Pr}}\def \Fr {\mathit {Fr}}\def \Rey {\mathit {Re}}\mathbb{F}_{p^n}$ for the whole range of applicability of the NFS and lowers the asymptotic complexity from $L_{p^n}({1/3},({128/9})^{1/3})$ to $L_{p^n}({1/3},(2^{13}/3^6)^{1/3})$ in the medium-characteristic case, and from $L_{p^n}({1/3},({64/9})^{1/3})$ to $L_{p^n}({1/3},((92 + 26 \sqrt{13})/27)^{1/3})$ in the high-characteristic case.

Download Full-text

Collecting relations for the number field sieve in

LMS Journal of Computation and Mathematics ◽

10.1112/s1461157016000164 ◽

2016 ◽

Vol 19 (A) ◽

pp. 332-350 ◽

Cited By ~ 6

Author(s):

Pierrick Gaudry ◽

Laurent Grémy ◽

Marion Videau

Keyword(s):

Number Field ◽

Finite Fields ◽

Discrete Logarithm ◽

Discrete Logarithm Problem ◽

Selection Methods ◽

Number Field Sieve ◽

Galois Action

In order to assess the security of cryptosystems based on the discrete logarithm problem in non-prime finite fields, as are the torus-based or pairing-based ones, we investigate thoroughly the case in$\mathbb{F}_{p^{6}}$with the number field sieve. We provide new insights, improvements, and comparisons between different methods to select polynomials intended for a sieve in dimension 3 using a special-$\mathfrak{q}$strategy. We also take into account the Galois action to increase the relation productivity of the sieving phase. To validate our results, we ran several experiments and real computations for various polynomial selection methods and field sizes with our publicly available implementation of the sieve in dimension 3, with special-$\mathfrak{q}$and various enumeration strategies.

Download Full-text

On the use of the lattice sieve in the 3D NFS

Tatra Mountains Mathematical Publications ◽

10.2478/v10127-010-0012-y ◽

2010 ◽

Vol 45 (1) ◽

pp. 161-172 ◽

Cited By ~ 2

Author(s):

Pavol Zajac

Keyword(s):

Number Field ◽

Finite Fields ◽

Discrete Logarithm ◽

Three Dimensional ◽

Practical Approach ◽

Discrete Logarithms ◽

Number Field Sieve ◽

Successful Solution ◽

Alternative Approach ◽

Large Factor

ABSTRACT An adaptation of the Number Field Sieve (NFS) algorithm to solve a discrete logarithm problem in degree 6 finite fields (DLP6) requires a modified sieving procedure to find smooth elements of the three dimensional sieve space. In our successful solution [P. Zajac: Discrete Logarithms and Degree Six NumbereField Sieve: A practical Approach. VDM Verlag Dr. M¨uller, Saarbr¨ucken, 2009] we have used a modified line sieving to process a box-shaped region using a large factor base. In this contribution, we compare the results with an alternative approach based on the lattice sieving, which was used in most of the classical factorization and DLP record solutions. Results indicate that this approach does not scale to the 3D-case, making DLP6 more difficult in practice than comparable classical DLP cases.

Download Full-text

Finding roots in with the successive resultants algorithm

LMS Journal of Computation and Mathematics ◽

10.1112/s1461157014000138 ◽

2014 ◽

Vol 17 (A) ◽

pp. 203-217 ◽

Cited By ~ 2

Author(s):

Christophe Petit

Keyword(s):

Finite Field ◽

Elliptic Curve ◽

Finite Fields ◽

Coding Theory ◽

Discrete Logarithm ◽

Discrete Logarithm Problem ◽

Polynomial Equations ◽

Preliminary Results ◽

Characteristic Case ◽

Practical Security

AbstractThe problem of solving polynomial equations over finite fields has many applications in cryptography and coding theory. In this paper, we consider polynomial equations over a ‘large’ finite field with a ‘small’ characteristic. We introduce a new algorithm for solving this type of equations, called the successive resultants algorithm (SRA). SRA is radically different from previous algorithms for this problem, yet it is conceptually simple. A straightforward implementation using Magma was able to beat the built-in Roots function for some parameters. These preliminary results encourage a more detailed study of SRA and its applications. Moreover, we point out that an extension of SRA to the multivariate case would have an important impact on the practical security of the elliptic curve discrete logarithm problem in the small characteristic case.Supplementary materials are available with this article.

Download Full-text