An Algorithm to Solve the Discrete Logarithm Problem with the Number Field Sieve

Commeine, An; Semaev, Igor

doi:10.1007/11745853_12

Cited by 22 publications

(19 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These expressions coincide with the ones in the analogous stage of the classical variant (for example in Equation (7.11) in [5]) and we obtain a complexity of L Q (1/3, 1.1338...) which is the same as in the classical case [15]. We conclude that the overall complexity of individual logarithm is dominated by the L Q (1/3, 3 1/3 ) complexity of the smoothing test.…”

Section: Smoothingsupporting

confidence: 80%

“…this only step, like in the classical NFS: if this is too small, the probability of being smooth is too small, while if it is too large, the cost of testing the smoothness by ECM is prohibitive. The analysis is the same as in [15] and gives a value B 1 = L Q (2/3, ( After the smoothing phase, the logarithm of s has been rewritten in terms of the logarithms of small prime ideals of K g for which the logarithm is already known, and some largish prime ideals of K g , of norm bounded by B 1 . The next step is to compute the logarithms of these largish ideals.…”

Section: Smoothingmentioning

confidence: 99%

See 1 more Smart Citation

The Tower Number Field Sieve

Barbulescu

Gaudry

Kleinjung

2015

Advances in Cryptology – ASIACRYPT 2015

View full text Add to dashboard Cite

Abstract. The security of pairing-based crypto-systems relies on the difficulty to compute discrete logarithms in finite fields Fpn where n is a small integer larger than 1. The state-of-art algorithm is the number field sieve (NFS) together with its many variants. When p has a special form (SNFS), as in many pairings constructions, NFS has a faster variant due to Joux and Pierrot. We present a new NFS variant for SNFS computations, which is better for some cryptographically relevant cases, according to a precise comparison of norm sizes. The new algorithm is an adaptation of Schirokauer's variant of NFS based on tower extensions, for which we give a middlebrow presentation.

show abstract

Section: Smoothingsupporting

confidence: 80%

Section: Smoothingmentioning

confidence: 99%

The Tower Number Field Sieve

Barbulescu

Gaudry

Kleinjung

2015

Advances in Cryptology – ASIACRYPT 2015

View full text Add to dashboard Cite

show abstract

“…The simple algorithm reviewed here is not the state-of-the-art algorithm for the second stage; see, e.g., the "special-q descent" algorithms in [51] and [32]. The gap between known algorithms and existing algorithms is thus even larger than indicated in this section.…”

Section: Previous Workmentioning

confidence: 89%

Non-uniform Cracks in the Concrete: The Power of Free Precomputation

Bernstein

Lange

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. AES-128, the NIST P-256 elliptic curve, DSA-3072, RSA-3072, and various higher-level protocols are frequently conjectured to provide a security level of 2 128 . Extensive cryptanalysis of these primitives appears to have stabilized sufficiently to support such conjectures.In the literature on provable concrete security it is standard to define 2 b security as the nonexistence of high-probability attack algorithms taking time ≤2b . However, this paper provides overwhelming evidence for the existence of high-probability attack algorithms against AES-128, NIST P-256, DSA-3072, and RSA-3072 taking time considerably below 2 128 , contradicting the standard security conjectures.These attack algorithms are not realistic; do not indicate any actual security problem; do not indicate any risk to cryptographic users; and do not indicate any failure in previous cryptanalysis. Any actual use of these attack algorithms would be much more expensive than the conventional 2 128 attack algorithms. However, this expense is not visible to the standard definitions of security. Consequently the standard definitions of security fail to accurately model actual security.The underlying problem is that the standard set of algorithms, namely the set of algorithms taking time ≤2 b , fails to accurately model the set of algorithms that an attacker can carry out. This paper analyzes this failure in detail, and analyzes several ideas for fixing the security definitions.

show abstract

“…Using more than two polynomials in the NFS (the so-called MNFS variants [6,8,9, 25]) has not yet been done for practical computations, even in the much easier case of integer factorization, so we stick to two polynomials. The setting starts therefore with two irreducible polynomials f 0 and f 1 over Z that have a common irreducible factor of degree n modulo p. They define two number fields K f0 and K f1 .…”

Section: The Number Field Sievementioning

confidence: 99%

Collecting relations for the number field sieve in

Gaudry¹,

Grémy²,

Videau³

2016

LMS J. Comput. Math.

View full text Add to dashboard Cite

In order to assess the security of cryptosystems based on the discrete logarithm problem in non-prime finite fields, as are the torus-based or pairing-based ones, we investigate thoroughly the case in F p 6 with the number field sieve. We provide new insights, improvements, and comparisons between different methods to select polynomials intended for a sieve in dimension 3 using a special-q strategy. We also take into account the Galois action to increase the relation productivity of the sieving phase. To validate our results, we ran several experiments and real computations for various polynomial selection methods and field sizes with our publicly available implementation of the sieve in dimension 3, with special-q and various enumeration strategies.

show abstract

An Algorithm to Solve the Discrete Logarithm Problem with the Number Field Sieve

Abstract: Abstract.Recently, Shirokauer's algorithm to solve the discrete logarithm problem modulo a prime p has been modified by Matyukhin, yielding an algorithm with running time Lp[

Cited by 22 publications

References 23 publications

The Tower Number Field Sieve

The Tower Number Field Sieve

Non-uniform Cracks in the Concrete: The Power of Free Precomputation

Collecting relations for the number field sieve in

Contact Info

Product

Resources

About