Collecting relations for the number field sieve in

Gaudry, Pierrick; Grémy, Laurent; Videau, Marion

doi:10.1112/s1461157016000164

Cited by 12 publications

(21 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Pollard designed in this sense the sieve by vectors [33], now subsumed by the lattice sieve of Franke and Kleinjung [11]. Based on this sieve algorithm, the plane sieve [14] and the 3-dimensional lattice sieve [19] were proposed for similar densities in three dimensions. The plane sieve was turned into a generic sieve algorithm in CADO-NFS [43] (see Section 4D).…”

Section: A Framework To Study Existing Sieve Algorithmsmentioning

confidence: 99%

“…Heuristic sieve algorithms. Because of these drawbacks and especially the penalty in terms of running time, the designers of the plane sieve proposed a heuristic sieve algorithm, the space sieve [14]. Its line lattice 3-dimensional plane space this sieve sieve [11] lattice sieve [19] sieve [14] sieve [14] work…”

Section: A Framework To Study Existing Sieve Algorithmsmentioning

confidence: 99%

“…To ensure the best running time for the relation collection, the polynomials f 0 and f 1 must be chosen carefully. However, the two usual quality criteria, especially the α but also the Murphy-E functions [31], are only defined for NFS 1 and µ ≤ 3 [14]. Finding good polynomials for NFS >1 , even by settling for integer coefficients to define f 0 and f 1 , is yet a challenge.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Higher-dimensional sieving for the number field sieve algorithms

Grémy

2019

Open Book Series

Self Cite

View full text Add to dashboard Cite

Since 2016 and the introduction of the exTNFS (extended tower number field sieve) algorithm, the security of cryptosystems based on nonprime finite fields, mainly the pairing-and torus-based ones, is being reassessed. The feasibility of the relation collection, a crucial step of the NFS variants, is especially investigated. It usually involves polynomials of degree 1, i.e., a search space of dimension 2. However, exTNFS uses bivariate polynomials of at least four coefficients. If sieving in dimension 2 is well described in the literature, sieving in higher dimensions has received significantly less attention. We describe and analyze three different generic algorithms to sieve in any dimension for the NFS algorithms. Our implementation shows the practicability of dimension-4 sieving, but the hardness of dimension-6 sieving. and completed in the AriC team. MSC2010: 11T71. Keywords: discrete logarithm, finite fields, sieve algorithms, medium characteristic. 275 276 LAURENT GRÉMY in the o(1) term [1; 30; 7]. Experimental results are then needed to assess the concrete limits of known algorithms.On the practical side, there has been a lot of effort to compute discrete logarithms in prime fields, culminating in a 768-bit record [27]. Although the records for ‫ކ‬ p 2 are smaller than the ones in prime fields, the computations turned out to be faster than expected [4]. However, when n is a small composite and p fits for ‫ކ‬ p n to be in the medium characteristic case (typically n = 6 [16] and n = 12 [18]), the records are smaller, even with a comparable amount of time spent during the computation. A way to fill the gap between medium and large characteristics is to implement exTNFS, since the computations in medium characteristic were, until now, performed with a predecessor of exTNFS.Since exTNFS is a relatively new algorithm, there remain many theoretical and practical challenges to be solved before a practical computation can be reached. One of the major challenges concerns the sieve algorithms which efficiently perform the relation collection, one of the most costly steps of NFS. However, if there exist sieve algorithms in dimensions 2 and 3, these sieves are not efficient for higher dimensions and exTNFS needs to sieve in even dimension larger than or equal to 4.

show abstract

Section: A Framework To Study Existing Sieve Algorithmsmentioning

confidence: 99%

Section: A Framework To Study Existing Sieve Algorithmsmentioning

confidence: 99%

mentioning

confidence: 99%

See 1 more Smart Citation

Higher-dimensional sieving for the number field sieve algorithms

Grémy

2019

Open Book Series

Self Cite

View full text Add to dashboard Cite

show abstract

“…Choosing E to be equal to B, this cost comes out to be B 2+o (1) . For more details on sieving, we refer to [10,15,36].…”

Section: Basics Of the Tower Number Field Sieve Algorithmmentioning

confidence: 99%

“…There are two known general approaches to this problem which lead to subexponential run-times. These are the function field sieve (FFS) [1,2,18,20] and Practical issues in relation collection were considered in Gaudry et al [10]. Using the Conjugation method for selecting polynomials, Guillevic et al [14] reported a computation of discrete logarithm on an 170-bit MNT curve.…”

Section: Introductionmentioning

confidence: 99%

A unified polynomial selection method for the (tower) number field sieve algorithm

Sarkar¹,

Singh²

2019

Advances in Mathematics of Communications

View full text Add to dashboard Cite

At Eurocrypt 2015, Barbulescu et al. introduced two new methods of polynomial selection, namely the Conjugation and the Generalised Joux-Lercier methods, for the number field sieve (NFS) algorithm as applied to the discrete logarithm problem over finite fields. A sequence of subsequent works have developed and applied these methods to the multiple and the (extended) tower number field sieve algorithms. This line of work has led to new asymptotic complexities for various cases of the discrete logarithm problem over finite fields. The current work presents a unified polynomial selection method which we call Algorithm D. Starting from the Barbulescu et al. paper, all the subsequent polynomial selection methods can be seen as special cases of Algorithm D. Moreover, for the extended tower number field sieve (exTNFS) and the multiple extended TNFS (MexTNFS), there are finite fields for which using the polynomials selected by Algorithm D provides the best asymptotic complexity. Suppose Q = p n for a prime p and further suppose that n = ηκ such that there is a c θ > 0 for which p η = L Q (2/3, c θ ). For c θ > 3.39, the complexity of exTNFS-D is lower than the complexities of all previous algorithms; for c θ / ∈ (0, 1.12) ∪ [1.45, 3.15], the complexity of MexTNFS-D is lower than that of all previous methods.2010 Mathematics Subject Classification: Primary: 11Y16; Secondary: 94A60. Key words and phrases: Finite fields, discrete logarithm, number field sieve, tower number field sieve, multiple tower number field sieve. the number field sieve (NFS) [11,19,21] Depending on the value of a, fields F Q are classified into the following types: small characteristic, if a < 1/3; medium characteristic, if 1/3 ≤ a < 2/3; boundary, if a = 2/3; and large characteristic, if a > 2/3. The case a = 2/3 has been singled out as a boundary case in [4] since it is possible to show that the best complexity for this case is lower than the best complexities for the medium characteristic and the large characteristic cases. For a = 1/3, on the other hand, no such complexity improvement is known.There has been tremendous progress in the FFS algorithm leading to a quasipolynomial time algorithm [5,23] for the small characteristic case. Using algorithms given in [17,5], a record computation of discrete log in the binary extension field F 2 9234 was reported by Granger et al. [12]. The FFS algorithm also applies to the medium prime case and this has been reported in [20,16,29].The application of NFS to compute discrete logarithms over finite fields was first proposed by Gordon [11] for prime order fields, i.e., for n = 1. Application to composite order fields, i.e., for n > 1, was shown by Schirokauer [33]. Important improvements to the NFS for prime order fields were given by Joux and Lercier [19]. Joux, Lercier, Smart and Vercauteren [21] showed that the NFS algorithm is applicable to all finite fields. When the prime p is of a special form, Joux and Pierrot [22] showed the application of the special number field sieve algorithm to obtain improved ...

show abstract

A Brief History of Pairings

Barbulescu

2016

Arithmetic of Finite Fields

View full text Add to dashboard Cite

Collecting relations for the number field sieve in

Cited by 12 publications

References 27 publications

Higher-dimensional sieving for the number field sieve algorithms

Higher-dimensional sieving for the number field sieve algorithms

A unified polynomial selection method for the (tower) number field sieve algorithm

A Brief History of Pairings

Contact Info

Product

Resources

About