Comparing the Difficulty of Factorization and Discrete Logarithm: A 240-Digit Experiment

Boudot, Fabrice; Gaudry, Pierrick; Guillevic, Aurore; Heninger, Nadia; Thomé, Emmanuel; Zimmermann, Paul

doi:10.1007/978-3-030-56880-1_3

Cited by 53 publications

(54 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The best published academic record is the factorization of an 829 bit RSA modulus in 2020, see [11] for details regarding this computation. For the earlier record, see [50].…”

Section: Implications For Rsamentioning

confidence: 99%

See 1 more Smart Citation

How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits

Gidney

Ekerå

2021

Quantum

386

175

View full text Add to dashboard Cite

We significantly reduce the cost of factoring integers and computing discrete logarithms in finite fields on a quantum computer by combining techniques from Shor 1994, Griffiths-Niu 1996, Zalka 2006, Fowler 2012, Ekerå-Håstad 2017, Ekerå 2017, Ekerå 2018, Gidney-Fowler 2019, Gidney 2019. We estimate the approximate cost of our construction using plausible physical assumptions for large-scale superconducting qubit platforms: a planar grid of qubits with nearest-neighbor connectivity, a characteristic physical gate error rate of 10−3, a surface code cycle time of 1 microsecond, and a reaction time of 10 microseconds. We account for factors that are normally ignored such as noise, the need to make repeated attempts, and the spacetime layout of the computation. When factoring 2048 bit RSA integers, our construction's spacetime volume is a hundredfold less than comparable estimates from earlier works (Van Meter et al. 2009, Jones et al. 2010, Fowler et al. 2012, Gheorghiu et al. 2019). In the abstract circuit model (which ignores overheads from distillation, routing, and error correction) our construction uses 3n+0.002nlg⁡n logical qubits, 0.3n3+0.0005n3lg⁡n Toffolis, and 500n2+n2lg⁡n measurement depth to factor n-bit RSA integers. We quantify the cryptographic implications of our work, both for RSA and for schemes based on the DLP in finite fields.

show abstract

“…The best published academic record is the factorization of an 829 bit RSA modulus in 2020, see [11] for details regarding this computation. For the earlier record, see [50].…”

Section: Implications For Rsamentioning

confidence: 99%

“…For an in-depth historical account of the development of the GNFS, see [53,72]. For the best academic record, see [11].…”

Section: Implications For Finite Field Discrete Logarithmsmentioning

confidence: 99%

How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits

Gidney

Ekerå

2021

Quantum

386

175

View full text Add to dashboard Cite

show abstract

“…Following a suggestion from a reviewer, we carried out experiments to determine the effectiveness of the filtering step. To this end, we utilised the filtering algorithm implemented in the CADO-NFS software which has been used in the recent 240-bit DLP computation [7]. For the filtering algorithm, an important parameter is the distribution of the weights of the columns.…”

Section: A Concrete Discrete Logarithm Computationmentioning

confidence: 99%

“…Both the above experiments indicate that the CADO-filtering step is not very effective for this variant of the FFS algorithm. On the other hand, the filtering step leads to a substantial reduction in the dimension of the matrix for the NFS algorithm as can be noted from the recent 240-bit DLP computation in [7]. A possible explanation for this difference in behaviour is the following.…”

Section: A Concrete Discrete Logarithm Computationmentioning

confidence: 99%

See 1 more Smart Citation

New discrete logarithm computation for the medium prime case using the function field sieve

Mukhopadhyay¹,

Sarkar²,

Singh³

et al. 2022

AMC

Self Cite

View full text Add to dashboard Cite

The present work reports progress in discrete logarithm computation for the general medium prime case using the function field sieve algorithm. A new record discrete logarithm computation over a 1051-bit field having a 22bit characteristic was performed. This computation builds on and implements previously known techniques. Analysis indicates that the relation collection and descent steps are within reach for fields with 32-bit characteristic and moderate extension degrees. It is the linear algebra step which will dominate the computation time for any discrete logarithm computation over such fields.

show abstract