Computing discrete logarithms in cryptographically-interesting characteristic-three finite fields

Abstract

Since 2013 there have been several developments in algorithms for computing discrete logarithms in small-characteristic finite fields, culminating in a quasi-polynomial algorithm. In this paper, we report on our successful computation of discrete logarithms in the cryptographically-interesting characteristic-three finite field F 3 6•509 using these new algorithms; prior to 2013, it was believed that this field enjoyed a security level of 128 bits. We also show that a recent idea of Guillevic can be used to compute discrete logarithms in the cryptographically-interesting finite field F 3 6•709 using essentially the same resources as we expended on the F 3 6•509 computation. Finally, we argue that discrete logarithms in the finite field F 3 6•1429 can feasibly be computed today; this is significant because this cryptographically-interesting field was previously believed to enjoy a security level of 192 bits.

History of Cryptographic Key Sizes

“…The case of characteristic three finite fields, which held a lot of promise for pairing based cryptography, faired not much better. In the period from 2010 to 2016 the record advanced from a 676-bit field, up to 4841 [1].…”

Faster individual discrete logarithms in finite fields of composite extension degree

“…Remark 4.1. As was pointed out to us by F. Rodríguez-Henríquez [56,3], the elements of the form x i R(x) where R itself is of degree ≤ n 2 − d/n 1 are evenly interesting because the discrete logarithm of x i can be deduced from the discrete logarithm of x, which is known after linear algebra.…”

“…Remark 4.3. Other improvements are possible [56,3], for instance computing F p gcd(n 1 ,d) -linear combinations over a small number of rows corresponding to polynomials of almost the same degree. The resulting polynomial will have degree increased by one or two, which does not significantly affect its B 1 -smoothness probability in practice for cryptographic sizes.…”

“…In the FFS setting, n 1 = 1 and usually n 2 is prime and our technique cannot be helpful, but if n is not prime, our algorithm applies, and moreover in favorable cases Joux's L[1/4] algorithm and its variants can be used and our technique can provide a further notable speed-up in the descent. For the implementations in small characteristic, the factor basis is made of the irreducible polynomials of F p n 1 [x] of very small degree, e.g., of degrees 1, 2, 3, and 4 in [3]. Our aim is to improve the smoothness probability of a preimage P ∈ F p n 1 [x] of a given target T ∈ F (p n 1 ) n 2 and for that we want to reduce the degree in x of the preimage P (as a lift of T in F p n 1 [x], P has degree at most n 2 − 1 in x), while keeping the property log(ρ(P )) = log T mod ℓ , where ρ : F p n 1 [x] → F (p n 1 ) n 2 is the reduction modulo ψ.…”

Computing Discrete Logarithms in $${\mathbb F}_{{p}^{6}}$$

“…However in certain cases this is not possible, so that efficient symmetric pairings are still desired. The earliest "fast" symmetric pairings are now completely broken since they used supersingular curves over fields of characteristic 2 or 3: the target group is then a sugroup of F 2 4n or F 3 6m , and the quasi-polynomial-time algorithm [6] is particularly devastating [20,1]. Since this algorithm does not apply to large characteristic, three constructions of supersingular curves survived.…”