Discrete Logarithms in $GF ( P )$ Using the Number Field Sieve

Gordon, Daniel M.

doi:10.1137/0406010

Cited by 273 publications

(140 citation statements)

References 23 publications

Supporting

Mentioning

138

Contrasting

Unclassified

Order By: Relevance

“…In solving the DLP in GF(3 6n ), these two variants of the FFS have the same asymptotic complexity, but the new variant was expected more efficient than the earlier one in some extension degree n. By our experiment result, we confirmed this forecast when the extension degree n = 19, 61. Moreover, with our implementations, we computed [10,17]. † JLSV06-NFS: NFS in the medium prime case [19].…”

Section: Discussionmentioning

confidence: 99%

Solving a 676-Bit Discrete Logarithm Problem in GF(36n )

Hayashi

Shinohara

Wang

et al. 2010

Public Key Cryptography – PKC 2010

View full text Add to dashboard Cite

Abstract. Pairings on elliptic curves in finite fields are crucial material for constructions of various cryptographic schemes. The ηT pairing on supersingular curves over GF(3 n ) is in particular popular since it is efficiently implementable. Taking into account of the MOV attack, the discrete logarithm problems (DLP) in GF(3 6n ) becomes concerned to the security of cryptosystems using ηT pairings in this case. In 2006, Joux and Lercier proposed a new variant of the function field sieve in the medium prime case, named JL06-FFS. We have, however, not found any practical implementations on JL06-FFS over GF(3 6n ) up to now. Therefore, we have firstly fulfilled such an implementation and successfully set a new record for solving the DLP in GF(3 6n ), the DLP in GF(3 6·71 ) of 676-bit size. We conclude that n = 97 case, where there are many implementations of the ηT pairing, is not recommended in practical use. In addition, we also conduct comparisons between JL06-FFS and an earlier version, named JL02-FFS, by practical experiments. Our results confirm that the former is faster several times than the latter under certain conditions.

show abstract

Section: Discussionmentioning

confidence: 99%

Solving a 676-Bit Discrete Logarithm Problem in GF(36n )

Hayashi

Shinohara

Wang

et al. 2010

Public Key Cryptography – PKC 2010

View full text Add to dashboard Cite

show abstract

“…First, however, we focus on the DL problem in a subgroup γ of prime order ω of the multiplicative group GF(p t ) * of an extension field GF(p t ) of GF(p) for a fixed t. There are two approaches to this problem (cf. [1], [5], [9], [11], [16], [19], [21]): one can either attack the multiplicative group or one can attack the subgroup. For the first attack the best known method is the Discrete Logarithm variant of the Number Field Sieve.…”

Section: Discrete Logarithms In Gf(p T )mentioning

confidence: 99%

The XTR Public Key System

Lenstra

Verheul

2000

Advances in Cryptology — CRYPTO 2000

153

266

View full text Add to dashboard Cite

show abstract

“…Now suppose we want to solve the ECDL problem for a given prime p by using Mestre's method to lift E/ p to a curve E/É of moderately large rank. Looking at the Heuristic Bound (10), in order to have a reasonable chance of lifting a point of E( p ) to a point of E(É) of height at most B, we need N (E, B) fairly close to p, say N (E, B) ≥ p/2 10 . Then (10) and (11) give us the lower bound log B ≥ r log(p 11.93 r 0.26r ) 20πe…”

Section: Fitting the Data Inmentioning

confidence: 99%

Elliptic Curve Discrete Logarithms and the Index Calculus

Silverman

Suzuki

1998

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The discrete logarithm problem forms the basis of numerous cryptographic systems. The most effective attack on the discrete logarithm problem in the multiplicative group of a finite field is via the index calculus, but no such method is known for elliptic curve discrete logarithms. Indeed, Miller [23] has given a brief heuristic argument as to why no such method can exist. IN this note we give a detailed analysis of the index calculus for elliptic curve discrete logarithms, amplifying and extending miller's remarks. Our conclusions fully support his contention that the natural generalization of the index calculus to the elliptic curve discrete logarithm problem yields an algorithm with is less efficient than a brute-force search algorithm. IntroductionThe discrete logarithm problem for the multiplicative group * q of a finite field can be solved in subexponential time using the Index Calculus method, which appears to have been first discovered by Kraitchik [14, 15] in the 1920's and subsequently rediscovered and extended by many mathematicians. (See, for example, [1] and [43], and for a nice summary of the current state-of-the-art, see [29].) For this reason, it was proposed independently by Miller [23] and Koblitz [12] that for cryptographic purposes, one should replace * q by the group of rational points E( q ) on an elliptic curve, thus leading to the Elliptic Curve Discrete Logarithm Problem, which we abbreviate as the ECDL problem. Indeed, Victor Miller gives in his article [23, page 423] two reasons why "it is extremely unlikely that an 'index calculus' attack on elliptic curves will ever be able to work." Miller's reasons may be briefly summarized as follows:(1) It is difficult to find elliptic curves E/É with a large number of small rational points. This observation may be split into two pieces. (a) It is difficult to find elliptic curves E/É with high rank. (b) It is difficult to find elliptic curves E/É generated by points of small height.

show abstract

Discrete Logarithms in $GF ( P )$ Using the Number Field Sieve

Cited by 273 publications

References 23 publications

Solving a 676-Bit Discrete Logarithm Problem in GF(36n )

Solving a 676-Bit Discrete Logarithm Problem in GF(36n )

The XTR Public Key System

Elliptic Curve Discrete Logarithms and the Index Calculus

Contact Info

Product

Resources

About