Extended Tower Number Field Sieve with Application to Finite Fields of Arbitrary Composite Extension Degree

Kim, Tae-Chan; Jeong, Jinhyuck

doi:10.1007/978-3-662-54365-8_16

Cited by 32 publications

(29 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(Algorithm A subsumes the Conjugation and the GJL methods.) • The generalised Conjugation method of Jeong and Kim [25]. (The method of Jeong and Kim subsumes the polynomial selection algorithm by Kim and Barbulescu [24].)…”

Section: Introductionmentioning

confidence: 99%

“…Let p = L Q (a, c p ) with 1/3 < a ≤ 2/3 and n = ηκ be such that there is a c θ > 0 with p η = L Q (2/3, c θ ). The expression for the complexity obtained in [24,25] is a function of c θ . The minimum value of the complexity (as a function of c θ ) is the best known complexity for the medium prime case and is achieved only for a particular value of c θ .…”

Section: Introductionmentioning

confidence: 99%

“…1. Using two number fields, the best known complexity for the medium prime case is L Q (1/3, (48/9) 1/3 ) [24,25] This complexity is achieved only for c θ = 12 1/3 . Algorithm D does not lower this complexity.…”

Section: Introductionmentioning

confidence: 99%

“…Complexities of the variants using multiple tower number fields and special number fields were derived. Sarkar and Singh [30] proposed an algorithm for polynomial selection which provided improved complexities for the medium prime case for all composite n. This was followed by a paper by Jeong and Kim [25] who showed how to combine the Conjugation method with exTNFS to cover all composite extension degrees and improve the complexity for the medium prime case over what was obtained in [30].…”

mentioning

confidence: 99%

See 3 more Smart Citations

A unified polynomial selection method for the (tower) number field sieve algorithm

Sarkar¹,

Singh²

2019

Advances in Mathematics of Communications

View full text Add to dashboard Cite

At Eurocrypt 2015, Barbulescu et al. introduced two new methods of polynomial selection, namely the Conjugation and the Generalised Joux-Lercier methods, for the number field sieve (NFS) algorithm as applied to the discrete logarithm problem over finite fields. A sequence of subsequent works have developed and applied these methods to the multiple and the (extended) tower number field sieve algorithms. This line of work has led to new asymptotic complexities for various cases of the discrete logarithm problem over finite fields. The current work presents a unified polynomial selection method which we call Algorithm D. Starting from the Barbulescu et al. paper, all the subsequent polynomial selection methods can be seen as special cases of Algorithm D. Moreover, for the extended tower number field sieve (exTNFS) and the multiple extended TNFS (MexTNFS), there are finite fields for which using the polynomials selected by Algorithm D provides the best asymptotic complexity. Suppose Q = p n for a prime p and further suppose that n = ηκ such that there is a c θ > 0 for which p η = L Q (2/3, c θ ). For c θ > 3.39, the complexity of exTNFS-D is lower than the complexities of all previous algorithms; for c θ / ∈ (0, 1.12) ∪ [1.45, 3.15], the complexity of MexTNFS-D is lower than that of all previous methods.2010 Mathematics Subject Classification: Primary: 11Y16; Secondary: 94A60. Key words and phrases: Finite fields, discrete logarithm, number field sieve, tower number field sieve, multiple tower number field sieve. the number field sieve (NFS) [11,19,21] Depending on the value of a, fields F Q are classified into the following types: small characteristic, if a < 1/3; medium characteristic, if 1/3 ≤ a < 2/3; boundary, if a = 2/3; and large characteristic, if a > 2/3. The case a = 2/3 has been singled out as a boundary case in [4] since it is possible to show that the best complexity for this case is lower than the best complexities for the medium characteristic and the large characteristic cases. For a = 1/3, on the other hand, no such complexity improvement is known.There has been tremendous progress in the FFS algorithm leading to a quasipolynomial time algorithm [5,23] for the small characteristic case. Using algorithms given in [17,5], a record computation of discrete log in the binary extension field F 2 9234 was reported by Granger et al. [12]. The FFS algorithm also applies to the medium prime case and this has been reported in [20,16,29].The application of NFS to compute discrete logarithms over finite fields was first proposed by Gordon [11] for prime order fields, i.e., for n = 1. Application to composite order fields, i.e., for n > 1, was shown by Schirokauer [33]. Important improvements to the NFS for prime order fields were given by Joux and Lercier [19]. Joux, Lercier, Smart and Vercauteren [21] showed that the NFS algorithm is applicable to all finite fields. When the prime p is of a special form, Joux and Pierrot [22] showed the application of the special number field sieve algorithm to obtain improved ...

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

A unified polynomial selection method for the (tower) number field sieve algorithm

Sarkar¹,

Singh²

2019

Advances in Mathematics of Communications

View full text Add to dashboard Cite

show abstract

“…The embedding degree k is large enough, so that the DLP in G T ⊂ F * p k is as hard as in G 1 , G 2 . In practice F p k must be resistant to the variants of the number field sieve (NFS) attack [EMJ17, KJ17,KB16]. 4. k is relatively small, for efficient operations in G T .…”

mentioning

confidence: 99%

Ordinary Pairing-Friendly Genus 2 Hyperelliptic Curves with Absolutely Simple Jacobians

Fotiadis

Konstantinou

2017

Mathematical Aspects of Computer and Information Sciences

View full text Add to dashboard Cite

We present a method for producing pairing-friendly, simple, ordinary Jacobian varieties of genus 2 hyperelliptic curves defined over a prime field F p . The proposed method heavily relies on the construction of a suitable p-Weil number and a corresponding quartic CM-field. Our Jacobians are absolutely simple and for this special class of Jacobians we give the first examples in the literature with ρ-values below 4, while previous results had in general ρ-values between 6 and 8. These examples derive from "families" of pairing-friendly Jacobians, which are basically polynomial representations of the Jacobian parameters.An asymmetric pairing is a bilinear, non-degenerate, efficiently computable map e : G 1 × G 2 −→ G T , where G 1 , G 2 , G T are cyclic groups of prime order r with G 1 = G 2 . A crucial cryptographic requirement is that the discrete logarithm problem (DLP) is computationally infeasible in all pairing groups G 1 , G 2 , G T . We call G 1 , G 2 the source groups and G T the target group. Initially the source groups were set as r-order subgroups of ordinary elliptic curves over a finite field, while the target group was an r-order subgroup of a finite field.Since elliptic curves are genus 1 algebraic curves, an obvious question is whether pairings on higher genus curves can be also used in implementations. In this case G 1 and G 2 consist of elements in the Jacobian variety of a genus g hyperelliptic curve defined over a finite field. By [Ber06, Lan06], this can be an advantageous choice especially when g = 2, since genus 2 curves and their Jacobians: 1. are competitive to elliptic curves in performance and security [Ber06, Lan06]. 2. result in efficient Tate pairing calculations [FL06]. 3. have efficient CM-constructions [LS13, Wen02] and point operations [Can87]. 4. have points with smaller size.This is our motivation for constructing "pairing-friendly", ordinary Jacobians of genus 2 hyperelliptic curves over a prime field F p , called the base field.

show abstract

A Short-List of Pairing-Friendly Curves Resistant to Special TNFS at the 128-Bit Security Level

Guillevic

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

HAL is a multidisciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés. Copyright

show abstract

Extended Tower Number Field Sieve with Application to Finite Fields of Arbitrary Composite Extension Degree

Cited by 32 publications

References 19 publications

A unified polynomial selection method for the (tower) number field sieve algorithm

A unified polynomial selection method for the (tower) number field sieve algorithm

Ordinary Pairing-Friendly Genus 2 Hyperelliptic Curves with Absolutely Simple Jacobians

A Short-List of Pairing-Friendly Curves Resistant to Special TNFS at the 128-Bit Security Level

Contact Info

Product

Resources

About