Extended Tower Number Field Sieve: A New Complexity for the Medium Prime Case

Kim, Tae-Chan; Barbulescu, Razvan

doi:10.1007/978-3-662-53018-4_20

Cited by 155 publications

(107 citation statements)

References 23 publications

Supporting

Mentioning

107

Contrasting

Order By: Relevance

“…6 Our threshold encryption scheme requires a 5 The actual bound is (1 − e −1/3 )B > B/4, but we use the looser bound B/4 for readability. 6 Earlier reports estimate 112 bits of security for the MNT224 curve [44]; however, recent improvements in computing discrete log suggest larger parameters are required [28,29]. symmetric bilinear group: we therefore use the SS512 group, which heuristically provides 80 bits of security [44].…”

Section: Implementation and Evaluationmentioning

confidence: 99%

The Honey Badger of BFT Protocols

Miller

Xia

Croman

et al. 2016

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

603

407

View full text Add to dashboard Cite

The surprising success of cryptocurrencies has led to a surge of interest in deploying large scale, highly robust, Byzantine fault tolerant (BFT) protocols for mission-critical applications, such as financial transactions. Although the conventional wisdom is to build atop a (weakly) synchronous protocol such as PBFT (or a variation thereof), such protocols rely critically on network timing assumptions, and only guarantee liveness when the network behaves as expected. We argue these protocols are ill-suited for this deployment scenario.We present an alternative, HoneyBadgerBFT, the first practical asynchronous BFT protocol, which guarantees liveness without making any timing assumptions. We base our solution on a novel atomic broadcast protocol that achieves optimal asymptotic efficiency. We present an implementation and experimental results to show our system can achieve throughput of tens of thousands of transactions per second, and scales to over a hundred nodes on a wide area network. We even conduct BFT experiments over Tor, without needing to tune any parameters. Unlike the alternatives, HoneyBadgerBFT simply does not care about the underlying network.

show abstract

Section: Implementation and Evaluationmentioning

confidence: 99%

The Honey Badger of BFT Protocols

Miller

Xia

Croman

et al. 2016

Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

603

407

View full text Add to dashboard Cite

show abstract

“…It is possible that including some of the ideas of [17] would speed up our implementation. Further work also includes studying the practical aspects of the tower NFS variants [4,21]; this would imply sieving in dimension at least 4.…”

Section: Resultsmentioning

confidence: 99%

“…Instead, if we want to optimize the number of relations found, we need to consider a variant of the NFS in a higher dimension, that is, relying on polynomials of degree greater than 1. Although the complexity fits in the L(1/3, c) class, these finite fields where higher-dimensional sieving is required are those for which the constant c is highest compared to other finite fields, despite recent advances [4,6,21,25].…”

Section: Introductionmentioning

confidence: 99%

Collecting relations for the number field sieve in

Gaudry¹,

Grémy²,

Videau³

2016

LMS J. Comput. Math.

View full text Add to dashboard Cite

In order to assess the security of cryptosystems based on the discrete logarithm problem in non-prime finite fields, as are the torus-based or pairing-based ones, we investigate thoroughly the case in F p 6 with the number field sieve. We provide new insights, improvements, and comparisons between different methods to select polynomials intended for a sieve in dimension 3 using a special-q strategy. We also take into account the Galois action to increase the relation productivity of the sieving phase. To validate our results, we ran several experiments and real computations for various polynomial selection methods and field sizes with our publicly available implementation of the sieve in dimension 3, with special-q and various enumeration strategies.

show abstract

“…We recall these sizes for F p 3 . The recent improvements of Kim and Kim-Barbulescu [37,38] do not apply to F p n where n is prime, so F p 3 is not affected. The asymptotic complexity of the NFS algorithm for F p 3 is exp (c + o(1))(log p n ) 1/3 (log log p n ) 2/3 = L p 3 [1/3, (64/9) 1/3 ].…”

Section: Consequences For Pairing-based Cryptographymentioning

confidence: 99%

Solving Discrete Logarithms on a 170-Bit MNT Curve by Pairing Reduction

Guillevic

Morain

Thomé

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Pairing based cryptography is in a dangerous position following the breakthroughs on discrete logarithms computations in finite fields of small characteristic. Remaining instances are built over finite fields of large characteristic and their security relies on the fact the embedding field of the underlying curve is relatively large. How large is debatable. The aim of our work is to sustain the claim that the combination of degree 3 embedding and too small finite fields obviously does not provide enough security. As a computational example, we solve the DLP on a 170-bit MNT curve, by exploiting the pairing embedding to a 508-bit, degree-3 extension of the base field.

show abstract

Extended Tower Number Field Sieve: A New Complexity for the Medium Prime Case

Cited by 155 publications

References 23 publications

The Honey Badger of BFT Protocols

The Honey Badger of BFT Protocols

Collecting relations for the number field sieve in

Solving Discrete Logarithms on a 170-Bit MNT Curve by Pairing Reduction

Contact Info

Product

Resources

About