Higher-dimensional sieving for the number field sieve algorithms

Abstract

Since 2016 and the introduction of the exTNFS (extended tower number field sieve) algorithm, the security of cryptosystems based on nonprime finite fields, mainly the pairing-and torus-based ones, is being reassessed. The feasibility of the relation collection, a crucial step of the NFS variants, is especially investigated. It usually involves polynomials of degree 1, i.e., a search space of dimension 2. However, exTNFS uses bivariate polynomials of at least four coefficients. If sieving in dimension 2 is well described in the literature, sieving in higher dimensions has received significantly less attention. We describe and analyze three different generic algorithms to sieve in any dimension for the NFS algorithms. Our implementation shows the practicability of dimension-4 sieving, but the hardness of dimension-6 sieving. and completed in the AriC team. MSC2010: 11T71. Keywords: discrete logarithm, finite fields, sieve algorithms, medium characteristic. 275 276 LAURENT GRÉMY in the o(1) term [1; 30; 7]. Experimental results are then needed to assess the concrete limits of known algorithms.On the practical side, there has been a lot of effort to compute discrete logarithms in prime fields, culminating in a 768-bit record [27]. Although the records for ‫ކ‬ p 2 are smaller than the ones in prime fields, the computations turned out to be faster than expected [4]. However, when n is a small composite and p fits for ‫ކ‬ p n to be in the medium characteristic case (typically n = 6 [16] and n = 12 [18]), the records are smaller, even with a comparable amount of time spent during the computation. A way to fill the gap between medium and large characteristics is to implement exTNFS, since the computations in medium characteristic were, until now, performed with a predecessor of exTNFS.Since exTNFS is a relatively new algorithm, there remain many theoretical and practical challenges to be solved before a practical computation can be reached. One of the major challenges concerns the sieve algorithms which efficiently perform the relation collection, one of the most costly steps of NFS. However, if there exist sieve algorithms in dimensions 2 and 3, these sieves are not efficient for higher dimensions and exTNFS needs to sieve in even dimension larger than or equal to 4.

Lattice Enumeration for Tower NFS: A 521-Bit Discrete Logarithm Computation

“…These algorithms either find and extract smooth parts of the norms, or completely factor them. The family of sieving algorithms [13,26], batch algorithms [6, Algorithm 2.1] and ECM [7,25] are examples of such methods used in factorization and DLP computations. They all have different complexities and properties and thus cannot be used on the same amount of input norms N i .…”

“…Taking the polynomials a(ι) and b(ι) of degree deg h − 1 leads to d = 2 × deg h hence d ≥ 4. There exist two competitive algorithms that can be used when d ≥ 3: the transition vectors method [13] and the recursive hyperplan one [26], see Section 3.1 for these algorithms. They both use as a sieving space a d-orthotope whereas in this work we consider a d-sphere.…”

“…Transition vectors for lattice sieving in [13]. In 2018, Grémy suggested a sieving algorithm inspired by Franke-Kleinjung's algorithm in dimension 2 but extended to higher dimensions.…”

“…In dimension 4, this method seems to have sufficient prospects of success. However, even with the relaxed variant, experiments ran in dimension 6 in [13] point to the limits of this method due to the poor quality of the nearly-transitionvectors and the number of calls required to the dedicated fall-back strategy. [13] concluded that "using cuboid search is probably a too hard constraint that implies the hardness or even an impossibility for the sieving process".…”

“…In dimension 2, Franke and Kleinjung [10] proposed in 2005 an efficient algorithm used in all previous records. For higher dimensions, after a pioneer work in F p 12 by Hayasaka et al [19], the transition vectors method from Grémy [13] and a recursive plane method proposed by McGuire and Robinson [26] were tested in dimension 3 and used for record computations using NFS. However, the efficiency of their algorithms for even higher dimensions is questionable.…”