Improving the Polynomial time Precomputation of Frobenius Representation Discrete Logarithm Algorithms

Joux, Antoine; Pierrot, Cécile

doi:10.1007/978-3-662-45611-8_20

Cited by 20 publications

(40 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Improving the record computation in GF(3 5·479 ). Joux and Pierrot announced a discrete logarithm record computation in GF(3 5·479 ) in [42] (then published in [40]). They defined a first degree 5 extension F 3 5 = F 3 [y]/(y 5 − y + 1) and then a degree 479 extension on top of F 3 5 .…”

Section: 5mentioning

confidence: 99%

Faster individual discrete logarithms in finite fields of composite extension degree

Guillevic¹

2018

Math. Comp.

View full text Add to dashboard Cite

Computing discrete logarithms in finite fields is a main concern in cryptography. The best algorithms in large and medium characteristic fields (e.g., GF(p 2 ), GF(p 12 )) are the Number Field Sieve and its variants (special, high-degree, tower). The best algorithms in small characteristic finite fields (e.g., GF(3 6·509 )) are the Function Field Sieve, Joux's algorithm, and the quasipolynomial-time algorithm. The last step of this family of algorithms is the individual logarithm computation. It computes a smooth decomposition of a given target in two phases: an initial splitting, then a descent tree. While new improvements have been made to reduce the complexity of the dominating relation collection and linear algebra steps, resulting in a smaller factor basis (database of known logarithms of small elements), the last step remains at the same level of difficulty. Indeed, we have to find a smooth decomposition of a typically large element in the finite field. This work improves the initial splitting phase and applies to any nonprime finite field. It is very efficient when the extension degree is composite. It exploits the proper subfields, resulting in a much more smooth decomposition of the target. This leads to a new trade-off between the initial splitting step and the descent step in small characteristic. Moreover it reduces the width and the height of the subsequent descent tree.

show abstract

Section: 5mentioning

confidence: 99%

Faster individual discrete logarithms in finite fields of composite extension degree

Guillevic¹

2018

Math. Comp.

View full text Add to dashboard Cite

show abstract

“…For simplicity, we follow the approach of [23] and consider two non-zero polynomials A and B with coefficients in F q . We can write:…”

Section: The Paradigm Shift: Constructed Smooth Polynomialsmentioning

confidence: 99%

“…From a practical point of view, the complexity of the polynomial time precomputation of the logarithms of factor base elements has been reduced [23] to O(q 6 ) for finite fields of the form F q k with k < 2q. From a theoretical point of view, the most recent progress appears in [15] and proposes a method to reduce the heuristic hypotheses required : it would now suffice to prove the existence of a pair of polynomials (S 0 , S 1 ) such that S 1 (X)X q −S 0 (X) has an irreducible factor of degree k. This final, challenging question remains open, despite the fact that in practical computations, finding (S 0 , S 1 ) is easy and efficient.…”

Section: Current State and Open Problemsmentioning

confidence: 99%

“…The final publication is available at Springer via http://dx.doi.org/10.1007/s10623-015-0147 -6 9234 [11,13,14,19] Granger, Kleinjung, Zumbrägel 2014/09 3 5·479 3796 [19,23] Joux, Pierrot 2014/10 2 1279 1279 [11,13,14,19] Kleinjung least Ω( √ p) operations, where p is the largest prime factor of N . This is much faster that exhaustively trying all possible values from 0 to N − 1, but remains completely infeasible even for moderately large groups.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Technical history of discrete logarithms in small characteristic finite fields

Joux

Pierrot

2015

Des. Codes Cryptogr.

Self Cite

View full text Add to dashboard Cite

Due to its use in cryptographic protocols such as the Diffie-Hellman key exchange, the discrete logarithm problem attracted a considerable amount of attention in the past 40 years. In this paper, we summarize the key technical ideas and their evolution for the case of discrete logarithms in small characteristic finite fields. This road leads from the original belief that this problem was hard enough for cryptographic purpose to the current state of the art where the algorithms are so efficient and practical that the problem can no longer be considered for cryptographic use.

show abstract

“…The case a = 2/3 has been singled out as a boundary case in [4] since it is possible to show that the best complexity for this case is lower than the best complexities for the medium characteristic and the large characteristic cases. For a = 1/3, on the other hand, no such complexity improvement is known.There has been tremendous progress in the FFS algorithm leading to a quasipolynomial time algorithm [5,23] for the small characteristic case. Using algorithms given in [17,5], a record computation of discrete log in the binary extension field F 2 9234 was reported by Granger et al [12].…”

mentioning

confidence: 99%

A unified polynomial selection method for the (tower) number field sieve algorithm

Sarkar¹,

Singh²

2019

Advances in Mathematics of Communications

View full text Add to dashboard Cite

At Eurocrypt 2015, Barbulescu et al. introduced two new methods of polynomial selection, namely the Conjugation and the Generalised Joux-Lercier methods, for the number field sieve (NFS) algorithm as applied to the discrete logarithm problem over finite fields. A sequence of subsequent works have developed and applied these methods to the multiple and the (extended) tower number field sieve algorithms. This line of work has led to new asymptotic complexities for various cases of the discrete logarithm problem over finite fields. The current work presents a unified polynomial selection method which we call Algorithm D. Starting from the Barbulescu et al. paper, all the subsequent polynomial selection methods can be seen as special cases of Algorithm D. Moreover, for the extended tower number field sieve (exTNFS) and the multiple extended TNFS (MexTNFS), there are finite fields for which using the polynomials selected by Algorithm D provides the best asymptotic complexity. Suppose Q = p n for a prime p and further suppose that n = ηκ such that there is a c θ > 0 for which p η = L Q (2/3, c θ ). For c θ > 3.39, the complexity of exTNFS-D is lower than the complexities of all previous algorithms; for c θ / ∈ (0, 1.12) ∪ [1.45, 3.15], the complexity of MexTNFS-D is lower than that of all previous methods.2010 Mathematics Subject Classification: Primary: 11Y16; Secondary: 94A60. Key words and phrases: Finite fields, discrete logarithm, number field sieve, tower number field sieve, multiple tower number field sieve. the number field sieve (NFS) [11,19,21] Depending on the value of a, fields F Q are classified into the following types: small characteristic, if a < 1/3; medium characteristic, if 1/3 ≤ a < 2/3; boundary, if a = 2/3; and large characteristic, if a > 2/3. The case a = 2/3 has been singled out as a boundary case in [4] since it is possible to show that the best complexity for this case is lower than the best complexities for the medium characteristic and the large characteristic cases. For a = 1/3, on the other hand, no such complexity improvement is known.There has been tremendous progress in the FFS algorithm leading to a quasipolynomial time algorithm [5,23] for the small characteristic case. Using algorithms given in [17,5], a record computation of discrete log in the binary extension field F 2 9234 was reported by Granger et al. [12]. The FFS algorithm also applies to the medium prime case and this has been reported in [20,16,29].The application of NFS to compute discrete logarithms over finite fields was first proposed by Gordon [11] for prime order fields, i.e., for n = 1. Application to composite order fields, i.e., for n > 1, was shown by Schirokauer [33]. Important improvements to the NFS for prime order fields were given by Joux and Lercier [19]. Joux, Lercier, Smart and Vercauteren [21] showed that the NFS algorithm is applicable to all finite fields. When the prime p is of a special form, Joux and Pierrot [22] showed the application of the special number field sieve algorithm to obtain improved ...

show abstract

Improving the Polynomial time Precomputation of Frobenius Representation Discrete Logarithm Algorithms

Cited by 20 publications

References 7 publications

Faster individual discrete logarithms in finite fields of composite extension degree

Faster individual discrete logarithms in finite fields of composite extension degree

Technical history of discrete logarithms in small characteristic finite fields

A unified polynomial selection method for the (tower) number field sieve algorithm

Contact Info

Product

Resources

About