Lattice Enumeration for Tower NFS: A 521-Bit Discrete Logarithm Computation

Abstract

The Tower variant of the Number Field Sieve (TNFS) is known to be asymptotically the most efficient algorithm to solve the discrete logarithm problem in finite fields of medium characteristics, when the extension degree is composite. A major obstacle to an efficient implementation of TNFS is the collection of algebraic relations, as it happens in dimension greater than 2. This requires the construction of new sieving algorithms which remain efficient as the dimension grows. In this article, we overcome this difficulty by considering a lattice enumeration algorithm which we adapt to this specific context. We also consider a new sieving area, a high-dimensional sphere, whereas previous sieving algorithms for the classical NFS considered an orthotope. Our new sieving technique leads to a much smaller running time, despite the larger dimension of the search space, and even when considering a larger target, as demonstrated by a record computation we performed in a 521-bit finite field F p 6 . The target finite field is of the same form than finite fields used in recent zero-knowledge proofs in some blockchains. This is the first reported implementation of TNFS.

Families of SNARK-Friendly 2-Chains of Elliptic Curves

“…To reach the 2 128 cost, we q bw up to 672 bits. We stress that the tool we use only gives an estimate, and recent progress are being made about TNFS [17]. In case of underestimate of the tool, one can consider a 704-bit BLS24-BW6 curve.…”

A survey of elliptic curves for proof systems

“…However these papers estimate the security level, but they do not scale with respect to a record computation. This is not yet possible as the first record computation with the TNFS algorithm was published after them, in [DGP21]: it runs the TNFS in a field F p 6 but new security estimates are not extrapolated. In Table 4 we reproduce the keysizes from [GS21,Gui21].…”

The State of the Art in Integer Factoring and Breaking Public-Key Cryptography

“…Several new algorithms have emerged in recent years, and practical progress has been steady. The current record is a 521-bit computation in a degree-6 field [4]. As a result of this ongoing progress, accurate assessments of feasibility limits for the DLP in such fields are much harder to obtain, as they rely on fragile and fast-changing empirical evidence.…”