Selecting polynomials for the Function Field Sieve

Barbulescu, Razvan

doi:10.1090/s0025-5718-2015-02940-8

Cited by 6 publications

(6 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, for brevity purposes, this presentation is in no way complete nor exhaustive. For more details, we refer the interested reader to the extensive literature on this topic, starting from the first theoretical articles [2,3,25] to the algorithmic advances and implementation reports which followed [18,14,15,7,11,10,16].…”

Section: A Brief Overview Of Ffsmentioning

confidence: 99%

“…In order to further increase the probability to find doubly-smooth elements a(t) − b(t)x all the while keeping arithmetic computations to a minimum in the relation collection step, one has to pay extra care to the selection of the polynomials f and g ∈ k[t] [x]. Similar to the case of the Number Field Sieve (NFS), several criteria exist in the literature in order to rate polynomials to be used in FFS [7].…”

Section: )) and Res X (A(t) − B(t)x G(x T))mentioning

confidence: 99%

“…We used the criteria defined in [7] to select the polynomials. It appears that monic polynomials f (x, t) and g(x, t) of degree 6 and 1 in x, respectively, were the best choice.…”

Section: Polynomial Selectionmentioning

confidence: 99%

“…With this setting, the degree of the resultant in x of f and g is 6 times the degree in t of the constant coefficient of g. Since we want this resultant to have an irreducible factor of degree 809, this imposes this constant coefficient to have a degree at least 135. According to [7], our choice may be driven by the α value and by the factorization pattern of the resultant. As it turns out, among the few polynomials f (x, t) that were preselected for having an α value around −6, all but one have arithmetic properties that force a small factor of degree 2 in the resultant, independently of the linear polynomial g. For those polynomials, the degree in t of the constant coefficient of g would have to be at least 136 in order to leave enough room for an irreducible factor of degree 809 to exist in the resultant.…”

Section: Polynomial Selectionmentioning

confidence: 99%

“…The development of the present work has led to several preprints and articles providing detailed insights on the improvements of the individual steps of FFS [7,10,11,16]. For brevity, this article does not repeat these details, and the interested reader is referred to these articles for more detail.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Discrete Logarithm in GF(2809) with FFS

Barbulescu

Bouvier

Detrey

et al. 2014

Public-Key Cryptography – PKC 2014

Self Cite

View full text Add to dashboard Cite

Abstract. The year 2013 has seen several major complexity advances for the discrete logarithm problem in multiplicative groups of smallcharacteristic finite fields. These outmatch, asymptotically, the Function Field Sieve (FFS) approach, which was so far the most efficient algorithm known for this task. Yet, on the practical side, it is not clear whether the new algorithms are uniformly better than FFS. This article presents the state of the art with regard to the FFS algorithm, and reports data from a record-sized discrete logarithm computation in a prime-degree extension field.

show abstract

Section: A Brief Overview Of Ffsmentioning

confidence: 99%

Section: )) and Res X (A(t) − B(t)x G(x T))mentioning

confidence: 99%

“…We used the criteria defined in [7] to select the polynomials. It appears that monic polynomials f (x, t) and g(x, t) of degree 6 and 1 in x, respectively, were the best choice.…”

Section: Polynomial Selectionmentioning

confidence: 99%

Section: Polynomial Selectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Discrete Logarithm in GF(2809) with FFS

Barbulescu

Bouvier

Detrey

et al. 2014

Public-Key Cryptography – PKC 2014

Self Cite

View full text Add to dashboard Cite

show abstract

Enhanced Lattice-Based Signatures on Reconfigurable Hardware

Pöppelmann

Ducas

Güneysu

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The recent Bimodal Lattice Signature Scheme (Bliss) showed that lattice-based constructions have evolved to practical alternatives to RSA or ECC. Besides reasonably small signatures with 5600 bits for a 128-bit level of security, Bliss enables extremely fast signing and signature verification in software. However, due to the complex sampling of Gaussian noise with high precision, it is not clear whether this scheme can be mapped efficiently to embedded devices. Even though the authors of Bliss also proposed a new sampling algorithm using Bernoulli variables this approach is more complex than previous methods using large precomputed tables. The clear disadvantage of using large tables for high performance is that they cannot be used on constrained computing environments, such as FPGAs, with limited memory. In this work we thus present techniques for an efficient Cumulative Distribution Table (CDT) based Gaussian sampler on reconfigurable hardware involving Peikert's convolution lemma and the Kullback-Leibler divergence. Based on our enhanced sampler design, we provide a first Bliss architecture for Xilinx Spartan-6 FPGAs that integrates fast FFT/NTT-based polynomial multiplication, sparse multiplication, and a Keccak hash function. Additionally, we compare the CDT with the Bernoulli approach and show that for the particular Bliss-I parameter set the improved CDT approach is faster with lower area consumption. Our core uses 2,431 slices, 7.5 BRAMs, and 6 DSPs and performs a signing operation in 126 µs on average. Verification takes even less with 70 µs.

show abstract