Solving a 676-Bit Discrete Logarithm Problem in GF(36n)

Abstract

Abstract. Pairings on elliptic curves in finite fields are crucial material for constructions of various cryptographic schemes. The ηT pairing on supersingular curves over GF(3 n ) is in particular popular since it is efficiently implementable. Taking into account of the MOV attack, the discrete logarithm problems (DLP) in GF(3 6n ) becomes concerned to the security of cryptosystems using ηT pairings in this case. In 2006, Joux and Lercier proposed a new variant of the function field sieve in the medium prime case, named JL06-FFS. We have, however, not found any practical implementations on JL06-FFS over GF(3 6n ) up to now. Therefore, we have firstly fulfilled such an implementation and successfully set a new record for solving the DLP in GF(3 6n ), the DLP in GF(3 6·71 ) of 676-bit size. We conclude that n = 97 case, where there are many implementations of the ηT pairing, is not recommended in practical use. In addition, we also conduct comparisons between JL06-FFS and an earlier version, named JL02-FFS, by practical experiments. Our results confirm that the former is faster several times than the latter under certain conditions.

FPGA Implementation of Various Elliptic Curve Pairings over Odd Characteristic Field with Non Supersingular Curves

“…Since the smallness sometimes affects some insecurity [6], non supersingular pairing-friendly curves have attracted many researchers from the viewpoints of not only cryptographic protocols but also efficient implementations on both software [21] and hardware [21]. Currently BN curve seems to be the most attractive because its embedding degree 12 bridges the security gaps between ECDLP and DLP the most efficiently; however, various kinds of non supersingular pairing-friendly curves should be studied and available on both software and hardware.…”

“…Supersingular curve realizes very efficient pairing calculations such as η T pairing [26]; however, its embedding degree that bridges between ECDLP and DLP is small such as less than or equal to 6. Thus, sometimes it leads to insecure situations [6]. On the other hand, non supersingular pairing-friendly curves, especially BN curve, are able to have larger embedding degree and therefore they are recently focused on from software and hardware viewpoints [13], [15].…”

“…It is known that curves in the former class have less embedding degrees than those in the latter one. Therefore, sometimes the former class leads to insecure parameter settings as reported in Hayashi's report [6]. On the other hand, elliptic curves in the latter class supports various kinds of embedding degrees, therefore they are particularly focused on in these years.…”

“…There is no need to say that it should be implemented on various secure applications and devices for satisfying many complicated security demands in the coming IoT (Internet of Things) era. Such activities on pairing are based on sufficient security evaluations [6]- [8] and a bilinearity between rational point groups on elliptic curve and a multiplicative group in a certain finite field. Therefore, the security of pairing is based on not only elliptic curve discrete logarithm problem (ECDLP) but also discrete logarithm problem (DLP).…”