Solving Large Sparse Linear Systems Over Finite Fields

LaMacchia, Brian A.; Odlyzko, Andrew

doi:10.1007/3-540-38424-3_8

Cited by 131 publications

(111 citation statements)

References 20 publications

(13 reference statements)

Supporting

Mentioning

102

Contrasting

Unclassified

Order By: Relevance

“…On the other hand, then there is no way to beat sparse-matrix methods for finding a unique solution to a sparse system of equations. Standard estimates for Lanczos, Conjugate Gradients or Wiedemann methods ( [17,24,38]) resemble…”

Section: A Framework For Estimating Security Levelsmentioning

confidence: 99%

On Asymptotic Security Estimates in XL and Gröbner Bases-Related Algebraic Cryptanalysis

Yang

Chen²,

Courtois³

2004

Information and Communications Security

View full text Add to dashboard Cite

Abstract. "Algebraic Cryptanalysis" against a cryptosystem often comprises finding enough relations that are generally or probabilistically valid, then solving the resultant system. The security of many schemes (most important being AES) thus depends on the difficulty of solving multivariate polynomial equations. Generically, this is NP-hard. The related methods of XL (eXtended Linearization), Gröbner Bases, and their variants (of which a large number has been proposed) form a unified approach to solving equations and thus affect our assessment and understanding of many cryptosystems. Building on prior theory, we analyze these XL variants and derive asymptotic formulas giving better security estimates under XL-related algebraic attacks; through this examination we have hopefully improved our understanding of such variants. In particular, guessing a portion of variables is a good idea for both XL and Gröbner Bases methods.

show abstract

Section: A Framework For Estimating Security Levelsmentioning

confidence: 99%

On Asymptotic Security Estimates in XL and Gröbner Bases-Related Algebraic Cryptanalysis

Yang

Chen²,

Courtois³

2004

Information and Communications Security

View full text Add to dashboard Cite

show abstract

“…Note that computing M T M is not efficient, and so we compute the vector u = M v and M T u. For more details about this computation is written in [20].…”

Section: The Parallel Lanczos Methodsmentioning

confidence: 99%

Solving a 676-Bit Discrete Logarithm Problem in GF(36n )

Hayashi

Shinohara

Wang

et al. 2010

Public Key Cryptography – PKC 2010

View full text Add to dashboard Cite

Abstract. Pairings on elliptic curves in finite fields are crucial material for constructions of various cryptographic schemes. The ηT pairing on supersingular curves over GF(3 n ) is in particular popular since it is efficiently implementable. Taking into account of the MOV attack, the discrete logarithm problems (DLP) in GF(3 6n ) becomes concerned to the security of cryptosystems using ηT pairings in this case. In 2006, Joux and Lercier proposed a new variant of the function field sieve in the medium prime case, named JL06-FFS. We have, however, not found any practical implementations on JL06-FFS over GF(3 6n ) up to now. Therefore, we have firstly fulfilled such an implementation and successfully set a new record for solving the DLP in GF(3 6n ), the DLP in GF(3 6·71 ) of 676-bit size. We conclude that n = 97 case, where there are many implementations of the ηT pairing, is not recommended in practical use. In addition, we also conduct comparisons between JL06-FFS and an earlier version, named JL02-FFS, by practical experiments. Our results confirm that the former is faster several times than the latter under certain conditions.

show abstract

“…A description of these methods can be found in the paper by LaMacchia and Odlyzko [5], where they describe their experience in solving systems that arise from integer factoring algorithms and the computation of discrete logarithms over fields GF (p) for a prime p. We chose to implement two of these algorithms: conjugate gradient and structured Gaussian elimination. For handling multiple precision integers we used the Lenstra-Manasse package.…”

Section: Linear Algebramentioning

confidence: 99%

“…The original systems were reduced in size using the structured Gaussian elimination algorithm, after which the conjugate gradient algorithm was applied to solve the smaller (and still fairly sparse) system. This approach was used by LaMacchia and Odlyzko in [5] with great success. The structured Gaussian elimination reduced their systems by as much as 95%, leaving a small system that could easily be solved on a single processor.…”

Section: Linear Algebramentioning

confidence: 99%

“…We were not as successful, due to a feature of the equations that Coppersmith's method produces. For the equations in [5], almost all the coefficients are ±1, and so during the Gaussian elimination most operations involve adding or subtracting one row from another. For our systems, half of the coefficients are multiples of 4, and so it is often necessary to multiply a row by ±4 before adding it to another.…”

Section: Linear Algebramentioning

confidence: 99%

See 1 more Smart Citation

Massively Parallel Computation of Discrete Logarithms

Gordon

McCurley

Advances in Cryptology — CRYPTO’ 92

View full text Add to dashboard Cite

Numerous cryptosystems have been designed to be secure under the assumption that the computation of discrete logarithms is infeasible. This paper reports on an aggressive attempt to discover the size of fields of characteristic two for which the computation of discrete logarithms is feasible. We discover several things that were previously overlooked in the implementation of Coppersmith's algorithm, some positive, and some negative. As a result of this work we have shown that fields as large as GF (2 503 ) can definitely be attacked.

show abstract

Solving Large Sparse Linear Systems Over Finite Fields

Cited by 131 publications

References 20 publications

On Asymptotic Security Estimates in XL and Gröbner Bases-Related Algebraic Cryptanalysis

On Asymptotic Security Estimates in XL and Gröbner Bases-Related Algebraic Cryptanalysis

Solving a 676-Bit Discrete Logarithm Problem in GF(36n )

Massively Parallel Computation of Discrete Logarithms

Contact Info

Product

Resources

About