The Tower Number Field Sieve

Computing discrete logarithms in finite fields is a main concern in cryptography. The best algorithms in large and medium characteristic fields (e.g., G F ( p 2 ) \rm {GF}(p^2) , G F ( p 12 ) \rm {GF}(p^{12}) ) are the Number Field Sieve and its variants (special, high-degree, tower). The best algorithms in small characteristic finite fields (e.g., G F ( 3 6 ⋅ 509 ) \rm {GF}(3^{6 \cdot 509}) ) are the Function Field Sieve, Joux’s algorithm, and the quasipolynomial-time algorithm. The last step of this family of algorithms is the individual logarithm computation. It computes a smooth decomposition of a given target in two phases: an initial splitting, then a descent tree. While new improvements have been made to reduce the complexity of the dominating relation collection and linear algebra steps, resulting in a smaller factor basis (database of known logarithms of small elements), the last step remains at the same level of difficulty. Indeed, we have to find a smooth decomposition of a typically large element in the finite field. This work improves the initial splitting phase and applies to any nonprime finite field. It is very efficient when the extension degree is composite. It exploits the proper subfields, resulting in a much more smooth decomposition of the target. This leads to a new trade-off between the initial splitting step and the descent step in small characteristic. Moreover it reduces the width and the height of the subsequent descent tree.

In the past two years there have been several advances in Number Field Sieve (NFS) algorithms for computing discrete logarithms in finite fields $${\mathbb F}_{p^n}$$ where p is prime and $$n > 1$$ is a small integer. This article presents a concise overview of these algorithms and discusses some of the challenges with assessing their impact on keylengths for pairing-based cryptosystems.

We essentially improve lower bounds on the linear complexity of a sequence representing the residues of the discrete logarithm in a finite field modulo a divisor of the order of the multiplicative group. More generally, we present the result as a bound on the linear complexity profile. The proof is based on character sum bounds.

In this paper, we show that some new variants of the Very Smooth Hash (VSH) hash function are susceptible to similar types of preimage attacks as the original VSH. We also generalise the previous mathematical results, which have been used in the preimage attacks. VSH is a hash function based on the multiexponentiation of prime numbers modulo some large product of two primes. The security proof of VSH is based on some computational problems in number theory, which are related to the problem of factoring large integers. However, the preimage resistance of VSH has been studied and found somewhat lacking especially in password protection. There have been many different variants of VSH proposed by the original authors and others. Especially the discrete logarithm version of VSH has been proposed in order to make the hash values shorter. Further proposals have used the discrete logarithm in finite fields and elliptic curves to gain even more advantage to the hash length. Our results demonstrate that even for these new variants, the same ideas for preimage attacks can be applied as for the original VSH and they result in effective preimage attacks.

A short proof for explicit formulas for discrete logarithms in finite fields

Classifying and generating exact coset representatives of [formula omitted] in [formula omitted

In this paper, we describe many improvements to the number field sieve. Our main contribution consists of a new way to compute individual logarithms with the number field sieve without solving a very large linear system for each logarithm. We show that, with these improvements, the number field sieve outperforms the gaussian integer method in the hundred digit range. We also illustrate our results by successfully computing discrete logarithms with GNFS in a large prime field.

Recently, several striking advances have taken place regarding the discrete logarithm problem (DLP) in finite fields of small characteristic, despite progress having remained essentially static for nearly thirty years, with the best known algorithms being of subexponential complexity. In this expository article we describe the key insights and constructions which culminated in two independent quasi-polynomial algorithms. To put these developments into both a historical and a mathematical context, as well as to provide a comparison with the cases of so-called large and medium characteristic fields, we give an overview of the state-of-the-art algorithms for computing discrete logarithms in all finite fields. Our presentation aims to guide the reader through the algorithms and their complexity analyses ab initio.

Refined analysis to the extended tower number field sieve

As we examine the behaviour of the number field sieve (NFS) in the medium prime case, we notice various patterns that can be exploited to improve the running time of the sieving stage. The contributions of these observations to the computational mathematics community are twofold. Firstly, we clarify the understanding of the true practical effectiveness of the algorithm. Secondly, we propose a test for a better choice of the polynomials used in the NFS. These results are of particular interest to cryptographers as the run-time of the NFS directly determines the security level of some discrete logarithm problem based protocols.

The selection of polynomials to represent number fields crucially determines the efficiency of the Number Field Sieve NFS algorithm for solving the discrete logarithm in a finite field. An important recent work due to Barbulescu et al. builds upon existing works to propose two new methods for polynomial selection when the target field is a non-prime field. These methods are called the generalised Joux-Lercier GJL and the Conjugation methods. In this work, we propose a new method which we denote as $$\mathcal {A}$$A for polynomial selection for the NFS algorithm in fields $$\mathbb {F}_{Q}$$FQ, with $$Q=p^n$$Q=pn and $$n>1$$n>1. The new method both subsumes and generalises the GJL and the Conjugation methods and provides new trade-offs for both n composite and n prime. Let us denote the variant of the multiple NFS algorithm using the polynomial selection method X by MNFS-X. Asymptotic analysis is performed for both the NFS-$$\mathcal {A}$$A and the MNFS-$$\mathcal {A}$$A algorithms. In particular, when $$p=L_Q2/3,c_p$$p=LQ2/3,cp, for $$c_p\in [3.39,20.91]$$cp∈[3.39,20.91], the complexity of NFS-$$\mathcal {A}$$A is better than the complexities of all previous algorithms whether classical or MNFS. The MNFS-$$\mathcal {A}$$A algorithm provides lower complexity compared to NFS-$$\mathcal {A}$$A algorithm; for $$c_p\in 0, 1.12] \cup [1.45,3.15]$$cp∈0,1.12]i¾?[1.45,3.15], the complexity of MNFS-$$\mathcal {A}$$A is the same as that of the MNFS-Conjugation and for $$c_p\notin 0, 1.12] \cup [1.45,3.15]$$cpi¾?0,1.12]i¾?[1.45,3.15], the complexity of MNFS-$$\mathcal {A}$$A is lower than that of all previous methods.

In order to assess the security of cryptosystems based on the discrete logarithm problem in non-prime finite fields, as are the torus-based or pairing-based ones, we investigate thoroughly the case in$\mathbb{F}_{p^{6}}$with the number field sieve. We provide new insights, improvements, and comparisons between different methods to select polynomials intended for a sieve in dimension 3 using a special-$\mathfrak{q}$strategy. We also take into account the Galois action to increase the relation productivity of the sieving phase. To validate our results, we ran several experiments and real computations for various polynomial selection methods and field sizes with our publicly available implementation of the sieve in dimension 3, with special-$\mathfrak{q}$and various enumeration strategies.

The two currently fastest general-purpose integer factorization algorithms are the Quadratic Sieve and the Number Field Sieve. Both techniques are used to find so-called smooth values of certain polynomials, i.e., values that factor completely over a set of small primes (the factor base). As the names of the methods suggest, a sieving procedure is used for the task of quickly identifying smooth values among the candidates in a certain range. While the Number Field Sieve is asymptotically faster, the Quadratic Sieve is still considered the most efficient factorization technique for numbers up to around 100 digits. In this paper, we challenge the Quadratic Sieve by presenting a novel approach based on representing smoothness candidates as sums that are always divisible by several of the primes in the factor base. The resulting values are generally smaller than those considered in the Quadratic Sieve, increasing the likelihood of them being smooth. Using the fastest implementations of the Self-initializing Quadratic Sieve in Python as benchmarks, a Python implementation of our approach runs consistently 5 to 7 times faster for numbers with 45–100 digits, and around 10 times faster for numbers with 30–40 digits. We discuss several avenues for further improvements and applications of the technique.

A simple algorithm to find logarithms in a finite field of characteristic two is described. It uses the Euclidean algorithm for polynomials in attempting to reduce an element to a product of factors all of whose logarithms are stored in a database. The algorithm, which is similar to one of Adleman, has a random runtime and constant storage requirements. It is analyzed and problems associated with the construction of the database are considered. The aim of the work is to show that the algorithm is feasible for the field with $2^{127} $ elements on which several proposed public key distribution systems have been based. For such application it is felt that the discrete logarithm is still a viable technique for sufficiently large fields.

The security of pairing-based cryptography is based on the hardness of the discrete logarithm problem (DLP) over finite field GF(p n). For example, the security of the optimal Ate pairing using BN curves, which is one of the most efficient algorithms for computing paring, is based on the hardness of DLP over GF(p 12). Joux et al. proposed the number field sieve over GF(p n) as an extension of the number field sieve that can efficiently solve the DLP over prime field GF(p). Two implementations of the number field sieve over GF(p 3) and GF(p 6) have been proposed, but there is no report on that over GF(p 12) of extension degree 12. In the sieving step of the number field sieve over GF(p) we perform the sieving of two dimensions, but we have to deal with more than two dimensions in the case of number field sieves over GF(p 12). In this paper we construct a lattice sieve of more than two dimensions, and discuss its parameter sizes such as the dimension of sieving and the size of sieving region from some experiments of the multi-dimensional sieving. Using the parameters suitable for efficient implementation of the number field sieve, we have solved the DLP over GF(p 12) of 203 bits in about 43 hours using a PC of 16 CPU cores.Keywordspairingdiscrete logarithm problemnumber field sieveextension fieldlattice sieve