Virtual logarithms

In this paper, we describe many improvements to the number field sieve. Our main contribution consists of a new way to compute individual logarithms with the number field sieve without solving a very large linear system for each logarithm. We show that, with these improvements, the number field sieve outperforms the gaussian integer method in the hundred digit range. We also illustrate our results by successfully computing discrete logarithms with GNFS in a large prime field.

The security of pairing-based crypto-systems relies on the difficulty to compute discrete logarithms in finite fields $${\mathbb F}_{p^n}$$ where n is a small integer larger than 1. The state-of-art algorithm is the number field sieve (NFS) together with its many variants. When p has a special form (SNFS), as in many pairings constructions, NFS has a faster variant due to Joux and Pierrot. We present a new NFS variant for SNFS computations, which is better for some cryptographically relevant cases, according to a precise comparison of norm sizes. The new algorithm is an adaptation of Schirokauer’s variant of NFS based on tower extensions, for which we give a middlebrow presentation.

As we examine the behaviour of the number field sieve (NFS) in the medium prime case, we notice various patterns that can be exploited to improve the running time of the sieving stage. The contributions of these observations to the computational mathematics community are twofold. Firstly, we clarify the understanding of the true practical effectiveness of the algorithm. Secondly, we propose a test for a better choice of the polynomials used in the NFS. These results are of particular interest to cryptographers as the run-time of the NFS directly determines the security level of some discrete logarithm problem based protocols.

In this paper a probabilistic algorithm is exhibited that factors any positive integer n n into prime factors in expected time at most L n [ 1 2 , 1 + o ( 1 ) ] {L_n}[\tfrac {1}{2},1 + o(1)] for n → ∞ n \to \infty , where L x [ a , b ] = exp ( b ( log ⁡ x ) a ( log log ⁡ x ) 1 − a ) {L_x}[a,b] = {\text {exp}}(b{(\log x)^a}{({\text {log}}\log x)^{1 - a}}) . Many practical factoring algorithms, including the quadratic sieve and the elliptic curve method, are conjectured to have an expected running time that satisfies the same bound, but this is the first algorithm for which the bound can be rigorously proved. Nevertheless, this does not close the gap between rigorously established time bounds and merely conjectural ones for factoring algorithms. This is due to the advent of a new factoring algorithm, the number field sieve, which is conjectured to factor any positive integer n n in time L n [ 1 3 , O ( 1 ) ] {L_n}[\tfrac {1}{3},O(1)] . The algorithm analyzed in this paper is a variant of the class group relations method, which makes use of class groups of binary quadratic forms of negative discriminant. This algorithm was first suggested by Seysen, and later improved by A. K. Lenstra, who showed that the algorithm runs in expected time at most L n [ 1 2 , 1 + o ( 1 ) ] {L_n}[\tfrac {1}{2},1 + o(1)] if one assumes the generalized Riemann hypothesis. The main device for removing the use of the generalized Riemann hypothesis from the proof is the use of multipliers. In addition a character sum estimate for algebraic number fields is used, with an explicit dependence on possible exceptional zeros of the corresponding L L -functions. Another factoring algorithm using class groups that has been proposed is the random class groups method. It is shown that there is a fairly large set of numbers that this algorithm cannot be expected to factor as efficiently as had previously been thought.

The selection of polynomials to represent number fields crucially determines the efficiency of the Number Field Sieve NFS algorithm for solving the discrete logarithm in a finite field. An important recent work due to Barbulescu et al. builds upon existing works to propose two new methods for polynomial selection when the target field is a non-prime field. These methods are called the generalised Joux-Lercier GJL and the Conjugation methods. In this work, we propose a new method which we denote as $$\mathcal {A}$$A for polynomial selection for the NFS algorithm in fields $$\mathbb {F}_{Q}$$FQ, with $$Q=p^n$$Q=pn and $$n>1$$n>1. The new method both subsumes and generalises the GJL and the Conjugation methods and provides new trade-offs for both n composite and n prime. Let us denote the variant of the multiple NFS algorithm using the polynomial selection method X by MNFS-X. Asymptotic analysis is performed for both the NFS-$$\mathcal {A}$$A and the MNFS-$$\mathcal {A}$$A algorithms. In particular, when $$p=L_Q2/3,c_p$$p=LQ2/3,cp, for $$c_p\in [3.39,20.91]$$cp∈[3.39,20.91], the complexity of NFS-$$\mathcal {A}$$A is better than the complexities of all previous algorithms whether classical or MNFS. The MNFS-$$\mathcal {A}$$A algorithm provides lower complexity compared to NFS-$$\mathcal {A}$$A algorithm; for $$c_p\in 0, 1.12] \cup [1.45,3.15]$$cp∈0,1.12]i¾?[1.45,3.15], the complexity of MNFS-$$\mathcal {A}$$A is the same as that of the MNFS-Conjugation and for $$c_p\notin 0, 1.12] \cup [1.45,3.15]$$cpi¾?0,1.12]i¾?[1.45,3.15], the complexity of MNFS-$$\mathcal {A}$$A is lower than that of all previous methods.

Integer factoring is a curious number theory problem with wide applications in complexity and cryptography. The best known algorithm to factor a number n takes time, roughly, exp(2*log^{1/3}(n)*log^{2/3}(log(n))) (number field sieve, 1989). One basic idea used is to find two squares, possibly in a number field, that are congruent modulo n. Several variants of this idea have been utilized to get other factoring algorithms in the last century. In this work we intend to explore new ideas towards integer factoring. In particular, we adapt the AKS primality test (2004) ideas for integer factoring. In the motivating case of semiprimes n=pq, i.e. p<q are primes, we exploit the difference in the two Frobenius morphisms (one over F_p and the other over F_q) to factor n in special cases. Specifically, our algorithm is polynomial time (on number theoretic conjectures) if we know a small algebraic dependence between p,q. We discuss families of n where our algorithm is significantly faster than the algorithms based on known techniques.

The two currently fastest general-purpose integer factorization algorithms are the Quadratic Sieve and the Number Field Sieve. Both techniques are used to find so-called smooth values of certain polynomials, i.e., values that factor completely over a set of small primes (the factor base). As the names of the methods suggest, a sieving procedure is used for the task of quickly identifying smooth values among the candidates in a certain range. While the Number Field Sieve is asymptotically faster, the Quadratic Sieve is still considered the most efficient factorization technique for numbers up to around 100 digits. In this paper, we challenge the Quadratic Sieve by presenting a novel approach based on representing smoothness candidates as sums that are always divisible by several of the primes in the factor base. The resulting values are generally smaller than those considered in the Quadratic Sieve, increasing the likelihood of them being smooth. Using the fastest implementations of the Self-initializing Quadratic Sieve in Python as benchmarks, a Python implementation of our approach runs consistently 5 to 7 times faster for numbers with 45–100 digits, and around 10 times faster for numbers with 30–40 digits. We discuss several avenues for further improvements and applications of the technique.

The security of pairing-based cryptography is based on the hardness of the discrete logarithm problem (DLP) over finite field GF(p n). For example, the security of the optimal Ate pairing using BN curves, which is one of the most efficient algorithms for computing paring, is based on the hardness of DLP over GF(p 12). Joux et al. proposed the number field sieve over GF(p n) as an extension of the number field sieve that can efficiently solve the DLP over prime field GF(p). Two implementations of the number field sieve over GF(p 3) and GF(p 6) have been proposed, but there is no report on that over GF(p 12) of extension degree 12. In the sieving step of the number field sieve over GF(p) we perform the sieving of two dimensions, but we have to deal with more than two dimensions in the case of number field sieves over GF(p 12). In this paper we construct a lattice sieve of more than two dimensions, and discuss its parameter sizes such as the dimension of sieving and the size of sieving region from some experiments of the multi-dimensional sieving. Using the parameters suitable for efficient implementation of the number field sieve, we have solved the DLP over GF(p 12) of 203 bits in about 43 hours using a PC of 16 CPU cores.Keywordspairingdiscrete logarithm problemnumber field sieveextension fieldlattice sieve

Computing discrete logarithms in finite fields is a main concern in cryptography. The best algorithms in large and medium characteristic fields (e.g., G F ( p 2 ) \rm {GF}(p^2) , G F ( p 12 ) \rm {GF}(p^{12}) ) are the Number Field Sieve and its variants (special, high-degree, tower). The best algorithms in small characteristic finite fields (e.g., G F ( 3 6 ⋅ 509 ) \rm {GF}(3^{6 \cdot 509}) ) are the Function Field Sieve, Joux’s algorithm, and the quasipolynomial-time algorithm. The last step of this family of algorithms is the individual logarithm computation. It computes a smooth decomposition of a given target in two phases: an initial splitting, then a descent tree. While new improvements have been made to reduce the complexity of the dominating relation collection and linear algebra steps, resulting in a smaller factor basis (database of known logarithms of small elements), the last step remains at the same level of difficulty. Indeed, we have to find a smooth decomposition of a typically large element in the finite field. This work improves the initial splitting phase and applies to any nonprime finite field. It is very efficient when the extension degree is composite. It exploits the proper subfields, resulting in a much more smooth decomposition of the target. This leads to a new trade-off between the initial splitting step and the descent step in small characteristic. Moreover it reduces the width and the height of the subsequent descent tree.

In order to assess the security of cryptosystems based on the discrete logarithm problem in non-prime finite fields, as are the torus-based or pairing-based ones, we investigate thoroughly the case in$\mathbb{F}_{p^{6}}$with the number field sieve. We provide new insights, improvements, and comparisons between different methods to select polynomials intended for a sieve in dimension 3 using a special-$\mathfrak{q}$strategy. We also take into account the Galois action to increase the relation productivity of the sieving phase. To validate our results, we ran several experiments and real computations for various polynomial selection methods and field sizes with our publicly available implementation of the sieve in dimension 3, with special-$\mathfrak{q}$and various enumeration strategies.

Researchers use NFS (Number Field Sieve) method with Lanczos algorithm to analyze big-sized RSA keys. NFS method includes the integer factorization process and nullspace computation of huge sparse matrices. Parallel processing is indispensible since sequential computation requires weeks (even months) of CPU time with supercomputers even for 150-digit RSA keys. This paper presents details of improved block Lanczos algorithm based on previous implementation[4,10]. It includes a new load balancing scheme by partitioning the matrix such that the numbers of nonzero components in the submatrices become equal. Experimentally, a speedup up to 6 and the maximum of efficiency of 0.74 have been achieved using an 8-node cluster with Myrinet interconnection.Keywordsparallel/cluster computingcryptologyRSA keyload balancingsparse matrix

Using a number field sieve, discrete logarithms modulo primes of special forms can be found faster than standard primes. This has raised concerns about trapdoors in discrete log cryptosystems, such as the Digital Signature Standard. Tins paper discusses the practical impact of these trapdoors, and how to avoid them.

In the past two years there have been several advances in Number Field Sieve (NFS) algorithms for computing discrete logarithms in finite fields $${\mathbb F}_{p^n}$$ where p is prime and $$n > 1$$ is a small integer. This article presents a concise overview of these algorithms and discusses some of the challenges with assessing their impact on keylengths for pairing-based cryptosystems.

Refined analysis to the extended tower number field sieve

The number field sieve on many computers