Indiscreet logarithms in finite fields of small characteristic

Recently, several striking advances have taken place regarding the discrete logarithm problem (DLP) in finite fields of small characteristic, despite progress having remained essentially static for nearly thirty years, with the best known algorithms being of subexponential complexity. In this expository article we describe the key insights and constructions which culminated in two independent quasi-polynomial algorithms. To put these developments into both a historical and a mathematical context, as well as to provide a comparison with the cases of so-called large and medium characteristic fields, we give an overview of the state-of-the-art algorithms for computing discrete logarithms in all finite fields. Our presentation aims to guide the reader through the algorithms and their complexity analyses ab initio.

On Small Degree Extension Fields in Cryptology

Robert Granger

This thesis studies the implications of using public key cryptographic primitives that are based in, or map to, the multiplicative group of finite fields with small extension degree. A central observation is that the multiplicative group of extension fields essentially decomposes as a product of algebraic tori, whose properties allow for improved communication efficiency. Part I of this thesis is concerned with the constructive implications of this idea. Firstly, algorithms are developed for the efficient implementation of torus-based cryptosystems and their performance compared with previous work. It is then shown how to apply these methods to operations required in low characteristic pairing-based cryptography. Finally, practical schemes for high-dimensional tori are discussed. Highly optimised implementations and benchmark timings are provided for each of these systems. Part II addresses the security of the schemes presented in Part I, i.e., the hardness of the discrete logarithm problem. Firstly, an heuristic analysis of the effectiveness of the Function Field Sieve in small characteristic is given. Next presented is an implementation of this algorithm for characteristic three fields used in pairing-based cryptography. Finally, a new index calculus algorithm for solving the discrete logarithm problem on algebraic tori is described and analysed.

PhD dissertation, University of Bristol, UK, February 20062006

Solving a $6120$-bit DLP on a Desktop Computer

Robert Granger, Jens Markus Zumbrägel

In this paper we show how some recent ideas regarding the discrete logarithm problem (DLP) in finite fields of small characteristic may be applied to compute logarithms in some very large fields extremely efficiently. By combining the polynomial time relation generation from the authors’ CRYPTO 2013 paper, an improved degree two elimination technique, and an analogue of Joux’s recent small-degree elimination method, we solved a DLP in the record-sized finite field of

2^{6120}

elements, using just a single core-month. Relative to the previous record set by Joux in the field of

2^{4080}

elements, this represents a 50% increase in the bitlength, using just 5% of the core-hours. We also show that for the fields considered, the parameters for Joux’s

L_Q(1/4+o(1))

algorithm may be optimised to produce an

L_Q(1/4)

algorithm.

Springer Berlin Heidelberg2013

Estimates for Discrete Logarithm Computations in Finite Fields of Small Characteristic

Robert Granger

We give estimates for the running-time of the function field sieve (FFS) to compute discrete logarithms in

\mathbb{F}_{p^n}^{\times}

for small

p

. Specifically, we obtain sharp probability estimates that allow us to select optimal parameters in cases of cryptographic interest, without appealing to the heuristics commonly relied upon in an asymptotic analysis. We also give evidence that for any fixed field size some may be weaker than others of a different characteristic or field representation, and compare the relative difficulty of computing discrete logarithms via the FFS in such cases.

Springer Berlin Heidelberg2003

Solving a $6120$-bit DLP on a Desktop Computer

Robert Granger, Jens Markus Zumbrägel

2^{6120}

elements, using just a single core-month. Relative to the previous record set by Joux in the field of

2^{4080}

elements, this represents a 50% increase in the bitlength, using just 5% of the core-hours. We also show that for the fields considered, the parameters for Joux’s

L_Q(1/4+o(1))

algorithm may be optimised to produce an

L_Q(1/4)

algorithm.

Springer Berlin Heidelberg2013

Estimates for Discrete Logarithm Computations in Finite Fields of Small Characteristic

Robert Granger

We give estimates for the running-time of the function field sieve (FFS) to compute discrete logarithms in

\mathbb{F}_{p^n}^{\times}

for small

p

Springer Berlin Heidelberg2003