This paper reports on the number field sieve computation of a 768-bit prime field discrete logarithm, describes the different parameter optimizations and resulting algorithmic changes compared to the factorization of a 768-bit RSA modulus, and briefly discusses the cryptologic relevance of the result.
Arjen Lenstra, Robert Granger, Thorsten Kleinjung, Benjamin Pierre Charles Wesolowski
Dario Floreano, Valentin Wüest, Davide Scaramuzza