A New Index Calculus Algorithm with Complexity $$L(1/4+o(1))$$ in Small Characteristic

Joux, Antoine

doi:10.1007/978-3-662-43414-7_18

Cited by 120 publications

(121 citation statements)

References 13 publications

Supporting

Mentioning

112

Contrasting

Unclassified

Order By: Relevance

“…This was long before the MD5 attack by Wang and Yu [117]. -Many discrete-logarithm experts recommended prime fields (see, e.g., [1, page 25]) long before recent attacks such as [72] against small-characteristic finite-field discrete logarithms. -Many discrete-logarithm experts specifically recommend prime-field ECDL over small-characteristic ECDL (see, e.g., [1, page 62]), even though none of the efforts to break small-characteristic ECDL have been successful (see the recent survey [56]).…”

Section: Choosing Haswell Multiplication Instructionsmentioning

confidence: 99%

NTRU Prime: Reducing Attack Surface at Low Cost

Bernstein

Chuengsatiansup

Lange

et al. 2017

Lecture Notes in Computer Science

120

View full text Add to dashboard Cite

Abstract. Several ideal-lattice-based cryptosystems have been broken by recent attacks that exploit special structures of the rings used in those cryptosystems. The same structures are also used in the leading proposals for post-quantum lattice-based cryptography, including the classic NTRU cryptosystem and typical Ring-LWE-based cryptosystems. This paper (1) proposes NTRU Prime, which tweaks NTRU to use rings without these structures; (2) proposes Streamlined NTRU Prime, a public-key cryptosystem optimized from an implementation perspective, subject to the standard design goal of IND-CCA2 security; (3) finds high-security post-quantum parameters for Streamlined NTRU Prime; and (4) optimizes a constant-time implementation of those parameters. The resulting sizes and speeds show that reducing the attack surface has very low cost.

show abstract

Section: Choosing Haswell Multiplication Instructionsmentioning

confidence: 99%

NTRU Prime: Reducing Attack Surface at Low Cost

Bernstein

Chuengsatiansup

Lange

et al. 2017

Lecture Notes in Computer Science

120

View full text Add to dashboard Cite

show abstract

“…In terms of efficiency, Type II pairings compare quite favorably to Type I pairings (especially at higher security levels, and particularly now that low-characteristic pairings are known to be broken [23,9]), and are close to Type III pairings: in fact, a Type II pairing computation can be reduced to a Type III one at the cost of one multiplication in G 1 [17,Note 10]. The size of the representation of elements in G 1 is also the same in the Type II and Type III settings, and usually much smaller than in Type I pairings.…”

Section: Bilinear Groupsmentioning

confidence: 99%

Structure-Preserving Signatures from Type II Pairings

Abe

Groth

Ohkubo³

et al. 2014

Advances in Cryptology – CRYPTO 2014

View full text Add to dashboard Cite

Abstract. We investigate structure-preserving signatures in asymmetric bilinear groups with an efficiently computable homomorphism from one source group to the other, i.e., the Type II setting. It has been shown that in the Type I and Type III settings (with maximal symmetry and maximal asymmetry respectively), structure-preserving signatures need at least 2 verification equations and 3 group elements. It is therefore natural to conjecture that this would also be required in the intermediate Type II setting, but surprisingly this turns out not to be the case. We construct structure-preserving signatures in the Type II setting that only require a single verification equation and consist of only 2 group elements. This shows that the Type II setting with partial asymmetry is different from the other two settings in a way that permits the construction of cryptographic schemes with unique properties. We also investigate lower bounds on the size of the public verification key in the Type II setting. Previous work in structure-preserving signatures has explored lower bounds on the number of verification equations and the number of group elements in a signature but the size of the verification key has not been investigated before. We show that in the Type II setting it is necessary to have at least 2 group elements in the public verification key in a signature scheme with a single verification equation. Our constructions match the lower bounds so they are optimal with respect to verification complexity, signature sizes and verification key sizes. In fact, in terms of verification complexity, they are the most efficient structure preserving signature schemes to date. Depending on the context in which a scheme is deployed it is sometimes desirable to have strong existential unforgeability, and in other cases full randomizability. We give two structure-preserving signature schemes with a single verification equation where both the signatures and the public verification keys consist of two group elements each. One signature scheme is strongly existentially unforgeable, the other is fully randomizable. Having such simple and elegant structure-preserving signatures may make the Type II setting the easiest to use when designing new structure-preserving cryptographic schemes, and lead to schemes with the greatest conceptual simplicity.

show abstract

“…In 2013, many improvements were discovered for discrete logarithm computation in the case of finite fields of small characteristic, starting with an algorithm with an L 2 n (1/4) complexity due to Joux [15], that was then modified to get a quasi-polynomial complexity [6]. By quasipolynomial, we mean a complexity of n O(log n) where n is the number of bits of the input, which would correspond to L 2 n (o(1)) in the L-notation.…”

Section: Ii-7 3 Discrete Logarithms In Finite Fields Of Small Characmentioning

confidence: 99%

Integer factorization and discrete logarithm problems

Gaudry¹

2014

Cours du CIRM

View full text Add to dashboard Cite

A New Index Calculus Algorithm with Complexity $$L(1/4+o(1))$$ in Small Characteristic

Cited by 120 publications

References 13 publications

NTRU Prime: Reducing Attack Surface at Low Cost

NTRU Prime: Reducing Attack Surface at Low Cost

Structure-Preserving Signatures from Type II Pairings

Integer factorization and discrete logarithm problems

Contact Info

Product

Resources

About