A unified polynomial selection method for the (tower) number field sieve algorithm

Abstract

At Eurocrypt 2015, Barbulescu et al. introduced two new methods of polynomial selection, namely the Conjugation and the Generalised Joux-Lercier methods, for the number field sieve (NFS) algorithm as applied to the discrete logarithm problem over finite fields. A sequence of subsequent works have developed and applied these methods to the multiple and the (extended) tower number field sieve algorithms. This line of work has led to new asymptotic complexities for various cases of the discrete logarithm problem over finite fields. The current work presents a unified polynomial selection method which we call Algorithm D. Starting from the Barbulescu et al. paper, all the subsequent polynomial selection methods can be seen as special cases of Algorithm D. Moreover, for the extended tower number field sieve (exTNFS) and the multiple extended TNFS (MexTNFS), there are finite fields for which using the polynomials selected by Algorithm D provides the best asymptotic complexity. Suppose Q = p n for a prime p and further suppose that n = ηκ such that there is a c θ > 0 for which p η = L Q (2/3, c θ ). For c θ > 3.39, the complexity of exTNFS-D is lower than the complexities of all previous algorithms; for c θ / ∈ (0, 1.12) ∪ [1.45, 3.15], the complexity of MexTNFS-D is lower than that of all previous methods.2010 Mathematics Subject Classification: Primary: 11Y16; Secondary: 94A60. Key words and phrases: Finite fields, discrete logarithm, number field sieve, tower number field sieve, multiple tower number field sieve. the number field sieve (NFS) [11,19,21] Depending on the value of a, fields F Q are classified into the following types: small characteristic, if a < 1/3; medium characteristic, if 1/3 ≤ a < 2/3; boundary, if a = 2/3; and large characteristic, if a > 2/3. The case a = 2/3 has been singled out as a boundary case in [4] since it is possible to show that the best complexity for this case is lower than the best complexities for the medium characteristic and the large characteristic cases. For a = 1/3, on the other hand, no such complexity improvement is known.There has been tremendous progress in the FFS algorithm leading to a quasipolynomial time algorithm [5,23] for the small characteristic case. Using algorithms given in [17,5], a record computation of discrete log in the binary extension field F 2 9234 was reported by Granger et al. [12]. The FFS algorithm also applies to the medium prime case and this has been reported in [20,16,29].The application of NFS to compute discrete logarithms over finite fields was first proposed by Gordon [11] for prime order fields, i.e., for n = 1. Application to composite order fields, i.e., for n > 1, was shown by Schirokauer [33]. Important improvements to the NFS for prime order fields were given by Joux and Lercier [19]. Joux, Lercier, Smart and Vercauteren [21] showed that the NFS algorithm is applicable to all finite fields. When the prime p is of a special form, Joux and Pierrot [22] showed the application of the special number field sieve algorithm to obtain improved ...

Asymptotic Complexities of Discrete Logarithm Algorithms in Pairing-Relevant Finite Fields

“…In the latter case, the prefix letter M is added refering to the MNFS variant. Details about (M)(ex)TNFS and their variants are given in [5,29,30,37].…”

“…We now look at polynomial selections with composite extension degree n = ηκ. The most general algorithms are the algorithms B, C and D presented in [35,37] that extend algorithm A to the composite case. Thus, the construction of the polynomials f 1 and f 2 follow very similar steps as the ones in algorithm A.…”

Individual discrete logarithm with sublattice reduction

“…When n has an appropriate size, this variant is faster 2 than NFS, with a complexity of L p n (1/3, (48/9) 1/3 ). Moreover, in [SS19], Sarkar and Singh presented a unified polynomial selection for TNFS and lowered its complexity in some cases. In [KB16, KJ17], when coupled with the multiple variant or special variant TNFS is called MexTNFS or SexTNFS, but in this article we simply denote it by MTNFS or STNFS.…”