Faster Index Calculus for the Medium Prime Case Application to 1175-bit and 1425-bit Finite Fields

Abstract

Abstract. Many index calculus algorithms generate multiplicative relations between smoothness basis elements by using a process called Sieving. This process allows to filter potential candidate relations very quickly, without spending too much time to consider bad candidates. However, from an asymptotic point of view, there is not much difference between sieving and straightforward testing of candidates. The reason is that even when sieving, some small amount time is spend for each bad candidates. Thus, asymptotically, the total number of candidates contributes to the complexity. In this paper, we introduce a new technique: Pinpointing, which allows us to construct multiplicate relations much faster, thus reducing the asymptotic complexity of relations' construction. Unfortunately, we only know how to implement this technique for finite fields which contain a medium-sized subfield. When applicable, this method improves the asymptotic complexity of the index calculus algorithm in the cases where the sieving phase dominates. In practice, it gives a very interesting boost to the performance of state-of-the-art algorithms. We illustrate the feasability of the method with a discrete logarithm record in medium prime finite fields of sizes 1175 bits and 1425 bits.

Use of SIMD-based data parallelism to speed up sieving in integer-factoring algorithms

“…Fresh experimentation is needed to investigate the effects of SIMD parallelization on polynomial sieves. Data-parallel implementations of the pinpointing algorithm of Joux [29] also merits attention.…”

A New Index Calculus Algorithm with Complexity $$L(1/4+o(1))$$ in Small Characteristic

“…In [10], it was remarked that a single polynomial f that nicely factors can be transformed into several such polynomials, simply by a linear change of variable: f (X) −→ f (aX), for any non-zero constant a.…”

“…One of the two main ideas used for our algorithm is a generalization of the pinpointing technique proposed in [10]. Another independent algorithm for characteristic 2 was proposed in [5], yielding an algorithm with complexity L Q (1/3), with a better constant than the Function Field Sieve.…”

The Past, Evolving Present, and Future of the Discrete Logarithm

“…The first of these improvements published in [Jou13a] showed that the 2006 version of the Function Field Sieve from [JL06] can be modified in a surprising way to improve its complexity. The basic idea is to slightly change how finite fields are defined and ends in a situation where the search for one smooth polynomial on the left-hand side of a relation can be amortized by constructing many possible right-hand sides from a single initial polynomial on the left.…”

“…The basic idea can be viewed in two different ways, one can either consider a family of polynomials whose splitting probability is much higher than for random polynomials of the same degree as proposed in [GGMZ13], or start from a polynomial that splits and use a generalized version of the change of variable from [Jou13a] to construct many polynomials from this starting point. This latter approach is described in [Jou13b] and combined with a new method for computing individual logarithms, it yields a heuristic L(1/4) algorithm.…”