Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic

Abstract

Lattice sieving in two dimensions has proven to be an indispensable practical aid in integer factorization and discrete log computations involving the number field sieve. The main contribution of this article is to show that a different method of lattice sieving in three dimensions will provide a significant speedup in medium characteristic. Our method is to use the successive minima and shortest vectors of the lattice instead of transition vectors to iterate through lattice points. We showcase the new method by a record computation in a 133-bit subgroup of ${{\mathbb{F}}_{{{p}^{6}}}}$, with p6 having 423 bits. Our overall timing is nearly 3 times faster than the previous record of a 132-bit subgroup in a 422-bit field. The approach generalizes to dimensions 4 or more, overcoming one key obstruction to the implementation of the tower number field sieve.

Lattice Enumeration for Tower NFS: A 521-Bit Discrete Logarithm Computation

“…These algorithms either find and extract smooth parts of the norms, or completely factor them. The family of sieving algorithms [13,26], batch algorithms [6, Algorithm 2.1] and ECM [7,25] are examples of such methods used in factorization and DLP computations. They all have different complexities and properties and thus cannot be used on the same amount of input norms N i .…”

“…Taking the polynomials a(ι) and b(ι) of degree deg h − 1 leads to d = 2 × deg h hence d ≥ 4. There exist two competitive algorithms that can be used when d ≥ 3: the transition vectors method [13] and the recursive hyperplan one [26], see Section 3.1 for these algorithms. They both use as a sieving space a d-orthotope whereas in this work we consider a d-sphere.…”

“…Recursive lattice sieving through hyperplanes in [26]. In 2020, McGuire and Robinson also proposed an enumeration algorithm in dimension 3 or higher.…”

“…In dimension 2, Franke and Kleinjung [10] proposed in 2005 an efficient algorithm used in all previous records. For higher dimensions, after a pioneer work in F p 12 by Hayasaka et al [19], the transition vectors method from Grémy [13] and a recursive plane method proposed by McGuire and Robinson [26] were tested in dimension 3 and used for record computations using NFS. However, the efficiency of their algorithms for even higher dimensions is questionable.…”

“…Ultimately, as shown in Table 2, our algorithm is much faster than existing high-dimensional sieving algorithms, despite the larger dimension of the search space and the larger finite field. [14] and [26] for finite fields of the form F p 6 .…”