Relation Collection for the Function Field Sieve

Abstract

Abstract-In this paper, we focus on the relation collection step of the Function Field Sieve (FFS), which is to date the best algorithm known for computing discrete logarithms in smallcharacteristic finite fields of cryptographic sizes. Denoting such a finite field by Fpn , where p is much smaller than n, the main idea behind this step is to find polynomials of the formwhich, when considered as principal ideals in carefully selected function fields, can be factored into products of low-degree prime ideals. Such polynomials are called "relations", and current record-sized discrete-logarithm computations need billions of those.Collecting relations is therefore a crucial and extremely expensive step in FFS, and a practical implementation thereof requires heavy use of cache-aware sieving algorithms, along with efficient polynomial arithmetic over Fp[t]. This paper presents the algorithmic and arithmetic techniques which were put together as part of a new public implementation of FFS, aimed at medium-to record-sized computations.

Discrete Logarithm in GF(2809) with FFS

“…However, for brevity purposes, this presentation is in no way complete nor exhaustive. For more details, we refer the interested reader to the extensive literature on this topic, starting from the first theoretical articles [2,3,25] to the algorithmic advances and implementation reports which followed [18,14,15,7,11,10,16].…”

“…The relation collection was performed using the implementation described in [11]. This is a rather classical sieving method using lattice-sieving for various specialq's.…”

“…The terminology used in [11] is the classical one, where the factor base bound is the limit for the degree of the irreducible polynomials that are sieved, and the large-prime bound refers to the limit for the degree of the polynomials allowed in a relation (i.e., the smoothness bound). These notions are very similar to the ones used when sieving relations for factoring integers using NFS (see for instance [23]); irreducible polynomials of a given degree playing the role of prime numbers of a given number of bits, we keep the "large-prime" terminology for convenience.…”

“…As mentioned in [11], it is a rather easy task to obtain a set of relations that is complete-in the sense that it yields a system with (far) more equations than unknowns-so that we can expect it to be full-rank or close to full-rank. We ran our software with exactly the same parameters as in [11], namely:…”

“…The development of the present work has led to several preprints and articles providing detailed insights on the improvements of the individual steps of FFS [7,10,11,16]. For brevity, this article does not repeat these details, and the interested reader is referred to these articles for more detail.…”