Symmetrized Summation Polynomials: Using Small Order Torsion Points to Speed Up Elliptic Curve Index Calculus

Abstract

Abstract. Decomposition-based index calculus methods are currently efficient only for elliptic curves E defined over non-prime finite fields of very small extension degree n. This corresponds to the fact that the Semaev summation polynomials, which encode the relation search (or "sieving"), grow over-exponentially with n. Actually, even their computation is a first stumbling block and the largest Semaev polynomial ever computed is the 6-th. Following ideas from Faugère, Gaudry, Huot and Renault, our goal is to use the existence of small order torsion points on E to define new summation polynomials whose symmetrized expressions are much more compact and easier to compute. This setting allows to consider smaller factor bases, and the high sparsity of the new summation polynomials provides a very efficient decomposition step. In this paper the focus is on 2-torsion points, as it is the most important case in practice. We obtain records of two kinds: we successfully compute up to the 8-th symmetrized summation polynomial and give new timings for the computation of relations with degree 5 extension fields.

Summation Polynomial Algorithms for Elliptic Curves in Characteristic Two

“…Note that the degree bound 2 m−2 is consistent with the arguments on page 44 (Sections 2 and 3.1) of [13]: Since deg(t) = 4 we would expect polynomials of degree 4 m−1 , but t is invariant and so factors through a 2-isogeny, so we get degree 2 m−1 . The further saving of a factor 2 follows since t(−P ) = t(P ).…”

“…Faugère et al [12,13] have considered action by larger groups (by using points of small order) for elliptic curves over F q n where n is small (e.g., n = 4 or n = 5) and the characteristic is = 2, 3. Their work gives further reduction in the cost of solving the system.…”

“…Their work gives further reduction in the cost of solving the system. We sketch (for all the details see [12,13]) the case of points of order 2 on twisted Edwards curves.…”

“…We study binary Edwards curves [1] since the addition by points of order 2 and 4 is nicer than when using the Weierstrass model as was done in [12,13]. Hence we feel this model of curves is ideally suited for the index calculus application.…”

Recent progress on the elliptic curve discrete logarithm problem

“…or 4 m−1 m!. The paper [35] experiments further with these ideas and computes an 8-th summation polynomial in terms of invariant variables (previously the 8-th summation polynomial would have been unreachable). Vitse [113] did a more systematic study of which subgroups could be used in such a setting.…”