The Function Field Sieve in the Medium Prime Case

Abstract

Abstract. In this paper, we study the application of the function field sieve algorithm for computing discrete logarithms over finite fields of the form Fqn when q is a medium-sized prime power. This approach is an alternative to a recent paper of Granger and Vercauteren for computing discrete logarithms in tori, using efficient torus representations. We show that when q is not too large, a very efficient L(1/3) variation of the function field sieve can be used. Surprisingly, using this algorithm, discrete logarithms computations over some of these fields are even easier than computations in the prime field and characteristic two field cases. We also show that this new algorithm has security implications on some existing cryptosystems, such as torus based cryptography in T30, short signature schemes in characteristic 3 and cryptosystems based on supersingular abelian varieties. On the other hand, cryptosystems involving larger basefields and smaller extension degrees, typically of degree at most 6, such as LUC, XTR or T6 torus cryptography, are not affected.

Faster Index Calculus for the Medium Prime Case Application to 1175-bit and 1425-bit Finite Fields

“…The medium prime discrete logarithms proposed in [13] works as follows. In order to compute discrete logarithms in F q n , a degree n extension of the base field F q , it starts by defining the extension field implicitly from two bivariate polynomials in X and Y :…”

“…In order to define the expected extension, this requires that the polynomial −g 2 (g 1 (Y )) + Y has an irreducible factor F (Y ) of degree n over F q . As explained in [13], it is easy to find polynomials g 1 and g 2 that satisfy this requirement.…”

“…To use the equations as index calculus relations, the algorithm of [13] selects the set of all unitary polynomials of degree at most D in X or Y , with coefficients in F q as its smoothness basis and keeps pairs of polynomials (a, b) such that the two polynomials a(Y ) g 1 (Y ) + b(Y ) and a(g 2 (X)) X + b(g 2 (X)) both factor into terms of degree at most D. These good pairs are found using a classical sieving approach.…”

“…However, this is not always possible as illustrated by the function field sieve for the medium prime case introduced in [13]. In this specific case, the exact asymptotic complexity varies depending on the relative contribution of the base field and of the extension degree to the total size of the finite field being considered (see Section 2).…”

“…Unfortunately, we only know how to achieve this for a limited number of index calculus algorithms. More precisely, we show how to use pinpointing for the medium prime case as described in [13].…”