The Number Field Sieve in the Medium Prime Case

Joux, Antoine; Lercier, Reynald; Smart, Nigel P.; Vercauteren, Fréderik

doi:10.1007/11818175_19

Cited by 80 publications

(123 citation statements)

References 20 publications

Supporting

Mentioning

123

Contrasting

Order By: Relevance

“…Many cryptographic protocols base their security on this assumption. The fastest general purpose algorithm [7] solves the discrete logarithm problem over finite field F * q h in conjectured time…”

Section: Our Results On Hardness Of Decodingmentioning

confidence: 99%

Complexity of Decoding Positive-Rate Reed-Solomon Codes

Cheng

Wan

2008

Automata, Languages and Programming

View full text Add to dashboard Cite

Abstract-It has been proved that the maximum likelihood decoding problem of Reed-Solomon codes is NP-hard. However, the length of the code in the proof is at most polylogarithmic in the size of the alphabet. For the complexity of maximum likelihood decoding of the primitive Reed-Solomon code, whose length is one less than the size of alphabet, the only known result states that it is at least as hard as the discrete logarithm in some cases where the information rate unfortunately goes to zero. In this paper, it is proved under a well known cryptography hardness assumption that 1) There does not exist a randomized polynomial time maximum likelihood decoder for the Reed-Solomon code family2) There does not exist a randomized polynomial time bounded-distance decoder for primitive Reed-Solomon codes at distance 2 3 + of the minimum distance for any constant 0 < < 1 3 . In particular, this rules out the possibility of a polynomial time algorithm for maximum likelihood decoding problem of primitive Reed-Solomon codes of any rate under the assumption.

show abstract

Section: Our Results On Hardness Of Decodingmentioning

confidence: 99%

Complexity of Decoding Positive-Rate Reed-Solomon Codes

Cheng

Wan

2008

Automata, Languages and Programming

View full text Add to dashboard Cite

show abstract

“…Moreover, with our implementations, we computed [10,17]. † JLSV06-NFS: NFS in the medium prime case [19]. ‡ See footnote 2 in page 2.…”

Section: Discussionmentioning

confidence: 99%

Solving a 676-Bit Discrete Logarithm Problem in GF(36n )

Hayashi

Shinohara

Wang

et al. 2010

Public Key Cryptography – PKC 2010

View full text Add to dashboard Cite

Abstract. Pairings on elliptic curves in finite fields are crucial material for constructions of various cryptographic schemes. The ηT pairing on supersingular curves over GF(3 n ) is in particular popular since it is efficiently implementable. Taking into account of the MOV attack, the discrete logarithm problems (DLP) in GF(3 6n ) becomes concerned to the security of cryptosystems using ηT pairings in this case. In 2006, Joux and Lercier proposed a new variant of the function field sieve in the medium prime case, named JL06-FFS. We have, however, not found any practical implementations on JL06-FFS over GF(3 6n ) up to now. Therefore, we have firstly fulfilled such an implementation and successfully set a new record for solving the DLP in GF(3 6n ), the DLP in GF(3 6·71 ) of 676-bit size. We conclude that n = 97 case, where there are many implementations of the ηT pairing, is not recommended in practical use. In addition, we also conduct comparisons between JL06-FFS and an earlier version, named JL02-FFS, by practical experiments. Our results confirm that the former is faster several times than the latter under certain conditions.

show abstract

“…For larger values of p, it becomes preferable to use a variation of the number field sieve. The choice between the two family of algorithms is made by comparing p and L Q ( 1 3 ) (see [12]). All these variants of the function field sieve find multiplicative relations by factoring various polynomials into polynomials of low degree.…”

Section: ) = Exp((c + O(1))(log Q)mentioning

confidence: 99%

A New Index Calculus Algorithm with Complexity $$L(1/4+o(1))$$ in Small Characteristic

Joux

2014

Lecture Notes in Computer Science

Self Cite

120

112

View full text Add to dashboard Cite

Abstract. In this paper, we describe a new algorithm for discrete logarithms in small characteristic. This algorithm is based on index calculus and includes two new contributions. The first is a new method for generating multiplicative relations among elements of a small smoothness basis. The second is a new descent strategy that allows us to express the logarithm of an arbitrary finite field element in terms of the logarithm of elements from the smoothness basis. For a small characteristic finite field of size Q = p n , this algorithm achieves heuristic complexity LQ(1/4 + o(1)). For technical reasons, unless n is already a composite with factors of the right size, this is done by embedding FQ in a small extension FQe with e ≤ 2 log p n .

show abstract

The Number Field Sieve in the Medium Prime Case

Cited by 80 publications

References 20 publications

Complexity of Decoding Positive-Rate Reed-Solomon Codes

Complexity of Decoding Positive-Rate Reed-Solomon Codes

Solving a 676-Bit Discrete Logarithm Problem in GF(36n )

A New Index Calculus Algorithm with Complexity $$L(1/4+o(1))$$ in Small Characteristic

Contact Info

Product

Resources

About