The Tower Number Field Sieve

Barbulescu, Razvan; Gaudry, Pierrick; Kleinjung, Thorsten

doi:10.1007/978-3-662-48800-3_2

Cited by 38 publications

(36 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is possible that including some of the ideas of [17] would speed up our implementation. Further work also includes studying the practical aspects of the tower NFS variants [4,21]; this would imply sieving in dimension at least 4.…”

Section: Resultsmentioning

confidence: 99%

“…Instead, if we want to optimize the number of relations found, we need to consider a variant of the NFS in a higher dimension, that is, relying on polynomials of degree greater than 1. Although the complexity fits in the L(1/3, c) class, these finite fields where higher-dimensional sieving is required are those for which the constant c is highest compared to other finite fields, despite recent advances [4,6,21,25].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Collecting relations for the number field sieve in

Gaudry¹,

Grémy²,

Videau³

2016

LMS J. Comput. Math.

Self Cite

View full text Add to dashboard Cite

In order to assess the security of cryptosystems based on the discrete logarithm problem in non-prime finite fields, as are the torus-based or pairing-based ones, we investigate thoroughly the case in F p 6 with the number field sieve. We provide new insights, improvements, and comparisons between different methods to select polynomials intended for a sieve in dimension 3 using a special-q strategy. We also take into account the Galois action to increase the relation productivity of the sieving phase. To validate our results, we ran several experiments and real computations for various polynomial selection methods and field sizes with our publicly available implementation of the sieve in dimension 3, with special-q and various enumeration strategies.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Collecting relations for the number field sieve in

Gaudry¹,

Grémy²,

Videau³

2016

LMS J. Comput. Math.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Below we provide an overview of the TNFS algorithm. More detailed descriptions can be found in [24,6]. The TNFS algorithm applies to fields F Q where Q = p n , p is a prime and n = ηκ is a factorisation of n. Depending on the values of η and κ, several variants are obtained.…”

Section: Basics Of the Tower Number Field Sieve Algorithmmentioning

confidence: 99%

A unified polynomial selection method for the (tower) number field sieve algorithm

Sarkar¹,

Singh²

2019

Advances in Mathematics of Communications

View full text Add to dashboard Cite

At Eurocrypt 2015, Barbulescu et al. introduced two new methods of polynomial selection, namely the Conjugation and the Generalised Joux-Lercier methods, for the number field sieve (NFS) algorithm as applied to the discrete logarithm problem over finite fields. A sequence of subsequent works have developed and applied these methods to the multiple and the (extended) tower number field sieve algorithms. This line of work has led to new asymptotic complexities for various cases of the discrete logarithm problem over finite fields. The current work presents a unified polynomial selection method which we call Algorithm D. Starting from the Barbulescu et al. paper, all the subsequent polynomial selection methods can be seen as special cases of Algorithm D. Moreover, for the extended tower number field sieve (exTNFS) and the multiple extended TNFS (MexTNFS), there are finite fields for which using the polynomials selected by Algorithm D provides the best asymptotic complexity. Suppose Q = p n for a prime p and further suppose that n = ηκ such that there is a c θ > 0 for which p η = L Q (2/3, c θ ). For c θ > 3.39, the complexity of exTNFS-D is lower than the complexities of all previous algorithms; for c θ / ∈ (0, 1.12) ∪ [1.45, 3.15], the complexity of MexTNFS-D is lower than that of all previous methods.2010 Mathematics Subject Classification: Primary: 11Y16; Secondary: 94A60. Key words and phrases: Finite fields, discrete logarithm, number field sieve, tower number field sieve, multiple tower number field sieve. the number field sieve (NFS) [11,19,21] Depending on the value of a, fields F Q are classified into the following types: small characteristic, if a < 1/3; medium characteristic, if 1/3 ≤ a < 2/3; boundary, if a = 2/3; and large characteristic, if a > 2/3. The case a = 2/3 has been singled out as a boundary case in [4] since it is possible to show that the best complexity for this case is lower than the best complexities for the medium characteristic and the large characteristic cases. For a = 1/3, on the other hand, no such complexity improvement is known.There has been tremendous progress in the FFS algorithm leading to a quasipolynomial time algorithm [5,23] for the small characteristic case. Using algorithms given in [17,5], a record computation of discrete log in the binary extension field F 2 9234 was reported by Granger et al. [12]. The FFS algorithm also applies to the medium prime case and this has been reported in [20,16,29].The application of NFS to compute discrete logarithms over finite fields was first proposed by Gordon [11] for prime order fields, i.e., for n = 1. Application to composite order fields, i.e., for n > 1, was shown by Schirokauer [33]. Important improvements to the NFS for prime order fields were given by Joux and Lercier [19]. Joux, Lercier, Smart and Vercauteren [21] showed that the NFS algorithm is applicable to all finite fields. When the prime p is of a special form, Joux and Pierrot [22] showed the application of the special number field sieve algorithm to obtain improved ...

show abstract

“…The algorithm has been analysed and extended in a recent work [BGK15], in which the authors coined the term tower number field sieve. In particular, it has been shown that it applies to the whole range of large characteristic fields, achieving the same complexity L( 1 3 , ( 64 9 ) 1/3 ) as the medium number field sieve of [JLSV06], while being practically advantageous for certain cases.…”

Section: The Medium Number Field Sievementioning

confidence: 99%

Indiscreet logarithms in finite fields of small characteristic

Granger¹,

Kleinjung²,

Zumbrägel³

2018

Advances in Mathematics of Communications

Self Cite

View full text Add to dashboard Cite

Recently, several striking advances have taken place regarding the discrete logarithm problem (DLP) in finite fields of small characteristic, despite progress having remained essentially static for nearly thirty years, with the best known algorithms being of subexponential complexity. In this expository article we describe the key insights and constructions which culminated in two independent quasi-polynomial algorithms. To put these developments into both a historical and a mathematical context, as well as to provide a comparison with the cases of so-called large and medium characteristic fields, we give an overview of the state-of-the-art algorithms for computing discrete logarithms in all finite fields. Our presentation aims to guide the reader through the algorithms and their complexity analyses ab initio.

show abstract

The Tower Number Field Sieve

Cited by 38 publications

References 32 publications

Collecting relations for the number field sieve in

Collecting relations for the number field sieve in

A unified polynomial selection method for the (tower) number field sieve algorithm

Indiscreet logarithms in finite fields of small characteristic

Contact Info

Product

Resources

About