The number field sieve in the medium prime case
|
|
- Eleanor Cooper
- 5 years ago
- Views:
Transcription
1 The number field sieve in the medium prime case Frederik Vercauteren ESAT/COSIC - K.U. Leuven Joint work with Antoine Joux, Reynald Lercier, Nigel Smart
2
3 Finite Field DLOG Basis finite field is F p = {0,..., p 1}, with p prime Let q = p n, then extension field F q F p [x]/(f (x)) with f (x) F p [x] of degree n and irreducible Multiplicative group F q is cyclic, take generator g Let h F q, then h = g d with d = log g h the DLOG
4 Number field sieve Index calculus algorithm used for factoring, then DLOGs Let q = p n with p prime, then complexity expressed by L q (α, c) = exp((c + o(1))(log q) α (log log q) 1 α ) Large p: number field sieve with running time as long as log p > n 2+ε L q (1/3, (64/9) 1/3 ) Small p: function field sieve with running time as long as p n o( n) L q (1/3, (32/9) 1/3 ) In the gap, i.e. log p < n 2+ε and p > n o( n), have to resort to Adleman - DeMarrais with complexity L q (1/2)
5 : setup To compute discrete logarithms in F p Two number fields K 1 = Q and K 2 = Q[X]/(f (X)) with: ) 1/3 ( The degree of f is d 3 1/3 log p log log p Exists m Z with f (m) 0 mod p, i.e. ring homomorphism φ 2 : O 2 F p E.g. f can be obtained by base m p 1/d expansion of p Choose two factor bases F 1 and F 2 F 1 : integer primes p < B for some bound B F2 : degree 1 prime ideals of norm < B
6 : sieving Sieve over pairs of integers (a, b) with gcd(a, b) = 1 and a, b < S for some bound S a bm is B-smooth No(a θ2 b) is B-smooth with f (θ 2 ) = 0 and No(a θ 2 b) = b d f ( a b ) Since No(a θ 2 b) is B-smooth the ideal a θ 2 b factors over F 2 since only degree 1 (or index divisors) appear a θ 2 b = i p e i i
7 : relations (a, b) with a bm and a θ 2 b B-smooth gives relation Need to get rid of ideals and work with elements only... Simplicity: assume class number h(k ) = 1 and computable unit group, then a θ 2 b = r i=0 u λ i i i γ e i i with u 1,..., u r fundamental units and p i = γ i Finally, by using φ 2 from O 2 to F p obtain a bm j p e j j r φ 2 (u i ) λ i φ 2 (γ i ) e i i=0 i mod p
8 : relations Take logs of both sides, obtain relation between DLOGs e j log g p j j r i=0 λ i log g φ 2 (u i )+ i e i log g φ 2 (γ i ) mod (p 1) Need to collect #F 1 + #F 2 + d + ε relations Solve sparse linear system using Lanczos or Wiedemann Individual DLOGs: descent procedure (see more later)
9 Schirokauer s extension for n > 1 Number field K 1 is chosen such that O 1 /po 1 = Fq, so K 1 has degree at least n Number field K 2 is extension of K 1, i.e. K 2 = K 1 [X]/(f (X)) Collect pairs (a, b) O 1 O 1 with similar properties as before: a bm is B-smooth where m O1 such that f (m) po 1 a θ 2 b is B-smooth with f (θ 2 ) = 0 Leads to L q (1/3)-algorithm for fixed n and p Main disadvantage: not really practical (only n = 2 has been attempted by Weber) Choice of polynomial f depends on input DLOG problem
10 Basic variation p = L p n(2/3, c): setup Finite fields F p n with p = L p n(2/3, c) and c near 2 (1/3) 1/3 Choose polynomial f 1 of degree n irreducible over F p very small coefficients (e.g. use poly to define F q ) Choose polynomial f 2 = f 1 + p K 1 Q[X]/(f 1 (X)) = Q[θ 1 ] and K 2 = Q[X]/(f2 (X)) = Q[θ 2 ] Note: f 1 f 2 mod p, so have compatible homomorphisms φ i : O i F q, for i = 1, 2 with φ 1 (θ 1 ) = φ 2 (θ 2 ) No relative extensions necessary and f i independent of input DLOG
11 Basic variation p = L p n(2/3, c): sieving/linear algebra Factor bases F 1 and F 2 of degree 1 ideals of small norm Choose smoothness bound B and a sieve limit S Pairs (a, b) of coprime integers, a S and b S No(a bθ 1 ) and No(a bθ 2 ) B-smooth Add logarithmic maps to take into account h(k i ) 1 and unit groups Obtain linear equation between logarithms of ideals in the smoothness bases Solve using SGE and Lanczos or Wiedemann
12 Basic variation p = L p n(2/3, c): individual DLOG Recursive special q-descent procedure similar to F p Represent F p n as F p [t]/(f 1 (t)) Assume we want to compute log t y with y F p n Search for element z = y i t j for some i, j N with 1. lifting z K 1, norm factors into primes smaller than some bound B 1 L p n(2/3, 1/3 1/3 ), 2. only degree one prime ideals in the factorisation of (z) 3. E.g.: the norm of the lift of z should be squarefree Remark: probability of squarefree smoothness is about 6/π 2 probability of smoothness
13 Basic variation p = L p n(2/3, c): individual DLOG Factor principal ideal generated by z as (z) = p ei i p i F 1 Ideals q j not contained in F 1, so need to compute DLOGs For each q j, perform special-q j descent: 1. Sieve over pairs (a, b) such that q j (a bθ 1 ) and j q e j j No(a bθ 1 )/No(q j ) and No(a bθ 2 ) B 2 -smooth B 2 < B 1 2. Factor (a bθ 1 ) and (a bθ 2 ) to obtain new special q j s 3. Repeat until bound B k < B DLOGs of all q j known Remark: special q j in both number fields K 1 and K 2
14 Definition 120-digit challenge Adaptation of Joux & Lercier s implementation for F p Finite field F p 3 with p = π p = Group order p 3 1 has 110-bit factor l Definition of number fields K 1 and K 2 by f 1 (X) = X 3 + X 2 2X 1 and f 2 (X) = f 1 (X) + p, where we have F p 3 F p [t]/(f 1 (t))
15 Number fields K 1 and K 2 Q[θ 1 ] is a cubic cyclic number field with Galois group Aut(Q[θ 1 ]) = {θ 1 θ 1, θ 1 θ 2 1 2, θ 1 θ 2 1 θ 1 + 1} K 1 has class number 1 and System of fundamental units u 1 = θ and u 2 = θ θ 1 1 Q[θ 2 ] has signature (1, 1), so only need single Schirokauer logarithmic map λ
16 Factor bases and sieving Smoothness bases with prime ideals in the Q[θ1 ] side, we include prime ideals, but only are meaningful due to the Galois action, in the Q[θ 2 ] side, we include prime ideals. Lattice sieving: only algebraic integers a + bθ 2 divisible by prime ideal in Q[θ 2 ] Norms to be smoothed in Q[θ 2 ] are 150 bit integers Norms in Q[θ 1 ] are 110 bit integers Sieving took 12 days on a 1.15 GHz 16-processors HP AlphaServer GS1280
17 Linear algebra Compute the kernel of a matrix Coefficients mostly equal modulo l to ±1, ±p or ±p 2 SGE: matrix with non null entries Lanczos s algorithm: about one week h(k 1 ) = 1, check DLOGs of generators of ideals in F 1 (t 2 + t + 1) (p3 1)/l = G , (t 3) (p3 1)/l = G , (3 t 1) (p3 1)/l = G , where G = g (p3 1)/ l and g = 2t + 1.
18 Individual DLOGs Challenge γ = 2 i=0 ( π pi+1 mod p)t i Using Pollard-Rho, computed DLOG modulo (p 3 1)/l, To obtain a complete result, we expressed γ = t t t t , Numerator and denominator are both smooth in Q[θ 1 ] Three level tree with 80 special-q ideals Recovered DLOG modulo l, namely Each special-q sieving took 10 minutes or a total of 14 hours
19 Variation I: smaller p Polynomial setup same as in basic case Main problem: sieving space is not large enough, due to larger n cannot collect enough relations Solution: sieve over elements of larger degree than 1 t a i θ1 i i=0 and t a i θ2 i i=0 Bound on norm: (n + t) n+t B a n B f t with Ba is an upper bound on the absolute values of the a i B f a similar bound on the coefficients of f 1 (resp. f 2 )
20 Variation II: larger p p is too large to simply add to f 1, so need different polynomial construction Only requirement is: f 1 (x) f 2 (x) mod p Idea: construct f 2 (x) of degree > n with small coefficients such that f 1 (x) f 2 (x) over Q Choose constant W and construct f 1 (x) = f 0 (x + W ), coefficient at least W n Use LLL to reduce the lattice L = ( f 1 (x) xf 1 (x) x 2 f 1 (x) x D n f 1 (x) p px px 2 px D ) Need vector with coefficients smaller than W n so 2 (D+1)/4 p n/(d+1) W n
21 Complexity of variations p can be written as L q (l p, c) with 1/3 < l p < 2/3 L q (1/3, (128/9) 1/3 ) L q (1/3, ) p can be written as L q (2/3, c) for a constant c L q (1/3, 2c ) with c = 4 ( 3t 3 4(t + 1) ) 1/3 sieve over elements of degree t with 3c 3 t(t + 1) 2 32 = 0 p can be written as L q (2/3, c) for a constant c L q (1/3, 2c ) with 9c 3 6 c c c 2 c 8 = 0 p can be written as L q (l p, c) with l p > 2/3 L q (1/3, (64/9) 1/3 ) L q (1/3, )
22 JLSV NFS: complexity = L q (1/3, 2c ) 2.4 t -> oo 2.3 t = c t = D > n t = c
23 Conclusions New, simple and practical variations of NFS Can simply adapt existing implementations of NFS for F p More optimisations: large prime variation, multiple number fields,... Combined with work Joux/Lercier on FFS: obtain two families of algorithms such that DLOGs in F p n can be computed in L p n(1/3) time
24 Optimisation I: Galois extensions p is inert in K 1, so isomorphism Gal(K 1 /Q) Gal(F q /F p ) Thus: K 1 has to be a cyclic number field of degree n Partition factor base F 1 in n parts F 1,k with k = 1,..., n n (a bθ 1 ) = k=1 p i F 1,1 ψ k (p i ) ei,k with Gal(K 1 /Q) = ψ Choose ψ such log g φ 1 (ψ(δ i ))) = p log g φ 1 (δ i ) with p i = δ i Effectively divides factor base size by n
25 Optimisation II: choice of polynomials Two possible optimisations: Poss I: Maximise automorphism group of K 1 and K 2 simultaneously Example: p 2, 5 mod 9, can take f 1 = x 6 + x f 2 = x 6 + (p + 1)x K 1 is Galois and K 2 has non-trivial automorphism order 2 Poss II: balance size of coefficients of f 1 and f 2 Remark: better to adapt sieving region...
26 Optimisation III: individual logarithms Instead of factoring z, first write z as ai t i bi t i with a i and b i are of the order of p. Use LLL to find short vector in lattice L z tz t 2 z t n 1 z p pt pt 2 pt n L = Expect LLL finds short vector of norm p.
The Number Field Sieve in the Medium Prime Case
The Number Field Sieve in the Medium Prime Case Antoine Joux 1,3, Reynald Lercier 1,2, Nigel Smart 4, and Frederik Vercauteren 5 1 DGA 2 CELAR Route de Laillé, 35170 Bruz, France Reynald.Lercier@m4x.org
More informationDiscrete logarithms: Recent progress (and open problems)
Discrete logarithms: Recent progress (and open problems) CryptoExperts Chaire de Cryptologie de la Fondation de l UPMC LIP6 February 25 th, 2014 Discrete logarithms Given a multiplicative group G with
More informationA brief overwiev of pairings
Bordeaux November 22, 2016 A brief overwiev of pairings Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Overview pairings 0 / 37 Plan of the lecture Pairings Pairing-friendly curves Progress of NFS attacks
More informationREMARKS ON THE NFS COMPLEXITY
REMARKS ON THE NFS COMPLEXITY PAVOL ZAJAC Abstract. In this contribution we investigate practical issues with implementing the NFS algorithm to solve the DLP arising in XTR-based cryptosystems. We can
More informationA quasi polynomial algorithm for discrete logarithm in small characteristic
CCA seminary January 10, 2014 A quasi polynomial algorithm for discrete logarithm in small characteristic Razvan Barbulescu 1 Pierrick Gaudry 2 Antoine Joux 3 Emmanuel Thomé 2 LIX, École Polytechnique
More informationGood algebraic reading. MPRI Cours III. Integer factorization NFS. A) Definitions and properties
F. Morain École polytechnique MPRI cours -1 007-008 3/45 F. Morain École polytechnique MPRI cours -1 007-008 4/45 ECOLE POLYTECHNIQUE MPRI Cours -1 F. Morain III. Integer factorization NFS 007/10/01 I.
More informationThe Number Field Sieve for Barreto-Naehrig Curves: Smoothness of Norms
The Number Field Sieve for Barreto-Naehrig Curves: Smoothness of Norms by Michael Shantz A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master
More informationDiscrete Logarithm Computation in Hyperelliptic Function Fields
Discrete Logarithm Computation in Hyperelliptic Function Fields Michael J. Jacobson, Jr. jacobs@cpsc.ucalgary.ca UNCG Summer School in Computational Number Theory 2016: Function Fields Mike Jacobson (University
More informationImproving NFS for the discrete logarithm problem in non-prime finite fields
Improving NFS for the discrete logarithm problem in non-prime finite fields Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, François Morain To cite this version: Razvan Barbulescu, Pierrick Gaudry,
More informationElliptic Curve Discrete Logarithm Problem
Elliptic Curve Discrete Logarithm Problem Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM October 19, 2009 Vanessa VITSE (UVSQ) Elliptic Curve Discrete Logarithm Problem October
More informationTraps to the BGJT-Algorithm for Discrete Logarithms
Submitted exclusively to the London Mathematical Society doi:10.1112/0000/000000 Traps to the BGJT-Algorithm for Discrete Logarithms Qi Cheng, Daqing Wan and Jincheng Zhuang Abstract In the recent breakthrough
More informationComputing Individual Discrete Logarithms Faster in GF(p n ) with the NFS-DL Algorithm
Computing Individual Discrete Logarithms Faster in GF(p n ) with the NFS-DL Algorithm Aurore Guillevic 1,2 1 Inria Saclay, Palaiseau, France 2 École Polytechnique/LIX, Palaiseau, France guillevic@lixpolytechniquefr
More informationComputational algebraic number theory tackles lattice-based cryptography
Computational algebraic number theory tackles lattice-based cryptography Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Moving to the left Moving to the right
More informationON THE USE OF THE LATTICE SIEVE IN THE 3D NFS
Tatra Mt Math Publ 45 (2010), 161 172 Ø Ñ Å Ø Ñ Ø Ð ÈÙ Ð Ø ÓÒ ON THE USE OF THE LATTICE SIEVE IN THE 3D NFS Pavol Zajac ABSTRACT An adaptation of the Number Field Sieve(NFS) algorithm to solve a discrete
More informationProblème du logarithme discret sur courbes elliptiques
Problème du logarithme discret sur courbes elliptiques Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM Groupe de travail équipe ARITH LIRMM Vanessa VITSE (UVSQ) DLP over elliptic
More informationGRE Subject test preparation Spring 2016 Topic: Abstract Algebra, Linear Algebra, Number Theory.
GRE Subject test preparation Spring 2016 Topic: Abstract Algebra, Linear Algebra, Number Theory. Linear Algebra Standard matrix manipulation to compute the kernel, intersection of subspaces, column spaces,
More informationSolving a 6120-bit DLP on a Desktop Computer
Solving a 6120-bit DLP on a Desktop Computer Faruk Göloğlu, Robert Granger, Gary McGuire, and Jens Zumbrägel Complex & Adaptive Systems Laboratory and School of Mathematical Sciences University College
More informationRamification Theory. 3.1 Discriminant. Chapter 3
Chapter 3 Ramification Theory This chapter introduces ramification theory, which roughly speaking asks the following question: if one takes a prime (ideal) p in the ring of integers O K of a number field
More informationFIELD THEORY. Contents
FIELD THEORY MATH 552 Contents 1. Algebraic Extensions 1 1.1. Finite and Algebraic Extensions 1 1.2. Algebraic Closure 5 1.3. Splitting Fields 7 1.4. Separable Extensions 8 1.5. Inseparable Extensions
More informationImproving NFS for the discrete logarithm problem in non-prime nite elds
Improving NFS for the discrete logarithm problem in non-prime nite elds Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, Francois Morain Institut national de recherche en informatique et en automatique
More informationCover and Decomposition Index Calculus on Elliptic Curves made practical
Cover and Decomposition Index Calculus on Elliptic Curves made practical Application to a previously unreachable curve over F p 6 Vanessa VITSE Antoine JOUX Université de Versailles Saint-Quentin, Laboratoire
More informationSolving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction
Solving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction Aurore Guillevic and François Morain and Emmanuel Thomé University of Calgary, PIMS CNRS, LIX École Polytechnique, Inria, Loria SAC,
More informationAlgebraic number theory Solutions to exercise sheet for chapter 4
Algebraic number theory Solutions to exercise sheet for chapter 4 Nicolas Mascot n.a.v.mascot@warwick.ac.uk), Aurel Page a.r.page@warwick.ac.uk) TAs: Chris Birkbeck c.d.birkbeck@warwick.ac.uk), George
More informationIndividual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm)
Individual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm) Aurore Guillevic INRIA Saclay / GRACE Team École Polytechnique / LIX ECC 2015, Sept. 28th Aurore Guillevic (INRIA/LIX)
More informationA heuristic quasi-polynomial algorithm for discrete logarithm in small characteristic
ECC, Chennai October 8, 2014 A heuristic quasi-polynomial algorithm for discrete logarithm in small characteristic Razvan Barbulescu 1 Pierrick Gaudry 2 Antoine Joux 3 Emmanuel Thomé 2 IMJ-PRG, Paris Loria,
More informationDirichlet Characters. Chapter 4
Chapter 4 Dirichlet Characters In this chapter we develop a systematic theory for computing with Dirichlet characters, which are extremely important to computations with modular forms for (at least) two
More informationNearly Sparse Linear Algebra
Nearly Sparse Linear Algebra Antoine Joux 1,2,4 and Cécile Pierrot 3,4 1 CryptoExperts, France 2 Chaire de Cryptologie de la Fondation de l UPMC 3 CNRS and Direction Générale de l Armement 4 Laboratoire
More informationDiscrete Logarithm Problem
Discrete Logarithm Problem Çetin Kaya Koç koc@cs.ucsb.edu (http://cs.ucsb.edu/~koc/ecc) Elliptic Curve Cryptography lect08 discrete log 1 / 46 Exponentiation and Logarithms in a General Group In a multiplicative
More informationImprovements to the number field sieve for non-prime finite fields
Improvements to the number field sieve for non-prime finite fields Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, François Morain To cite this version: Razvan Barbulescu, Pierrick Gaudry, Aurore
More informationIMPROVEMENTS TO THE GENERAL NUMBER FIELD SIEVE FOR DISCRETE LOGARITHMS IN PRIME FIELDS.
IMPROVEMENTS TO THE GENERAL NUMBER FIELD SIEVE FOR DISCRETE LOGARITHMS IN PRIME FIELDS. A COMPARISON WITH THE GAUSSIAN INTEGER METHOD. ANTOINE JOUX AND REYNALD LERCIER Abstract. In this paper, we describe
More informationPrime Decomposition. Adam Gamzon. 1 Introduction
Prime Decomposition Adam Gamzon 1 Introduction Let K be a number field, let O K be its ring of integers, and let p Z be a prime. Since every prime of O K lies over a prime in Z, understanding how primes
More informationCounting Points on Curves using Monsky-Washnitzer Cohomology
Counting Points on Curves using Monsky-Washnitzer Cohomology Frederik Vercauteren frederik@cs.bris.ac.uk Jan Denef jan.denef@wis.kuleuven.ac.be University of Leuven http://www.arehcc.com University of
More informationMath 4400, Spring 08, Sample problems Final Exam.
Math 4400, Spring 08, Sample problems Final Exam. 1. Groups (1) (a) Let a be an element of a group G. Define the notions of exponent of a and period of a. (b) Suppose a has a finite period. Prove that
More informationFACTORIZATION OF IDEALS
FACTORIZATION OF IDEALS 1. General strategy Recall the statement of unique factorization of ideals in Dedekind domains: Theorem 1.1. Let A be a Dedekind domain and I a nonzero ideal of A. Then there are
More informationShort generators without quantum computers: the case of multiquadratics
Short generators without quantum computers: the case of multiquadratics Christine van Vredendaal Technische Universiteit Eindhoven 1 May 2017 Joint work with: Jens Bauch & Daniel J. Bernstein & Henry de
More informationMODEL ANSWERS TO HWK #10
MODEL ANSWERS TO HWK #10 1. (i) As x + 4 has degree one, either it divides x 3 6x + 7 or these two polynomials are coprime. But if x + 4 divides x 3 6x + 7 then x = 4 is a root of x 3 6x + 7, which it
More informationChapter 3. Rings. The basic commutative rings in mathematics are the integers Z, the. Examples
Chapter 3 Rings Rings are additive abelian groups with a second operation called multiplication. The connection between the two operations is provided by the distributive law. Assuming the results of Chapter
More informationMath 547, Exam 1 Information.
Math 547, Exam 1 Information. 2/10/10, LC 303B, 10:10-11:00. Exam 1 will be based on: Sections 5.1, 5.2, 5.3, 9.1; The corresponding assigned homework problems (see http://www.math.sc.edu/ boylan/sccourses/547sp10/547.html)
More informationA Course in Computational Algebraic Number Theory
Henri Cohen 2008 AGI-Information Management Consultants May be used for personal purporses only or by libraries associated to dandelon.com network. A Course in Computational Algebraic Number Theory Springer
More informationOn metacyclic extensions
On metacyclic extensions Masanari Kida 1 Introduction A group G is called metacyclic if it contains a normal cyclic subgroup N such that the quotient group G/N is also cyclic. The category of metacyclic
More informationThus, the integral closure A i of A in F i is a finitely generated (and torsion-free) A-module. It is not a priori clear if the A i s are locally
Math 248A. Discriminants and étale algebras Let A be a noetherian domain with fraction field F. Let B be an A-algebra that is finitely generated and torsion-free as an A-module with B also locally free
More informationMATH 3030, Abstract Algebra FALL 2012 Toby Kenney Midyear Examination Friday 7th December: 7:00-10:00 PM
MATH 3030, Abstract Algebra FALL 2012 Toby Kenney Midyear Examination Friday 7th December: 7:00-10:00 PM Basic Questions 1. Compute the factor group Z 3 Z 9 / (1, 6). The subgroup generated by (1, 6) is
More information1 The Fundamental Theorem of Arithmetic. A positive integer N has a unique prime power decomposition. Primality Testing. and. Integer Factorisation
1 The Fundamental Theorem of Arithmetic A positive integer N has a unique prime power decomposition 2 Primality Testing Integer Factorisation (Gauss 1801, but probably known to Euclid) The Computational
More informationDecomposed Attack for the Jacobian of a Hyperelliptic Curve over an Extension Field
Decomposed Attack for the Jacobian of a Hyperelliptic Curve over an Extension Field Koh-ichi Nagao nagao@kanto-gakuin.ac.jp Dept. of Engineering, Kanto Gakuin Univ., 1-50-1 Mutsuura Higashi Kanazawa-ku
More informationAlgebraic number theory
Algebraic number theory F.Beukers February 2011 1 Algebraic Number Theory, a crash course 1.1 Number fields Let K be a field which contains Q. Then K is a Q-vector space. We call K a number field if dim
More informationComputational algebraic number theory tackles lattice-based cryptography
Computational algebraic number theory tackles lattice-based cryptography Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Moving to the left Moving to the right
More informationMathematics for Cryptography
Mathematics for Cryptography Douglas R. Stinson David R. Cheriton School of Computer Science University of Waterloo Waterloo, Ontario, N2L 3G1, Canada March 15, 2016 1 Groups and Modular Arithmetic 1.1
More informationA construction of 3-dimensional lattice sieve for number field sieve over GF(p n )
A construction of 3-dimensional lattice sieve for number field sieve over GF(p n ) Kenichiro Hayasaka 1, Kazumaro Aoki 2, Tetsutaro Kobayashi 2, and Tsuyoshi Takagi 3 Mitsubishi Electric, Japan NTT Secure
More informationCLASS FIELD THEORY WEEK Motivation
CLASS FIELD THEORY WEEK 1 JAVIER FRESÁN 1. Motivation In a 1640 letter to Mersenne, Fermat proved the following: Theorem 1.1 (Fermat). A prime number p distinct from 2 is a sum of two squares if and only
More informationChallenges with Assessing the Impact of NFS Advances on the Security of Pairing-based Cryptography
Challenges with Assessing the Impact of NFS Advances on the Security of Pairing-based Cryptography Alfred Menezes 1, Palash Sarkar 2, and Shashank Singh 3 1 Department of Combinatorics & Optimization,
More informationInteger factorization, part 1: the Q sieve. D. J. Bernstein
Integer factorization, part 1: the Q sieve D. J. Bernstein Sieving small integers 0 using primes 3 5 7: 1 3 3 4 5 5 6 3 7 7 8 9 3 3 10 5 11 1 3 13 14 7 15 3 5 16 17 18 3 3 19 0 5 etc. Sieving and 611 +
More informationA Las Vegas algorithm to solve the elliptic curve discrete logarithm problem
A Las Vegas algorithm to solve the elliptic curve discrete logarithm problem Ayan Mahalanobis Vivek Mallick February 5, 018 Abstract In this paper, we describe a new Las Vegas algorithm to solve the elliptic
More informationSelected exercises from Abstract Algebra by Dummit and Foote (3rd edition).
Selected exercises from Abstract Algebra by Dummit and Foote (3rd edition). Bryan Félix Abril 12, 2017 Section 14.2 Exercise 3. Determine the Galois group of (x 2 2)(x 2 3)(x 2 5). Determine all the subfields
More informationRings in Coding Theory
Rings in Coding Theory Steven T. Dougherty July 3, 2013 Cyclic Codes Cyclic Codes were first studied by Prange in 1957. Prange, E. Cyclic error-correcting codes in two symbols. Technical Note TN-57-103,
More informationFactoring Algorithms Pollard s p 1 Method. This method discovers a prime factor p of an integer n whenever p 1 has only small prime factors.
Factoring Algorithms Pollard s p 1 Method This method discovers a prime factor p of an integer n whenever p 1 has only small prime factors. Input: n (to factor) and a limit B Output: a proper factor of
More informationCryptography IV: Asymmetric Ciphers
Cryptography IV: Asymmetric Ciphers Computer Security Lecture 7 David Aspinall School of Informatics University of Edinburgh 31st January 2011 Outline Background RSA Diffie-Hellman ElGamal Summary Outline
More informationRelation collection for the Function Field Sieve
Relation collection for the Function Field Sieve Jérémie Detrey, Pierrick Gaudry and Marion Videau CARAMEL project-team, LORIA, INRIA / CNRS / Université de Lorraine, Vandœuvre-lès-Nancy, France Email:
More informationBreaking pairing-based cryptosystems using η T pairing over GF (3 97 )
Breaking pairing-based cryptosystems using η T pairing over GF (3 97 ) Takuya Hayashi 1, Takeshi Shimoyama 2, Naoyuki Shinohara 3, and Tsuyoshi Takagi 1 1 Kyushu University, 744, Motooka, Nishi-ku, Fukuoka
More informationName: Solutions Final Exam
Instructions. Answer each of the questions on your own paper, and be sure to show your work so that partial credit can be adequately assessed. Put your name on each page of your paper. 1. [10 Points] For
More informationSample algebra qualifying exam
Sample algebra qualifying exam University of Hawai i at Mānoa Spring 2016 2 Part I 1. Group theory In this section, D n and C n denote, respectively, the symmetry group of the regular n-gon (of order 2n)
More informationA General Polynomial Selection Method and New Asymptotic Complexities for the Tower Number Field Sieve Algorithm
A General Polynomial Selection Method and New Asymptotic Complexities for the Tower Number Field Sieve Algorithm Palash Sarkar and Shashank Singh Indian Statistical Institute, Kolkata September 5, 2016
More informationpart 2: detecting smoothness part 3: the number-field sieve
Integer factorization, part 1: the Q sieve Integer factorization, part 2: detecting smoothness Integer factorization, part 3: the number-field sieve D. J. Bernstein Problem: Factor 611. The Q sieve forms
More informationMath 120 HW 9 Solutions
Math 120 HW 9 Solutions June 8, 2018 Question 1 Write down a ring homomorphism (no proof required) f from R = Z[ 11] = {a + b 11 a, b Z} to S = Z/35Z. The main difficulty is to find an element x Z/35Z
More informationAlgebraic number theory Revision exercises
Algebraic number theory Revision exercises Nicolas Mascot (n.a.v.mascot@warwick.ac.uk) Aurel Page (a.r.page@warwick.ac.uk) TA: Pedro Lemos (lemos.pj@gmail.com) Version: March 2, 20 Exercise. What is the
More informationPage Points Possible Points. Total 200
Instructions: 1. The point value of each exercise occurs adjacent to the problem. 2. No books or notes or calculators are allowed. Page Points Possible Points 2 20 3 20 4 18 5 18 6 24 7 18 8 24 9 20 10
More informationLemma 1.1. The field K embeds as a subfield of Q(ζ D ).
Math 248A. Quadratic characters associated to quadratic fields The aim of this handout is to describe the quadratic Dirichlet character naturally associated to a quadratic field, and to express it in terms
More informationIntroduction to Arithmetic Geometry Fall 2013 Lecture #24 12/03/2013
18.78 Introduction to Arithmetic Geometry Fall 013 Lecture #4 1/03/013 4.1 Isogenies of elliptic curves Definition 4.1. Let E 1 /k and E /k be elliptic curves with distinguished rational points O 1 and
More informationSection 18 Rings and fields
Section 18 Rings and fields Instructor: Yifan Yang Spring 2007 Motivation Many sets in mathematics have two binary operations (and thus two algebraic structures) For example, the sets Z, Q, R, M n (R)
More informationAlgorithms for ray class groups and Hilbert class fields
(Quantum) Algorithms for ray class groups and Hilbert class fields Sean Hallgren joint with Kirsten Eisentraeger Penn State 1 Quantum Algorithms Quantum algorithms for number theoretic problems: Factoring
More informationFinite Fields and Elliptic Curves in Cryptography
Finite Fields and Elliptic Curves in Cryptography Frederik Vercauteren - Katholieke Universiteit Leuven - COmputer Security and Industrial Cryptography 1 Overview Public-key vs. symmetric cryptosystem
More informationFinite Fields. [Parts from Chapter 16. Also applications of FTGT]
Finite Fields [Parts from Chapter 16. Also applications of FTGT] Lemma [Ch 16, 4.6] Assume F is a finite field. Then the multiplicative group F := F \ {0} is cyclic. Proof Recall from basic group theory
More informationA BRIEF INTRODUCTION TO LOCAL FIELDS
A BRIEF INTRODUCTION TO LOCAL FIELDS TOM WESTON The purpose of these notes is to give a survey of the basic Galois theory of local fields and number fields. We cover much of the same material as [2, Chapters
More informationFinding small factors of integers. Speed of the number-field sieve. D. J. Bernstein University of Illinois at Chicago
The number-field sieve Finding small factors of integers Speed of the number-field sieve D. J. Bernstein University of Illinois at Chicago Prelude: finding denominators 87366 22322444 in R. Easily compute
More informationPart II Galois Theory
Part II Galois Theory Theorems Based on lectures by C. Birkar Notes taken by Dexter Chua Michaelmas 2015 These notes are not endorsed by the lecturers, and I have modified them (often significantly) after
More informationGEOMETRIC CLASS FIELD THEORY I
GEOMETRIC CLASS FIELD THEORY I TONY FENG 1. Classical class field theory 1.1. The Artin map. Let s start off by reviewing the classical origins of class field theory. The motivating problem is basically
More informationComputing coefficients of modular forms
Computing coefficients of modular forms (Work in progress; extension of results of Couveignes, Edixhoven et al.) Peter Bruin Mathematisch Instituut, Universiteit Leiden Théorie des nombres et applications
More informationFactorization of Integers Notes for talks given at London South Bank University 20 February, 19 March, 2008 Tony Forbes
Factorization of Integers Notes for talks given at London South Bank University 20 February, 19 March, 2008 Tony Forbes ADF37A version 1.7A THE PROBLEM Given a positive integer N, find a positive integer
More informationCover Page. The handle holds various files of this Leiden University dissertation.
Cover Page The handle http://hdl.handle.net/1887/20310 holds various files of this Leiden University dissertation. Author: Jansen, Bas Title: Mersenne primes and class field theory Date: 2012-12-18 Chapter
More information6 Ideal norms and the Dedekind-Kummer theorem
18.785 Number theory I Fall 2016 Lecture #6 09/27/2016 6 Ideal norms and the Dedekind-Kummer theorem Recall that for a ring extension B/A in which B is a free A-module of finite rank, we defined the (relative)
More informationRSA Cryptosystem and Factorization
RSA Cryptosystem and Factorization D. J. Guan Department of Computer Science National Sun Yat Sen University Kaoshiung, Taiwan 80424 R. O. C. guan@cse.nsysu.edu.tw August 25, 2003 RSA Cryptosystem was
More information1. a) Let ω = e 2πi/p with p an odd prime. Use that disc(ω p ) = ( 1) p 1
Number Theory Mat 6617 Homework Due October 15, 018 To get full credit solve of the following 7 problems (you are welcome to attempt them all) The answers may be submitted in English or French 1 a) Let
More informationNon-generic attacks on elliptic curve DLPs
Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September 13 2013 Smith
More informationGalois theory (Part II)( ) Example Sheet 1
Galois theory (Part II)(2015 2016) Example Sheet 1 c.birkar@dpmms.cam.ac.uk (1) Find the minimal polynomial of 2 + 3 over Q. (2) Let K L be a finite field extension such that [L : K] is prime. Show that
More information2a 2 4ac), provided there is an element r in our
MTH 310002 Test II Review Spring 2012 Absractions versus examples The purpose of abstraction is to reduce ideas to their essentials, uncluttered by the details of a specific situation Our lectures built
More informationLevel Structures of Drinfeld Modules Closing a Small Gap
Level Structures of Drinfeld Modules Closing a Small Gap Stefan Wiedmann Göttingen 2009 Contents 1 Drinfeld Modules 2 1.1 Basic Definitions............................ 2 1.2 Division Points and Level Structures................
More information1 Fields and vector spaces
1 Fields and vector spaces In this section we revise some algebraic preliminaries and establish notation. 1.1 Division rings and fields A division ring, or skew field, is a structure F with two binary
More informationSM9 identity-based cryptographic algorithms Part 1: General
SM9 identity-based cryptographic algorithms Part 1: General Contents 1 Scope... 1 2 Terms and definitions... 1 2.1 identity... 1 2.2 master key... 1 2.3 key generation center (KGC)... 1 3 Symbols and abbreviations...
More information1 Number Fields Introduction Algebraic Numbers Algebraic Integers Algebraic Integers Modules over Z...
Contents 1 Number Fields 3 1.1 Introduction............................ 3 1.2 Algebraic Numbers........................ 5 2 Algebraic Integers 7 2.1 Algebraic Integers......................... 7 2.2 Modules
More informationChapter 4. Characters and Gauss sums. 4.1 Characters on finite abelian groups
Chapter 4 Characters and Gauss sums 4.1 Characters on finite abelian groups In what follows, abelian groups are multiplicatively written, and the unit element of an abelian group A is denoted by 1 or 1
More informationLecture 7: Etale Fundamental Group - Examples
Lecture 7: Etale Fundamental Group - Examples October 15, 2014 In this lecture our only goal is to give lots of examples of etale fundamental groups so that the reader gets some feel for them. Some of
More informationp-adic fields Chapter 7
Chapter 7 p-adic fields In this chapter, we study completions of number fields, and their ramification (in particular in the Galois case). We then look at extensions of the p-adic numbers Q p and classify
More informationPolynomial Selection for Number Field Sieve in Geometric View
Polynomial Selection for Number Field Sieve in Geometric View Min Yang 1, Qingshu Meng 2, zhangyi Wang 2, Lina Wang 2, and Huanguo Zhang 2 1 International school of software, Wuhan University, Wuhan, China,
More information1. Algebra 1.7. Prime numbers
1. ALGEBRA 30 1. Algebra 1.7. Prime numbers Definition Let n Z, with n 2. If n is not a prime number, then n is called a composite number. We look for a way to test if a given positive integer is prime
More informationDiscrete mathematics I - Number theory
Discrete mathematics I - Number theory Emil Vatai (based on hungarian slides by László Mérai) 1 January 31, 2018 1 Financed from the financial support ELTE won from the Higher Education
More informationOn the complexity of computing discrete logarithms in the field F
On the complexity of computing discrete logarithms in the field F 3 6 509 Francisco Rodríguez-Henríquez CINVESTAV-IPN Joint work with: Gora Adj Alfred Menezes Thomaz Oliveira CINVESTAV-IPN University of
More informationAlgorithms for integer factorization and discrete logarithms computation
/* */ C,A, /* */ R,a, /* */ M,E, L,i= 5,e, d[5],q[999 ]={0};main(N ){for (;i--;e=scanf("%" "d",d+i));for(a =*d; ++i
More informationLooking back at lattice-based cryptanalysis
September 2009 Lattices A lattice is a discrete subgroup of R n Equivalently, set of integral linear combinations: α 1 b1 + + α n bm with m n Lattice reduction Lattice reduction looks for a good basis
More informationEstimates for factoring 1024-bit integers. Thorsten Kleinjung, University of Bonn
Estimates for factoring 1024-bit integers Thorsten Kleinjung, University of Bonn Contents GNFS Overview Polynomial selection, matrix construction, square root computation Sieving and cofactoring Strategies
More informationGenerating Subfields
Generating Subfields joint with Marc van Hoeij, Andrew Novocin Jürgen Klüners Universität Paderborn Number Theory Conference, Bordeaux, 14th January 2013 Jürgen Klüners (Universität Paderborn) Generating
More informationSolving a 6120-bit DLP on a Desktop Computer
Solving a 6120-bit DLP on a Desktop Computer Faruk Göloğlu, Robert Granger, Gary McGuire, and Jens Zumbrägel Claude Shannon Institute Complex & Adaptive Systems Laboratory School of Mathematical Sciences
More information