A quasi polynomial algorithm for discrete logarithm in small characteristic
|
|
- Shavonne Cummings
- 5 years ago
- Views:
Transcription
1 CCA seminary January 10, 2014 A quasi polynomial algorithm for discrete logarithm in small characteristic Razvan Barbulescu 1 Pierrick Gaudry 2 Antoine Joux 3 Emmanuel Thomé 2 LIX, École Polytechnique Loria, Nancy LIP 6, Paris R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 0 / 34
2 Motivation For any prime power Q, F Q is the field of Q elements. factorization same complexity dlog. in F p analoguous pairings in small char. rely on dlog. in F 2 n or F 3 n rely on elliptic curve dlog. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 1 / 34
3 Discrete logarithm Definition Let g and h be two elements in a cyclic group. We call discrete logarithm of g in base h, if it exists, the smallest positive integer x such that g x = h. Example DSA signature relies on the difficulty of solving the equation for a prime p and integers g and h. g x h mod p, Example Pairing based crypto-systems in small characteristic rely, in particular, on the difficulty of solving the equation g(x ) x h(x ) mod ϕ(x ), for an irreducible polynomial ϕ(x ) in F 2 [X ] or F 3 [X ]. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 2 / 34
4 The Pohlig-Hellman reduction Let N = p e i i Let g i = g N/pe i i Then, g i is of order p e i i be the factorization of the group order. and h i = h N/pe i i. and h i = g x i i, where x i x mod p e i i. Theorem Using the Chinese Remainder Theorem, the DLP in G reduces to DLPs in groups whose orders are prime powers. A similar trick, à la Hensel, allows to reduce the DLP modulo a prime power to several DLPs modulo primes. Theorem (Pohlig-Hellman reduction) The DLP in G cyclic of composite order is not harder than the DLP in the subgroup of G of largest prime order. In the following we compute dlogs modulo a prime divisor l of the group order. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 3 / 34
5 Shanks baby-step giant-step algorithm Let K be a parameter (in the end, K N). Write the dlog x as x = x 0 + K x 1, with 0 x 0 < K and 0 x 1 < N/K. Algorithm 1. Compute Baby Steps: For all i in [0, K 1], compte g i. Store in a hash table the resulting pairs (g i, i). 2. Compute Giant Steps: For all j in [0, N/K ], compute hg Kj. If the resulting element is in the BS table, then get the corresponding i, and return x = i + Kj. Theorem Discrete logarithms in a cyclic group of order N can be computed in less than 2 N operations. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 4 / 34
6 Summary of generic algorithms Putting things together, one obtain: Theorem (DLP in generic groups) Let G be a cyclic group of order N, and let p be the largest prime factor of N. The DLP in G can be solved in O( p) operations in G (up to factors that are polynomial in log N). Pollard s Rho method has the same time complexity, but a low memory complexity. Finite fields are not generic groups! R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 5 / 34
7 Outline of the talk Background Discrete logarithm in small caracteristic The algorithm Some comments R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 6 / 34
8 The L notation Sub-exponential algorithms have complexities of the order of n O(1) 2 nα with 0 < α < 1, where n is the bit-size of the input. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 7 / 34
9 The L notation Sub-exponential algorithms have complexities of the order of n O(1) 2 nα with 0 < α < 1, where n is the bit-size of the input. A more precise function is: where n = log x. ) L x (α, c) = exp (cn α (log n) 1 α, R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 7 / 34
10 The L notation Sub-exponential algorithms have complexities of the order of n O(1) 2 nα with 0 < α < 1, where n is the bit-size of the input. A more precise function is: where n = log x. ) L x (α, c) = exp (cn α (log n) 1 α, The most common values of α are 0 for polynomial-time algorithms; 1 for exponential ones; 1/2 for older DL algorithms; 1/3 for algorithms used in today s records of factorization, dlog in large, medium and small caracteristic. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 7 / 34
11 Smoothness Definition A polynomial in F q [t] is m-smooth if all its irreducible factors have degree less than m. Theorem (Panario Gourdon Flajolet) The probability that a degree-n polynomial is m-smooth is 1/u u(1+o(1)) where u = n m. Cases: n = log q L x (α, ), m = log q L x (β, ) gives a probability of 1/L x (α β, ); n = D, m = D/6 gives a constant probability; n = D, m = 1 gives a probability 1/D! 1/D D. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 8 / 34
12 Obtaining relations The finite field F q k is represented as F q [t]/ϕ for an irreducible degree k polynomial ϕ F q [t]. Example Take q = 3, k = 5, ϕ = x 5 + x 4 + 2x and l = 11 (divisor of 3 5 1). We have x 5 x 6 2(x + 1)(x 3 + x 2 + 2x + 1) mod ϕ 2(x 2 + 1)(x 2 + x + 2) mod ϕ x 7 2(x + 2)(x + 1) 2 mod ϕ. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 9 / 34
13 Obtaining relations The finite field F q k is represented as F q [t]/ϕ for an irreducible degree k polynomial ϕ F q [t]. Example Take q = 3, k = 5, ϕ = x 5 + x 4 + 2x and l = 11 (divisor of 3 5 1). We have x 5 x 6 2(x + 1)(x 3 + x 2 + 2x + 1) mod ϕ 2(x 2 + 1)(x 2 + x + 2) mod ϕ x 7 2(x + 2)(x + 1) 2 mod ϕ. The last relation gives: 7 log x x 1 log x (x + 2) + 2 log x (x + 1) R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 9 / 34
14 Obtaining relations The finite field F q k is represented as F q [t]/ϕ for an irreducible degree k polynomial ϕ F q [t]. Example Take q = 3, k = 5, ϕ = x 5 + x 4 + 2x and l = 11 (divisor of 3 5 1). We have x 5 x 6 2(x + 1)(x 3 + x 2 + 2x + 1) mod ϕ 2(x 2 + 1)(x 2 + x + 2) mod ϕ x 7 2(x + 2)(x + 1) 2 mod ϕ. The last relation gives: 7 log x x 1 log x (x + 2) + 2 log x (x + 1) 8 log x (x + 1) 1 log x (x + 2) 9 log x (x + 2) 2 log x x. We find log x (x + 1) 4 mod 11 and log x (x + 2) 10 mod 11. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 9 / 34
15 L(1/2) index calculus in F 2 n = F 2 [x]/ϕ(x) Algorithm To compute the log of h in base g: 0. Fix a smoothness bound B, and construct the factor base F = {p i irreducible and monic; deg p i B}. 1. Collect relations. Repeat the following until #F relations have been found: 1.1 Pick a at random and compute z = g a mod ϕ. 1.2 check if z is smooth. 1.3 If yes, write z as a product of elements of F and store the corresponding relation as a row of a matrix. 2. Linear algebra. Find a vector v in the right-kernel of the matrix, modulo 2 n 1. Normalizing to get log g = 1, this gives the log of all factor base elements. 3. Individual logs. Pick b at random until h b is smooth. Deduce the log of h. Note B = log 2 L(α, ). Then #F = L(α); the cost of the relation collection stage is L(α)L(1 α) while the linear algebra has a cost of L(α) 2 = L(α). We optimize the complexity for α = 1/2. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 10 / 34
16 L(1/2) index calculus: comments All L(1/2) and L(1/3) DLP algorithms follow the same scheme: Relation collection; Linear algebra to get logs of factor base elements; Individual log, to handle any element. Joux s L(1/4) algorithm still uses this terminology (but very different in nature). Quasi-polynomial time algorithm: it s time to stop speaking about factor base! R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 11 / 34
17 Records for fields F 2 n with prime n The most studied algorithm in small characteristic is the function field sieve (FFS) of complexity L(1/3). Joux and Lercier gave a variant and Coppersmith s algorithm can be seen as a particular case. n date GIPS year algo. author Copp. Gordon,McCurley FFS Joux,Lercier Copp. Thomé FFS Joux,Lercier FFS Joux,Lercier FFS Caramel FFS Caramel 1 Using the same algorithm as for prime degrees. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 12 / 34
18 Records for fields F 2 n with prime n The most studied algorithm in small characteristic is the function field sieve (FFS) of complexity L(1/3). Joux and Lercier gave a variant and Coppersmith s algorithm can be seen as a particular case. n date GIPS year algo. author Copp. Gordon,McCurley FFS Joux,Lercier Copp. Thomé FFS Joux,Lercier FFS Joux,Lercier FFS Caramel FFS Caramel Caramel completed the relation collection stage for n = 1039 with a computation of 384 GIPS years. Linear algebra must be adapted to larger sizes. 1 Using the same algorithm as for prime degrees. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 12 / 34
19 Composed degrees n Pairings issued instances of discrete logarithm have composed exponent: 4n, 6n or 12n. Theorem Under the same assumptions as in the classical variante of FFS, if n has a factor κ less than 3 n, then 1. the relations collection phase can be sped up by κ; 2. the linear algebra stage can be sped up by κ 2. Two japanese teams computed discrete logs in F 3 6n (pairings): a 2010 record for n = 71 (676 bits) using κ = 6; cost 14 GIPS year. a 2012 record for n = 97 (923 bits) using κ = 3; cost 290 GIPS years. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 13 / 34
20 Results of the year 2013 The fields F q 2k and F q 3k with k q are weak; if k {q 1, q, q + 1} they are very weak. (Joux) R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 14 / 34
21 Results of the year 2013 The fields F q 2k and F q 3k with k q are weak; if k {q 1, q, q + 1} they are very weak. (Joux) Two methods for relation collection and linear algebra in polynomial time. (Joux and Göloğlu et al.) R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 14 / 34
22 Results of the year 2013 The fields F q 2k and F q 3k with k q are weak; if k {q 1, q, q + 1} they are very weak. (Joux) Two methods for relation collection and linear algebra in polynomial time. (Joux and Göloğlu et al.) Amazing records by Joux (n = 6168) and Göloğlu et al.(n = 6120). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 14 / 34
23 Results of the year 2013 The fields F q 2k and F q 3k with k q are weak; if k {q 1, q, q + 1} they are very weak. (Joux) Two methods for relation collection and linear algebra in polynomial time. (Joux and Göloğlu et al.) Amazing records by Joux (n = 6168) and Göloğlu et al.(n = 6120). Individual logarithm in time L(1/4 + o(1)) by Joux. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 14 / 34
24 Results of the year 2013 The fields F q 2k and F q 3k with k q are weak; if k {q 1, q, q + 1} they are very weak. (Joux) Two methods for relation collection and linear algebra in polynomial time. (Joux and Göloğlu et al.) Amazing records by Joux (n = 6168) and Göloğlu et al.(n = 6120). Individual logarithm in time L(1/4 + o(1)) by Joux. One can embed F 2 n with prime n in a field F q 2k with k q (Joux). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 14 / 34
25 Results of the year 2013 The fields F q 2k and F q 3k with k q are weak; if k {q 1, q, q + 1} they are very weak. (Joux) Two methods for relation collection and linear algebra in polynomial time. (Joux and Göloğlu et al.) Amazing records by Joux (n = 6168) and Göloğlu et al.(n = 6120). Individual logarithm in time L(1/4 + o(1)) by Joux. One can embed F 2 n with prime n in a field F q 2k with k q (Joux). Quasi-polynomial algorithm of complexity n O(log n) for prime n (this work). Estimation of the weakness of small caracteristic pairings by Adj et al.. for example pairing based crypto-systems over have security of 80 bits instead of 128 bits. (BGJT is used in tandem with Joux s algorithm) R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 14 / 34
26 Outline of the talk Background Discrete logarithm in small caracteristic The algorithm Some comments R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 15 / 34
27 Main result Theorem (based on heuristics) Let K be any finite field F q k. A discrete logarithm in K can be computed in heuristic time max(q, k) O(log k). Cases: K = F 2 n, with prime n. Complexity is n O(log n). Much better than L 2 n(1/3 + o(1)) 2 3 n. K = F q k, with q k. Complexity is log Q O(log log Q), where Q = #K. Again, this is L Q (o(1)). K = F q k, with q L q k(α). Complexity is L q k(α + o(1)), i.e. better than Joux-Lercier or FFS for α < 1/3. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 16 / 34
28 We suppose first k q and k q + 2. Representing F q 2k Choosing ϕ: Try random h 0, h 1 F q 2[x] with deg h 0, deg h 1 2 until T (x) := h 1 (x)x q h 0 (x) has an irreducible factor of degree k. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 17 / 34
29 Representing F q 2k We suppose first k q and k q + 2. Choosing ϕ: Try random h 0, h 1 F q 2[x] with deg h 0, deg h 1 2 until T (x) := h 1 (x)x q h 0 (x) has an irreducible factor of degree k. Remark The existence of h 0 and h 1 is heuristic, but found in practice in time O(k). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 17 / 34
30 Representing F q 2k We suppose first k q and k q + 2. Choosing ϕ: Try random h 0, h 1 F q 2[x] with deg h 0, deg h 1 2 until T (x) := h 1 (x)x q h 0 (x) has an irreducible factor of degree k. Remark The existence of h 0 and h 1 is heuristic, but found in practice in time O(k). h 1 (x)x q h 0 (x) mod ϕ(x). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 17 / 34
31 Representing F q 2k We suppose first k q and k q + 2. Choosing ϕ: Try random h 0, h 1 F q 2[x] with deg h 0, deg h 1 2 until T (x) := h 1 (x)x q h 0 (x) has an irreducible factor of degree k. Remark The existence of h 0 and h 1 is heuristic, but found in practice in time O(k). h 1 (x)x q h 0 (x) mod ϕ(x). If P F q 2[x] then h 1 (x) deg P P(x) q = h 1 (x) deg P P(x q ) ( ) h 1 (x) deg P h0 P h 1 mod ϕ(x), where P is the polynomial obtained after conjugating all coefficients. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 17 / 34
32 Building block Proposition (Under heuristic assumptions) There exists an algorithm whose complexity is polynomial in q and k and which can be used for the following two tasks. 1. Given an element of K represented by a polynomial P F q 2[X ] with 2 deg P k 1, the algorithm returns an expression of log P(X ) as a linear combination of at most O(kq 2 ) logarithms log P i (X ) with deg P i 1 2 deg P and of log h 1 (X ). 2. The algorithm returns the logarithm of h 1 (X ) and the logarithms of all the elements of K of the form X + a, for a in F q 2. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 18 / 34
33 Descent tree P deg = k deg = k/ deg = k/ deg = 1 Attention: nodes can repeat; in particular the number of leaves is less than q 2, the number of polynomials x + γ. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 19 / 34
34 The descent tree Each node of the descent tree corresponds to one application of the Proposition, hence its arity is in q 2 D. level deg P i width of tree 0 k 1 1 k/2 q 2 k 2 k/4 q 2 k q 2 k 2 3. k/8. q 2 k q 2 k 2 q2 k 4. log k 1 q 2 log k k log k Total number of nodes = q O(log k). Each node yields a cost that is polynomial in q, hence one can solve discrete logarithms in F q 2k with k q + 2 in time q O(log k). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 20 / 34
35 Proof idea Recall that the individual log for Index Calculus is done using equations P i = R i, where i is a random integer and R i is the residue of x i P modulo ϕ. We search relations L S = γ S(P + γ) where S is a subset of F q 2 and L S is the residue of γ S (P + γ) modulo ϕ. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 21 / 34
36 Proof: The left hand side Let log P be the required computation. For every matrix m = have log L m log R m where ( a c ) b GL 2 (F q 2) we d R m := h 1 (x) deg P ( (ap + b) q (cp + d) (ap + b)(cp + d) q) mod ϕ(x ). and L m := R m mod ϕ. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 22 / 34
37 Proof: The left hand side Let log P be the required computation. For every matrix m = have log L m log R m where ( a c ) b GL 2 (F q 2) we d R m := h 1 (x) deg P ( (ap + b) q (cp + d) (ap + b)(cp + d) q) mod ϕ(x ). and L m := R m mod ϕ. We have deg L m 3 deg P. Indeed, we have L m = h deg P 1 (ã P(x q ) + b)(cp(x) + d) (ap(x) + b)( c P(x q ) + d) ( ( ) ) ( = h deg P h0 (X ) 1 ã P + b (cp(x ) + d) (ap(x ) + b) c P h 1 (X ) ( ) ) h0 (X ) + d. h 1 (X ) R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 22 / 34
38 The right hand side Recall the identity x q x = α F q (x α). We further have x q y xy q = (α:β) P 1 (F q )(βx αy) and R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 23 / 34
39 The right hand side Recall the identity x q x = α F q (x α). We further have x q y xy q = (α:β) P 1 (F q )(βx αy) and (ap + b) q (cp + d) (ap + b)(cp + d) q = = = λ (α,β) P 1 (F q) (α,β) P 1 (F q) (α,β) P 1 (F q) β(ap + b) α(cp + d) ( cα + aβ)p (dα bβ) ( P ) dα bβ, aβ cα Here q + 1 out of the q elements of {1} {P + a : a F q 2} occur. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 23 / 34
40 Linear algebra step for P If L m is 1 2 deg P-smooth we have γ P 1 (F q 2)(P + γ) vm(γ) = i P e i i, for some polynomials P i with deg P i 1 2 deg P and { 1, if γ = dα bβ aβ cα v m (γ) = with (α : β) P1 (F q ), 0 otherwise. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 24 / 34
41 Notation P q := PGL(2, q 2 )/PGL(2, q). Linear algebra step for P Since #PGL(2, q) = q 3 q, #P q = q 3 + q. γ P 1 (F q 2) m P q v m (γ) Since L m has degree 3 deg P, its heuristic probability to be 1 2 deg P-smooth is constant. Hence the matrix has Θ(q 3 ) rows and q columns. We make the heuristic that the matrix has rank q R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 25 / 34
42 Evidence in favour of the heuristic We computed the discriminant over Z of some matrices obtained as above; denoted δ i. In our example, the discriminant δ i of q random rows had the same probability to be divisible by a large prime l as a random integer. q #trials in gcd({δ i }) in gcd(δ i, δ j ) , 3 431, , 5 none above q , 3 none above q , 13 none above q , , 3, 5 none above q , , 11 none above q 2 R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 26 / 34
43 Arity of the descent tree log P is obtained as a sum of at most q 2 linear combinations. Each linear combination has at most 3 deg P terms. So, we have at most O(q 2 deg P) new polynomials. Adj et al. gave a method to compute the average number of divisors for a smooth polynomial. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 27 / 34
44 Outline of the talk Background Discrete logarithm in small caracteristic The algorithm Some comments R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 28 / 34
45 The embedding trick log g h has the same value as elements of F q k or as any field F q k where q is a multiple of q. When q < k 2 we embed F q k in F q 2k with q = q log qk. Note that q qk. The input size log Q = k log q is replaced by 2k log q 2k log(qk) 4 log Q log log Q. When replacing log Q by log Q log log Q a polynomial algorithm changes the big-oh by a soft-oh; a sub-exponential L(α) algorithm becomes L(α + o(1)); a quasi-polynomial one changes the constant in the big-oh. Example 1. For F we compute logs in F = F The field F can be embedded in F q 2k with q = 3 6 and k = 509. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 29 / 34
46 Very weak fields Assume that k = q 1 (same is true for q + 1 and q). For many values of q we can take h 1 = 1 and h 0 = Ax for some generator A of F q 2. Then ϕ = x q 1 A. Then, for any a F q 2, we have (x + a) q = x q + ã = x q 1 x + ã = A(x + ã/a), where ã is the Frobenius conjugate of a. We obtain q log(x + a) = log(x + ã/a). Hence we can reduce the factor base by a factor k. For example for , the linear algebra time was accelerated by k 2 = Remark The smoothness probabilities are improved. For example, The proportion of matrices m P q which produce relations for the linear polynomials is 1/6! = 1/620 when max(deg h 0, deg h 1 ) = 2 and it is 1/3! for the weak case (Kummer). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 30 / 34
47 The traps of Cheng Wan Zhuang In a recent preprint, Cheng, Wan and Zhuang noticed that the two last heuristics might fail. Let P(X ) be a divisor of h 1 X q h 0 (not the one used to define F q 2k). It can be checked that P will divide both sides of relations we try to construct. In general, such a P can not be descended in the usual way. And if P is linear, then we will not get its logarithm in the usual way. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 31 / 34
48 The CWZ traps: solutions CWZ proposed to just avoid these elements: still get a quasi-polynomial time complexity. We propose an alternative solution to descend a problematic P of degree D: We have h D 1 P q h D 1 P(h 0 /h 1 ) mod x q h 1 h 0. The RHS is always divisible by P (it is problematic). Taking logs, we get D log h 1 + (q 1) log P = log Q, where Q is the RHS divided by P. In general, P Q, and, if deg h 0, h 1 2, then deg Q D. So we have related log P to other logarithms, and the descent can continue. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 32 / 34
49 Conclusion Looking back: 30 years ago, first L(1/3) DL algorithm by Coppersmith; It took more than a decade to get this complexity for a wide range of scenarios; Still recent progress on L(1/3)-algorithms. Interesting times! We are entering a better-than-l(1/3) era; A lot of theoretical and practical improvements are expected in the next few months / years; At the moment, absolutely no clue how to extend the quasi-polynomial complexity to large characteristic, or to remove the quasi. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 33 / 34
50 RSA 0 1/3 2/3 1 α The complexity of discrete logarithm for a given size log Q with respect to the caracteristic q = L(α) R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi polynomial algorithm 34 / 34
A heuristic quasi-polynomial algorithm for discrete logarithm in small characteristic
ECC, Chennai October 8, 2014 A heuristic quasi-polynomial algorithm for discrete logarithm in small characteristic Razvan Barbulescu 1 Pierrick Gaudry 2 Antoine Joux 3 Emmanuel Thomé 2 IMJ-PRG, Paris Loria,
More informationA quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic
A quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic Razvan Barbulescu 1, Pierrick Gaudry 1, Antoine Joux 2,3, and Emmanuel Thomé 1 1 Inria, CNRS, University of
More informationDiscrete logarithms: Recent progress (and open problems)
Discrete logarithms: Recent progress (and open problems) CryptoExperts Chaire de Cryptologie de la Fondation de l UPMC LIP6 February 25 th, 2014 Discrete logarithms Given a multiplicative group G with
More informationOn the complexity of computing discrete logarithms in the field F
On the complexity of computing discrete logarithms in the field F 3 6 509 Francisco Rodríguez-Henríquez CINVESTAV-IPN Joint work with: Gora Adj Alfred Menezes Thomaz Oliveira CINVESTAV-IPN University of
More informationImproving NFS for the discrete logarithm problem in non-prime nite elds
Improving NFS for the discrete logarithm problem in non-prime nite elds Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, Francois Morain Institut national de recherche en informatique et en automatique
More informationAlgorithmes de calcul de logarithme discret dans les corps finis
Algorithmes de calcul de logarithme discret dans les corps finis Grenoble, École de printemps C2 2014 E. Thomé CARAMEL /* */ C,A, /* */ R,a, /* */ M,E, L,i= 5,e, d[5],q[999 ){for ]={0};main(N (;i--;e=scanf("%"
More informationTraps to the BGJT-Algorithm for Discrete Logarithms
Submitted exclusively to the London Mathematical Society doi:10.1112/0000/000000 Traps to the BGJT-Algorithm for Discrete Logarithms Qi Cheng, Daqing Wan and Jincheng Zhuang Abstract In the recent breakthrough
More informationOn Generating Coset Representatives of P GL 2 (F q ) in P GL 2 (F q 2)
On Generating Coset Representatives of P GL 2 F q in P GL 2 F q 2 Jincheng Zhuang 1,2 and Qi Cheng 3 1 State Key Laboratory of Information Security Institute of Information Engineering Chinese Academy
More informationA brief overwiev of pairings
Bordeaux November 22, 2016 A brief overwiev of pairings Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Overview pairings 0 / 37 Plan of the lecture Pairings Pairing-friendly curves Progress of NFS attacks
More informationDiscrete Logarithm Problem
Discrete Logarithm Problem Çetin Kaya Koç koc@cs.ucsb.edu (http://cs.ucsb.edu/~koc/ecc) Elliptic Curve Cryptography lect08 discrete log 1 / 46 Exponentiation and Logarithms in a General Group In a multiplicative
More informationIndividual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm)
Individual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm) Aurore Guillevic INRIA Saclay / GRACE Team École Polytechnique / LIX ECC 2015, Sept. 28th Aurore Guillevic (INRIA/LIX)
More informationElliptic Curve Discrete Logarithm Problem
Elliptic Curve Discrete Logarithm Problem Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM October 19, 2009 Vanessa VITSE (UVSQ) Elliptic Curve Discrete Logarithm Problem October
More informationElliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
More informationSolving a 6120-bit DLP on a Desktop Computer
Solving a 6120-bit DLP on a Desktop Computer Faruk Göloğlu, Robert Granger, Gary McGuire, and Jens Zumbrägel Claude Shannon Institute Complex & Adaptive Systems Laboratory School of Mathematical Sciences
More informationSolving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction
Solving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction Aurore Guillevic and François Morain and Emmanuel Thomé University of Calgary, PIMS CNRS, LIX École Polytechnique, Inria, Loria SAC,
More informationThe number field sieve in the medium prime case
The number field sieve in the medium prime case Frederik Vercauteren ESAT/COSIC - K.U. Leuven Joint work with Antoine Joux, Reynald Lercier, Nigel Smart Finite Field DLOG Basis finite field is F p = {0,...,
More informationBasic Algorithms in Number Theory
Basic Algorithms in Number Theory Algorithmic Complexity... 1 Basic Algorithms in Number Theory Francesco Pappalardi #2 - Discrete Logs, Modular Square Roots, Polynomials, Hensel s Lemma & Chinese Remainder
More informationDiscrete Logarithm Computation in Hyperelliptic Function Fields
Discrete Logarithm Computation in Hyperelliptic Function Fields Michael J. Jacobson, Jr. jacobs@cpsc.ucalgary.ca UNCG Summer School in Computational Number Theory 2016: Function Fields Mike Jacobson (University
More informationBasic Algorithms in Number Theory
Basic Algorithms in Number Theory Algorithmic Complexity... 1 Basic Algorithms in Number Theory Francesco Pappalardi Discrete Logs, Modular Square Roots & Euclidean Algorithm. July 20 th 2010 Basic Algorithms
More informationNon-generic attacks on elliptic curve DLPs
Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September 13 2013 Smith
More informationLecture 7: ElGamal and Discrete Logarithms
Lecture 7: ElGamal and Discrete Logarithms Johan Håstad, transcribed by Johan Linde 2006-02-07 1 The discrete logarithm problem Recall that a generator g of a group G is an element of order n such that
More informationHyperelliptic curves
1/40 Hyperelliptic curves Pierrick Gaudry Caramel LORIA CNRS, Université de Lorraine, Inria ECC Summer School 2013, Leuven 2/40 Plan What? Why? Group law: the Jacobian Cardinalities, torsion Hyperelliptic
More informationProblème du logarithme discret sur courbes elliptiques
Problème du logarithme discret sur courbes elliptiques Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM Groupe de travail équipe ARITH LIRMM Vanessa VITSE (UVSQ) DLP over elliptic
More informationIntroduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
More informationChapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations
Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 9.1 Chapter 9 Objectives
More informationExplicit isogenies and the Discrete Logarithm Problem in genus three
Explicit isogenies and the Discrete Logarithm Problem in genus three Benjamin Smith INRIA Saclay Île-de-France Laboratoire d informatique de l école polytechnique (LIX) EUROCRYPT 2008 : Istanbul, April
More informationA Generic Algorithm for Small Weight Discrete Logarithms in Composite Groups
A Generic Algorithm for Small Weight Discrete Logarithms in Composite Groups Alexander May and Ilya Ozerov Horst Görtz Institute for IT-Security Ruhr-University Bochum, Germany Faculty of Mathematics alex.may@rub.de,
More informationBlock Wiedemann likes Schirokauer maps
Block Wiedemann likes Schirokauer maps E. Thomé INRIA/CARAMEL, Nancy. /* EPI CARAMEL */ C,A, /* Cryptologie, Arithmétique : */ R,a, /* Matériel et Logiciel */ M,E, L,i= 5,e, d[5],q[999 ]={0};main(N ){for
More informationFactoring Algorithms Pollard s p 1 Method. This method discovers a prime factor p of an integer n whenever p 1 has only small prime factors.
Factoring Algorithms Pollard s p 1 Method This method discovers a prime factor p of an integer n whenever p 1 has only small prime factors. Input: n (to factor) and a limit B Output: a proper factor of
More informationSignatures and DLP-I. Tanja Lange Technische Universiteit Eindhoven
Signatures and DLP-I Tanja Lange Technische Universiteit Eindhoven How to compute ap Use binary representation of a to compute a(x; Y ) in blog 2 ac doublings and at most that many additions. E.g. a =
More informationSM9 identity-based cryptographic algorithms Part 1: General
SM9 identity-based cryptographic algorithms Part 1: General Contents 1 Scope... 1 2 Terms and definitions... 1 2.1 identity... 1 2.2 master key... 1 2.3 key generation center (KGC)... 1 3 Symbols and abbreviations...
More informationDefinition of a finite group
Elliptic curves Definition of a finite group (G, * ) is a finite group if: 1. G is a finite set. 2. For each a and b in G, also a * b is in G. 3. There is an e in G such that for all a in G, a * e= e *
More informationCS259C, Final Paper: Discrete Log, CDH, and DDH
CS259C, Final Paper: Discrete Log, CDH, and DDH Deyan Simeonov 12/10/11 1 Introduction and Motivation In this paper we will present an overview of the relations between the Discrete Logarithm (DL), Computational
More informationImproving NFS for the discrete logarithm problem in non-prime finite fields
Improving NFS for the discrete logarithm problem in non-prime finite fields Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, François Morain To cite this version: Razvan Barbulescu, Pierrick Gaudry,
More informationAspects of Pairing Inversion
Applications of Aspects of ECC 2007 - Dublin Aspects of Applications of Applications of Aspects of Applications of Pairings Let G 1, G 2, G T be groups of prime order r. A pairing is a non-degenerate bilinear
More informationCover and Decomposition Index Calculus on Elliptic Curves made practical
Cover and Decomposition Index Calculus on Elliptic Curves made practical Application to a previously unreachable curve over F p 6 Vanessa VITSE Antoine JOUX Université de Versailles Saint-Quentin, Laboratoire
More informationCalcul d indice et courbes algébriques : de meilleures récoltes
Calcul d indice et courbes algébriques : de meilleures récoltes Alexandre Wallet ENS de Lyon, Laboratoire LIP, Equipe AriC Alexandre Wallet De meilleures récoltes dans le calcul d indice 1 / 35 Today:
More informationBreaking pairing-based cryptosystems using η T pairing over GF (3 97 )
Breaking pairing-based cryptosystems using η T pairing over GF (3 97 ) Takuya Hayashi 1, Takeshi Shimoyama 2, Naoyuki Shinohara 3, and Tsuyoshi Takagi 1 1 Kyushu University, 744, Motooka, Nishi-ku, Fukuoka
More informationFast, twist-secure elliptic curve cryptography from Q-curves
Fast, twist-secure elliptic curve cryptography from Q-curves Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC #17, Leuven September 16,
More informationElliptic Curve Cryptography with Derive
Elliptic Curve Cryptography with Derive Johann Wiesenbauer Vienna University of Technology DES-TIME-2006, Dresden General remarks on Elliptic curves Elliptic curces can be described as nonsingular algebraic
More informationThe point decomposition problem in Jacobian varieties
The point decomposition problem in Jacobian varieties Jean-Charles Faugère2, Alexandre Wallet1,2 1 2 ENS Lyon, Laboratoire LIP, Equipe AriC UPMC Univ Paris 96, CNRS, INRIA, LIP6, Equipe PolSys 1 / 19 1
More informationConstructing Abelian Varieties for Pairing-Based Cryptography
for Pairing-Based CWI and Universiteit Leiden, Netherlands Workshop on Pairings in Arithmetic Geometry and 4 May 2009 s MNT MNT Type s What is pairing-based cryptography? Pairing-based cryptography refers
More informationREMARKS ON THE NFS COMPLEXITY
REMARKS ON THE NFS COMPLEXITY PAVOL ZAJAC Abstract. In this contribution we investigate practical issues with implementing the NFS algorithm to solve the DLP arising in XTR-based cryptosystems. We can
More informationA General Polynomial Selection Method and New Asymptotic Complexities for the Tower Number Field Sieve Algorithm
A General Polynomial Selection Method and New Asymptotic Complexities for the Tower Number Field Sieve Algorithm Palash Sarkar and Shashank Singh Indian Statistical Institute, Kolkata September 5, 2016
More informationComputing Individual Discrete Logarithms Faster in GF(p n ) with the NFS-DL Algorithm
Computing Individual Discrete Logarithms Faster in GF(p n ) with the NFS-DL Algorithm Aurore Guillevic 1,2 1 Inria Saclay, Palaiseau, France 2 École Polytechnique/LIX, Palaiseau, France guillevic@lixpolytechniquefr
More informationFixed points for discrete logarithms
Fixed points for discrete logarithms Mariana Levin, U. C. Berkeley Carl Pomerance, Dartmouth College Suppose that G is a group and g G has finite order m. Then for each t g the integers n with g n = t
More informationA NEW PERSPECTIVE ON THE POWERS OF TWO DESCENT FOR DISCRETE LOGARITHMS IN FINITE FIELDS THORSTEN KLEINJUNG AND BENJAMIN WESOLOWSKI
A NEW PERSPECTIVE ON THE POWERS OF TWO DESCENT FOR DISCRETE LOGARITHMS IN FINITE FIELDS THORSTEN KLEINJUNG AND BENJAMIN WESOLOWSKI Abstract. A new proof is given for the correctness of the powers of two
More informationThe Decisional Diffie-Hellman Problem and the Uniform Boundedness Theorem
The Decisional Diffie-Hellman Problem and the Uniform Boundedness Theorem Qi Cheng and Shigenori Uchiyama April 22, 2003 Abstract In this paper, we propose an algorithm to solve the Decisional Diffie-Hellman
More informationPublic-key Cryptography: Theory and Practice
Public-key Cryptography Theory and Practice Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Chapter 2: Mathematical Concepts Divisibility Congruence Quadratic Residues
More informationComputing Discrete Logarithms. Many cryptosystems could be broken if we could compute discrete logarithms quickly.
Computing Discrete Logarithms Many cryptosystems could be broken if we could compute discrete logarithms quickly. The first discrete logarithm algorithms below apply in any group. They are about the best
More informationCryptography IV: Asymmetric Ciphers
Cryptography IV: Asymmetric Ciphers Computer Security Lecture 7 David Aspinall School of Informatics University of Edinburgh 31st January 2011 Outline Background RSA Diffie-Hellman ElGamal Summary Outline
More information1 The Fundamental Theorem of Arithmetic. A positive integer N has a unique prime power decomposition. Primality Testing. and. Integer Factorisation
1 The Fundamental Theorem of Arithmetic A positive integer N has a unique prime power decomposition 2 Primality Testing Integer Factorisation (Gauss 1801, but probably known to Euclid) The Computational
More informationEvidence that the Diffie-Hellman Problem is as Hard as Computing Discrete Logs
Evidence that the Diffie-Hellman Problem is as Hard as Computing Discrete Logs Jonah Brown-Cohen 1 Introduction The Diffie-Hellman protocol was one of the first methods discovered for two people, say Alice
More informationLecture 6: Cryptanalysis of public-key algorithms.,
T-79.159 Cryptography and Data Security Lecture 6: Cryptanalysis of public-key algorithms. Helsinki University of Technology mjos@tcs.hut.fi 1 Outline Computational complexity Reminder about basic number
More informationArithmétique et Cryptographie Asymétrique
Arithmétique et Cryptographie Asymétrique Laurent Imbert CNRS, LIRMM, Université Montpellier 2 Journée d inauguration groupe Sécurité 23 mars 2010 This talk is about public-key cryptography Why did mathematicians
More informationA variant of the F4 algorithm
A variant of the F4 algorithm Vanessa VITSE - Antoine JOUX Université de Versailles Saint-Quentin, Laboratoire PRISM CT-RSA, February 18, 2011 Motivation Motivation An example of algebraic cryptanalysis
More informationDiscrete Logarithm Problem
Discrete Logarithm Problem Finite Fields The finite field GF(q) exists iff q = p e for some prime p. Example: GF(9) GF(9) = {a + bi a, b Z 3, i 2 = i + 1} = {0, 1, 2, i, 1+i, 2+i, 2i, 1+2i, 2+2i} Addition:
More informationContinuing discussion of CRC s, especially looking at two-bit errors
Continuing discussion of CRC s, especially looking at two-bit errors The definition of primitive binary polynomials Brute force checking for primitivity A theorem giving a better test for primitivity Fast
More informationThe Berlekamp algorithm
The Berlekamp algorithm John Kerl University of Arizona Department of Mathematics 29 Integration Workshop August 6, 29 Abstract Integer factorization is a Hard Problem. Some cryptosystems, such as RSA,
More informationPUBLIC KEY EXCHANGE USING MATRICES OVER GROUP RINGS
PUBLIC KEY EXCHANGE USING MATRICES OVER GROUP RINGS DELARAM KAHROBAEI, CHARALAMBOS KOUPPARIS, AND VLADIMIR SHPILRAIN Abstract. We offer a public key exchange protocol in the spirit of Diffie-Hellman, but
More informationSolving a 6120-bit DLP on a Desktop Computer
Solving a 6120-bit DLP on a Desktop Computer Faruk Göloğlu, Robert Granger, Gary McGuire, and Jens Zumbrägel Complex & Adaptive Systems Laboratory and School of Mathematical Sciences University College
More informationQuasi-reducible Polynomials
Quasi-reducible Polynomials Jacques Willekens 06-Dec-2008 Abstract In this article, we investigate polynomials that are irreducible over Q, but are reducible modulo any prime number. 1 Introduction Let
More informationCryptography CS 555. Topic 18: RSA Implementation and Security. CS555 Topic 18 1
Cryptography CS 555 Topic 18: RSA Implementation and Security Topic 18 1 Outline and Readings Outline RSA implementation issues Factoring large numbers Knowing (e,d) enables factoring Prime testing Readings:
More informationSecurity Level of Cryptography Integer Factoring Problem (Factoring N = p 2 q) December Summary 2
Security Level of Cryptography Integer Factoring Problem (Factoring N = p 2 ) December 2001 Contents Summary 2 Detailed Evaluation 3 1 The Elliptic Curve Method 3 1.1 The ECM applied to N = p d............................
More informationOne can use elliptic curves to factor integers, although probably not RSA moduli.
Elliptic Curves Elliptic curves are groups created by defining a binary operation (addition) on the points of the graph of certain polynomial equations in two variables. These groups have several properties
More informationLecture Notes, Week 6
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several
More informationThe point decomposition problem in Jacobian varieties
The point decomposition problem in Jacobian varieties Alexandre Wallet ENS Lyon, Laboratoire LIP, Equipe AriC 1 / 38 1 Generalities Discrete Logarithm Problem Short State-of-the-Art for curves About Index-Calculus
More informationA connection between number theory and linear algebra
A connection between number theory and linear algebra Mark Steinberger Contents 1. Some basics 1 2. Rational canonical form 2 3. Prime factorization in F[x] 4 4. Units and order 5 5. Finite fields 7 6.
More informationarxiv: v2 [cs.cc] 23 Dec 2013
ON THE RELATION GENERATION METHOD OF JOUX FOR COMPUTING DISCRETE LOGARITHMS arxiv:13121674v2 [cscc] 23 Dec 2013 MING-DEH HUANG AND ANAND KUMAR NARAYANAN Abstract In [Jou], Joux devised an algorithm to
More informationMATH 431 PART 2: POLYNOMIAL RINGS AND FACTORIZATION
MATH 431 PART 2: POLYNOMIAL RINGS AND FACTORIZATION 1. Polynomial rings (review) Definition 1. A polynomial f(x) with coefficients in a ring R is n f(x) = a i x i = a 0 + a 1 x + a 2 x 2 + + a n x n i=0
More informationIndustrial Strength Factorization. Lawren Smithline Cornell University
Industrial Strength Factorization Lawren Smithline Cornell University lawren@math.cornell.edu http://www.math.cornell.edu/~lawren Industrial Strength Factorization Given an integer N, determine the prime
More informationENHANCING THE PERFORMANCE OF FACTORING ALGORITHMS
ENHANCING THE PERFORMANCE OF FACTORING ALGORITHMS GIVEN n FIND p 1,p 2,..,p k SUCH THAT n = p 1 d 1 p 2 d 2.. p k d k WHERE p i ARE PRIMES FACTORING IS CONSIDERED TO BE A VERY HARD. THE BEST KNOWN ALGORITHM
More informationb = 10 a, is the logarithm of b to the base 10. Changing the base to e we obtain natural logarithms, so a = ln b means that b = e a.
INTRODUCTION TO CRYPTOGRAPHY 5. Discrete Logarithms Recall the classical logarithm for real numbers: If we write b = 10 a, then a = log 10 b is the logarithm of b to the base 10. Changing the base to e
More informationTC10 / 3. Finite fields S. Xambó
TC10 / 3. Finite fields S. Xambó The ring Construction of finite fields The Frobenius automorphism Splitting field of a polynomial Structure of the multiplicative group of a finite field Structure of the
More informationBasic elements of number theory
Cryptography Basic elements of number theory Marius Zimand 1 Divisibility, prime numbers By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a
More informationCounting points on hyperelliptic curves
University of New South Wales 9th November 202, CARMA, University of Newcastle Elliptic curves Let p be a prime. Let X be an elliptic curve over F p. Want to compute #X (F p ), the number of F p -rational
More informationFinite Fields. Saravanan Vijayakumaran Department of Electrical Engineering Indian Institute of Technology Bombay
1 / 25 Finite Fields Saravanan Vijayakumaran sarva@ee.iitb.ac.in Department of Electrical Engineering Indian Institute of Technology Bombay September 25, 2014 2 / 25 Fields Definition A set F together
More informationBasic elements of number theory
Cryptography Basic elements of number theory Marius Zimand By default all the variables, such as a, b, k, etc., denote integer numbers. Divisibility a 0 divides b if b = a k for some integer k. Notation
More informationConstructing Pairing-Friendly Elliptic Curves for Cryptography
Constructing Pairing-Friendly Elliptic Curves for Cryptography University of California, Berkeley, USA 2nd KIAS-KMS Summer Workshop on Cryptography Seoul, Korea 30 June 2007 Outline 1 Pairings in Cryptography
More informationGENERATION OF RANDOM PICARD CURVES FOR CRYPTOGRAPHY. 1. Introduction
GENERATION OF RANDOM PICARD CURVES FOR CRYPTOGRAPHY ANNEGRET WENG Abstract. Combining the ideas in [BTW] [GS], we give a efficient, low memory algorithm for computing the number of points on the Jacobian
More informationNo.6 Selection of Secure HC of g = divisors D 1, D 2 defined on J(C; F q n) over F q n, to determine the integer m such that D 2 = md 1 (if such
Vol.17 No.6 J. Comput. Sci. & Technol. Nov. 2002 Selection of Secure Hyperelliptic Curves of g = 2 Based on a Subfield ZHANG Fangguo ( ) 1, ZHANG Futai ( Ξ) 1;2 and WANG Yumin(Π±Λ) 1 1 P.O.Box 119 Key
More informationENEE 457: Computer Systems Security. Lecture 5 Public Key Crypto I: Number Theory Essentials
ENEE 457: Computer Systems Security Lecture 5 Public Key Crypto I: Number Theory Essentials Charalampos (Babis) Papamanthou Department of Electrical and Computer Engineering University of Maryland, College
More informationCHAPMAN & HALL/CRC CRYPTOGRAPHY AND NETWORK SECURITY ALGORITHMIC CR YPTAN ALY51S. Ant nine J aux
CHAPMAN & HALL/CRC CRYPTOGRAPHY AND NETWORK SECURITY ALGORITHMIC CR YPTAN ALY51S Ant nine J aux (g) CRC Press Taylor 8* Francis Croup Boca Raton London New York CRC Press is an imprint of the Taylor &
More informationPolynomial Selection. Thorsten Kleinjung École Polytechnique Fédérale de Lausanne
Polynomial Selection Thorsten Kleinjung École Polytechnique Fédérale de Lausanne Contents Brief summary of polynomial selection (no root sieve) Motivation (lattice sieving, monic algebraic polynomial)
More informationG Solution (10 points) Using elementary row operations, we transform the original generator matrix as follows.
EE 387 October 28, 2015 Algebraic Error-Control Codes Homework #4 Solutions Handout #24 1. LBC over GF(5). Let G be a nonsystematic generator matrix for a linear block code over GF(5). 2 4 2 2 4 4 G =
More informationElliptic Curves Spring 2013 Lecture #12 03/19/2013
18.783 Elliptic Curves Spring 2013 Lecture #12 03/19/2013 We now consider our first practical application of elliptic curves: factoring integers. Before presenting the elliptic curve method (ECM) for factoring
More informationIntroduction to Cryptology. Lecture 20
Introduction to Cryptology Lecture 20 Announcements HW9 due today HW10 posted, due on Thursday 4/30 HW7, HW8 grades are now up on Canvas. Agenda More Number Theory! Our focus today will be on computational
More informationElliptic Curves Spring 2015 Lecture #7 02/26/2015
18.783 Elliptic Curves Spring 2015 Lecture #7 02/26/2015 7 Endomorphism rings 7.1 The n-torsion subgroup E[n] Now that we know the degree of the multiplication-by-n map, we can determine the structure
More informationNumber Theory in Cryptology
Number Theory in Cryptology Abhijit Das Department of Computer Science and Engineering Indian Institute of Technology Kharagpur October 15, 2011 What is Number Theory? Theory of natural numbers N = {1,
More informationCyclic Groups in Cryptography
Cyclic Groups in Cryptography p. 1/6 Cyclic Groups in Cryptography Palash Sarkar Indian Statistical Institute Cyclic Groups in Cryptography p. 2/6 Structure of Presentation Exponentiation in General Cyclic
More informationIntroduction to cryptology (GBIN8U16) More on discrete-logarithm based schemes
Introduction to cryptology (GBIN8U16) More on discrete-logarithm based schemes Pierre Karpman pierre.karpman@univ-grenoble-alpes.fr https://www-ljk.imag.fr/membres/pierre.karpman/tea.html 2018 03 13 More
More informationMath 3 Variable Manipulation Part 3 Polynomials A
Math 3 Variable Manipulation Part 3 Polynomials A 1 MATH 1 & 2 REVIEW: VOCABULARY Constant: A term that does not have a variable is called a constant. Example: the number 5 is a constant because it does
More informationInteger Factorization and Computing Discrete Logarithms in Maple
Integer Factorization and Computing Discrete Logarithms in Maple Aaron Bradord, Michael Monagan, Colin Percival anbradfo@sfu.ca, mmonagan@cecm.sfu.ca, cperciva@irmacs.sfu.ca Department of Mathematics,
More informationLecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
More informationCOMPRESSION FOR TRACE ZERO SUBGROUPS OF ELLIPTIC CURVES
COMPRESSION FOR TRACE ZERO SUBGROUPS OF ELLIPTIC CURVES A. SILVERBERG Abstract. We give details of a compression/decompression algorithm for points in trace zero subgroups of elliptic curves over F q r,
More informationNumber Theory. CSS322: Security and Cryptography. Sirindhorn International Institute of Technology Thammasat University CSS322. Number Theory.
CSS322: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 29 December 2011 CSS322Y11S2L06, Steve/Courses/2011/S2/CSS322/Lectures/number.tex,
More informationFinite fields and cryptology
Computer Science Journal of Moldova, vol.11, no.2(32), 2003 Ennio Cortellini Abstract The problem of a computationally feasible method of finding the discrete logarithm in a (large) finite field is discussed,
More informationCS 6260 Some number theory
CS 6260 Some number theory Let Z = {..., 2, 1, 0, 1, 2,...} denote the set of integers. Let Z+ = {1, 2,...} denote the set of positive integers and N = {0, 1, 2,...} the set of non-negative integers. If
More informationConstructing genus 2 curves over finite fields
Constructing genus 2 curves over finite fields Kirsten Eisenträger The Pennsylvania State University Fq12, Saratoga Springs July 15, 2015 1 / 34 Curves and cryptography RSA: most widely used public key
More information8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
More information