THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT

Transcription

1 MATHEMATICS OF COMPUTATION Volume 79, Number 269, January 2010, Pages S (09)02198-X Artile eletronially published on July 27, 2009 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT OLIVER SCHIROKAUER Abstrat. We define the weight of an integer N to be the smallest w suh that N an be represented as w i=1 ɛ i2 i,withɛ 1,...,ɛ w {1, 1}. Sine arithmeti modulo a prime of low weight is partiularly effiient, it is tempting to use suh primes in ryptographi protools. In this paper we onsider the diffiulty of the disrete logarithm problem modulo a prime N of low weight, as well as the diffiulty of fatoring an integer N of low weight. We desribe a version of the number field sieve whih handles both problems. In the ase that w = 2, the method is the same as the speial number field sieve, whih runs onjeturally in time exp(((32/9) 1/3 + o(1))(log N) 1/3 (log log N) 2/3 )for N. For fixed w>2, we onjeture that there is a onstant ξ less than (32/9) 1/3 ((2w 3)/(w 1)) 1/3 suh that the running time of the algorithm is at most exp((ξ + o(1))(log N) 1/3 (log log N) 2/3 )forn. We further onjeture that no ξ less than (32/9) 1/3 (( 2w 2 2+1)/(w 1)) 2/3 has this property. Our analysis reveals that on average the method performs signifiantly better than it does in the worst ase. We onsider all the examples given in a reent paper of Koblitz and Menezes and demonstrate that in every ase but one, our algorithm runs faster than the standard versions of the number field sieve. 1. Introdution We define the weight of an integer N to be the smallest w with the property that there exists a representation of N as a sum w (1.1) ɛ i 2 i, i=1 with ɛ 1,...,ɛ w {1, 1}. In 1999, Solinas observed that arithmeti modulo a prime an be made more effiient if the prime is hosen to be of small weight ([14]). More reently, Koblitz and Menezes, in their investigation of the impat of high seurity levels on ryptosystems whih are based on the Weil and Tate pairings on ellipti urves over finite fields have asked whether there is a downside to using a field in this ontext whose harateristi has small weight ([6]). In partiular, they raise the onern that disrete logarithms modulo a prime N might be easier to ompute with the number field sieve (NFS) when N is of low weight than they are in general. The inrease in vulnerability may then offset any effiieny advantages gained by implementing the protool with a low weight prime. Reeived by the editor July 31, 2006 and, in revised form, June 15, Mathematis Subjet Classifiation. Primary 11Y16; Seondary 11T71, 11Y05, 11Y40. Key words and phrases. Disrete logarithm, integer fatorization, number field sieve Amerian Mathematial Soiety

2 584 OLIVER SCHIROKAUER There is no doubt that for weight two primes, the onern about vulnerability is justified. In this ase the speial number field sieve (SNFS) an be used to solve the disrete logarithm problem. This algorithm, whih is designed to ompute logarithms modulo primes N of the more general form kr + s, with k, r, ands small, has a onjetural running time of (1.2) L N [1/3; (32/9) 1/3 + o(1)], where L N [ρ; ξ] =exp(ξ(log N) ρ (log log N) 1 ρ ) and the o(1)isforn with k, r, and s bounded in absolute value. By omparison, the general NFS has a onjetural running time of L N [1/3; (64/9) 1/3 + o(1)], for N. The suggestion, whih is supported by the details of the running time analyses, is that the time it takes to ompute a disrete logarithm modulo a large general prime N is about the time required for a speial prime of size N 2. The purpose of this paper is to extend the SNFS to primes of arbitrary weight. In all versions of the NFS, an extensive searh takes plae for smooth elements in two different number rings. The goal at the outset of the algorithm is to hoose the best possible rings. In the SNFS, one ring is taken to be Z and the other is generated over Z by the root of a polynomial with integral oeffiients having a root mod N. The reason the SNFS is faster than the NFS is that the speial form of the modulus N allows for the onstrution of a suitable polynomial with extremely small oeffiients. The algorithm we desribe in the next setion takes advantage of the low weight of N in muh the same way. In partiular, we onvert (1.1) into a representation of a multiple of N as a sum of the form w ɛ i 2 a i+b i e i=1 and make use of the assoiated polynomial with oeffiients ɛ i 2 a i and root 2 e mod N. Beause our results are appliable to the problem of fatoring as well as to the disrete logarithm problem, and in order to avoid a disussion about the existene of primes of fixed weight, we formulate our algorithm as a general method whih takes an arbitrary odd integer N as input and whih an be inorporated either intoamethodtofatorn when N is omposite or a method to ompute disrete logarithms mod N when N is prime. In 3, we analyze the algorithm of the previous setion. When w =2,themethod is the same as the SNFS and so runs onjeturally in time (1.2) for N. For fixed w > 2, we onjeture that the running time of the algorithm is at most L N [1/3; ξ + o(1)], where ξ is a onstant whih is less than ( 32 ) 1/3 ( 2w 3 ) 1/3 9 w 1 and the o(1) is again for N.Thus,forfixedw, our algorithm is asymptotially faster than the general NFS. We also exhibit, for eah w, an infinite set S of integers of weight w having the property that for N S tending to, the onjetural running time of the algorithm is bounded below by L N [1/3; (32/9) 1/3 τ 2/3 + o(1)],

3 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT 585 where 2w τ =. w 1 The details of the running time analysis for these sets of inputs are set aside as an appendix. The reader who onsults Figure 3.11 will see that the differene between ((2w 3)/(w 1)) 1/3 and τ 2/3 is quite small. Though the asymptoti results we obtain are satisfying in that they indiate how to parametrize the gap between the SNFS and general NFS running times in terms of w, their value is diminished by the fat that the weight of an input only loosely determines the time required by the method. As we will see, the spaing of the exponents in (1.1) has a signifiant impat on the algorithm, produing a wide range of performanes for a fixed weight. To partially remedy the situation, we also investigate in 3 what happens on average for inputs of a fixed weight. In the fourth and final setion of the paper, we turn to pratial onsiderations. To get a better sense of the speedup afforded by small weight inputs, we ompare the size of the numbers that are tested for smoothness in our algorithm with those arising in other versions of the NFS. The disrete logarithm problems we use for this investigation are the seven examples appearing in [6]. Of these, four involve a finite field of degree two over its prime field. In all but one of the seven examples, the method we desribe in 2 is superior to the other versions of the NFS, and in many of these ases, dramatially so. One pratial issue we do not disuss is how to determine whether a given input N has low weight. We do, however, note that fast algorithms exist to determine the weight of an integer and to produe all representations of the form displayed in (1.1). Thus, for a value of N not given in this form, we an quikly determine whether to look for a representation for use in the method of this paper. For more on representing integers in signed-binary form, see [10]. 2. The algorithm Whether it is being used to fator an integer N or to ompute disrete logarithms in a prime field of size N, the number field sieve (NFS) begins with the seletion of two number rings R 1 and R 2 for whih there exist maps φ 1 : R 1 Z/N Z and φ 2 : R 2 Z/N Z. An element in a number ring is said to be smooth with respet toaboundb if eah prime fator of its norm in Z is at most B. OneR 1 and R 2 are obtained, sieving tehniques are used to ollet many pairs (β 1,β 2 ) R 1 R 2 suh that β 1 and β 2 are smooth with respet to an optimally hosen bound and suh that φ 1 (β 1 )=φ 2 (β 2 ). Finally, a massive linear algebra omputation leads to the desired fators or logarithms. The hallenge when hoosing R 1 and R 2 is to minimize the size of the norms being tested for smoothness. Our purpose in this setion is to desribe a method for hoosing rings whih is partiularly well-suited to the ase that N is of low weight. The algorithm we present is an extension of the speial number field sieve (SNFS), whih is designed for inputs N of the form kr + s. We give a brief overview of the SNFS in the event that k = 1. In this ase, one of the number rings used is Z, and the other is obtained by adjoining to Z arootα Cof the polynomial f = X d + sr,

4 586 OLIVER SCHIROKAUER where d is the preomputed optimal degree of f and is the smallest multiple of d greater than or equal to. Observethatr /d is a root of f mod N. Therefore, the anonial ring homomorphism from Z Z/N Z an be extended to Z[α] by sending α to r /d + NZ. The pairs heked for smoothness in the algorithm are of the form (a br /d,a bα), with a, b Z. Sine the norm of a bα is equal to b d f(a/b), the oeffiients of f have a signifiant impat on the size of the smoothness andidates. In the speial ase that r and s are small, these andidates are muh smaller than those arising in the general NFS, and as a result, the SNFS is the faster method. Sine our fous is on the polynomial onstrution that ours at the beginning of the NFS and sine there are many good aounts of the NFS available, we do not provide a omplete desription here of how to fator N or determine logarithms mod N for a low weight input N. Instead, we arry the story line only through the sieving stage. For a desription of the remaining steps, see [1] and [15] in the ase of fatoring and [3] and [13] in the ase of disrete logarithms. Algorithm 2.1 (Extended SNFS). This algorithm takes as input a positive, odd integer N of weight w, representedasthesum w ɛ i 2 i, i=1 with w > w 1 >... > 1 = 0 and ɛ 1,...,ɛ w {1, 1}, as well as integer parameters e, B, M, J > 0, with e w. Its purpose is to produe a matrix A whih an be used for fatoring N or omputing disrete logarithms mod N. In what follows, B serves as a smoothness bound, M determines the size of the region sieved for smooth elements, and J is used to speify how many smooth pairs are needed. Step 1. This step is devoted to produing a polynomial with integral oeffiients and a root mod N. The goal is to have the oeffiients and root be small. For i =1,...,w, let i be the least non-negative residue of i mod e. In addition, let w+1 = e. Assume that σ is a permutation on the set {1,...,w,w+1} whih fixes w + 1 and has the property that the sequene (2.2) σ(1), σ(2),..., σ(w), σ(w+1) is non-dereasing, and let I be the largest number suh that σ(i+1) σ(i) is greater than or equal to the differene between any other pair of onseutive terms in (2.2). Finally, write µ for the quantity e σ(i+1), and let w f = ɛ i 2 a i x b i, where a i = i + µ and b i = i /e if σ 1 (i) I, and a i = i σ(i+1) and b i = i /e +1 if σ 1 (i) >I. It is a straightforward matter to verify that (2.3) max a i = σ(i) + µ = e ( σ(i+1) σ(i) ) and that f(2 e )=2 µ N. i=1

5 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT 587 Notie that the weight of N does not appear in (2.3) but instead influenes the bound on the size of the oeffiients of f indiretly by imposing a lower bound on the size of the maximal gap in sequene (2.2). In the ase that N is prime, it follows from a result in [4] that f is irreduible. In the ase that N is omposite and f fatorsintoaprodutg 1...g m of non-onstant irreduible polynomials, we either obtain a splitting of N by plugging 2 e into the fators of f or we find that g i (2 e ) is a multiple of N for some i. In the former ase, our problem is solved, and in the latter, replaing f by g i only improves the algorithm that follows. For this reason, we assume from this point onwards that f is irreduible. Let α C be a root of f and let O be the ring of integers of Q(α). If f is moni, then the desription of the next two steps is easily reoniled with the outline of the NFS given at the beginning of this setion. As in our sketh of the SNFS, the two rings being used are Z and Z[α] and the pairs being tested for smoothness are of the form (a b2 e,a bα), where a and b are integers. If f is not moni, then almost no adjustments are required in the omputations in the algorithm but the algebrai struture underlying the method is somewhat different. We refer the reader to 12 of [1] for a disussion of this ase. Step 2. Let d bethedegreeoff, let be the disriminant of f, and let T be the set of prime ideals of degree one in O whih lie over a rational prime whih is prime to and at most B. The objetive of this step is to find all pairs (a, b) of relatively prime integers satisfying a M and 0 <b M suh that (2.4) (a b2 e )b d f(a/b) is B-smooth and prime to. This an be aomplished by means of a sieve ([1],[9]). Call the set of pairs passing the smoothness test U. If U <π(b)+ T + J, then the algorithm is not suessful and terminates. Step 3. In this step, we onstrut the matrix A. For eah rational prime q, letν q denote the valuation of Q assoiated to q, and similarly, for eah prime ideal q O, let ν q be the valuation of Q(α) orresponding to q. LetU be a subset of U of size π(b)+ T + J. Foreah(a, b) U, ompute ν q (a b2 e )forq B and ν q (a bα) for q T, and let v(a, b) be the vetor whose oordinates are these values. Finally, let A be the matrix whose olumns are the vetors v(a, b). Note that the norm of a bα is b d f(a/b), k where k is the leading oeffiient of f, andthatforq T lying over a rational prime not dividing k, the oordinate ν q (a bα) is equal to the exponent to whih q divides b d f(a/b) intheasethatk(a bα) isinq and is 0 otherwise. The ase that q lies over a prime divisor of k is addressed in 12 of [1]. This ompletes the desription of Algorithm 2.1. The soures ited prior to Algorithm 2.1 desribe how to fator N or ompute logarithms mod N by solving one or more ongruenes of the form A x v mod l, where l is prime, v is a speified vetor, x is unknown, and A is a modifiation of the matrix A. The purpose of J is to ensure that A has enough olumns so that suh a ongruene is likely to have a solution. In general, J is small and in the analysis that follows, we take it to be O(log N).

6 588 OLIVER SCHIROKAUER 3. Running time In this setion we provide a worst-ase running time analysis of Algorithm 2.1 for inputs of a fixed weight. As revealed by equation (2.3), the maximum size of the oeffiients of the polynomial f appearing in Step 1, and in turn the running time of the method, depend on the size of the largest gap in sequene (2.2). Sine this size an vary widely for different inputs of the same weight, we also onsider the performane of the method on average. In partiular, we onsider the set of all non-dereasing sequenes of a fixed length whose terms are non-negative integers at most a given bound and determine the average size of the largest gap in suh a sequene. This result gives a better indiation than the worst-ase analysis of the speedup that follows, both asymptotially and in pratie, from using a low weight input. The speial number field sieve (SNFS), desribed briefly in the previous setion and in detail in [9], serves as an initial point of referene. Its onjetural running time for input N = kr + s is (3.1) L N [1/3; (32/9) 1/3 + o(1)] for N with k, r and s bounded in absolute value. This is a signifiant improvement over the running time of the number field sieve (NFS) for general numbers, whih runs onjeturally in time (3.2) L N [1/3; (64/9) 1/3 + o(1)] for N.Intheasethatw = 2, the method for finding f in Algorithm 2.1 is the same tehnique as is used in the SNFS, and as w grows, we expet the running time of Algorithm 2.1 to span the distane between (3.1) and (3.2). Our first task is to determine preisely how this ours. Conjeture 3.3. Fix w and let θ =(2w 3)/(w 1). For eah positive, odd integer N of weight w, letj(n) be a positive integer and assume that J(N) is O(log N). Then for eah N as just desribed, there exists e, B, andm suh that Algorithm 2.1, upon input of N and parameters e, B, M, and J = J(N), produesamatrixa in time at most (3.4) L N [1/3; (32θ/9) 1/3 + o(1)] for N. Let N>3beanodd integer of weight w, represented as in Algorithm 2.1. That is, w N = ɛ i 2 i, i=1 with w > w 1 >... > 1 =0andɛ i {1, 1}. To obtain (3.4) as a onjetural running time, we let e = w /δ, where ( 3θ log N ) 1/3 δ =. 2 log log N As in 2, we denote by d thedegreeofthepolynomialf produed in Step 1 of the algorithm. We leave it to the reader to verify that for N suffiiently large, d = δ. In partiular, we see that (3.5) d = for N. ( (3θ + o(1)) log N ) 1/3 2 log log N

7 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT 589 We proeed to determine the size of the numbers whih are being tested for smoothness in Step 2 of the algorithm, that is, the numbers given in (2.4). In what follows, assume that N is suffiiently large that d = δ > 1. Sine the least non-negative residue of w mod e is less than d, the largest gap in sequene (2.2), all it γ, isatleast ( 1 ) e w 1 λ, where λ = d 1 e(w 1). Reall that the oeffiients of f are bounded in absolute value by 2 e γ. Thus the quantityin(2.4)isatmost 2dM d+1 (2 e ) 2 1 w 1 +λ. Letting θ =(2w 3)/(w 1) and using the fat that e = w /d, we see that this bound is less than or equal to 2dM d+1 (2 w ) (θ+λ)/d,whihisatmost (3.6) 2dM d+1 (2N) θ+λ d. The remainder of our argument in support of Conjeture 3.3 is the same as the one given in 11 of [1]. We sketh only the first part here. Consider the ase that Algorithm 2.1 is run with e as given and with B = M = L N [1/3; (4θ/9) 1/3 ]. Let z equal the quantity in (3.6). For any positive real numbers x and y, letψ(x, y) denote the number of integers at most x whih are y-smooth. It is shown in [2] that for any ɛ>0, (3.7) ψ(x, x 1/w ) x = w w(1+o(1)) for w, uniformly for x w w(1+ɛ). It follows that M 2 ψ(z, B) = B 1+o(1) z for N. Notethatwehavereliedhereonthefatthatdsatisfies (3.5) and that λ = o(1) for N. We now adopt the assumption that for N suffiiently large, the numbers tested for smoothness in the algorithm behave with respet to the property of being B-smooth like random numbers at most z. The reason that our result is onjetural is that this assumption is unproved. Sine the number of pairs (a, b) onsidered in Step 2 is approximately 12M 2 /π 2, we onlude that this step produes a set U of size B 1+o(1) for N. Under the assumption that J is O(log N), the threshold π(b)+ T + J giveninstep2isalsoequaltob 1+o(1). Thus, we might expet that U is suffiiently large that the algorithm sueeds. In fat, the values of B and M need only be adjusted slightly. To see that they an be hosen so that (3.8) B = M = L N [1/3; (4θ/9) 1/3 + o(1)] for N and so that Step 2 sueeds, see the analysis supporting Conjeture 11.4 in [1]. Finally note that Step 2 runs in time M 2+o(1) and that when d satisfies (3.5) and J is O(log N), Step 3 runs in time at most B 2+o(1),evenintheasethat no information about the fatorization of (2.4) is retained from the sieving proess

8 590 OLIVER SCHIROKAUER and trial division is used to ompute the needed valuations. Both quantities equal (3.4) when (3.8) holds. This onludes our argument in support of Conjeture 3.3. The running time given in Conjeture 3.3 is best possible in the following sense. Let z denote the quantity in (3.6), and assume that the input parameters B and M satisfy M 2 ψ(z, B) B 1+o(1) z for N, as we believe they must for Algorithm 2.1 to sueed. Then it is possible to show rigorously that M is at least L N [1/3; (4θ/9) 1/3 + o(1)]. See 10 and 11 of [1] for details. Conjeture 3.3, however, does not give the right answer. It turns out that for w>2, it is not possible to find an infinite set of integers for whih the bound in (3.6) is attained. Indeed, we might expet that for fixed w, Algorithm 2.1 would runintime(3.4)forn of the form w 2 2 η w 1 i + 2, i=0 where η = ( 3θ log 2 ) 1/3. 2loglog 2 Certainly, for these numbers, if e is set equal to η, then Step 1 of Algorithm 2.1 produes a polynomial of degree d satisfying (3.5), the bound (3.6) is the right one to use, and the algorithm runs in time (3.4). However, hoosing e to be a little larger improves the asymptoti running time by foring the largest gap in sequene (2.2) to be greater than e/(w 1). More generally, we have the following strategy. Assume we are given as input an integer N of weight w, represented as w i=1 ɛ i2 i, with ɛ i {1, 1} and w > i for i =1,...,w 1. Assume also that w w and let δ be a multiple of w whih is at most w. We proeed by produing two polynomials aording to the method desribed in Step 1 of Algorithm 2.1, one with e equal to e 1 = w /δ and the other with e set equal to e 2 = e 1 w/(w 1). We then ontinue the algorithm with the polynomial whih produes the smaller smoothness andidates. It turns out that when we optimize this method, we obtain for all w>2, a running time whih is slightly better than that of Conjeture 3.3. To see why this is so, first note that beause w divides δ, the least non-negative residue of w mod e 2 is less than 2δ and hene asymptotially negligible. Next let γ 1 be the largest gap in sequene (2.2) in the ase that e 1 is used, define γ 2 analogously, and observe that if γ 1 is lose to e 1 /(w 1), then the least non-negative residue mod e 1 of eah i is neessarily lose to a multiple of e 1 /(w 1). It follows that, in this ase, γ 2 is lose to me 1 /(w 1) with m 2. Thus, when e 1 is not a good hoie, γ 2 is signifiantly better than the worst-ase value of e 2 /(w 1). We leave the remaining details to the interested reader and offer instead the following result, whih shows that the room for improvement over Conjeture 3.3 is quite small. Conjeture 3.9. Fix w and let 2w τ =. w 1

9 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT 591 Then there exists an infinite set of integers of weight w with the property that for N in this set, the time required by Algorithm 2.1 to produe a matrix A is at least (3.10) L N [1/3; (32τ 2 /9) 1/3 + o(1)] for N. The seondary onstant in (3.10) is, of ourse, bounded by the seondary onstant in the running time proposed in Conjeture 3.3. Figure 3.11 gives the values of these onstants for small values of w. All entries are rounded to the nearest thousandth. We note that in the ase that w = 2, our upper and lower bounds equal (32/9) 1/3 and that both onstants approah (64/9) 1/3 as w. λ (32τ 2 /9) 1/3 (32θ/9) 1/3 w = w = w = w = w = w = w = w = w = Figure 3.11 We delay the argument in support of Conjeture 3.9, in whih we expliitly demonstrate a set with the stated property, to the appendix at the end of the paper. For now we observe that, although Conjetures 3.3 and 3.9 give important information about Algorithm 2.1 and are easily juxtaposed with analogous onjetures for the SNFS and the general NFS, they are deeptive. On the one hand, the asymptoti improvement over the general NFS that they report suggests, overly optimistially, that for a given integer N, Algorithm 2.1 should be the method of hoie. However, for a given weight w, this improvement is not neessarily realized unless N is suffiiently large. Indeed, in 4 we observe that in the worst ase, Algorithm 2.1 runs faster than standard NFS methods only if w is at most of the order of d, that is, of the order of (log N/ log log N) 1/3. On the other hand, Conjetures 3.3 and 3.9 are overly pessimisti. As noted earlier, for a given input N, the running time of Algorithm 2.1 is not so muh determined by the weight of N but by the largest gap in sequene (2.2). As the next result shows, this gap is signifiantly greater on average than the value e/(w 1) used to obtain Conjeture 3.3, espeially when w is small. Proposition Let w and e be integers greater than or equal to 2. Let S = S(e, w) be the set of sequenes of length w 2 of non-negative integers less than e. For s S, let g(s) be the largest differene between onseutive terms of the sequene obtained by ordering the elements of s, together with the numbers 0 and e, from smallest to largest. Then the average value of g(s) as s ranges over S is (3.13) w 2 1 e w 2 k=1 k w 2 k (e!) G(e, k +2), (e k)!

10 592 OLIVER SCHIROKAUER where (3.14) G(e, k) = e e g g ( 1) j+1( k 1 e g= (k 1) j j=1 ) e jg l=1 ( e k 2 ( 1) l+1( k 2 l 1 )( e 1 (j+l 1)g k (j+2) ). Proof. For a given w, lets 0 = S 0 (e, w) be the set of inreasing sequenes of length w 2 of non-negative integers less than e. We begin by alulating the average value of g(s) ass varies over S 0. We aomplish this by ounting, for a given value g, thenumberofs suh that g(s) =g. The first step is to determine for a given g, how many ways there are to partition e g into w 2 parts, subjet to the ondition that eah summand is at least 1 and at most g, and then to multiply by w 1 to aount for the fat that the maximum gap g an our at any one of the w 1 parts of e. Standard, elementary, ombinatorial tehniques yield the answer e/g ( w 2 (w 1) ( 1) j+1 j 1 j=1 )( e 1 jg w 3 Of ourse, this tally is too large sine those partitions of e ontaining more than one g have been ounted more than one. We thus need to subtrat off the number of ways to partition e 2g into w 3 parts, multiplied by ( ) w 1 2, add bak in the number of ways to partition e 3g into w 4 parts, multiplied by ( ) w 1 3,andso on. Multiplying the resulting alternating sum by g, summing over all the possible values of g, and dividing by S 0 yields the value G(e, w) given in (3.14). Sine G(e, w) is also the average value of g(s)assranges over the set of sequenes of length w 2 of distint non-negative integers less than e, it only remains to handle those sequenes in S(e, w) with repeated terms. We lassify these aording to how many distint terms eah suh sequene ontains. In partiular, we observe that for k =1,...,w 2, the number of sequenes in S(e, w) ontaining k distint terms is k w 2 k S 0 (e, k). The average value of g(s) for these sequenes is G(e, k +2). We find, therefore, that the average value of g(s) overs(e, w) is w 2 k=1 k w 2 k S 0 (e, k) G(e, k +2). S(e, w) This expression is the same as (3.13), and the proof of the proposition is omplete. Proposition 3.12 gives us an idea of what to expet when running Algorithm 2.1 on a number N of weight w. Let be the largest exponent appearing in the weight w representation of N. Then the quantity in (3.13) represents, roughly speaking, the size of the gap we an expet in sequene (2.2) when Algorithm 2.1 is run with e hosen so that the least non-negative residue of mod e is negligible. It is easy enough to ompare this value with the worst-ase value of e/(w 1). We an make a omparison, however, that does not depend on e by noting that (3.13) is asymptotially linear in e. Thatis,ase with w fixed, the ratio of (3.13) to e approahes a onstant whih we all κ w. In Figure 3.15, we give for small w, the value of (3.13) divided by e when e = 200 and when e = 1000, the value of κ w, and for omparison, the value of 1/(w 1). All entries are rounded to the nearest thousandth. ). )

11 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT 593 e = 200 e = 1000 κ w 1/(w 1) w = w = w = w = w = w = w = w = Figure 3.15 The hart reveals learly that one an expet in pratie to fare muh better than one would in the worst ase. Going one step further, we an substitute 2 κ w for θ in (3.6) and modify the statement of Conjeture 3.3 aordingly. In partiular, quantity (3.4) with θ replaed by 2 κ w represents a kind of average running time for Algorithm 2.1 to sueed upon input of an integer of weight w. We leave a preise formulation of this statement to the reader. We onlude this setion by remarking that the algorithms whih use the matrix A produed by Algorithm 2.1 to fator N or ompute disrete logarithms mod N have running times dominated by a linear algebra omputation whih runs in time B 2+o(1) for N. Sine (3.4) is equal to B 2+o(1) for the value of B given in (3.8) and sine (3.10) is a lower bound, we see that Conjetures 3.3 and 3.9 apply to the full fatoring and disrete logarithm algorithms that inorporate Algorithm Examples In pratie, when onfronted with a partiular N whih one wants to fator or modulo whih one wants to ompute logarithms, asymptoti results are of limited interest. One simply wants to hoose the best method for the number at hand. In this setion, we ompare the performane of Algorithm 2.1 with that of other versions of the number field sieve (NFS). The hief fator in determing how fast the sieving stage of these methods runs for a given input is the size of the integers being tested for smoothness. The algorithm to hoose is the one with the smallest smoothness andidates. In the standard NFS for fatoring, these numbers are at most (4.1) 2(d +1)M d+1 N 2/(d+1), where M as usual is the bound on the size of the oeffiients of the elements onsidered for smoothness and d is the degree of the proper extension of Q employed in the algorithm. In the ase of disrete logarithms modulo a prime, the best approah is due to Joux and Lerier and makes use of two extensions of Q generated by the roots of two polynomials whih have a shared root mod N and whose degrees are onseutive integers ([5]). The smoothness andidates in this method are bounded by ( d 2 (4.2) 4 + 3d ) 2 +2 M d+1 N 2/(d+2), where d + 1 is the sum of the degrees of the two extensions. Note that this sum is neessarily odd. The method of Joux and Lerier an be modified so that two

12 594 OLIVER SCHIROKAUER extensions with degrees over Q of the same parity are used. In this ase, however, the bound on the smoothness andidates is at least as big as (4.1). Comparison of (4.1) and (4.2) with the orresponding bound appearing in the analysis supporting Conjeture 3.3 provides some information about how Algorithm 2.1 measures up to other versions of the NFS. For instane, if we ignore the small fators in (3.6) and (4.1) and ompare M d+1 N θ/d,whereθ =(2w 3)/(w 1), with M d+1 N 2/(d+1), we see that in the worst ase Algorithm 2.1 only outperforms other NFS methods if w is bounded by a value lose to (d+3)/2. Sine the optimal value of d grows very slowly with respet to N, this ondition represents a severe restrition on w. The usefulness of suh a omparison, however, is ompromised by the fat that (3.6) is, in general, a poor estimate for the size of the largest smoothness andidate tested in Algorithm 2.1, whereas the bounds for the other methods are generally attained. A omparison of methods, therefore, should be made on a ase by ase basis, using (4.1), (4.2) for d even, and a tighter bound for Algorithm 2.1. This is preisely what we do with the examples from [6]. We begin with the three examples that involve the omputation of logarithms in prime fields. The remaining four examples onern logarithms in fields of degree two and are disussed subsequently. Let N be a prime input to Algorithm 2.1, given in signed-binary form. Let be the largest exponent appearing in this representation. The upper bound we use for the size of the smoothness andidates arising in the algorithm is the quantity 2dM d+1 2 2e γ, where for a given e, weletγ be the largest gap in sequene (2.2) and for a given d, we hoose e between /(d +1) and /(d 1) so as to minimize the exponent 2e γ. For fixed d, we an easily ompare this value to (4.1) and (4.2), sine the M d+1 term an be ignored. When we ompare bounds for different values of d, however, the dependeny on M reates a problem. We overome this diffiulty by minimizing for a given d, the maximum of M and the smoothness bound B, subjet to the onstraint that suffiiently many smoothness pairs are found during the sieving stage of the algorithm. We use the resulting minima for our rankings. Our hoie of max{m,b} as target funtion reflets our desire to take into aount the linear algebra step that dominates the NFS one the sieving is omplete. Indeed, at least asymptotially, this is the right funtion to minimize sine the sieve in the NFS runs in time M 2+o(1) and the linear algebra runs in time B 2+o(1). Proeeding with the optimization, we approximate the number of smooth pairs olleted in the NFS, as we did in 3, by (12/π 2 )M 2 ψ(z, B), z where z is a bound on the size of the smoothness andidates. The number of pairs needed is roughly equal to the number of degree one prime ideals of norm at most B in the two rings being used. For eah ring, this number is approximately the number of rational primes at most B ([16]), so we adopt the value 2B/log B as our estimate for the number of smooth pairs required. Finally, we use (3.7), with the o(1) dropped, to approximate ψ(z, B)/z. We arrive then at the problem of minimizing, for a given d and a given expression for the bound z, the value of max{m,b} subjet to the ondition that

13 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT 595 M 2 u u log B π2 B 6, where u = (log z)/ log B. By omparing the values produed, as we vary d and the NFS version used, we an determine whih algorithm is fastest for N and obtain an estimate for its running time in this ase. We aution, however, that the estimates we find this way are very rough and are generally higher than those produed by means of extrapolation tehniques suh as are used in [7]. For eah example that follows, we report for a range of values of d, the bit length of z/m d+1 evaluated for eah of the three expressions for z under onsideration and the outome of the optimization problem for the ase that z/m d+1 is minimal. Though they are not of pratial interest, we inlude the values obtained when z is given by (4.2) and d is odd. In no ase do these yield an estimated running time faster than the one obtained by onsidering the other bounds given. For those N for whih Algorithm 2.1 is the best hoie, we also ompute an estimate of the size of a general prime for whih the NFS variation of Joux and Lerier runs in time approximately equal to that required by Algorithm 2.1 to ompute logarithms mod N. More speifially, we determine the bit length of the smallest general prime having the property that, as we let d vary over the positive even integers, the smallest solution to the optimization problem just desribed using bound (4.2) is equal to the optimal value of max{m,b} assoiated to N. This bit length then an be thought of as a measure of the NFS-seurity of N. The reader an hek that these seurity estimates do not hange if the solutions to the minimization problem using (4.1) for d oddaretakenintoaount. For eah example that follows, we only inlude data for those d whih are lose to optimal. In eah ase, the interval from ((3/2) log N/ log log N) 1/3 to (3 log N/ log log N) 1/3 is ontained in the range of values of d presented. All entries in the harts are bit lengths. Only powers of 2 were onsidered when determining the optimal values of max{m,b}. In those ases that we give the NFS-seurity of a prime, we round to the nearest 10. Example 4.3. We onsider the weight 7 prime In this ase, we find that the method of Joux and Lerier beats Algorithm 2.1. The values given below in the max{m,b} olumn are obtained using the bound from the former method. We note that there are values of d for whih the polynomial obtained using Algorithm 2.1 is superior to the pair given by the method of Joux and Lerier. Indeed, when the bit length of e is lose to 90 or 180, the polynomial produed by Algorithm 2.1 has very small oeffiients. The degree in these ases, however, is far too large to be pratial. 2d2 2e γ 2(d +1)N 2/(d+1) ( d d 2 +2)N2/(d+2) max{m,b} d = d = d = d = d = d =

14 596 OLIVER SCHIROKAUER Example 4.4. Our seond example, also of weight 7, is the prime In this ase, we find that Algorithm 2.1 is the winner. Moreover, the value of 102 bits in the max{m,b} olumn orresponds to the optimal value of max{m,b} obtained when using the method of Joux and Lerier on a prime of 7310 bits. Thus the NFS-seurity of this prime is only about 7310 bits. 2d2 2e γ 2(d +1)N 2/(d+1) ( d d 2 +2)N2/(d+2) max{m,b} d = d = d = d = d = Example 4.5. Our final example for disrete logarithms in a prime field is the field of size One again, we find that Algorithm 2.1 is the best method. Based on the optimal max{m,b} for d = 14, we estimate the NFS-seurity of this prime to be approximately bits. 2d2 2e γ 2(d +1)N 2/(d+1) ( d d 2 +2)N2/(d+2) max{m,b} d = d = d = d d = The remaining examples involve fields of degree two over their prime field. Let F be suh a field and denote by N its harateristi. Logarithms an be omputed in F using the NFS in muh the same way as in the prime ase. The major differene stems from the fat that F annot be represented as a quotient of Z but instead is represented as the quotient of an order of a quadrati extension K of Q. As a result, the number fields employed in the NFS are extensions of K. In one approah, K itself is used in onjuntion with a field produed by adjoining to K the root of a polynomial with integral oeffiients, preferably small, whih has a root mod N, also preferably small ([13]). Suh a polynomial an be obtained by the usual methods employed in fatoring versions of the NFS or, in the ase that N has small weight, by the tehnique given in the first step of Algorithm 2.1. A seond approah is to follow the method of Joux and Lerier and produe two polynomials with a shared root mod N and, in turn, two extensions of K. Regardless of strategy, if we define M suitably and make various simplifying assumptions regarding the

15 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT 597 ompliations introdued by the replaement of Q by K, we arrive at the same optimization problem as in the prime ase, exept that the fators other than M d+1 appearing in the formula adopted for z must be squared. For the examples that follow, therefore, we provide the same data as given in the harts above exept that the bit lengths in the first three olumns are omputed using the squares of the expressions used previously. For eah finite field, we again inlude an estimate of the field s NFS-seurity. Beause the weights of the primes in these examples are so low, Algorithm 2.1 registers signifiant gains. Example 4.6. Our first example of a field of degree two is the one of harateristi The optimal max{m,b} value of 42 for d =6andd = 7 orresponds to what we expet for a degree-two field of approximately 850 bits. Note that the best bounds for d =2andd = 5 are obtained using the expression assoiated to the method of Joux and Lerier. Of ourse, in the ase that d = 5, this bound is not realized beause d + 1 is even. 4d 2 2 2(2e γ) 4(d +1) 2 (N 2 ) 2/(d+1) ( d2 + 3d )2 (N 2 ) 2/(d+2) max {M,B} d = d = d = d = d = d = d = Example 4.7. Our next example is the degree-two field of harateristi Based on the ase d = 7, we obtain an NFS-seurity of approximately 2240 bits, whih is signifiantly lower than the 3162 bit size of the field. 4d 2 2 2(2e γ) 4(d +1) 2 (N 2 ) 2/(d+1) ( d2 + 3d )2 (N 2 ) 2/(d+2) max {M,B} d = d = d = d = d = d = Example 4.8. In this example, we onsider the prime We estimate that the NFS-seurity of the field of degree two in this ase is 5780 bits, again far below the size of the field.

16 598 OLIVER SCHIROKAUER 4d 2 2 2(2e γ) 4(d +1) 2 (N 2 ) 2/(d+1) ( d2 + 3d )2 (N 2 ) 2/(d+2) max {M,B} d = d = d = d = d = d = Example 4.9. Our final example is the weight 3 prime Our estimate for the NFS-seurity for the field in this ase is merely 9520 bits. 4d 2 2 2(2e γ) 4(d +1) 2 (N 2 ) 2/(d+1) ( d2 + 3d )2 (N 2 ) 2/(d+2) max {M,B} d = d = d = d = d = d = d = d = Appendix This additional setion is devoted to providing support for Conjeture 3.9, whih we relabel and restate here. We ontinue with the notation introdued in 2 and in 3. Conjeture A.1. Fix w, andlet 2w τ =. w 1 Then there exists an infinite set S of integers of weight w with the property that for N S, the time required by Algorithm 2.1 to produe a matrix A is at least (A.2) L N [1/3; (32τ 2 /9) 1/3 + o(1)] for N. We proeed by exhibiting a set S with the stated property. Fix w and for any positive real number ρ and any integer 2, let ( log 2 ) 1/3 h = h ρ () =ρ. log log 2 Intheasethat (w 1)(h + 1), let w 2 N ρ () =2 + 2 (w 1)(h+1) i. Finally, let ζ = i= ( 2 3 τ)1/3.

17 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT 599 Our set S then is the set of numbers N ζ (). To determine what happens when the numbers in S are input into Algorithm 2.1, we onsider more generally how the algorithm performs on inputs of the form N = N ρ () for some arbitrary but fixed ρ. We distinguish between three ases, basedonthesizeofthedegreed of the polynomial f produed in Step 1. Critial to our approah is the observation that, as a onsequene of the way in whih f is formed, the parameter e and the degree d satisfy d +1 e d 1. From this point forward, we write w 1 in plae of /((w 1)(h +1)) (w 2). d+1 h+1 Case 1. Assume that d h. Then e, and onsequently, e w 1 h +1 (w 2) (w 1)(h +1) (w 1) (w 2) (w 1)(h +1) (w 1)(h +1). (w 1)(h +1) Beause of the speial form of N, the maximal gap in sequene (2.2) is equal either to /((w 1)(h +1)) or to e w 1, depending on where the least non-negative residue of mod e appears in the sequene. In both ases, this maximal gap is at most e w 1, and we onlude that the maximum absolute value of the smoothness andidates in Step 2 is at least M d+1 (2 e 1)2 e (e w 1) = M d+1 (2 e 1)2 (w 2) (w 1)(h+1). Note that this quantity is bounded below by l 1 M d+1 (2 ) 1 d+1 + w 2 (w 1)(h+1) for some onstant l 1 whih does not depend on. Case 2. Assume that h<d (w 1)h. Then e d 1 < h 1. If e is in addition less than w 1, then the largest gap in sequene (2.2) is at most /((w 1)(h +1)). If e is not less than w 1,thenit may be that the largest gap in (2.2) is equal to e w 1 and that this differene is greater than /((w 1)(h +1)). However, e w 1 h 1 (w 2) (w 1)(h +1) (w 1)(h +1) + 2 h w 2. We onlude that the maximum absolute value of the smoothness andidates in Algorithm 2.1 is at least whihisatleast M d+1 (2 e 1)2 e (w 1)(h+1) 2 h 2 (w 2) 1, (A.3) l 2 M d+1 (2 ) 2 d+1 1 (w 1)(h+1) 2 h 2 1

18 600 OLIVER SCHIROKAUER for some onstant l 2. Observe that the upper bound on d ensures that the exponent on 2 in (A.3) is greater than or equal to 1 d +1 2 h 2 1, whih itself is bounded below by 1 d +1 2(w 1) (h 1)(h(w 1) + 1) 1+o(1) d +1, where the o(1)isfor, uniformly in d. Case 3. Assume that d>(w 1)h. In this ase, we draw no onlusions about the oeffiients of the polynomial f and simply point out that the maximum absolute value of the numbers tested for smoothness in Algorithm 2.1 is at least M d+1 (2 e 1). This lower bound, in turn, is at least l 3 M d+1 (2 ) 1 d+1 for some onstant l 3. Considering Cases 1-3 together, we see that when Algorithm 2.1 is run with input N = N ρ (), the maximum absolute value of the smoothness andidates is at least z = z(, d) =lm d+1 2 β, where l is the minimum of l 1,l 2, and l 3 and 1 d+1 + w 2 (w 1)(h+1) if d h, 2 β = β(, d) = d+1 1 (w 1)(h+1) 2 h 2 1 if h<d (w 1)h, 1 d+1 if (w 1)h <d. Reall here that h depends on ρ and is a funtion of. Sine we are interested in a lower bound on the running time of Algorithm 2.1, we an assume that all the smoothness andidates are, in fat, bounded by z in absolute value. If we then assume that these numbers behave with respet to B-smoothness as random numbers bounded by z, we find that any value of M whih is suffiiently large that the method sueeds must satisfy (12/π 2 )M 2 ψ(z, B) π(b)+ T + J, z where T and J are as in the desription of the algorithm. Next, we rely on results from 10 of [1]. In partiular, Lemma 10.1 tells us that beause π(b)+t + J B 1+o(1) for B, we are guaranteed that M 2 L z [1/2; 2+o(1)], where the o(1) is for z. Lemma then supplies the neessary manipulations to onlude that 2 log M is at least ( ) (A.4) (1 + o(1)) d log d + (d log d) log(2 β ) log log(2 β ) for, uniformly in d, aslongaswerestritourselvestopairs(, d) suh that (i) log(2 β ) 1for suffiiently large and (ii) d +log(2 β ) as, uniformly in d.

19 THE NUMBER FIELD SIEVE FOR INTEGERS OF LOW WEIGHT 601 This onstraint, however, is of no onsequene. The fat that (A.5) β 1+o(1) d +1 for, uniformly in d, implies that ondition (ii) is satisfied. With regard to (i), observe that in Step 2 of Algorithm 2.1, the numbers tested for smoothness are greater than 2 d in absolute value whenever the oeffiients a and b are greater than 1. As stated in the disussion of Conjeture 3.3, the running time given in that onjeture annot be improved upon if we maintain the assumption that the smoothness andidates in Step 2 behave like random positive integers at most the quantity given in (3.6). The reader an verify that with all parameters optimized, (3.6) is equal to L N [2/3; ζ] forsomeonstantζ. We onlude that the only (, d) of interest are those for whih 2 d L N [2/3; ζ], in whih ase d +1</2. For suh (, d), ondition (i) is now met as a onsequene of (A.5). Our final task is to minimize (A.4). Following 11 of [1], we note that for eah of the three ases used to formulate the funtion β, this is aomplished by having (d log d) 2 be of the same order of magnitude as the term aompanying it under the square root sign. Using (A.5) and the fat that β is bounded above by 2/(d +1), we determine that in eah ase, d must be of the same order of magnitude as (log 2 / log log 2 ) 1/3. We proeed to express (A.4) as a funtion of by using the definitions of β and h, and by substituting k(log 2 / log log 2 ) 1/3 for d. As a result, we find that the minimum of (A.4) is (A.6) (m + o(1))(log 2 ) 1/3 (log log 2 ) 2/3, where the o(1)isfor and m is the minimum value of ( k 3 + ( f ρ (k) = k 3 + ( k 3 + k k + 4(w 2) 3(w 1)ρ k k k 3k 4 3(w 1)ρ ) 1 2 ) 1 2 ) 1 2 if k ρ, if ρ k (w 1)ρ, if k (w 1)ρ. Sine 2 <N ρ () < 2 +1, we an replae the quantity 2 in (A.6) with N ρ (). All thatremainsthenistoletρ equal the onstant ζ defined at the beginning of the appendix. We leave it to the reader to verify that the minimum of f ζ (k) ours at k =(3τ 2 /2) 1/3 and k =(3τ 2 /2) 1/3 / 2 and is equal to (32τ 2 /9) 1/3. Sine (A.6) is a lower bound for 2 log M and the time required by the sieve in Step 2 of Algorithm 2.1 is equal to M 2+o(1), we see that the running time of the method is at least (A.2) on the set of numbers N ζ (). This onludes our argument in support of Conjeture A.1. Aknowledgement The author wishes to thank Neil Koblitz and Alfred Menezes for inquiring about a low weight version of the number field sieve and for their subsequent omments on this paper.

20 602 OLIVER SCHIROKAUER Referenes [1] J.P. Buhler, H.W. Lenstra, Jr., C. Pomerane, Fatoring integers with the number field sieve, in [8], pp MR [2] E.R. Canfield, P. Erdös, C. Pomerane, On a problem of Oppenheim onerning fatorisatio numerorum, J. Number Theory 17 (1983), MR (85j:11012) [3] A. Commeine, I. Semaev, An algorithm to solve the disrete logarithm problem with the number field sieve, Publi Key Cryptography, Leture Notes in Comput. Si., vol. 3958, Springer-Verlag, Berlin, 2006, pp MR [4] M. Filaseta, A further generalization of an irreduibility theorem of A. Cohn, Canad. J. Math. 34 (1982), MR (85g:11014) [5] A. Joux, R. Lerier, Improvements on the general number field sieve for disrete logarithms in prime fields, Math.Comp.72 (2003), MR (2003k:11192) [6] N. Koblitz, A. Menezes, Pairing-based ryptography at high seurity levels, Cryptography and Coding: 10th IMA International Conferene, Leture Notes in Comput. Si, vol. 3796, Springer-Verlag, Berlin, 2005, pp MR (2007b:94235) [7] A.K. Lenstra, Unbelievable seurity: Mathing AES seurity using publi key systems, Advanes in Cryptology - ASIACRYPT 2001, Leture Notes in Comput. Si., vol. 2248, Springer- Verlag, Berlin, 2001, pp MR (2003h:94042) [8] A.K. Lenstra, H.W. Lenstra, Jr., (eds.), The development of the number field sieve, Leture Notes in Mathematis, 1554, Springer-Verlag, Berlin, MR (96m:11116) [9] A.K. Lenstra, H.W. Lenstra, Jr., M.S. Manasse, J.M. Pollard, The number field sieve, in[8], pp MR [10] G. Manku, J. Sawada, A loopless Gray ode for minimal signed-binary representations, 13th Annual European Symposium on Algorithms, Leture Notes in Comput. Si., vol. 3669, Springer-Verlag, Berlin, 2005, pp MR [11] K. MCurley, The disrete logarithm problem, Cryptology and Computational Number Theory, Pro. Sympos. Appl. Math., vol. 42, Amer. Math. So., Providene, RI, 1990, pp MR (92d:11133) [12] O. Shirokauer, Disrete logarithms and loal units, Theory and Appliations of Numbers without Large Prime Fators, Philos. Trans. Roy. So. London, Ser. A, vol. 345, Royal Soiety, London, 1993, pp MR (95:11156) [13] O. Shirokauer, The impat of the number field sieve on the disrete logarithm problem, Algorithmi Number Theory: Latties, Number Fields, Curves, and Cryptography, Mathematial Sienes Researh Institute Publiations, Cambridge University Press, Cambridge, [14] J. Solinas, Generalized Mersenne numbers, Tehnial Report CORR (1999). [15] P. Stevenhagen, The number field sieve, Algorithmi Number Theory: Latties, Number Fields, Curves, and Cryptography, Mathematial Sienes Researh Institute Publiations, Cambridge University Press, Cambridge, [16] P. Stevenhagen, H.W. Lenstra, Jr., Chebotarëv and his density theorem, The Mathematial Intelligener 18 (1996), MR (97e:11144) Department of Mathematis, Oberlin College, Oberlin, Ohio address: oliver.shirokauer@oberlin.edu