Complexity news: discrete logarithms in multiplicative groups of small-characteristic finite fields the algorithm of Barbulescu, Gaudry, Joux, Thomé

Transcription

1 Complexity news: discrete logarithms in multiplicative groups of small-characteristic finite fields the algorithm of Barbulescu, Gaudry, Joux, Thomé D. J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Advertisement, maybe related: iml.univ-mrs.fr/ati/ geocrypt2013/ , Tahiti. Submit talks this month! Also somewhat related: I m starting to analyze cost of NFS + CVP for class groups, unit groups, short generators of ideals, etc.; exploiting subfields (find short norms first), small Galois groups, etc. Anyone else working on this? Cryptanalytic applications: attack NTRU, Ring-LWE, FHE. I think NTRU should switch to random prime-degree extensions with big Galois groups.

2 ity news: logarithms in ative groups of aracteristic finite fields ithm of Barbulescu, Joux, Thomé rnstein y of Illinois at Chicago & he Universiteit Eindhoven ment, maybe related: v-mrs.fr/ati/ t2013/ 07 11, Tahiti. alks this month! Also somewhat related: I m starting to analyze cost of NFS + CVP for class groups, unit groups, short generators of ideals, etc.; exploiting subfields (find short norms first), small Galois groups, etc. Anyone else working on this? Cryptanalytic applications: attack NTRU, Ring-LWE, FHE. I think NTRU should switch to random prime-degree extensions with big Galois groups. Discrete Goal: Co group iso F! q Z= represent Algorithm h 1 ; h 2 ; : Algorithm log g h 1 ; l for some log m g g 7! 1, i

3 in ps of finite fields arbulescu, mé is at Chicago & iteit Eindhoven ybe related: /ati/ hiti. onth! Also somewhat related: I m starting to analyze cost of NFS + CVP for class groups, unit groups, short generators of ideals, etc.; exploiting subfields (find short norms first), small Galois groups, etc. Anyone else working on this? Cryptanalytic applications: attack NTRU, Ring-LWE, FHE. I think NTRU should switch to random prime-degree extensions with big Galois groups. Discrete logarithm Goal: Compute so group isomorphism F! q Z=(q 1), represented in the Algorithm input: h 1 ; h 2 ; : : : 2 F q. Algorithm output: log g h 1 ; log g h 2 ; : : for some g. log means the g g 7! 1, if it exists.

4 ds go & hoven d: Also somewhat related: I m starting to analyze cost of NFS + CVP for class groups, unit groups, short generators of ideals, etc.; exploiting subfields (find short norms first), small Galois groups, etc. Anyone else working on this? Cryptanalytic applications: attack NTRU, Ring-LWE, FHE. I think NTRU should switch to random prime-degree extensions with big Galois groups. Discrete logarithms Goal: Compute some group isomorphism F! q Z=(q 1), represented in the usual way Algorithm input: h 1 ; h 2 ; : : : 2 F q. Algorithm output: log g h 1 ; log g h 2 ; : : : 2 Z=(q for some g. log means the isomorphis g g 7! 1, if it exists.

5 Also somewhat related: I m starting to analyze cost of NFS + CVP for class groups, unit groups, short generators of ideals, etc.; exploiting subfields (find short norms first), small Galois groups, etc. Anyone else working on this? Cryptanalytic applications: attack NTRU, Ring-LWE, FHE. I think NTRU should switch to random prime-degree extensions with big Galois groups. Discrete logarithms Goal: Compute some group isomorphism F! q Z=(q 1), represented in the usual way. Algorithm input: h 1 ; h 2 ; : : : 2 F q. Algorithm output: log g h 1 ; log g h 2 ; : : : 2 Z=(q 1) for some g. log means the isomorphism g g 7! 1, if it exists.

6 ewhat related: ing to analyze FS + CVP groups, unit groups, erators of ideals, etc.; g subfields rt norms first), lois groups, etc. lse working on this? lytic applications: TRU, Ring-LWE, FHE. TRU should switch to prime-degree extensions Galois groups. Discrete logarithms Goal: Compute some group isomorphism F! q Z=(q 1), represented in the usual way. Algorithm input: h 1 ; h 2 ; : : : 2 F q. Algorithm output: log g h 1 ; log g h 2 ; : : : 2 Z=(q 1) for some g. log means the isomorphism g g 7! 1, if it exists. Generic on avera uniform, Want so

7 ated: lyze P nit groups, ideals, etc.; first), s, etc. g on this? ications: g-lwe, FHE. ld switch to ree extensions ups. Discrete logarithms Goal: Compute some group isomorphism F! q Z=(q 1), represented in the usual way. Algorithm input: h 1 ; h 2 ; : : : 2 F q. Algorithm output: log g h 1 ; log g h 2 ; : : : 2 Z=(q 1) for some g. log means the isomorphism g g 7! 1, if it exists. Generic log g alg on average q 1=2+o( uniform, q 1=3+o(1) Want something fa

8 , c.; E. to ions Discrete logarithms Goal: Compute some group isomorphism F! q Z=(q 1), represented in the usual way. Algorithm input: h 1 ; h 2 ; : : : 2 F q. Algorithm output: log g h 1 ; log g h 2 ; : : : 2 Z=(q 1) for some g. log means the isomorphism g g 7! 1, if it exists. Generic log algorithms: g on average q 1=2+o(1) operati uniform, q 1=3+o(1) non-unifo Want something faster.

9 Discrete logarithms Goal: Compute some group isomorphism F! q Z=(q 1), represented in the usual way. Generic log algorithms: g on average q 1=2+o(1) operations uniform, q 1=3+o(1) non-uniform. Want something faster. Algorithm input: h 1 ; h 2 ; : : : 2 F q. Algorithm output: log g h 1 ; log g h 2 ; : : : 2 Z=(q 1) for some g. log means the isomorphism g g 7! 1, if it exists.

10 Discrete logarithms Goal: Compute some group isomorphism F! q Z=(q 1), represented in the usual way. Algorithm input: h 1 ; h 2 ; : : : 2 F q. Algorithm output: log g h 1 ; log g h 2 ; : : : 2 Z=(q 1) for some g. log means the isomorphism g g 7! 1, if it exists. Generic log algorithms: g on average q 1=2+o(1) operations uniform, q 1=3+o(1) non-uniform. Want something faster. Basic index calculus : 1968 Western Miller, 1979 Merkle, 1979 Adleman, 1983 Hellman Reyneri, 1984 Blake Fuji-Hara Mullin Vanstone, 1985 ElGamal, 1986 Coppersmith Odlyzko Schroeppel, 1991 LaMacchia Odlyzko, 1993 Adleman DeMarrais, 1995 Semaev, 1998 Bender Pomerance.

11 logarithms mpute some morphism (q 1), ed in the usual way. input: : : 2 F q. output: og g h 2 ; : : : 2 Z=(q 1) g. eans the isomorphism f it exists. Generic log algorithms: g on average q 1=2+o(1) operations uniform, q 1=3+o(1) non-uniform. Want something faster. Basic index calculus : 1968 Western Miller, 1979 Merkle, 1979 Adleman, 1983 Hellman Reyneri, 1984 Blake Fuji-Hara Mullin Vanstone, 1985 ElGamal, 1986 Coppersmith Odlyzko Schroeppel, 1991 LaMacchia Odlyzko, 1993 Adleman DeMarrais, 1995 Semaev, 1998 Bender Pomerance. NFS : Gordon, Odlyzko, Weber D 1998 We Lercier, 2 Smart V FFS : 1 Coppersm Odlyzko, Gordon 1999 Ad Joux Le 2010/20 Wang M

12 s me usual way. : 2 Z=(q 1) isomorphism Generic log algorithms: g on average q 1=2+o(1) operations uniform, q 1=3+o(1) non-uniform. Want something faster. Basic index calculus : 1968 Western Miller, 1979 Merkle, 1979 Adleman, 1983 Hellman Reyneri, 1984 Blake Fuji-Hara Mullin Vanstone, 1985 ElGamal, 1986 Coppersmith Odlyzko Schroeppel, 1991 LaMacchia Odlyzko, 1993 Adleman DeMarrais, 1995 Semaev, 1998 Bender Pomerance. NFS : 1991 Schir Gordon, 1993 Schi Odlyzko, 1996 Sch Weber Denny, Weber Denn Lercier, 2006 Joux Smart Vercauteren FFS : 1984 Copp Coppersmith Dave Odlyzko, 1990 Mc Gordon McCurley, 1999 Adleman Hu Joux Lercier, /2012 Hayash Wang Matsuo Sh

13 . 1) m Generic log algorithms: g on average q 1=2+o(1) operations uniform, q 1=3+o(1) non-uniform. Want something faster. Basic index calculus : 1968 Western Miller, 1979 Merkle, 1979 Adleman, 1983 Hellman Reyneri, 1984 Blake Fuji-Hara Mullin Vanstone, 1985 ElGamal, 1986 Coppersmith Odlyzko Schroeppel, 1991 LaMacchia Odlyzko, 1993 Adleman DeMarrais, 1995 Semaev, 1998 Bender Pomerance. NFS : 1991 Schirokauer, 1 Gordon, 1993 Schirokauer, 1 Odlyzko, 1996 Schirokauer Weber Denny, 1996 Weber, 1998 Weber Denny, 2001 Jo Lercier, 2006 Joux Lercier Smart Vercauteren. FFS : 1984 Coppersmith, 1 Coppersmith Davenport, 19 Odlyzko, 1990 McCurley, 19 Gordon McCurley, 1994 Adl 1999 Adleman Huang, 2001 Joux Lercier, 2006 Joux Ler 2010/2012 Hayashi Shinoha Wang Matsuo Shirase Taka

14 Generic log algorithms: g on average q 1=2+o(1) operations uniform, q 1=3+o(1) non-uniform. Want something faster. Basic index calculus : 1968 Western Miller, 1979 Merkle, 1979 Adleman, 1983 Hellman Reyneri, 1984 Blake Fuji-Hara Mullin Vanstone, 1985 ElGamal, 1986 Coppersmith Odlyzko Schroeppel, 1991 LaMacchia Odlyzko, 1993 Adleman DeMarrais, 1995 Semaev, 1998 Bender Pomerance. NFS : 1991 Schirokauer, 1993 Gordon, 1993 Schirokauer, 1994 Odlyzko, 1996 Schirokauer Weber Denny, 1996 Weber, 1998 Weber Denny, 2001 Joux Lercier, 2006 Joux Lercier Smart Vercauteren. FFS : 1984 Coppersmith, 1985 Coppersmith Davenport, 1985 Odlyzko, 1990 McCurley, 1992 Gordon McCurley, 1994 Adleman, 1999 Adleman Huang, 2001 Joux Lercier, 2006 Joux Lercier, 2010/2012 Hayashi Shinohara Wang Matsuo Shirase Takagi.

15 log algorithms: g ge q 1=2+o(1) operations q 1=3+o(1) non-uniform. mething faster. dex calculus : 1968 Miller, 1979 Merkle, leman, 1983 Hellman 1984 Blake Fuji-Hara anstone, 1985 ElGamal, ppersmith Odlyzko el, 1991 LaMacchia 1993 Adleman is, 1995 Semaev, nder Pomerance. NFS : 1991 Schirokauer, 1993 Gordon, 1993 Schirokauer, 1994 Odlyzko, 1996 Schirokauer Weber Denny, 1996 Weber, 1998 Weber Denny, 2001 Joux Lercier, 2006 Joux Lercier Smart Vercauteren. FFS : 1984 Coppersmith, 1985 Coppersmith Davenport, 1985 Odlyzko, 1990 McCurley, 1992 Gordon McCurley, 1994 Adleman, 1999 Adleman Huang, 2001 Joux Lercier, 2006 Joux Lercier, 2010/2012 Hayashi Shinohara Wang Matsuo Shirase Takagi. FFS, c Shimoya Detrey G Videau Z Barbules Gaudry Zimmerm

16 orithms: 1) operations non-uniform. ster. lus : Merkle, 83 Hellman e Fuji-Hara 1985 ElGamal, Odlyzko amacchia eman emaev, erance. NFS : 1991 Schirokauer, 1993 Gordon, 1993 Schirokauer, 1994 Odlyzko, 1996 Schirokauer Weber Denny, 1996 Weber, 1998 Weber Denny, 2001 Joux Lercier, 2006 Joux Lercier Smart Vercauteren. FFS : 1984 Coppersmith, 1985 Coppersmith Davenport, 1985 Odlyzko, 1990 McCurley, 1992 Gordon McCurley, 1994 Adleman, 1999 Adleman Huang, 2001 Joux Lercier, 2006 Joux Lercier, 2010/2012 Hayashi Shinohara Wang Matsuo Shirase Takagi. FFS, continued: Shimoyama Shino Barbulesc Detrey Gaudry Je Videau Zimmerma Barbulescu Bouvie Gaudry Jeljeli Tho Zimmermann.

17 ons rm., n ra mal, NFS : 1991 Schirokauer, 1993 Gordon, 1993 Schirokauer, 1994 Odlyzko, 1996 Schirokauer Weber Denny, 1996 Weber, 1998 Weber Denny, 2001 Joux Lercier, 2006 Joux Lercier Smart Vercauteren. FFS : 1984 Coppersmith, 1985 Coppersmith Davenport, 1985 Odlyzko, 1990 McCurley, 1992 Gordon McCurley, 1994 Adleman, 1999 Adleman Huang, 2001 Joux Lercier, 2006 Joux Lercier, 2010/2012 Hayashi Shinohara Wang Matsuo Shirase Takagi. FFS, continued: 2012 Hay Shimoyama Shinohara Taka Barbulescu Bouvier Detrey Gaudry Jeljeli Thom Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videa Zimmermann.

18 NFS : 1991 Schirokauer, 1993 Gordon, 1993 Schirokauer, 1994 Odlyzko, 1996 Schirokauer Weber Denny, 1996 Weber, 1998 Weber Denny, 2001 Joux Lercier, 2006 Joux Lercier Smart Vercauteren. FFS : 1984 Coppersmith, 1985 Coppersmith Davenport, 1985 Odlyzko, 1990 McCurley, 1992 Gordon McCurley, 1994 Adleman, 1999 Adleman Huang, 2001 Joux Lercier, 2006 Joux Lercier, 2010/2012 Hayashi Shinohara Wang Matsuo Shirase Takagi. FFS, continued: 2012 Hayashi Shimoyama Shinohara Takagi, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann.

19 NFS : 1991 Schirokauer, 1993 Gordon, 1993 Schirokauer, 1994 Odlyzko, 1996 Schirokauer Weber Denny, 1996 Weber, 1998 Weber Denny, 2001 Joux Lercier, 2006 Joux Lercier Smart Vercauteren. FFS : 1984 Coppersmith, 1985 Coppersmith Davenport, 1985 Odlyzko, 1990 McCurley, 1992 Gordon McCurley, 1994 Adleman, 1999 Adleman Huang, 2001 Joux Lercier, 2006 Joux Lercier, 2010/2012 Hayashi Shinohara Wang Matsuo Shirase Takagi. FFS, continued: 2012 Hayashi Shimoyama Shinohara Takagi, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann. Not your grandpa s FFS : Joux, Joux, Göloğlu Granger McGuire Zumbrägel, Göloğlu Granger McGuire Zumbrägel, Barbulescu Gaudry Joux Thomé.

20 1991 Schirokauer, Schirokauer, Schirokauer enny, 1996 Weber, ber Denny, 2001 Joux 006 Joux Lercier ercauteren. 984 Coppersmith, 1985 ith Davenport, McCurley, 1992 McCurley, 1994 Adleman, leman Huang, 2001 rcier, 2006 Joux Lercier, 12 Hayashi Shinohara atsuo Shirase Takagi. FFS, continued: 2012 Hayashi Shimoyama Shinohara Takagi, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann. Not your grandpa s FFS : Joux, Joux, Göloğlu Granger McGuire Zumbrägel, Göloğlu Granger McGuire Zumbrägel, Barbulescu Gaudry Joux Thomé. Reasona for fixed FFS cost log T 2 (

21 okauer, 1993 rokauer, 1994 irokauer 6 Weber, y, 2001 Joux Lercier. ersmith, 1985 nport, 1985 Curley, Adleman, ang, 2001 Joux Lercier, i Shinohara irase Takagi. FFS, continued: 2012 Hayashi Shimoyama Shinohara Takagi, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann. Not your grandpa s FFS : Joux, Joux, Göloğlu Granger McGuire Zumbrägel, Göloğlu Granger McGuire Zumbrägel, Barbulescu Gaudry Joux Thomé. Reasonable conjec for fixed characteri FFS costs T whe log T 2 (log q) 1=3+

22 ux eman, cier, ra gi. FFS, continued: 2012 Hayashi Shimoyama Shinohara Takagi, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann. Not your grandpa s FFS : Joux, Joux, Göloğlu Granger McGuire Zumbrägel, Göloğlu Granger McGuire Zumbrägel, Barbulescu Gaudry Joux Thomé. Reasonable conjectures for fixed characteristic: FFS costs T where log T 2 (log q) 1=3+o(1).

23 FFS, continued: 2012 Hayashi Shimoyama Shinohara Takagi, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann. Reasonable conjectures for fixed characteristic: FFS costs T where log T 2 (log q) 1=3+o(1). Not your grandpa s FFS : Joux, Joux, Göloğlu Granger McGuire Zumbrägel, Göloğlu Granger McGuire Zumbrägel, Barbulescu Gaudry Joux Thomé.

24 FFS, continued: 2012 Hayashi Shimoyama Shinohara Takagi, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann. Reasonable conjectures for fixed characteristic: FFS costs T where log T 2 (log q) 1=3+o(1) Joux algorithm: log T 2 (log q) 1=4+o(1). Not your grandpa s FFS : Joux, Joux, Göloğlu Granger McGuire Zumbrägel, Göloğlu Granger McGuire Zumbrägel, Barbulescu Gaudry Joux Thomé.

25 FFS, continued: 2012 Hayashi Shimoyama Shinohara Takagi, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann. Not your grandpa s FFS : Joux, Joux, Göloğlu Granger McGuire Zumbrägel, Göloğlu Granger McGuire Zumbrägel, Barbulescu Gaudry Joux Thomé. Reasonable conjectures for fixed characteristic: FFS costs T where log T 2 (log q) 1=3+o(1) Joux algorithm: log T 2 (log q) 1=4+o(1) Barbulescu Gaudry Joux Thomé algorithm: log T 2 (log log q) 2+o(1).

26 FFS, continued: 2012 Hayashi Shimoyama Shinohara Takagi, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann, Barbulescu Bouvier Detrey Gaudry Jeljeli Thomé Videau Zimmermann. Not your grandpa s FFS : Joux, Joux, Göloğlu Granger McGuire Zumbrägel, Göloğlu Granger McGuire Zumbrägel, Barbulescu Gaudry Joux Thomé. Reasonable conjectures for fixed characteristic: FFS costs T where log T 2 (log q) 1=3+o(1) Joux algorithm: log T 2 (log q) 1=4+o(1) Barbulescu Gaudry Joux Thomé algorithm: log T 2 (log log q) 2+o(1) Shor algorithm: log T 2 (log log q) 1+o(1), proven; but needs a quantum computer.

27 ontinued: 2012 Hayashi ma Shinohara Takagi, Barbulescu Bouvier audry Jeljeli Thomé immermann, cu Bouvier Detrey Jeljeli Thomé Videau ann. r grandpa s FFS : Joux, Joux, Göloğlu Granger Zumbrägel, Granger McGuire el, Barbulescu Joux Thomé. Reasonable conjectures for fixed characteristic: FFS costs T where log T 2 (log q) 1=3+o(1) Joux algorithm: log T 2 (log q) 1=4+o(1) Barbulescu Gaudry Joux Thomé algorithm: log T 2 (log log q) 2+o(1) Shor algorithm: log T 2 (log log q) 1+o(1), proven; but needs a quantum computer. Field con I ll make q = p 2n p is an o n 2 Z, p Most int Example (Can you p 2n 1 Find ra with an ' of deg Construc

28 2012 Hayashi hara Takagi, u Bouvier ljeli Thomé nn, r Detrey mé Videau s FFS : 3.02 Joux, ranger el, cguire 6 Barbulescu mé. Reasonable conjectures for fixed characteristic: FFS costs T where log T 2 (log q) 1=3+o(1) Joux algorithm: log T 2 (log q) 1=4+o(1) Barbulescu Gaudry Joux Thomé algorithm: log T 2 (log log q) 2+o(1) Shor algorithm: log T 2 (log log q) 1+o(1), proven; but needs a quantum computer. Field construction I ll make simplifyin q = p 2n where p is an odd prime n 2 Z, p p n Most interesting: Example: p = 100 (Can you find all p p 2n 1 = (p n 1 Find random po with an irreducible ' of degree n. Construct F q as F

29 ashi gi, é 04 u, 5 scu Reasonable conjectures for fixed characteristic: FFS costs T where log T 2 (log q) 1=3+o(1) Joux algorithm: log T 2 (log q) 1=4+o(1) Barbulescu Gaudry Joux Thomé algorithm: log T 2 (log log q) 2+o(1) Shor algorithm: log T 2 (log log q) 1+o(1), proven; but needs a quantum computer. Field construction I ll make simplifying assumpt q = p 2n where p is an odd prime power, n 2 Z, p p n p. Most interesting: n p. Example: p = 1009, n = 99 (Can you find all primes divi p 2n 1 = (p n 1)(p n + 1) Find random poly in F p 2[x with an irreducible divisor ' of degree n. Construct F q as F p 2[x]='.

30 Reasonable conjectures for fixed characteristic: FFS costs T where log T 2 (log q) 1=3+o(1) Joux algorithm: log T 2 (log q) 1=4+o(1) Barbulescu Gaudry Joux Thomé algorithm: log T 2 (log log q) 2+o(1) Shor algorithm: log T 2 (log log q) 1+o(1), proven; but needs a quantum computer. Field construction I ll make simplifying assumption: q = p 2n where p is an odd prime power, n 2 Z, p p n p. Most interesting: n p. Example: p = 1009, n = 997. (Can you find all primes dividing p 2n 1 = (p n 1)(p n + 1)?) Find random poly in F 2[x] p with an irreducible divisor ' of degree n. Construct F q as F p 2[x]='.

31 ble conjectures characteristic: s T where log q) 1=3+o(1). Joux algorithm: log q) 1=4+o(1). Barbulescu Gaudry omé algorithm: log log q) 2+o(1). r algorithm: log log q) 1+o(1), proven; s a quantum computer. Field construction I ll make simplifying assumption: q = p 2n where p is an odd prime power, n 2 Z, p p n p. Most interesting: n p. Example: p = 1009, n = 997. (Can you find all primes dividing p 2n 1 = (p n 1)(p n + 1)?) Find random poly in F 2[x] p with an irreducible divisor ' of degree n. Construct F q as F p 2[x]='. How ma What s c has an ir ' of deg For n express e uniquely (p 2 ) deg (p 2 ) n = (p 2 ) deg chance Similar s Factoring ) Quick

32 tures stic: re o(1). rithm: o(1). u Gaudry ithm: +o(1). m: +o(1), proven; m computer. Field construction I ll make simplifying assumption: q = p 2n where p is an odd prime power, n 2 Z, p p n p. Most interesting: n p. Example: p = 1009, n = 997. (Can you find all primes dividing p 2n 1 = (p n 1)(p n + 1)?) Find random poly in F 2[x] p with an irreducible divisor ' of degree n. Construct F q as F p 2[x]='. How many polys t What s chance tha has an irreducible ' of degree n? For n deg r < 2 express each succe uniquely as ' cof (p 2 ) deg r+1 polys (p 2 ) n =n monic i (p 2 ) deg r n+1 co chance 1=n that Similar story for de Factoring r is fast. ) Quickly find r,

33 ven; ter. Field construction I ll make simplifying assumption: q = p 2n where p is an odd prime power, n 2 Z, p p n p. Most interesting: n p. Example: p = 1009, n = 997. (Can you find all primes dividing p 2n 1 = (p n 1)(p n + 1)?) Find random poly in F 2[x] p with an irreducible divisor ' of degree n. Construct F q as F p 2[x]='. How many polys to try? What s chance that r 2 F p 2 has an irreducible divisor ' of degree n? For n deg r < 2n: express each successful r uniquely as ' cofactor. (p 2 ) deg r+1 polys r, (p 2 ) n =n monic irreds ', (p 2 ) deg r n+1 cofactors ) chance 1=n that r works. Similar story for deg r 2n. Factoring r is fast. ) Quickly find r, '.

34 Field construction I ll make simplifying assumption: q = p 2n where p is an odd prime power, n 2 Z, p p n p. Most interesting: n p. Example: p = 1009, n = 997. (Can you find all primes dividing p 2n 1 = (p n 1)(p n + 1)?) Find random poly in F 2[x] p with an irreducible divisor ' of degree n. Construct F q as F p 2[x]='. How many polys to try? What s chance that r 2 F 2[x] p has an irreducible divisor ' of degree n? For n deg r < 2n: express each successful r uniquely as ' cofactor. (p 2 ) deg r+1 polys r, (p 2 ) n =n monic irreds ', (p 2 ) deg r n+1 cofactors ) chance 1=n that r works. Similar story for deg r 2n. Factoring r is fast. ) Quickly find r, '.

35 struction simplifying assumption: where dd prime power, p n p. eresting: n p. : p = 1009, n = 997. find all primes dividing = (p n 1)(p n + 1)?) ndom poly in F 2[x] p irreducible divisor ree n. t F q as F p 2[x]='. How many polys to try? What s chance that r 2 F 2[x] p has an irreducible divisor ' of degree n? For n deg r < 2n: express each successful r uniquely as ' cofactor. (p 2 ) deg r+1 polys r, (p 2 ) n =n monic irreds ', (p 2 ) deg r n+1 cofactors ) chance 1=n that r works. Similar story for deg r 2n. Factoring r is fast. ) Quickly find r, '. Don t us (Starting Find ' d x p x 2 Then x p p 2 choic so overw that at l e.g. p = can have Easily ge x p = x 2 x p = (x But large

36 g assumption: power, p. n p. 9, n = 997. rimes dividing )(p n + 1)?) ly in F 2[x] p divisor p 2 [x]='. How many polys to try? What s chance that r 2 F 2[x] p has an irreducible divisor ' of degree n? For n deg r < 2n: express each successful r uniquely as ' cofactor. (p 2 ) deg r+1 polys r, (p 2 ) n =n monic irreds ', (p 2 ) deg r n+1 cofactors ) chance 1=n that r works. Similar story for deg r 2n. Factoring r is fast. ) Quickly find r, '. Don t use random (Starting now: aba Find ' dividing x p x 2 for so Then x p = x 2 + p 2 choices of 2 so overwhelmingly that at least one w e.g. p = 1009, n = can have Easily generalize: x p = x 2 + x + x p = (x + )=(x + But larger degrees

37 ion: 7. ding?) ] How many polys to try? What s chance that r 2 F 2[x] p has an irreducible divisor ' of degree n? For n deg r < 2n: express each successful r uniquely as ' cofactor. (p 2 ) deg r+1 polys r, (p 2 ) n =n monic irreds ', (p 2 ) deg r n+1 cofactors ) chance 1=n that r works. Similar story for deg r 2n. Factoring r is fast. ) Quickly find r, '. Don t use random polys! (Starting now: abandon proo Find ' dividing x p x 2 for some 2 F Then x p = x 2 + in F q. p 2 choices of 2 F 2, p so overwhelmingly likely that at least one works. e.g. p = 1009, n = 997: can have = Easily generalize: e.g., take x p = x 2 + x + or x p = (x + )=(x + ). But larger degrees are slower

38 How many polys to try? What s chance that r 2 F 2[x] p has an irreducible divisor ' of degree n? For n deg r < 2n: express each successful r uniquely as ' cofactor. (p 2 ) deg r+1 polys r, (p 2 ) n =n monic irreds ', (p 2 ) deg r n+1 cofactors ) chance 1=n that r works. Similar story for deg r 2n. Factoring r is fast. ) Quickly find r, '. Don t use random polys! (Starting now: abandon proofs.) Find ' dividing x p x 2 for some 2 F 2. p Then x p = x 2 + in F q. p 2 choices of 2 F 2, p so overwhelmingly likely that at least one works. e.g. p = 1009, n = 997: can have = 0. Easily generalize: e.g., take x p = x 2 + x + or x p = (x + )=(x + ). But larger degrees are slower.

39 ny polys to try? hance that r 2 F p 2[x] reducible divisor ree n? deg r < 2n: ach successful r as ' cofactor. r+1 polys r, n monic irreds ', r n+1 cofactors ) 1=n that r works. tory for deg r 2n. r is fast. ly find r, '. Don t use random polys! (Starting now: abandon proofs.) Find ' dividing x p x 2 for some 2 F 2. p Then x p = x 2 + in F q. p 2 choices of 2 F 2, p so overwhelmingly likely that at least one works. e.g. p = 1009, n = 997: can have = 0. Easily generalize: e.g., take x p = x 2 + x + or x p = (x + )=(x + ). But larger degrees are slower. Low-deg First step build tab each sma Easily ch Small h D 1; D

40 o try? t r 2 F 2[x] p divisor n: ssful r actor. r, rreds ', factors ) r works. g r 2n. '. Don t use random polys! (Starting now: abandon proofs.) Find ' dividing x p x 2 for some 2 F 2. p Then x p = x 2 + in F q. p 2 choices of 2 F 2, p so overwhelmingly likely that at least one works. e.g. p = 1009, n = 997: can have = 0. Easily generalize: e.g., take x p = x 2 + x + or x p = (x + )=(x + ). But larger degrees are slower. Low-degree discret First step of algori build table of h 7! each small h 2 F p 2 Easily choose g at Small h : deg h D 1; D 2 O(log

41 [x] Don t use random polys! (Starting now: abandon proofs.) Find ' dividing x p x 2 for some 2 F 2. p Then x p = x 2 + in F q. p 2 choices of 2 F 2, p so overwhelmingly likely that at least one works. e.g. p = 1009, n = 997: can have = 0. Easily generalize: e.g., take x p = x 2 + x + or x p = (x + )=(x + ). But larger degrees are slower. Low-degree discrete logs First step of algorithm: build table of h 7! log g h for each small h 2 F p 2[x] 'F p Easily choose g at same tim Small h : deg h D. Cho D 1; D 2 O(log n= log log

42 Don t use random polys! (Starting now: abandon proofs.) Find ' dividing x p x 2 for some 2 F 2. p Then x p = x 2 + in F q. p 2 choices of 2 F 2, p so overwhelmingly likely Low-degree discrete logs First step of algorithm: build table of h 7! log g h for each small h 2 F 2[x] 'F 2[x]. p p Easily choose g at same time. Small h : deg h D. Choose D 1; D 2 O(log n= log log n). that at least one works. e.g. p = 1009, n = 997: can have = 0. Easily generalize: e.g., take x p = x 2 + x + or x p = (x + )=(x + ). But larger degrees are slower.

43 Don t use random polys! (Starting now: abandon proofs.) Find ' dividing x p x 2 for some 2 F 2. p Then x p = x 2 + in F q. p 2 choices of 2 F 2, p so overwhelmingly likely that at least one works. e.g. p = 1009, n = 997: can have = 0. Low-degree discrete logs First step of algorithm: build table of h 7! log g h for each small h 2 F 2[x] 'F 2[x]. p p Easily choose g at same time. Small h : deg h D. Choose D 1; D 2 O(log n= log log n). Non-uniform approach: algorithm A q knows table! Easily generalize: e.g., take x p = x 2 + x + or x p = (x + )=(x + ). But larger degrees are slower.

44 Don t use random polys! (Starting now: abandon proofs.) Find ' dividing x p x 2 for some 2 F 2. p Then x p = x 2 + in F q. p 2 choices of 2 F 2, p so overwhelmingly likely that at least one works. e.g. p = 1009, n = 997: can have = 0. Easily generalize: e.g., take x p = x 2 + x + or x p = (x + )=(x + ). But larger degrees are slower. Low-degree discrete logs First step of algorithm: build table of h 7! log g h for each small h 2 F 2[x] 'F 2[x]. p p Easily choose g at same time. Small h : deg h D. Choose D 1; D 2 O(log n= log log n). Non-uniform approach: algorithm A q knows table! Two reasons to be more explicit: 1. Want A with q as an input. 2. Method to build table will be reused for larger h.

45 e random polys! now: abandon proofs.) ividing for some 2 F 2. p = x 2 + in F q. es of 2 F 2, p helmingly likely east one works. 1009, n = 997: = 0. neralize: e.g., take + x + or + )=(x + ). r degrees are slower. Low-degree discrete logs First step of algorithm: build table of h 7! log g h for each small h 2 F 2[x] 'F 2[x]. p p Easily choose g at same time. Small h : deg h D. Choose D 1; D 2 O(log n= log log n). Non-uniform approach: algorithm A q knows table! Two reasons to be more explicit: 1. Want A with q as an input. 2. Method to build table will be reused for larger h. The first Q (x for x p x 2 Hope tha splits in Not an u 50% o Then log P l This is a among d of monic

46 polys! ndon proofs.) me 2 F 2. p in F q. F 2, p likely orks. 997: = 0. e.g., take or ). are slower. Low-degree discrete logs First step of algorithm: build table of h 7! log g h for each small h 2 F 2[x] 'F 2[x]. p p Easily choose g at same time. Small h : deg h D. Choose D 1; D 2 O(log n= log log n). Non-uniform approach: algorithm A q knows table! Two reasons to be more explicit: 1. Want A with q as an input. 2. Method to build table will be reused for larger h. The first relation f Q (x ) x for F p 2[x]: eq x p x 2 ; force Hope that x 2 x splits in F p 2[x], sa Not an unreasonab 50% of quadratic Then log g f 1 + log P log g (x This is a relation among discrete log of monic linear po

47 fs.) p Low-degree discrete logs First step of algorithm: build table of h 7! log g h for each small h 2 F 2[x] 'F 2[x]. p p Easily choose g at same time. Small h : deg h D. Choose D 1; D 2 O(log n= log log n). Non-uniform approach: algorithm A q knows table! Two reasons to be more explicit: 1. Want A with q as an input. 2. Method to build table will be reused for larger h. The first relation for D = 1 Q (x ) x 2 x + for F p 2[x]: equal mod x p x 2 ; forces = in F q Hope that x 2 x + splits in F p 2[x], say as f 1 f Not an unreasonable hope: 50% of quadratics split. Then log g f 1 + log g f 2 = P log g (x ). This is a relation among discrete logs of monic linear polys.

48 Low-degree discrete logs First step of algorithm: build table of h 7! log g h for each small h 2 F 2[x] 'F 2[x]. p p Easily choose g at same time. Small h : deg h D. Choose D 1; D 2 O(log n= log log n). Non-uniform approach: algorithm A q knows table! Two reasons to be more explicit: 1. Want A with q as an input. 2. Method to build table will be reused for larger h. The first relation for D = 1 Q (x ) x 2 x +. for F p 2[x]: equal mod x p x 2 ; forces = in F q. Hope that x 2 x + splits in F p 2[x], say as f 1 f 2. Not an unreasonable hope: 50% of quadratics split. Then log g f 1 + log g f 2 = P log g (x ). This is a relation among discrete logs of monic linear polys.

49 ree discrete logs of algorithm: le of h 7! log g h for ll h 2 F 2[x] 'F 2[x]. p p oose g at same time. : deg h D. Choose 2 O(log n= log log n). orm approach: A q knows table! sons to be more explicit: A with q as an input. od to build table used for larger h. The first relation for D = 1 Q (x ) x 2 x +. for F p 2[x]: equal mod x p x 2 ; forces = in F q. Hope that x 2 x + splits in F p 2[x], say as f 1 f 2. Not an unreasonable hope: 50% of quadratics split. Then log g f 1 + log g f 2 = P log g (x ). This is a relation among discrete logs of monic linear polys. More rel For a; b; (cx + d) = (cx + (ax + = (cx + (ax + (cx + (ax + Left side linear po Often rig

50 e logs thm: log g h for [x] 'F 2[x]. p same time. D. Choose n= log log n). ach: s table! more explicit: as an input. table arger h. The first relation for D = 1 Q (x ) x 2 x +. for F p 2[x]: equal mod x p x 2 ; forces = in F q. Hope that x 2 x + splits in F p 2[x], say as f 1 f 2. Not an unreasonable hope: 50% of quadratics split. Then log g f 1 + log g f 2 = P log g (x ). This is a relation among discrete logs of monic linear polys. More relations for For a; b; c; d 2 F p 2 (cx + d) Y (ax + = (cx + d)(ax + b (ax + b)(cx + d = (cx + d)(a p x p + (ax + b)(c p x p + (cx + d)(a p (x 2 (ax + b)(c p (x 2 + Left side is produc linear polys in F p 2 Often right side is

51 2[x]. e. ose n). licit: t. The first relation for D = 1 Q (x ) x 2 x +. for F p 2[x]: equal mod x p x 2 ; forces = in F q. Hope that x 2 x + splits in F p 2[x], say as f 1 f 2. Not an unreasonable hope: 50% of quadratics split. Then log g f 1 + log g f 2 = P log g (x ). This is a relation among discrete logs of monic linear polys. More relations for D = 1 For a; b; c; d 2 F p 2: (cx + d) Y (ax + b (cx = (cx + d)(ax + b) p (ax + b)(cx + d) p = (cx + d)(a p x p + b p ) (ax + b)(c p x p + d p ) (cx + d)(a p (x 2 + ) + b p (ax + b)(c p (x 2 + ) + d p Left side is product of linear polys in F p 2[x]. Often right side is too.

52 The first relation for D = 1 Q (x ) x 2 x +. for F p 2[x]: equal mod x p x 2 ; forces = in F q. Hope that x 2 x + splits in F p 2[x], say as f 1 f 2. Not an unreasonable hope: 50% of quadratics split. Then log g f 1 + log g f 2 = P log g (x ). This is a relation among discrete logs of monic linear polys. More relations for D = 1 For a; b; c; d 2 F p 2: (cx + d) Y (ax + b (cx + d)) = (cx + d)(ax + b) p (ax + b)(cx + d) p = (cx + d)(a p x p + b p ) (ax + b)(c p x p + d p ) (cx + d)(a p (x 2 + ) + b p ) (ax + b)(c p (x 2 + ) + d p ). Left side is product of linear polys in F p 2[x]. Often right side is too.

53 relation for D = 1 ) x 2 x +. F 2[x]: equal mod p ; forces = in F q. t x 2 x + F 2[x], say as p f 1 f 2. nreasonable hope: f quadratics split. f g 1 + log g f 2 = og g (x ). relation iscrete logs linear polys. More relations for D = 1 For a; b; c; d 2 F p 2: (cx + d) Y (ax + b (cx + d)) = (cx + d)(ax + b) p (ax + b)(cx + d) p = (cx + d)(a p x p + b p ) (ax + b)(c p x p + d p ) (cx + d)(a p (x 2 + ) + b p ) (ax + b)(c p (x 2 + ) + d p ). Left side is product of linear polys in F p 2[x]. Often right side is too. 2 F p 2; ) M; M m 2 GL 2 ) M; m No other Is there the set o in PGL 2 ( Cremona Bartel gi Mindless is not a but want

54 or D = 1 2 x +. ual mod s = in F q. + y as f 1 f 2. le hope: s split. g f 2 = ). s lys. More relations for D = 1 For a; b; c; d 2 F p 2: (cx + d) Y (ax + b (cx + d)) = (cx + d)(ax + b) p (ax + b)(cx + d) p = (cx + d)(a p x p + b p ) (ax + b)(c p x p + d p ) (cx + d)(a p (x 2 + ) + b p ) (ax + b)(c p (x 2 + ) + d p ). Left side is product of linear polys in F p 2[x]. Often right side is too. 2 F p 2; M = a c b d ) M; M are redu m 2 GL 2 (F p ); M 2 ) M; mm are red No other obvious r Is there a nice way the set of cosets o in PGL 2 (F p 2)? Be Cremona points m Bartel gives solutio Mindless enumerat is not a real bottle but want fast mult

55 .. 2. More relations for D = 1 For a; b; c; d 2 F p 2: (cx + d) Y (ax + b (cx + d)) = (cx + d)(ax + b) p (ax + b)(cx + d) p = (cx + d)(a p x p + b p ) (ax + b)(c p x p + d p ) (cx + d)(a p (x 2 + ) + b p ) (ax + b)(c p (x 2 + ) + d p ). Left side is product of linear polys in F p 2[x]. Often right side is too. 2 F 2; M d = a b 2 GL2 (F p c ) M; M are redundant. m 2 GL 2 (F p ); M 2 GL 2 (F p 2 ) M; mm are redundant. No other obvious redundanc Is there a nice way to repres the set of cosets of PGL 2 (F p in PGL 2 (F p 2)? Best hints so Cremona points me to F p 4=F Bartel gives solution for GL 2 Mindless enumeration of cos is not a real bottleneck here but want fast multipoint eva

56 More relations for D = 1 For a; b; c; d 2 F p 2: (cx + d) Y (ax + b (cx + d)) = (cx + d)(ax + b) p (ax + b)(cx + d) p = (cx + d)(a p x p + b p ) (ax + b)(c p x p + d p ) (cx + d)(a p (x 2 + ) + b p ) (ax + b)(c p (x 2 + ) + d p ). Left side is product of linear polys in F p 2[x]. Often right side is too. 2 F 2; M d = a b 2 GL2 (F 2) p c p ) M; M are redundant. m 2 GL 2 (F p ); M 2 GL 2 (F p 2) ) M; mm are redundant. No other obvious redundancies. Is there a nice way to represent the set of cosets of PGL 2 (F p ) in PGL 2 (F p 2)? Best hints so far: Cremona points me to F p 4=F p 2; Bartel gives solution for GL 2. Mindless enumeration of cosets is not a real bottleneck here but want fast multipoint eval.

57 ations for D = 1 c; d 2 F p 2: Y (ax + b (cx + d)) d)(ax + b) p b)(cx + d) p d)(a p x p + b p ) b)(c p x p + d p ) d)(a p (x 2 + ) + b p ) b)(c p (x 2 + ) + d p ). is product of lys in F p 2[x]. ht side is too. 2 F 2; M d = a b 2 GL2 (F 2) p c p ) M; M are redundant. m 2 GL 2 (F p ); M 2 GL 2 (F p 2) ) M; mm are redundant. No other obvious redundancies. Is there a nice way to represent the set of cosets of PGL 2 (F p ) in PGL 2 (F p 2)? Best hints so far: Cremona points me to F p 4=F p 2; Bartel gives solution for GL 2. Mindless enumeration of cosets is not a real bottleneck here but want fast multipoint eval. p 3 + p p conjectu Each suc Only p 2 Expect e to determ (or most unless p BGJT sa but fast gives bet (How to Maybe c where

58 D = 1 : b (cx + d)) ) p ) p b p ) d p ) + ) + b p ) ) + d p ). t of [x]. too. 2 F 2; M d = a b 2 GL2 (F 2) p c p ) M; M are redundant. m 2 GL 2 (F p ); M 2 GL 2 (F p 2) ) M; mm are redundant. No other obvious redundancies. Is there a nice way to represent the set of cosets of PGL 2 (F p ) in PGL 2 (F p 2)? Best hints so far: Cremona points me to F p 4=F p 2; Bartel gives solution for GL 2. Mindless enumeration of cosets is not a real bottleneck here but want fast multipoint eval. p 3 + p potential re conjecturally ind Each succeeds with Only p 2 monic line Expect enough rela to determine their (or most logs: ok unless p is very sm BGJT say sparse li but fast matrix mu gives better const (How to avoid ann Maybe cleanest: x where generates

59 ) ). + d)) 2 F 2; M d = a b 2 GL2 (F 2) p c p ) M; M are redundant. m 2 GL 2 (F p ); M 2 GL 2 (F p 2) ) M; mm are redundant. No other obvious redundancies. Is there a nice way to represent the set of cosets of PGL 2 (F p ) in PGL 2 (F p 2)? Best hints so far: Cremona points me to F p 4=F p 2; Bartel gives solution for GL 2. Mindless enumeration of cosets is not a real bottleneck here but want fast multipoint eval. p 3 + p potential relations, conjecturally independent. Each succeeds with chance Only p 2 monic linear polys. Expect enough relations to determine their logs (or most logs: ok to miss a unless p is very small. BGJT say sparse linear algeb but fast matrix multiplicatio gives better const in expone (How to avoid annihilating F Maybe cleanest: x p = x 2 + where generates F p 2.)

60 2 F 2; M d = a b 2 GL2 (F 2) p c p ) M; M are redundant. m 2 GL 2 (F p ); M 2 GL 2 (F p 2) ) M; mm are redundant. No other obvious redundancies. Is there a nice way to represent the set of cosets of PGL 2 (F p ) in PGL 2 (F p 2)? Best hints so far: Cremona points me to F p 4=F p 2; Bartel gives solution for GL 2. Mindless enumeration of cosets is not a real bottleneck here but want fast multipoint eval. p 3 + p potential relations, conjecturally independent. Each succeeds with chance 1=6. Only p 2 monic linear polys. Expect enough relations to determine their logs (or most logs: ok to miss a few), unless p is very small. BGJT say sparse linear algebra; but fast matrix multiplication gives better const in exponent. (How to avoid annihilating F p 2? Maybe cleanest: x p = x 2 + 1, where generates F p 2.)

61 d a b 2 GL2 (F 2) c p are redundant. M = (F p ); M 2 GL 2 (F p 2) M are redundant. obvious redundancies. a nice way to represent f cosets of PGL 2 (F p ) F p 2)? Best hints so far: points me to F p 4=F p 2; ves solution for GL 2. enumeration of cosets real bottleneck here fast multipoint eval. p 3 + p potential relations, conjecturally independent. Each succeeds with chance 1=6. Only p 2 monic linear polys. Expect enough relations to determine their logs (or most logs: ok to miss a few), unless p is very small. BGJT say sparse linear algebra; but fast matrix multiplication gives better const in exponent. (How to avoid annihilating F p 2? Maybe cleanest: x p = x 2 + 1, where generates F p 2.) More rel For each (ch + d) = (ch + (ah + = (ch + (ah + (ch + (ah + Left side sometim 5% as

62 2 GL2 (F 2) p ndant. GL 2 (F 2) p undant. edundancies. to represent f PGL 2 (F p ) st hints so far: e to F p 4=F p 2; n for GL 2. ion of cosets neck here ipoint eval. p 3 + p potential relations, conjecturally independent. Each succeeds with chance 1=6. Only p 2 monic linear polys. Expect enough relations to determine their logs (or most logs: ok to miss a few), unless p is very small. BGJT say sparse linear algebra; but fast matrix multiplication gives better const in exponent. (How to avoid annihilating F p 2? Maybe cleanest: x p = x 2 + 1, where generates F p 2.) More relations for For each small h 2 (ch + d) Y (ah + = (ch + d)(ah + b (ah + b)(ch + d = (ch + d)(a p h p + (ah + b)(c p h p + (ch + d)(a p h(x (ah + b)(c p h(x 2 Left side is produc sometimes right si 5% as D! 1.

63 ) p 2 ) ies. ent ) far: p 2;. ets l. p 3 + p potential relations, conjecturally independent. Each succeeds with chance 1=6. Only p 2 monic linear polys. Expect enough relations to determine their logs (or most logs: ok to miss a few), unless p is very small. BGJT say sparse linear algebra; but fast matrix multiplication gives better const in exponent. (How to avoid annihilating F p 2? Maybe cleanest: x p = x 2 + 1, where generates F p 2.) More relations for arbitrary D For each small h 2 F p 2[x]: (ch + d) Y (ah + b (ch = (ch + d)(ah + b) p (ah + b)(ch + d) p = (ch + d)(a p h p + b p ) (ah + b)(c p h p + d p ) (ch + d)(a p h(x 2 + ) + b (ah + b)(c p h(x 2 + ) + d Left side is product of small sometimes right side is too. 5% as D! 1. BGJT say

64 p 3 + p potential relations, conjecturally independent. Each succeeds with chance 1=6. Only p 2 monic linear polys. Expect enough relations to determine their logs (or most logs: ok to miss a few), unless p is very small. BGJT say sparse linear algebra; but fast matrix multiplication gives better const in exponent. (How to avoid annihilating F p 2? Maybe cleanest: x p = x 2 + 1, where generates F p 2.) More relations for arbitrary D For each small h 2 F p 2[x]: (ch + d) Y (ah + b (ch + d)) = (ch + d)(ah + b) p (ah + b)(ch + d) p = (ch + d)(a p h p + b p ) (ah + b)(c p h p + d p ) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Left side is product of small polys; sometimes right side is too. 5% as D! 1. BGJT say 1=6.

65 otential relations, rally independent. ceeds with chance 1=6. monic linear polys. nough relations ine their logs logs: ok to miss a few), is very small. y sparse linear algebra; matrix multiplication ter const in exponent. avoid annihilating F p 2? leanest: x p = x 2 + 1, generates F p 2.) More relations for arbitrary D For each small h 2 F p 2[x]: (ch + d) Y (ah + b (ch + d)) = (ch + d)(ah + b) p (ah + b)(ch + d) p = (ch + d)(a p h p + b p ) (ah + b)(c p h p + d p ) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Left side is product of small polys; sometimes right side is too. 5% as D! 1. BGJT say 1=6. Larger d What if Use sam (ch + d) (ch + (ah + Occasion product We now Left side factor ba Solve for

66 lations, ependent. chance 1=6. ar polys. tions logs to miss a few), all. near algebra; ltiplication in exponent. ihilating F p 2? p = x 2 + 1, F p 2.) More relations for arbitrary D For each small h 2 F p 2[x]: (ch + d) Y (ah + b (ch + d)) = (ch + d)(ah + b) p (ah + b)(ch + d) p = (ch + d)(a p h p + b p ) (ah + b)(c p h p + d p ) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Left side is product of small polys; sometimes right side is too. 5% as D! 1. BGJT say 1=6. Larger discrete log What if D < deg h Use same equation (ch + d) Y (ah + (ch + d)(a p h(x (ah + b)(c p h(x 2 Occasionally right product of small p We now know thos Left side is produc factor base: fh + Solve for each log g

67 1=6. few), ra; n nt. p 2? 1, More relations for arbitrary D For each small h 2 F p 2[x]: (ch + d) Y (ah + b (ch + d)) = (ch + d)(ah + b) p (ah + b)(ch + d) p = (ch + d)(a p h p + b p ) (ah + b)(c p h p + d p ) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Left side is product of small polys; sometimes right side is too. 5% as D! 1. BGJT say 1=6. Larger discrete logs What if D < deg h 2D? Use same equation: (ch + d) Y (ah + b (ch (ch + d)(a p h(x 2 + ) + b (ah + b)(c p h(x 2 + ) + d Occasionally right side is product of small polys. We now know those discrete Left side is product on new factor base: fh + : 2 F p Solve for each log g (h + ).

68 More relations for arbitrary D For each small h 2 F p 2[x]: (ch + d) Y (ah + b (ch + d)) = (ch + d)(ah + b) p (ah + b)(ch + d) p = (ch + d)(a p h p + b p ) (ah + b)(c p h p + d p ) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Left side is product of small polys; sometimes right side is too. 5% as D! 1. BGJT say 1=6. Larger discrete logs What if D < deg h 2D? Use same equation: (ch + d) Y (ah + b (ch + d)) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Occasionally right side is product of small polys. We now know those discrete logs. Left side is product on new factor base: fh + : 2 F p 2g. Solve for each log g (h + ).

69 ations for arbitrary D small h 2 F p 2[x]: Y (ah + b (ch + d)) d)(ah + b) p b)(ch + d) p d)(a p h p + b p ) b)(c p h p + d p ) d)(a p h(x 2 + ) + b p ) b)(c p h(x 2 + ) + d p ). is product of small polys; es right side is too. D! 1. BGJT say 1=6. Larger discrete logs What if D < deg h 2D? Use same equation: (ch + d) Y (ah + b (ch + d)) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Occasionally right side is product of small polys. We now know those discrete logs. Left side is product on new factor base: fh + : 2 F p 2g. Solve for each log g (h + ). For deg h D-smoot so u u Need p Note fre Works fo Reminisc (1977 Sc ( p q + (a + b mod larg Factor b pq +

70 arbitrary D F 2[x]: p b (ch + d)) ) p ) p b p ) d p ) 2 + ) + b p ) + ) + d p ). t of small polys; de is too. BGJT say 1=6. Larger discrete logs What if D < deg h 2D? Use same equation: (ch + d) Y (ah + b (ch + d)) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Occasionally right side is product of small polys. We now know those discrete logs. Left side is product on new factor base: fh + : 2 F p 2g. Solve for each log g (h + ). For deg h (u=3) D-smoothness cha so u u p 3 relatio Need p 2 relation Note free relations Works for u log Reminiscent of line (1977 Schroeppel) ( p q + a)( pq (a + b) p q + mod large prime q Factor base in line pq + a [ fsm

71 + d)) p ) p ). polys; 1=6. Larger discrete logs What if D < deg h 2D? Use same equation: (ch + d) Y (ah + b (ch + d)) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Occasionally right side is product of small polys. We now know those discrete logs. Left side is product on new factor base: fh + : 2 F p 2g. Solve for each log g (h + ). For deg h (u=3)d: D-smoothness chance u u so u u p 3 relations. Need p 2 relations. Note free relations: smooth Works for u log p= log log Reminiscent of linear sieve (1977 Schroeppel): ( p q + a)( pq + b) (a + b) p q + ab + pq mod large prime q. Factor base in linear sieve: pq + a [ fsmall primes

72 Larger discrete logs What if D < deg h 2D? Use same equation: (ch + d) Y (ah + b (ch + d)) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Occasionally right side is product of small polys. We now know those discrete logs. Left side is product on new factor base: fh + : 2 F p 2g. Solve for each log g (h + ). For deg h (u=3)d: D-smoothness chance u u so u u p 3 relations. Need p 2 relations. Note free relations: smooth h +. Works for u log p= log log p. Reminiscent of linear sieve (1977 Schroeppel): ( p q + a)( pq + b) (a + b) p q + ab + pq 2 mod large prime q. Factor base in linear sieve: pq + a [ fsmall primesg. q

73 iscrete logs D < deg h 2D? e equation: Y (ah + b (ch + d)) d)(a p h(x 2 + ) + b p ) b)(c p h(x 2 + ) + d p ). ally right side is of small polys. know those discrete logs. is product on new se: fh + : 2 F p 2g. each log g (h + ). For deg h (u=3)d: D-smoothness chance u u so u u p 3 relations. Need p 2 relations. Note free relations: smooth h +. Works for u log p= log log p. Reminiscent of linear sieve (1977 Schroeppel): ( p q + a)( pq + b) (a + b) p q + ab + pq 2 mod large prime q. Factor base in linear sieve: pq + a [ fsmall primesg. q Arbitrary For (u=3 Use sam (ch + d) (ch + (ah + Occasion side; aga Have see (u=3)dp O(1) su of which

74 s 2D? : b (ch + d)) 2 + ) + b p ) + ) + d p ). side is olys. e discrete logs. t on new : 2 F 2g. p (h + ). For deg h (u=3)d: D-smoothness chance u u so u u p 3 relations. Need p 2 relations. Note free relations: smooth h +. Works for u log p= log log p. Reminiscent of linear sieve (1977 Schroeppel): ( p q + a)( pq + b) (a + b) p q + ab + pq 2 mod large prime q. Factor base in linear sieve: pq + a [ fsmall primesg. q Arbitrary discrete l For (u=3)d < deg Use same equation (ch + d) Y (ah + (ch + d)(a p h(x (ah + b)(c p h(x 2 Occasionally (u=3) side; again fh + Have seen subrout (u=3)d-smooth di p O(1) subroutine c of which Θ(p 2 ) are

75 + d)) p ) p ). logs. 2g. For deg h (u=3)d: D-smoothness chance u u so u u p 3 relations. Need p 2 relations. Note free relations: smooth h +. Works for u log p= log log p. Reminiscent of linear sieve (1977 Schroeppel): ( p q + a)( pq + b) (a + b) p q + ab + pq 2 mod large prime q. Factor base in linear sieve: pq + a [ fsmall primesg. q Arbitrary discrete logs For (u=3)d < deg h (u=3 Use same equation (ch + d) Y (ah + b (ch (ch + d)(a p h(x 2 + ) + b (ah + b)(c p h(x 2 + ) + d Occasionally (u=3)d-smooth side; again fh + g for left s Have seen subroutine to com (u=3)d-smooth discrete logs p O(1) subroutine calls, of which Θ(p 2 ) are importan

76 For deg h (u=3)d: D-smoothness chance u u so u u p 3 relations. Need p 2 relations. Note free relations: smooth h +. Works for u log p= log log p. Reminiscent of linear sieve (1977 Schroeppel): ( p q + a)( pq + b) (a + b) p q + ab + pq 2 mod large prime q. Factor base in linear sieve: pq + a [ fsmall primesg. q Arbitrary discrete logs For (u=3)d < deg h (u=3) 2 D: Use same equation (ch + d) Y (ah + b (ch + d)) (ch + d)(a p h(x 2 + ) + b p ) (ah + b)(c p h(x 2 + ) + d p ). Occasionally (u=3)d-smooth right side; again fh + g for left side. Have seen subroutine to compute (u=3)d-smooth discrete logs. p O(1) subroutine calls, of which Θ(p 2 ) are important.