Individual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm)
|
|
- Teresa Singleton
- 5 years ago
- Views:
Transcription
1 Individual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm) Aurore Guillevic INRIA Saclay / GRACE Team École Polytechnique / LIX ECC 2015, Sept. 28th Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
2 Link with Logjam attack (N. Heninger s talk) Solving actual practical problem: Given a fixed finite field GF(q), Huge massive precomputation (weeks, months, years) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
3 Link with Logjam attack (N. Heninger s talk) Solving actual practical problem: Given a fixed finite field GF(q), Huge massive precomputation (weeks, months, years) log tab p i < B 0 Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
4 Link with Logjam attack (N. Heninger s talk) Solving actual practical problem: Given a fixed finite field GF(q), Huge massive precomputation (weeks, months, years) log tab p i < B 0 Thousands of individual log computation < 1 min each Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
5 Link with Logjam attack (N. Heninger s talk) Solving actual practical problem: Given a fixed finite field GF(q), Huge massive precomputation (weeks, months, years) log tab p i < B 0 Thousands of individual log computation < 1 min each Logjam: GF(q) = GF(p) (standardized) prime field Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
6 Link with Logjam attack (N. Heninger s talk) Solving actual practical problem: Given a fixed finite field GF(q), Huge massive precomputation (weeks, months, years) log tab p i < B 0 Thousands of individual log computation < 1 min each Logjam: GF(q) = GF(p) (standardized) prime field Pairing-based cryptosystems: GF(q) = GF(p 2 ), GF(p 6 ), GF(p 12 ) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
7 Link with Logjam attack (N. Heninger s talk) Solving actual practical problem: Given a fixed finite field GF(q), Huge massive precomputation (weeks, months, years) log tab p i < B 0 Thousands of individual log computation < 1 min each Logjam: GF(q) = GF(p) (standardized) prime field Pairing-based cryptosystems: GF(q) = GF(p 2 ), GF(p 6 ), GF(p 12 ) Could we compute individual discrete logs in GF(p 2 ), GF(p 6 ), GF(p 12 ) in less than 1 min? Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
8 DLP in the target group of pairing-friendly curves DLP in the target group of pairing-friendly curves Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
9 DLP in the target group of pairing-friendly curves Why DLP in finite fields F p 2, F p 3,...? In a subgroup G = g of order l, (g, x) g x is easy (polynomial time) (g, g x ) x is (in well-chosen subgroup) hard: DLP. pairing: G 1 G 2 G T E(F p ) E(F p k ) F p k where E/F p is a pairing-friendly curve G 1, G 2, G T of large prime order l (generic attacks in O( l): take e.g. 256-bit l) 1 k 12 embedding degree: very specific property (specific attacks (NFS): take 3072-bit p k ) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
10 DLP in the target group of pairing-friendly curves DL records in small characteristic Small characteristic: supersingular curves E/F 2 n: G T F 2 4n, E/F 3 m: G T F 3 6m Practical attacks (first one and most recent): Hayashi, Shimoyama, Shinohara, Takagi: GF( ) ( 923 bit field) (2012) Granger, Kleinjung, Zumbragel: GF( ), GF( ) (2014) Adj, Menezes, Oliveira, Rodríguez-Henríquez: GF(3 822 ), GF(3 978 ) (2014) Joux: GF( ) (with Pierrot, 2014), GF( ) (2013) Theoretical attacks: [Barbulescu Gaudry Joux Thomé 14] Quasi-Polynomial-time Algorithm (QPA)... Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
11 DLP in the target group of pairing-friendly curves Common used pairing-friendly curves Curves over prime fields E/F p where QPA does NOT apply (with log p log l 256 bits, s.t. k log p 3072) supersingular: G T F p 2 (log p = 1536) [Miyaji Nakabayashi Takano 01] (MNT): G T F p 3 (log p = 1024), F p 4 (log p = 768), F p 6 (log p = 512) [Barreto Naehrig 05] (BN): G T F p 12 (log p = 256, optimal) [Kachisa Schaefer Scott 08] (KSS): G T F p 18 (used for 192-bit security level: 384-bit l, log p = 512, k log p = 9216) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
12 DLP in the target group of pairing-friendly curves Theoretical attacks in non-small characteristic fields Variants of NFS, generic fields MNFS [Coppersmith 89]: F p, [Barbulescu Pierrot 14], [Pierrot 15]: F p k Specific to pairing target groups, when p = P(x 0 ), with deg P 2 [Joux Pierrot 13] [Barbulescu Gaudry Kleinjung 15] Tower NFS Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
13 DLP in the target group of pairing-friendly curves Theoretical attacks in non-small characteristic fields Variants of NFS, generic fields MNFS [Coppersmith 89]: F p, [Barbulescu Pierrot 14], [Pierrot 15]: F p k Specific to pairing target groups, when p = P(x 0 ), with deg P 2 [Joux Pierrot 13] [Barbulescu Gaudry Kleinjung 15] Tower NFS These attacks were not taken into account in the 3072-bit target field recommendation. Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
14 DLP in the target group of pairing-friendly curves Last DL records, with the NFS-DL algorithm GF(p) GF(p 2 ), p 2 = q [BGGM15] Massive precomputation (d=core-day, y=core-year) [Logjam] 512-bit p: 10y 530-bit q: 0.2y GPU d [BGIJT14] 596-bit p: 131y 598-bit q: 0.75y + 18 GPU-d 175 faster Individual Discrete Log 512-bit p: 70s median 530-bit q : few d slow 768-bit p: 2d 600-bit q : few d slow [Logjam]: see weakdh.org [BGGM15]: Barbulescu, Gaudry, G., Morain [BGIJT14]: Bouvier, Gaudry, Imbert, Jeljeli, Thomé Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
15 DLP in the target group of pairing-friendly curves This talk: Faster individual discrete logarithm in F p k, especially k = 2, 3, 4, 6 Apply to pairing target group G T source code: part of Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
16 NFS Number Field Sieve algorithm NFS Number Field Sieve algorithm Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
17 NFS Number Field Sieve algorithm Number Field Sieve algorithm for DL in F p k 1. Polynomial selection: compute f (x), g(x) with ϕ = gcd(f, g) (mod p) and F p k = F p [x]/(ϕ(x)) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
18 NFS Number Field Sieve algorithm Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f (x), g(x) with 1. ϕ = gcd(f, g) (mod p) and F p k = F p [x]/(ϕ(x)) 2. Relation collection Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
19 NFS Number Field Sieve algorithm Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f (x), g(x) with 1. ϕ = gcd(f, g) (mod p) and F p k = F p [x]/(ϕ(x)) 2. Relation collection 3. Linear algebra modulo l p k 1. here we know the discrete log of a subset of elements. log DB p i < B 0 Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
20 NFS Number Field Sieve algorithm Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f (x), g(x) with 1. ϕ = gcd(f, g) (mod p) and massive precomputation F p k = F p [x]/(ϕ(x)) 2. Relation collection 3. Linear algebra modulo l p k 1 here we know the discrete log of a subset of elements. log DB p i < B 0 Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
21 NFS Number Field Sieve algorithm Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f (x), g(x) with 1. ϕ = gcd(f, g) (mod p) and massive precomputation F p k = F p [x]/(ϕ(x)) 2. Relation collection 3. Linear algebra modulo l p k 1 here we know the discrete log of a subset of elements. log DB 1. Individual target discrete logarithm p i < B 0 Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
22 NFS Number Field Sieve algorithm Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f (x), g(x) with 1. ϕ = gcd(f, g) (mod p) and massive precomputation F p k = F p [x]/(ϕ(x)) 2. Relation collection 3. Linear algebra modulo l p k 1 here we know the discrete log of a subset of elements. log DB p i < B 0 1. Individual target discrete logarithm for each given DLP instance not so trivial this talk: pratical improvements very efficient for small k Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
23 NFS Number Field Sieve algorithm Example: [MNT01] parameters (explicitly advised to NOT use them) Polynomial selection: Conjugation method [BGGM15] k = 3, p = 12y , t = 6y 0 1, l p + 1 t = 12y y 0 + 2, with y 0 = f = 12x 6 24x 5 85x x x x + 12 ϕ y = g = x 3 yx 2 (y + 3)x 1, where y = y (ϕ y0 not irr.) = x x x 1 f (mod p) = 12ϕ y ϕ y = Res y (ϕ y, 12y 2 + 1) G = X + 6 F p 3 = F p [X ]/(ϕ(x )) randomized target T = t 0 + t 1 X + t 2 X 2 F p 3 Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
24 NFS Number Field Sieve algorithm Preimage in Z[x]/(f (x)) and ρ map randomized target T = t 0 + t 1 X + t 2 X 2 F p = F 3 p [X ]/(ϕ(x )) Most simple preimage T choice: T = t 0 + t 1 x + t 2 x 2 Z[x]/(f (x)), with t i t i (mod p). We can always choose T s.t. t i < p deg T < deg f Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
25 NFS Number Field Sieve algorithm Preimage in Z[x]/(f (x)) and ρ map randomized target T = t 0 + t 1 X + t 2 X 2 F p = F 3 p [X ]/(ϕ(x )) Most simple preimage T choice: T = t 0 + t 1 x + t 2 x 2 Z[x]/(f (x)), with t i t i (mod p). We can always choose T s.t. t i < p deg T < deg f We need ρ(t) = T (where ρ is simply a reduction modulo (ϕ, p)) when f (resp. g) is monic Z[x] Z[x]/(f (x)) ρ f : x z F p k = F p [z]/(ϕ(z)) Z[y]/(g(y)) ρ g : y z Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
26 NFS Number Field Sieve algorithm Individual DL of random target T 0 F p k log DB Given G and a log database s.t. for all p i < B, log p i p i < B 0 Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
27 NFS Number Field Sieve algorithm Individual DL of random target T 0 F p k log DB Given G and a log database s.t. for all p i < B, log p i p i < B 0 1. booting step (a.k.a. smoothing step): DO 1.1 take t at random in {1,..., l 1} and set T = G t T 0 (hence log G (T 0 ) = log G (T ) t) 1.2 factorize Norm(T) = q 1 q }{{} i (elements in DL database), too large: B 0<q i B 1 UNTIL q i B 1 Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
28 NFS Number Field Sieve algorithm Individual DL of random target T 0 F p k log DB Given G and a log database s.t. for all p i < B, log p i p i < B 0 1. booting step (a.k.a. smoothing step): DO 1.1 take t at random in {1,..., l 1} and set T = G t T 0 (hence log G (T 0 ) = log G (T ) t) 1.2 factorize Norm(T) = q 1 q }{{} i (elements in DL database), too large: B 0<q i B 1 UNTIL q i B 1 2. dedicated recursive procedure for each new q i : q i = r 1 r j (elements in the DL database) with r 1,..., r j < B j < q i < B i. Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
29 NFS Number Field Sieve algorithm Individual DL of random target T 0 F p k log DB Given G and a log database s.t. for all p i < B, log p i p i < B 0 1. booting step (a.k.a. smoothing step): DO 1.1 take t at random in {1,..., l 1} and set T = G t T 0 (hence log G (T 0 ) = log G (T ) t) 1.2 factorize Norm(T) = q 1 q }{{} i (elements in DL database), too large: B 0<q i B 1 UNTIL q i B 1 2. dedicated recursive procedure for each new q i : q i = r 1 r j (elements in the DL database) with r 1,..., r j < B j < q i < B i. 3. log combination to find the individual target DL Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
30 NFS Number Field Sieve algorithm Individual DL of random target T 0 F p k log DB Given G and a log database s.t. for all p i < B, log p i p i < B 0 1. booting step (a.k.a. smoothing step): DO 1.1 take t at random in {1,..., l 1} and set T = G t T 0 (hence log G (T 0 ) = log G (T ) t) 1.2 factorize Norm(T) }{{} reduce this = q 1 q i }{{} too large: B 0<q i B 1 (elements in DL database), UNTIL q i B 1 2. dedicated recursive procedure for each new q i : q i = r 1 r j (elements in the DL database) with r 1,..., r j < B j < q i < B i. 3. log combination to find the individual target DL Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
31 Booting Step Booting Step Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
32 Booting Step Norm computation f monic, T = t 0 + t 1 x t d x d Z[x]/(f (x)), d < deg f : with f = max 1 i deg f f i Norm f (T) = Res(f, T) A T deg f f d Example: [MNT01], k = 3, deg g = 3, g = O(p 1/2 ) p = T = x x 2 f = 12x 6 24x 5 85x x x x + 12 g = x x x 1 Norm f (T)( T 6 f 2 ) = 1017bits p 6 Norm g (T)( T 3 g 2 ) = 665bits p 4 Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
33 Booting Step Booting step complexity Given random target T 0 F p k, and G a generator of F p k repeat 1. take t at random in {1,..., l 1} and set T = g t T 0 2. factorize Norm(T) until it is B 1 -smooth: Norm(T) = q i B 1 q i p i B 0 p i L-notation: Q = p k, L Q [1/3, c] = e (c+o(1))(log Q)1/3 (log log Q) 2/3 for c > 0. Norm factorization done with ECM method, in time L B1 [1/2, 2] Lemma (Booting step running-time) if Norm(T) Q e, take B 1 = L Q [2/3, (e 2 /3) 1/3 ], then the running-time is L Q [1/3, (3e) 1/3 ] (and this is optimal). Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
34 Booting Step Booting step complexity F p : Norm(preimage) p = Q, running-time: L Q [1/3, 1.44] with B 1 = L Q [2/3, 0.69] [Commeine Semaev 06, Barbulescu 13] med. char. F p k, JLSV1 poly. select.: deg f = deg g = k, f = g = O(p 1/2 ), Norm(preimage) Q 3/2, running-time: L Q [1/3, 1.65], with B 1 = L Q [2/3, 0.91] [Joux Lercier Naccache Thomé 09, Barbulescu Pierrot 14] field F p F p k polynomial selec. gjl JLSV 1 Conj NFS dominating, c L Q [ 1 3, c], 512-bit Q Norm(T) < Q e = Q Q Q 3/2 Q time L Q [1/3, c], c nb of operations, 512-bit Q q i bound B Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
35 Optimizing the Preimage Computation Optimizing the Preimage Computation Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
36 Optimizing the Preimage Computation Preimage optimization f, deg f, f, g, deg g, g are given by the polynomial selection step (NFS-DL step 1) To reduce the norm, reduce T and/or reduce d = deg T Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
37 Optimizing the Preimage Computation Previous work F p : Rational Reconstruction. T Z/pZ, T is an integer < p. Rational Reconstruction gives T = u/v (mod p) with u, v < p booting step: we want u,v to be B 1 -smooth at the same time, instead of T to be B 1 -smooth. T is already split in two integers of half size each. [Blake Mullin Vanstone 84] Waterloo algorithm in F 2 [x]: T = U/V = u u d/2 x d/2 reduce degree v v d/2 x d/2 [Joux Lercier Smart Vercauteren 06] in F p k : T = U/V = u u d x d v v d x d, where u i, v i p 1/2 reduce coefficient size Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
38 Optimizing the Preimage Computation Previous work F p : Rational Reconstruction. T Z/pZ, T is an integer < p. Rational Reconstruction gives T = u/v (mod p) with u, v < p booting step: we want u,v to be B 1 -smooth at the same time, instead of T to be B 1 -smooth. T is already split in two integers of half size each. [Blake Mullin Vanstone 84] Waterloo algorithm in F 2 [x]: T = U/V = u u d/2 x d/2 reduce degree v v d/2 x d/2 [Joux Lercier Smart Vercauteren 06] in F p k : T = U/V = u u d x d v v d x d, where u i, v i p 1/2 reduce coefficient size How much is the booting step improved? Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
39 Optimizing the Preimage Computation Booting step: First experiments Commonly assumed: launch at morning coffee... finished for afternoon tea. F p bits was easy (BGGM15 record), as fast as for F p (< one day) F p 3 F p 4 What happened? 400 bits and MNT 508 bits were much slower (days, week) 400 bits was even worse (> one week) F p 3: T = p, deg f = 6, [JLSV06] method: Norm(T) Q c = 1.44 (but still much slower) F p 4: f = O(p 1/2 ), Norm(T) Q 3/2 c = 1.65 Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
40 Optimizing the Preimage Computation Booting step: First experiments Commonly assumed: launch at morning coffee... finished for afternoon tea. F p bits was easy (BGGM15 record), as fast as for F p (< one day) F p 3 F p 4 What happened? 400 bits and MNT 508 bits were much slower (days, week) 400 bits was even worse (> one week) F p 3: T = p, deg f = 6, [JLSV06] method: Norm(T) Q c = 1.44 (but still much slower) F p 4: f = O(p 1/2 ), Norm(T) Q 3/2 c = 1.65 Because of the constant hidden in the O()? Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
41 Optimizing the Preimage Computation Our solution Lemma Let T F p k. log(t ) = log(u T ) (mod l) for any u in a proper subfield of F p k. Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
42 Optimizing the Preimage Computation Our solution Lemma Let T F p k. log(t ) = log(u T ) (mod l) for any u in a proper subfield of F p k. F p is a proper subfield of F p k target T = t 0 + t 1 x t d x d we divide the target by its leading term: log(t ) = log(t /t d ) (mod l) From now we assume that the target is monic. Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
43 Optimizing the Preimage Computation Our solution Lemma Let T F p k. log(t ) = log(u T ) (mod l) for any u in a proper subfield of F p k. F p is a proper subfield of F p k target T = t 0 + t 1 x t d x d we divide the target by its leading term: log(t ) = log(t /t d ) (mod l) From now we assume that the target is monic. Similar technique in pairing computation: Miller loop denominator elimination [Boneh Kim Lynn Scott 02] Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
44 Optimizing the Preimage Computation Subfield Simplification + LLL We want to reduce T. Example with F p 3: f = x x x x x 2 13x + 1 ϕ = x 3 yx 2 (y + 3)x 1 y Z T = t 0 + t 1 x + x 2 p p define L = t 0 t ϕ 0 ϕ 1 ϕ ϕ 0 ϕ 1 ϕ ϕ 0 ϕ 1 ϕ 2 1 LLL(L) outputs a short vector r, linear combination of L s rows. r = λ 0 p + λ 1 px + λ 2 T + λ 3 ϕ + λ 4 xϕ + λ 5 x 2 ϕ. r = r r 5 x 5, r i C det(l) 1/6 = O(p 1/3 ) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
45 Optimizing the Preimage Computation Subfield Simplification + LLL We want to reduce T. Example with F p 3: f = x x x x x 2 13x + 1 ϕ = x 3 yx 2 (y + 3)x 1 y Z T = t 0 + t 1 x + x 2 p p define L = t 0 t ϕ 0 ϕ 1 ϕ ϕ 0 ϕ 1 ϕ ϕ 0 ϕ 1 ϕ 2 1 LLL(L) outputs a short vector r, linear combination of L s rows. r = λ 0 p + λ 1 px + λ 2 T + λ 3 ϕ + λ 4 xϕ + λ 5 x 2 ϕ. r = r r 5 x 5, r i C det(l) 1/6 = O(p 1/3 ) log ρ(r) = log(t ) (mod l) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
46 Optimizing the Preimage Computation Subfield Simplification + LLL We want to reduce T. Example with F p 3: f = x x x x x 2 13x + 1 ϕ = x 3 yx 2 (y + 3)x 1 y Z T = t 0 + t 1 x + x 2 p p define L = t 0 t ϕ 0 ϕ 1 ϕ ϕ 0 ϕ 1 ϕ ϕ 0 ϕ 1 ϕ 2 1 ρ(p) = 0 F p k T ρ(ϕ) = 0 F p k LLL(L) outputs a short vector r, linear combination of L s rows. r = λ 0 p + λ 1 px + λ 2 T + λ 3 ϕ + λ 4 xϕ + λ 5 x 2 ϕ. r = r r 5 x 5, r i C det(l) 1/6 = O(p 1/3 ) log ρ(r) = log(t ) (mod l) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
47 Optimizing the Preimage Computation Subfield Simplification + LLL We want to reduce T. Example with F p 3: f = x x x x x 2 13x + 1 ϕ = x 3 yx 2 (y + 3)x 1 y Z T = t 0 + t 1 x + x 2 p p define L = t 0 t ϕ 0 ϕ 1 ϕ ϕ 0 ϕ 1 ϕ ϕ 0 ϕ 1 ϕ 2 1 ρ(p) = 0 F p k T ρ(ϕ) = 0 F p k LLL(L) outputs a short vector r, linear combination of L s rows. r = λ 0 p + λ 1 px + λ 2 T + λ 3 ϕ + λ 4 xϕ + λ 5 x 2 ϕ. r = r r 5 x 5, r i C det(l) 1/6 = O(p 1/3 ) log ρ(r) = log(t ) (mod l) because ρ(r) = λ 2 T with λ 2 F p Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
48 Optimizing the Preimage Computation Subfield Simplification + LLL Norm f (T) = Res(f, T) A T deg f f d Norm f (r) r 6 f 5 = O(p 2 ) = O(Q 2/3 ) < O(Q) MNT example: log Q = 508 bits Norm f (T) Norm g (T) L Q [1/3, c] q i B 1 = Q e bits Q e bits c time L Q [ 2 3, c] Nothing Q Q 4/ [JLSV06] Q 508 Q 5/ This work Q 2/3 340 Q Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
49 F p 4 F p 4: JLSV 1 polynomial selection and booting step improvement Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
50 F p 4 F p 4 of 400 bits [JLSV06] first method: choose f of degree 4 and very small coefficients, and set g = f + p. Booting step on f side, with the T = U/V method. Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
51 F p 4 F p 4 of 400 bits [JLSV06] first method: choose f of degree 4 and very small coefficients, and set g = f + p. Booting step on f side, with the T = U/V method. Relation collection and Linear algebra do not scale well for large p Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
52 F p 4 F p 4 of 400 bits [JLSV06] first method: choose f of degree 4 and very small coefficients, and set g = f + p. Booting step on f side, with the T = U/V method. Relation collection and Linear algebra do not scale well for large p We use JLSV06 other method: deg f = deg g = k, f = g = p 1/2 p = of 98 bits (30 dd) l = of 192 bits f = x x 3 6x x + 1 g = x x x x ϕ = g Terribly slow booting step (more than one week) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
53 F p 4 Terribly slow booting step T = t 0 + t 1 x + t 2 x 2 + x 3 define p L = 0 p p 0 t 0 t 1 t 2 1 dim 4 because max(deg f, deg g) = 4 compute LLL(L), get r, r p 3/4, Norm f (r) r 4 f 3 p 9/2 = Q 9/8 of 450 bits! Booting step, nb of operations: 2 44 Large prime bound B 1 of 82 bits Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
54 F p 4 Terribly slow booting step T = t 0 + t 1 x + t 2 x 2 + x 3 define p L = 0 p p 0 could we find something else, monic? t 0 t 1 t 2 1 dim 4 because max(deg f, deg g) = 4 compute LLL(L), get r, r p 3/4, Norm f (r) r 4 f 3 p 9/2 = Q 9/8 of 450 bits! Booting step, nb of operations: 2 44 Large prime bound B 1 of 82 bits Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
55 Our solution: quadratic subfield simplification F p 4 Lemma Let T F p k, k even. We can always find u F p k/2 and T F p k, such that T = u T and T is of degree k 2 instead of k 1. Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
56 Our solution: quadratic subfield simplification Lemma F p 4 Let T F p k, k even. We can always find u F p k/2 and T F p k, such that T = u T and T is of degree k 2 instead of k 1. p define L = 0 p 0 0 t 0 t t 0 t 1 t 2 1 LLL(L) short vector r linear combination of L rows r = r r 3 x 3, r i C det(l) 1/4 = O(p 1/2 ) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
57 Our solution: quadratic subfield simplification Lemma F p 4 Let T F p k, k even. We can always find u F p k/2 and T F p k, such that T = u T and T is of degree k 2 instead of k 1. p define L = 0 p 0 0 t 0 t t 0 t 1 t 2 1 ρ(p) = 0 F p k T T LLL(L) short vector r linear combination of L rows r = r r 3 x 3, r i C det(l) 1/4 = O(p 1/2 ) ρ(r) = λ 2 T + λ 3 T = (λ 2 u + λ 3 ) }{{} subfield F p k/2 T Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
58 Our solution: quadratic subfield simplification Lemma F p 4 Let T F p k, k even. We can always find u F p k/2 and T F p k, such that T = u T and T is of degree k 2 instead of k 1. p define L = 0 p 0 0 t 0 t t 0 t 1 t 2 1 ρ(p) = 0 F p k T T LLL(L) short vector r linear combination of L rows r = r r 3 x 3, r i C det(l) 1/4 = O(p 1/2 ) ρ(r) = λ 2 T + λ 3 T = (λ 2 u + λ 3 ) }{{} log ρ(r) = log(t ) (mod l) subfield F p k/2 Norm f (r) = r 4 f 3 = p 7/2 = Q 7/8 < Q Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32 T
59 F p 4 Summary of results G T F p 2 F p 3 F p 4 F p 6 Norm bound prev. Q [JLSV06] Q 3/2 (nothing) this work Q 1/2 Q 2/3 Q 7/8 Q 11/12 Booting step running time in L Q [1/3, c] prev. c (*) new c ** numerical values for a 512-bit Q prev. nb of operations new nb of operations q i bound B 1 = L Q [2/3, c ] previous B new B * [CommeineSemaev06, JouxLercierNaccacheThomé09, Barbulescu13, Bar.Pierrot14] ** with cubic subfield simplification Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
60 F p 4 Summary of results Accepted paper at Asiacrypt 2015, Auckland, New Zealand online version HAL guillevic@lix.polytechnique.fr Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
61 F p 4 DL record computation in F p 4 of 392 bits (120dd) Joint work with R. Barbulescu, P. Gaudry, F. Morain p = of 98 bits (30 dd) l = of 192 bits f = x x 3 6x x + 1 g = x x x x ϕ = g G = x + 3 F p 4 T 0 = x x x log G (T 0 ) = (mod l) Aurore Guillevic (INRIA/LIX) NFS-DL in F k September 28th, / 32
Solving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction
Solving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction Aurore Guillevic and François Morain and Emmanuel Thomé University of Calgary, PIMS CNRS, LIX École Polytechnique, Inria, Loria SAC,
More informationComputing Individual Discrete Logarithms Faster in GF(p n ) with the NFS-DL Algorithm
Computing Individual Discrete Logarithms Faster in GF(p n ) with the NFS-DL Algorithm Aurore Guillevic 1,2 1 Inria Saclay, Palaiseau, France 2 École Polytechnique/LIX, Palaiseau, France guillevic@lixpolytechniquefr
More informationImproving NFS for the discrete logarithm problem in non-prime nite elds
Improving NFS for the discrete logarithm problem in non-prime nite elds Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, Francois Morain Institut national de recherche en informatique et en automatique
More informationExtended Tower Number Field Sieve with Application to Finite Fields of Arbitrary Composite Extension Degree
Extended Tower Number Field Sieve with Application to Finite Fields of Arbitrary Composite Extension Degree Taechan Kim 1 and Jinhyuck Jeong 2 1 NTT Secure Platform Laboratories, Japan taechan.kim@lab.ntt.co.jp
More informationA brief overwiev of pairings
Bordeaux November 22, 2016 A brief overwiev of pairings Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Overview pairings 0 / 37 Plan of the lecture Pairings Pairing-friendly curves Progress of NFS attacks
More informationOn the complexity of computing discrete logarithms in the field F
On the complexity of computing discrete logarithms in the field F 3 6 509 Francisco Rodríguez-Henríquez CINVESTAV-IPN Joint work with: Gora Adj Alfred Menezes Thomaz Oliveira CINVESTAV-IPN University of
More informationImproving NFS for the discrete logarithm problem in non-prime finite fields
Improving NFS for the discrete logarithm problem in non-prime finite fields Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, François Morain To cite this version: Razvan Barbulescu, Pierrick Gaudry,
More informationarxiv: v2 [cs.cr] 24 Nov 2016
Solving discrete logarithms on a 170-bit MNT curve by pairing reduction Aurore Guillevic 5,6, François Morain 4,1, and Emmanuel Thomé 1,2,3 arxiv:1605.07746v2 [cs.cr] 24 Nov 2016 1 Institut national de
More informationNon-generic attacks on elliptic curve DLPs
Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September 13 2013 Smith
More informationConstructing Abelian Varieties for Pairing-Based Cryptography
for Pairing-Based CWI and Universiteit Leiden, Netherlands Workshop on Pairings in Arithmetic Geometry and 4 May 2009 s MNT MNT Type s What is pairing-based cryptography? Pairing-based cryptography refers
More informationComputing discrete logarithms in GF (p 6 )
Computing discrete logarithms in GF (p 6 ) Laurent Grémy, Aurore Guillevic, François Morain, Emmanuel Thomé To cite this version: Laurent Grémy, Aurore Guillevic, François Morain, Emmanuel Thomé. Computing
More informationChallenges with Assessing the Impact of NFS Advances on the Security of Pairing-based Cryptography
Challenges with Assessing the Impact of NFS Advances on the Security of Pairing-based Cryptography Alfred Menezes 1, Palash Sarkar 2, and Shashank Singh 3 1 Department of Combinatorics & Optimization,
More informationA quasi polynomial algorithm for discrete logarithm in small characteristic
CCA seminary January 10, 2014 A quasi polynomial algorithm for discrete logarithm in small characteristic Razvan Barbulescu 1 Pierrick Gaudry 2 Antoine Joux 3 Emmanuel Thomé 2 LIX, École Polytechnique
More informationA construction of 3-dimensional lattice sieve for number field sieve over GF(p n )
A construction of 3-dimensional lattice sieve for number field sieve over GF(p n ) Kenichiro Hayasaka 1, Kazumaro Aoki 2, Tetsutaro Kobayashi 2, and Tsuyoshi Takagi 3 Mitsubishi Electric, Japan NTT Secure
More informationA heuristic quasi-polynomial algorithm for discrete logarithm in small characteristic
ECC, Chennai October 8, 2014 A heuristic quasi-polynomial algorithm for discrete logarithm in small characteristic Razvan Barbulescu 1 Pierrick Gaudry 2 Antoine Joux 3 Emmanuel Thomé 2 IMJ-PRG, Paris Loria,
More informationDiscrete logarithms: Recent progress (and open problems)
Discrete logarithms: Recent progress (and open problems) CryptoExperts Chaire de Cryptologie de la Fondation de l UPMC LIP6 February 25 th, 2014 Discrete logarithms Given a multiplicative group G with
More informationConstructing Pairing-Friendly Elliptic Curves for Cryptography
Constructing Pairing-Friendly Elliptic Curves for Cryptography University of California, Berkeley, USA 2nd KIAS-KMS Summer Workshop on Cryptography Seoul, Korea 30 June 2007 Outline 1 Pairings in Cryptography
More informationPairing-Friendly Elliptic Curves of Prime Order
Pairing-Friendly Elliptic Curves of Prime Order Paulo S. L. M. Barreto 1 Michael Naehrig 2 1 University of São Paulo pbarreto@larc.usp.br 2 RWTH Aachen University mnaehrig@ti.rwth-aachen.de SAC 2005 Outline
More informationOn Generating Coset Representatives of P GL 2 (F q ) in P GL 2 (F q 2)
On Generating Coset Representatives of P GL 2 F q in P GL 2 F q 2 Jincheng Zhuang 1,2 and Qi Cheng 3 1 State Key Laboratory of Information Security Institute of Information Engineering Chinese Academy
More informationExplicit Complex Multiplication
Explicit Complex Multiplication Benjamin Smith INRIA Saclay Île-de-France & Laboratoire d Informatique de l École polytechnique (LIX) Eindhoven, September 2008 Smith (INRIA & LIX) Explicit CM Eindhoven,
More informationA General Polynomial Selection Method and New Asymptotic Complexities for the Tower Number Field Sieve Algorithm
A General Polynomial Selection Method and New Asymptotic Complexities for the Tower Number Field Sieve Algorithm Palash Sarkar and Shashank Singh Indian Statistical Institute, Kolkata September 5, 2016
More informationEfficient hash maps to G 2 on BLS curves
Efficient hash maps to G 2 on BLS curves Alessandro Budroni 1 and Federico Pintore 2 1 MIRACL Labs, London, England - budroni.alessandro@gmail.com 2 Department of Mathematics, University of Trento, Italy
More informationPairings for Cryptography
Pairings for Cryptography Michael Naehrig Technische Universiteit Eindhoven Ñ ÐÖÝÔØÓ ºÓÖ Nijmegen, 11 December 2009 Pairings A pairing is a bilinear, non-degenerate map e : G 1 G 2 G 3, where (G 1, +),
More informationThe Number Field Sieve for Barreto-Naehrig Curves: Smoothness of Norms
The Number Field Sieve for Barreto-Naehrig Curves: Smoothness of Norms by Michael Shantz A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Master
More informationA quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic
A quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic Razvan Barbulescu 1, Pierrick Gaudry 1, Antoine Joux 2,3, and Emmanuel Thomé 1 1 Inria, CNRS, University of
More informationCover and Decomposition Index Calculus on Elliptic Curves made practical
Cover and Decomposition Index Calculus on Elliptic Curves made practical Application to a previously unreachable curve over F p 6 Vanessa VITSE Antoine JOUX Université de Versailles Saint-Quentin, Laboratoire
More informationFast, twist-secure elliptic curve cryptography from Q-curves
Fast, twist-secure elliptic curve cryptography from Q-curves Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC #17, Leuven September 16,
More informationAlgorithmes de calcul de logarithme discret dans les corps finis
Algorithmes de calcul de logarithme discret dans les corps finis Grenoble, École de printemps C2 2014 E. Thomé CARAMEL /* */ C,A, /* */ R,a, /* */ M,E, L,i= 5,e, d[5],q[999 ){for ]={0};main(N (;i--;e=scanf("%"
More informationA New Family of Pairing-Friendly elliptic curves
A New Family of Pairing-Friendly elliptic curves Michael Scott 1 and Aurore Guillevic 2 1 MIRACL.com 2 Université de Lorraine, CNRS, Inria, LORIA, Nancy, France May 21, 2018 Abstract There have been recent
More informationProblème du logarithme discret sur courbes elliptiques
Problème du logarithme discret sur courbes elliptiques Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM Groupe de travail équipe ARITH LIRMM Vanessa VITSE (UVSQ) DLP over elliptic
More informationExtended Tower Number Field Sieve: A New Complexity for the Medium Prime Case
Extended Tower Number Field Sieve: A New Complexity for the Medium Prime Case Taechan Kim 1 and Razvan Barbulescu 2 1 NTT Secure Platform Laboratories, Japan taechan.kim@lab.ntt.co.jp 2 CNRS, Univ Paris
More informationREMARKS ON THE NFS COMPLEXITY
REMARKS ON THE NFS COMPLEXITY PAVOL ZAJAC Abstract. In this contribution we investigate practical issues with implementing the NFS algorithm to solve the DLP arising in XTR-based cryptosystems. We can
More informationHigher dimensional sieving for the number field sieve algorithms
Higher dimensional sieving for the number field sieve algorithms Laurent Grémy To cite this version: Laurent Grémy. Higher dimensional sieving for the number field sieve algorithms. ANTS 2018 - Thirteenth
More informationThe number field sieve in the medium prime case
The number field sieve in the medium prime case Frederik Vercauteren ESAT/COSIC - K.U. Leuven Joint work with Antoine Joux, Reynald Lercier, Nigel Smart Finite Field DLOG Basis finite field is F p = {0,...,
More informationMappings of elliptic curves
Mappings of elliptic curves Benjamin Smith INRIA Saclay Île-de-France & Laboratoire d Informatique de l École polytechnique (LIX) Eindhoven, September 2008 Smith (INRIA & LIX) Isogenies of Elliptic Curves
More informationConstructing Families of Pairing-Friendly Elliptic Curves
Constructing Families of Pairing-Friendly Elliptic Curves David Freeman Information Theory Research HP Laboratories Palo Alto HPL-2005-155 August 24, 2005* cryptography, pairings, elliptic curves, embedding
More informationFast hashing to G2 on pairing friendly curves
Fast hashing to G2 on pairing friendly curves Michael Scott, Naomi Benger, Manuel Charlemagne, Luis J. Dominguez Perez, and Ezekiel J. Kachisa School of Computing Dublin City University Ballymun, Dublin
More informationCollecting relations for the Number Field Sieve in GF pp 6 q
Collecting relations for the Number Field Sieve in GF pp 6 q Pierrick Gaudry, Laurent Grémy and Marion Videau Abstract In order to assess the security of cryptosystems based on the discrete logarithm problem
More informationA TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES
A TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES DAVID FREEMAN 1, MICHAEL SCOTT 2, AND EDLYN TESKE 3 1 Department of Mathematics University of California, Berkeley Berkeley, CA 94720-3840 USA dfreeman@math.berkeley.edu
More informationUpdating key size estimations for pairings
Updating key size estimations for pairings Razvan Barbulescu 1 and Sylvain Duquesne 2 1 IMJ-PRG, UMR CNRS 7586, Univ Paris 6, Univ Paris 7 razvan.barbulescu@imj-prg.fr 2 IRMAR, UMR CNRS 6625, Univ Rennes
More informationAnalysis of Optimum Pairing Products at High Security Levels
Analysis of Optimum Pairing Products at High Security Levels Xusheng Zhang and Dongdai Lin Institute of Software, Chinese Academy of Sciences Institute of Information Engineering, Chinese Academy of Sciences
More informationBreaking pairing-based cryptosystems using η T pairing over GF (3 97 )
Breaking pairing-based cryptosystems using η T pairing over GF (3 97 ) Takuya Hayashi 1, Takeshi Shimoyama 2, Naoyuki Shinohara 3, and Tsuyoshi Takagi 1 1 Kyushu University 2 FUJITSU LABORATORIES Ltd.
More informationThe Tower Number Field Sieve
The Tower Number Field Sieve Razvan Barbulescu, Pierrick Gaudry, Thorsten Kleinjung To cite this version: Razvan Barbulescu, Pierrick Gaudry, Thorsten Kleinjung. The Tower Number Field Sieve. Tetsu Iwata
More informationComputational algebraic number theory tackles lattice-based cryptography
Computational algebraic number theory tackles lattice-based cryptography Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Moving to the left Moving to the right
More informationNearly Sparse Linear Algebra
Nearly Sparse Linear Algebra Antoine Joux 1,2,4 and Cécile Pierrot 3,4 1 CryptoExperts, France 2 Chaire de Cryptologie de la Fondation de l UPMC 3 CNRS and Direction Générale de l Armement 4 Laboratoire
More informationBreaking pairing-based cryptosystems using η T pairing over GF (3 97 )
Breaking pairing-based cryptosystems using η T pairing over GF (3 97 ) Takuya Hayashi 1, Takeshi Shimoyama 2, Naoyuki Shinohara 3, and Tsuyoshi Takagi 1 1 Kyushu University, 744, Motooka, Nishi-ku, Fukuoka
More informationFaster Pairings on Special Weierstrass Curves
craig.costello@qut.edu.au Queensland University of Technology Pairing 2009 Joint work with Huseyin Hisil, Colin Boyd, Juanma Gonzalez-Nieto, Kenneth Koon-Ho Wong Table of contents 1 Introduction The evolution
More informationOn the Discrete Logarithm Problem on Algebraic Tori
On the Discrete Logarithm Problem on Algebraic Tori R. Granger 1 and F. Vercauteren 2 1 University of Bristol, Department of Computer Science, Merchant Venturers Building, Woodland Road, Bristol, BS8 1UB,
More informationBlock Wiedemann likes Schirokauer maps
Block Wiedemann likes Schirokauer maps E. Thomé INRIA/CARAMEL, Nancy. /* EPI CARAMEL */ C,A, /* Cryptologie, Arithmétique : */ R,a, /* Matériel et Logiciel */ M,E, L,i= 5,e, d[5],q[999 ]={0};main(N ){for
More informationKatherine Stange. ECC 2007, Dublin, Ireland
in in Department of Brown University http://www.math.brown.edu/~stange/ in ECC Computation of ECC 2007, Dublin, Ireland Outline in in ECC Computation of in ECC Computation of in Definition A integer sequence
More informationFaster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves
Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves Junfeng Fan, Frederik Vercauteren and Ingrid Verbauwhede Katholieke Universiteit Leuven, COSIC May 18, 2009 1 Outline What is
More informationPolynomial Selection Using Lattices
Polynomial Selection Using Lattices Mathias Herrmann Alexander May Maike Ritzenhofen Horst Görtz Institute for IT-Security Faculty of Mathematics Ruhr-University Bochum Factoring 2009 September 12 th Intro
More informationImprovements to the number field sieve for non-prime finite fields
Improvements to the number field sieve for non-prime finite fields Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, François Morain To cite this version: Razvan Barbulescu, Pierrick Gaudry, Aurore
More informationSpeeding up Ate Pairing Computation in Affine Coordinates
Speeding up Ate Pairing Computation in Affine Coordinates Duc-Phong Le and Chik How Tan Temasek Laboratories, National University of Singapore, 5A Engineering Drive 1, #09-02, Singapore 11711. (tslld,tsltch)@nus.edu.sg
More informationComputational algebraic number theory tackles lattice-based cryptography
Computational algebraic number theory tackles lattice-based cryptography Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Moving to the left Moving to the right
More informationElliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
More informationOn Near Prime-Order Elliptic Curves with Small Embedding Degrees
On Near Prime-Order Elliptic Curves with Small Embedding Degrees Duc-Phong Le, Nadia El Mrabet, Tan Chik How To cite this version: Duc-Phong Le, Nadia El Mrabet, Tan Chik How. On Near Prime-Order Elliptic
More informationImplementing Pairing-Based Cryptosystems
Implementing Pairing-Based Cryptosystems Zhaohui Cheng and Manos Nistazakis School of Computing Science, Middlesex University White Hart Lane, London N17 8HR, UK. {m.z.cheng, e.nistazakis}@mdx.ac.uk Abstract:
More informationSolving a 6120-bit DLP on a Desktop Computer
Solving a 6120-bit DLP on a Desktop Computer Faruk Göloğlu, Robert Granger, Gary McGuire, and Jens Zumbrägel Claude Shannon Institute Complex & Adaptive Systems Laboratory School of Mathematical Sciences
More informationOn near prime-order elliptic curves with small embedding degrees (Full version)
On near prime-order elliptic curves with small embedding degrees (Full version) Duc-Phong Le 1, Nadia El Mrabet 2, and Chik How Tan 1 1 Temasek Laboratories, National University of Singapore {tslld,tsltch}@nus.edu.sg
More informationIsogenies in a quantum world
Isogenies in a quantum world David Jao University of Waterloo September 19, 2011 Summary of main results A. Childs, D. Jao, and V. Soukharev, arxiv:1012.4019 For ordinary isogenous elliptic curves of equal
More informationCentrum Wiskunde & Informatica, Amsterdam, The Netherlands
Logarithmic Lattices Léo Ducas Centrum Wiskunde & Informatica, Amsterdam, The Netherlands Workshop: Computational Challenges in the Theory of Lattices ICERM, Brown University, Providence, RI, USA, April
More informationDiscrete Logarithm in GF(2 809 ) with FFS
Discrete Logarithm in GF(2 809 ) with FFS Razvan Barbulescu, Cyril Bouvier, Jérémie Detrey, Pierrick Gaudry, Hamza Jeljeli, Emmanuel Thomé, Marion Videau, and Paul Zimmermann CARAMEL project-team, LORIA,
More informationHyperelliptic curves
1/40 Hyperelliptic curves Pierrick Gaudry Caramel LORIA CNRS, Université de Lorraine, Inria ECC Summer School 2013, Leuven 2/40 Plan What? Why? Group law: the Jacobian Cardinalities, torsion Hyperelliptic
More informationFaster Squaring in the Cyclotomic Subgroup of Sixth Degree Extensions
Faster Squaring in the Cyclotomic Subgroup of Sixth Degree Extensions Robert Granger and Michael Scott School of Computing, Dublin City University, Glasnevin, Dublin 9, Ireland. {rgranger,mike}@computing.dcu.ie
More informationGenerating more MNT elliptic curves
Generating more MNT elliptic curves Michael Scott 1 and Paulo S. L. M. Barreto 2 1 School of Computer Applications Dublin City University Ballymun, Dublin 9, Ireland. mike@computing.dcu.ie 2 Universidade
More informationA TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES
A TAXONOMY OF PAIRING-FRIENDLY ELLIPTIC CURVES DAVID FREEMAN, MICHAEL SCOTT, AND EDLYN TESKE Abstract. Elliptic curves with small embedding degree and large prime-order subgroup are key ingredients for
More informationFINDING COMPOSITE ORDER ORDINARY ELLIPTIC CURVES USING THE COCKS-PINCH METHOD
FINDING COMPOSITE ORDER ORDINARY ELLIPTIC CURVES USING THE COCKS-PINCH METHOD D. BONEH, K. RUBIN, AND A. SILVERBERG Abstract. We apply the Cocks-Pinch method to obtain pairing-friendly composite order
More informationQuasi-reducible Polynomials
Quasi-reducible Polynomials Jacques Willekens 06-Dec-2008 Abstract In this article, we investigate polynomials that are irreducible over Q, but are reducible modulo any prime number. 1 Introduction Let
More informationA NEW PERSPECTIVE ON THE POWERS OF TWO DESCENT FOR DISCRETE LOGARITHMS IN FINITE FIELDS THORSTEN KLEINJUNG AND BENJAMIN WESOLOWSKI
A NEW PERSPECTIVE ON THE POWERS OF TWO DESCENT FOR DISCRETE LOGARITHMS IN FINITE FIELDS THORSTEN KLEINJUNG AND BENJAMIN WESOLOWSKI Abstract. A new proof is given for the correctness of the powers of two
More informationAsymmetric Pairings. Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp)
Asymmetric Pairings Alfred Menezes (joint work with S. Chatterjee, D. Hankerson & E. Knapp) 1 Overview In their 2006 paper "Pairings for cryptographers", Galbraith, Paterson and Smart identified three
More informationPairings at High Security Levels
Pairings at High Security Levels Michael Naehrig Eindhoven University of Technology michael@cryptojedi.org DoE CRYPTODOC Darmstadt, 21 November 2011 Pairings are efficient!... even at high security levels.
More informationDiscrete Logarithm Computation in Hyperelliptic Function Fields
Discrete Logarithm Computation in Hyperelliptic Function Fields Michael J. Jacobson, Jr. jacobs@cpsc.ucalgary.ca UNCG Summer School in Computational Number Theory 2016: Function Fields Mike Jacobson (University
More informationThe factorization of RSA D. J. Bernstein University of Illinois at Chicago
The factorization of RSA-1024 D. J. Bernstein University of Illinois at Chicago Abstract: This talk discusses the most important tools for attackers breaking 1024-bit RSA keys today and tomorrow. The same
More informationGood algebraic reading. MPRI Cours III. Integer factorization NFS. A) Definitions and properties
F. Morain École polytechnique MPRI cours -1 007-008 3/45 F. Morain École polytechnique MPRI cours -1 007-008 4/45 ECOLE POLYTECHNIQUE MPRI Cours -1 F. Morain III. Integer factorization NFS 007/10/01 I.
More informationSome Efficient Algorithms for the Final Exponentiation of η T Pairing
Some Efficient Algorithms for the Final Exponentiation of η T Pairing Masaaki Shirase 1, Tsuyoshi Takagi 1, and Eiji Okamoto 2 1 Future University-Hakodate, Japan 2 University of Tsukuba, Japan Abstract.
More informationCado-nfs, a Number Field Sieve implementation
1 / 37 Cado-nfs, a Number Field Sieve implementation P Gaudry1, A Kruppa1, F Morain2, L Muller1, E Thomé1, P Zimmermann1 1 Caramel/Inria/Loria ; 2 Tanc/Inria/Lix Sep 23rd, 2011 2 / 37 Plan Introduction
More informationElliptic Curve Discrete Logarithm Problem
Elliptic Curve Discrete Logarithm Problem Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM October 19, 2009 Vanessa VITSE (UVSQ) Elliptic Curve Discrete Logarithm Problem October
More informationOptimal TNFS-secure pairings on elliptic curves with even embedding degree
Optimal TNFS-secure pairings on elliptic curves with even embedding degree Georgios Fotiadis 1 and Chloe Martindale 2 1 University of the Aegean, Greece gfotiadis@aegean.gr 2 Technische Universiteit Eindhoven,
More informationEfficient Key Agreement and Signature Schemes Using Compact Representations in GF (p 10 )
Efficient Key Agreement and Signature Schemes Using Compact Representations in GF (p 10 ) Kenneth J. Giuliani 1 and Guang Gong 2 1 Dept. of Combinatorics and Optimization University of Waterloo Waterloo,
More informationPolynomial Selection. Thorsten Kleinjung École Polytechnique Fédérale de Lausanne
Polynomial Selection Thorsten Kleinjung École Polytechnique Fédérale de Lausanne Contents Brief summary of polynomial selection (no root sieve) Motivation (lattice sieving, monic algebraic polynomial)
More informationDecomposed Attack for the Jacobian of a Hyperelliptic Curve over an Extension Field
Decomposed Attack for the Jacobian of a Hyperelliptic Curve over an Extension Field Koh-ichi Nagao nagao@kanto-gakuin.ac.jp Dept. of Engineering, Kanto Gakuin Univ., 1-50-1 Mutsuura Higashi Kanazawa-ku
More informationKatherine Stange. Pairing, Tokyo, Japan, 2007
via via Department of Mathematics Brown University http://www.math.brown.edu/~stange/ Pairing, Tokyo, Japan, 2007 Outline via Definition of an elliptic net via Definition (KS) Let R be an integral domain,
More informationAdvanced code-based cryptography. Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven
Advanced code-based cryptography Daniel J. Bernstein University of Illinois at Chicago & Technische Universiteit Eindhoven Lattice-basis reduction Define L = (0; 24)Z + (1; 17)Z = {(b; 24a + 17b) : a;
More informationGenerating more Kawazoe-Takahashi Genus 2 Pairing-friendly Hyperelliptic Curves
Generating more Kawazoe-Takahashi Genus 2 Pairing-friendly Hyperelliptic Curves Ezekiel J Kachisa School of Computing Dublin City University Ireland ekachisa@computing.dcu.ie Abstract. Constructing pairing-friendly
More informationScalar multiplication in compressed coordinates in the trace-zero subgroup
Scalar multiplication in compressed coordinates in the trace-zero subgroup Giulia Bianco and Elisa Gorla Institut de Mathématiques, Université de Neuchâtel Rue Emile-Argand 11, CH-2000 Neuchâtel, Switzerland
More informationIntroduction to cryptology (GBIN8U16) More on discrete-logarithm based schemes
Introduction to cryptology (GBIN8U16) More on discrete-logarithm based schemes Pierre Karpman pierre.karpman@univ-grenoble-alpes.fr https://www-ljk.imag.fr/membres/pierre.karpman/tea.html 2018 03 13 More
More informationAn Alternate Decomposition of an Integer for Faster Point Multiplication on Certain Elliptic Curves
An Alternate Decomposition of an Integer for Faster Point Multiplication on Certain Elliptic Curves Young-Ho Park 1,, Sangtae Jeong 2, Chang Han Kim 3, and Jongin Lim 1 1 CIST, Korea Univ., Seoul, Korea
More informationThe filtering step of discrete logarithm and integer factorization algorithms
The filtering step of discrete logarithm and integer factorization algorithms Cyril Bouvier To cite this version: Cyril Bouvier. The filtering step of discrete logarithm and integer factorization algorithms.
More informationComplexity news: discrete logarithms in multiplicative groups of small-characteristic finite fields the algorithm of Barbulescu, Gaudry, Joux, Thomé
Complexity news: discrete logarithms in multiplicative groups of small-characteristic finite fields the algorithm of Barbulescu, Gaudry, Joux, Thomé D. J. Bernstein University of Illinois at Chicago &
More informationEfficient Tate Pairing Computation Using Double-Base Chains
Efficient Tate Pairing Computation Using Double-Base Chains Chang an Zhao, Fangguo Zhang and Jiwu Huang 1 Department of Electronics and Communication Engineering, Sun Yat-Sen University, Guangzhou 510275,
More informationSecurity Level of Cryptography Integer Factoring Problem (Factoring N = p 2 q) December Summary 2
Security Level of Cryptography Integer Factoring Problem (Factoring N = p 2 ) December 2001 Contents Summary 2 Detailed Evaluation 3 1 The Elliptic Curve Method 3 1.1 The ECM applied to N = p d............................
More informationGenus 2 Hyperelliptic Curve Families with Explicit Jacobian Order Evaluation and Pairing-Friendly Constructions
Genus Hyperelliptic Curve Families with Explicit Jacobian Order Evaluation and Pairing-Friendly Constructions Aurore Guillevic 1, and Damien Vergnaud 1 1 Équipe crypto DI, École Normale Supérieure, C.N.R.S.,
More informationSpeeding up characteristic 2: I. Linear maps II. The Å(Ò) game III. Batching IV. Normal bases. D. J. Bernstein University of Illinois at Chicago
Speeding up characteristic 2: I. Linear maps II. The Å(Ò) game III. Batching IV. Normal bases D. J. Bernstein University of Illinois at Chicago NSF ITR 0716498 Part I. Linear maps Consider computing 0
More informationFactoring univariate polynomials over the rationals
Factoring univariate polynomials over the rationals Tommy Hofmann TU Kaiserslautern November 21, 2017 Tommy Hofmann Factoring polynomials over the rationals November 21, 2017 1 / 31 Factoring univariate
More informationArithmétique et Cryptographie Asymétrique
Arithmétique et Cryptographie Asymétrique Laurent Imbert CNRS, LIRMM, Université Montpellier 2 Journée d inauguration groupe Sécurité 23 mars 2010 This talk is about public-key cryptography Why did mathematicians
More informationLattice Reductions over Euclidean Rings with Applications to Cryptanalysis
IMACC 2017 December 12 14, 2017 Lattice Reductions over Euclidean Rings with Applications to Cryptanalysis Taechan Kim and Changmin Lee NTT Secure Platform Laboratories, Japan and Seoul National University,
More informationDiscrete Logarithm Problem
Discrete Logarithm Problem Çetin Kaya Koç koc@cs.ucsb.edu (http://cs.ucsb.edu/~koc/ecc) Elliptic Curve Cryptography lect08 discrete log 1 / 46 Exponentiation and Logarithms in a General Group In a multiplicative
More informationModular Multiplication in GF (p k ) using Lagrange Representation
Modular Multiplication in GF (p k ) using Lagrange Representation Jean-Claude Bajard, Laurent Imbert, and Christophe Nègre Laboratoire d Informatique, de Robotique et de Microélectronique de Montpellier
More informationON THE USE OF THE LATTICE SIEVE IN THE 3D NFS
Tatra Mt Math Publ 45 (2010), 161 172 Ø Ñ Å Ø Ñ Ø Ð ÈÙ Ð Ø ÓÒ ON THE USE OF THE LATTICE SIEVE IN THE 3D NFS Pavol Zajac ABSTRACT An adaptation of the Number Field Sieve(NFS) algorithm to solve a discrete
More information