Polynomial Selection Using Lattices

Transcription

1 Polynomial Selection Using Lattices Mathias Herrmann Alexander May Maike Ritzenhofen Horst Görtz Institute for IT-Security Faculty of Mathematics Ruhr-University Bochum Factoring 2009 September 12 th

2 Intro Need to find 2 irreducible polynomials f 1 (x), f 2 (x) Z[x] with common root m modulo N. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 2

3 Intro Need to find 2 irreducible polynomials f 1 (x), f 2 (x) Z[x] with common root m modulo N. deg(f 1 (x)) = 5 (algebraic polynomial) deg(f 2 (x)) = 1 (linear polynomial) Homogeneous form: F 1 (x, z) = a d x d + a d1 x d 1 z a 0 z d F 2 (x, z) = x mz Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 2

4 Intro Need to find 2 irreducible polynomials f 1 (x), f 2 (x) Z[x] with common root m modulo N. deg(f 1 (x)) = 5 (algebraic polynomial) deg(f 2 (x)) = 1 (linear polynomial) Homogeneous form: F 1 (x, z) = a d x d + a d1 x d 1 z a 0 z d F 2 (x, z) = x mz Currently, algorithm of Thorsten Kleinjung yields the best polynomial pairs. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 2

5 Good Polynomials Want to find many pairs (a, b) Z 2 such that F 1 (a, b) and F 2 (a, b) are smooth. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 3

6 Good Polynomials Want to find many pairs (a, b) Z 2 such that F 1 (a, b) and F 2 (a, b) are smooth. Need to be able to (quickly) compare polynomial (pairs). Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 3

7 Good Polynomials Want to find many pairs (a, b) Z 2 such that F 1 (a, b) and F 2 (a, b) are smooth. Need to be able to (quickly) compare polynomial (pairs). Quality Measures Q 2(f 1, f 2) = Z π 0 «α(f1) + log F 1( A cos θ, B sin θ) ρ log L 1 «α(f2) + log F 2( A cos θ, B sin θ) ρ dθ log L 2 Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 3

8 Good Polynomials Want to find many pairs (a, b) Z 2 such that F 1 (a, b) and F 2 (a, b) are smooth. Need to be able to (quickly) compare polynomial (pairs). Quality Measures Q 2(f 1, f 2) = Z π 0 0 Q 3(f 1) = α(f 1) + 1 Z 2 log «α(f1) + log F 1( A cos θ, B sin θ) ρ log L 1 «α(f2) + log F 2( A cos θ, B sin θ) ρ dθ log L 2 a A 0 < b B 1 F 1(a, b) 2 da dbc A Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 3

9 Good Polynomials Want to find many pairs (a, b) Z 2 such that F 1 (a, b) and F 2 (a, b) are smooth. Need to be able to (quickly) compare polynomial (pairs). Quality Measures Q 2(f 1, f 2) = Z π 0 0 Q 3(f 1) = α(f 1) + 1 Z 2 log «α(f1) + log F 1( A cos θ, B sin θ) ρ log L 1 «α(f2) + log F 2( A cos θ, B sin θ) ρ dθ log L 2 a A 0 < b B Q 4(f 1) = max 0 i d a i s d i 2 1 F 1(a, b) 2 da dbc A Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 3

10 Basics in Lattices Definition Let b 1,..., b n Q n be linearly independent vectors. The set { } n L := x Q n x = a i b i, a i Z is a lattice. i=1 Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 4

11 Basics in Lattices Definition Let b 1,..., b n Q n be linearly independent vectors. The set { } n L := x Q n x = a i b i, a i Z is a lattice. Described by basis matrix B(L) = i=1 b 1. b n Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 4

12 Basic polynomial selection using lattices Question How can we use lattices to perform a polynomial selection? Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 5

13 Basic polynomial selection using lattices Question How can we use lattices to perform a polynomial selection? Fix a root m modulo N. Linear polynomial is just f 2 (x) = x m. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 5

14 Basic polynomial selection using lattices Question How can we use lattices to perform a polynomial selection? Fix a root m modulo N. Linear polynomial is just f 2 (x) = x m. For algebraic polynomial use the following basis matrix. 1 x x 2... x d f 1 (m) m m m d N Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 5

15 Basic polynomial selection using lattices Question How can we use lattices to perform a polynomial selection? Fix a root m modulo N. Linear polynomial is just f 2 (x) = x m. For algebraic polynomial use the following basis matrix. 1 x x 2... x d f 1 (m) m m m d N Lattice reduction yields short lattice vector, i.e. polynomial with small coefficients. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 5

16 Skewness More sieve reports, if sieving region and polynomial are skewed x x x x x Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 6

17 Skewness More sieve reports, if sieving region and polynomial are skewed x x x x x Skewness in lattice basis Multiply basis matrix with a weight matrix that forces the polynomial to be skewed. W = s s s d S. After LLL reduction apply the inverse scaling to obtain desired polynomial. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 6

18 Result Obtain (skewed) polynomial with small coefficients. good polynomial with respect to. Q 4 (f 1 ) = max 0 i d a i s d i 2 Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 7

19 Result Obtain (skewed) polynomial with small coefficients. good polynomial with respect to. Q 4 (f 1 ) = max 0 i d a i s d i 2 BUT: We want to use a better approximation of number of sieve reports. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 7

20 Result Obtain (skewed) polynomial with small coefficients. good polynomial with respect to. Q 4 (f 1 ) = max 0 i d a i s d i 2 BUT: We want to use a better approximation of number of sieve reports. Use different norm for LLL to capture quality with respect to Q 3. Q 3 (f 1 ) = α(f 1 ) log a A 0 < b B F 1 (a, b) 2 da db Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 7

21 Modified Norm Alter norm used by LLL. Define v := v T Mv with M := 2 11 s s s s 0 35 s s s s s s s s s s s s s s S. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 8

22 Comparison: Quality with standard norm vs. new norm 45 new norm euclidean norm Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 9

23 Root Property Recall quality measure Q 3 (f 1 ) = α(f 1 ) }{{} Root property log F 1 (a, b) 2 da db a A } 0 < b B {{ } Size property Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 10

24 Root Property Recall quality measure Q 3 (f 1 ) = α(f 1 ) }{{} Root property log F 1 (a, b) 2 da db a A } 0 < b B {{ } Size property Size property optimed by LLL, but Root property α(f 1 ) has major influence on quality. Need to model in lattice. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 10

25 Lattice basis with improved root property 1 x x 2... x d f 1 (m) f 1 (α 1 )... f 1 (α k ) α αk m α α 1 k m 2 α α 2 k m d α1 d... αk d N p p k Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 11

26 Remarks Using some roots modulo small primes of Kleinjung s polynomial, we are able to reconstruct it with the lattice approach. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 12

27 Remarks Using some roots modulo small primes of Kleinjung s polynomial, we are able to reconstruct it with the lattice approach. However, we are not able to allow LLL to choose a set of roots modulo small primes. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 12

28 Remarks Using some roots modulo small primes of Kleinjung s polynomial, we are able to reconstruct it with the lattice approach. However, we are not able to allow LLL to choose a set of roots modulo small primes. Trying all possibilities to complex, No iterative method obvious. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 12

29 Remarks Using some roots modulo small primes of Kleinjung s polynomial, we are able to reconstruct it with the lattice approach. However, we are not able to allow LLL to choose a set of roots modulo small primes. Trying all possibilities to complex, No iterative method obvious. Need a different approach to obtain a good root property. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 12

30 Special Galois groups A theorem by Odoni states that asymptotically a polynomial, where the Galois group is the Frobenius group, yields smaller values. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 13

31 Special Galois groups A theorem by Odoni states that asymptotically a polynomial, where the Galois group is the Frobenius group, yields smaller values. Our goal: Use LLL to find good polynomials with the special Galois group. Generic polynomials with Galois group F 20 f gen(x; a, b) := x 5 + b 2 (a 2 + 4) 2a 17 «x 4 + 3b(a 2 + 4) + (a 2 + 4) + 13a 4 f gen(x; p, q) := x px p 2 x + q b(a 2 + 4) + 11a «2 8 x 2 + (a 6) x + 1 «2 + 1 x 3 Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 13

32 Special Galois groups A theorem by Odoni states that asymptotically a polynomial, where the Galois group is the Frobenius group, yields smaller values. Our goal: Use LLL to find good polynomials with the special Galois group. Generic polynomials with Galois group F 20 f gen(x; a, b) := x 5 + b 2 (a 2 + 4) 2a 17 «x 4 + 3b(a 2 + 4) + (a 2 + 4) + 13a 4 f gen(x; p, q) := x px p 2 x + q b(a 2 + 4) + 11a «2 8 x 2 + (a 6) x + 1 «2 + 1 x 3 But: unable to find a root m modulo N. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 13

33 Enforce special Galois group Generic polynomial with Frobenius group as Galois group. Compute roots modulo small primes and use these as input to lattice reduction, randomly chosen m. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 14

34 Enforce special Galois group Generic polynomial with Frobenius group as Galois group. Compute roots modulo small primes and use these as input to lattice reduction, randomly chosen m. Hope that roots enforce the resulting polynomial to have the desired Galois group. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 14

35 Enforce special Galois group Generic polynomial with Frobenius group as Galois group. Compute roots modulo small primes and use these as input to lattice reduction, randomly chosen m. Hope that roots enforce the resulting polynomial to have the desired Galois group. Only happened if a lot of roots modulo small primes were enforce, but then the size of coefficients was very bad. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 14

36 Optimize parameters a, b Try to find parameters of the generic polynomials. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 15

37 Optimize parameters a, b Try to find parameters of the generic polynomials. Fix m and use Coppersmith s Algorithm to find a, b s.th. f gen (m; a, b) = 0 mod N. Two problems arise: 1 Upper bounds on a, b are very small. Experiments never found suitable a, b. 2 Even if we found good algebraic polynomial, the polynomial pair may still be bad. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 15

38 Optimize parameters a, b Try to find parameters of the generic polynomials. Fix m and use Coppersmith s Algorithm to find a, b s.th. f gen (m; a, b) = 0 mod N. Two problems arise: 1 Upper bounds on a, b are very small. Experiments never found suitable a, b. 2 Even if we found good algebraic polynomial, the polynomial pair may still be bad. Add m as a further variable in Coppersmith s algortihm. But then the bounds get even worse and we cannot expect a solution. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 15

39 Finding a root m All previous approaches used a given root m. Now: Try to find a good m with lattice methods. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 16

40 Finding a root m All previous approaches used a given root m. Now: Try to find a good m with lattice methods. Translation Given a polynomial f(x) with root m modulo N, the polynomial f (x) := f(x α) has root m = m + α. (f (m ) = f(m α) = f(m + α α) = 0 mod N) Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 16

41 Idea Start with arbitrary polynomial (known root m modulo N). Compute coefficients of translated polynomials. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 17

42 Idea Start with arbitrary polynomial (known root m modulo N). Compute coefficients of translated polynomials. Translated polynomials f 1(x) = px m f 2(x) = a 5x 5 + a 4x 4 + a 3x 3 + a 2x 2 + a 1x + a 0 f 1(x) = f 1(x α) = p(x α) m = px (pα + m) f 2(x) = f 2(x α) = a 5x 5 + (a 4 5a 5α)x 4 + (a 3 4a 4α + 10a 5α 2 )x 3 +(a 2 3a 3α + 6a 4α 2 10a 5α 3 )x 2 +(a 1 2a 2α + 3a 3α 2 4a 4α 3 + 5a 5α 4 )x +(a 0 a 1α + a 2α 2 a 3α 3 + a 4α 4 a 5α 5 ). Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 17

43 Problem Description Find α such that coefficients of translated polynomial are small. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 18

44 Problem Description Find α such that coefficients of translated polynomial are small. System of modular equations g 1 (α) = pα m = ɛ 1 mod N g 2 (α) = a 4 5a 5 α = ɛ 2 mod N g 3 (α) = a 3 4a 4 α + 10a 5 α 2 = ɛ 3 mod N g 4 (α) = a 2 3a 3 α + 6a 4 α 2 10a 5 α 3 = ɛ 4 mod N g 5 (α) = a 1 2a 2 α + 3a 3 α 2 4a 4 α 3 + 5a 5 α 4 = ɛ 5 mod N g 6 (α) = a 0 a 1 α + a 2 α 2 a 3 α 3 + a 4 α 4 a 5 α 5 = ɛ 6 mod N. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 18

45 First Approach: SVP Solve SVP! Lattice L 1 g 1 (α) g 2 (α) g 3 (α) g 4 (α) g 5 (α) g 6 (α) m a 4 a 3 a 2 a 1 a 0 1 α 1 p 5a 5 4a 4 3a 3 2a 2 a 1 α a 5 6a 4 3a 3 a 2 α a 5 4a 4 a 3 α 4 1 5a 5 a 4 α 5 1 a 5 N N N B N A N N Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 19

46 First Approach: SVP Solve SVP! Lattice L 1 g 1 (α) g 2 (α) g 3 (α) g 4 (α) g 5 (α) g 6 (α) m a 4 a 3 a 2 a 1 a 0 1 α 1 p 5a 5 4a 4 3a 3 2a 2 a 1 α a 5 6a 4 3a 3 a 2 α a 5 4a 4 a 3 α 4 1 5a 5 a 4 α 5 1 a 5 N N N B N A N N Target vector t = (1, α, α 2, α 3, α 4, α 5, ɛ 1, ɛ 2, ɛ 3, ɛ 4, ɛ 5, ɛ 6 ). Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 19

47 Results Not possible to enforce geometric progression (1, α, α 2, α 3, α 4, α 5 ) of the first components. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 20

48 Results Not possible to enforce geometric progression (1, α, α 2, α 3, α 4, α 5 ) of the first components. Target vector is not among the short vectors in this lattice. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 20

49 Results Not possible to enforce geometric progression (1, α, α 2, α 3, α 4, α 5 ) of the first components. Target vector is not among the short vectors in this lattice. Need a different approach. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 20

50 Second Approach: LLL-Property Let B = b 1,..., b n be LLL-reduced. Then the Gram-Schmidt-orthogonalized vectors b i fulfill b i 2 i 1 4 ( det(l) b max ) 1 i. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 21

51 Second Approach: LLL-Property Let B = b 1,..., b n be LLL-reduced. Then the Gram-Schmidt-orthogonalized vectors b i fulfill b i 2 i 1 4 ( det(l) b max ) 1 i. If target vector is larger than orthogonalized vector, then < b i, t >= 0 gives polynomial equation. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 21

52 Second Approach: LLL-Property Let B = b 1,..., b n be LLL-reduced. Then the Gram-Schmidt-orthogonalized vectors b i fulfill b i 2 i 1 4 ( det(l) b max ) 1 i. If target vector is larger than orthogonalized vector, then < b i, t >= 0 gives polynomial equation. System of modular equations has 7 unknowns. If we find at least 7 orthogonal vectors that are larger than target vector, then we may be able to compute a solution. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 21

53 Remarks The lattice L 1 only yields 6 polynomials. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 22

54 Remarks The lattice L 1 only yields 6 polynomials. Extending the lattice basis Use additionally powers and products of the g i. g 1 (α) g 2 (α) g 3 (α)... g1 2 0 (α) g 1g 2 (α) m a 4 a 3 m 2 a 4 m α 1 p 5a 5 4a 4 2pm a 4 p + 5a 5 m α a 5 p 2 5a 5 p α 3 1 α 4 1 α 5 1 N N N N N 1 C A We can explicitly compute upper bounds on variables, s.th. we target vector will be shorter than at least 7 orthogonalized vectors. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 22

55 Experimental results Start with translated version of Kleinjung s polynomial pair f i (x) = f KJ i (x α) Goal: Recover the inverse transformation α = α. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 23

56 Experimental results Start with translated version of Kleinjung s polynomial pair f i (x) = f KJ i (x α) Goal: Recover the inverse transformation α = α. Explicit computation of upper bound on α : α N 0.6 Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 23

57 Experimental results Start with translated version of Kleinjung s polynomial pair f i (x) = f KJ i (x α) Goal: Recover the inverse transformation α = α. Explicit computation of upper bound on α : α N 0.6 (Note: Search space of exponential size in polynomial time!) Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 23

58 Experimental results Start with translated version of Kleinjung s polynomial pair f i (x) = f KJ i (x α) Goal: Recover the inverse transformation α = α. Explicit computation of upper bound on α : α N 0.6 (Note: Search space of exponential size in polynomial time!) We get enough polynomials, but... Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 23

59 Experimental results Start with translated version of Kleinjung s polynomial pair f i (x) = f KJ i (x α) Goal: Recover the inverse transformation α = α. Explicit computation of upper bound on α : α N 0.6 (Note: Search space of exponential size in polynomial time!) We get enough polynomials, but... Problem: Obtained system of equations is still not 0-dimensional. Does not allow to efficiently recover the root. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 23

60 Summary Improving polynomial selection for the GNFS using lattice methods. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 24

61 Summary Improving polynomial selection for the GNFS using lattice methods. We are able to construct polynomials with good size property. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 24

62 Summary Improving polynomial selection for the GNFS using lattice methods. We are able to construct polynomials with good size property. New definition of norm better resembles polynomial quality. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 24

63 Summary Improving polynomial selection for the GNFS using lattice methods. We are able to construct polynomials with good size property. New definition of norm better resembles polynomial quality. It is possible to provide (fixed) roots modulo (fixed) small primes, but no selection by LLL. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 24

64 Summary Improving polynomial selection for the GNFS using lattice methods. We are able to construct polynomials with good size property. New definition of norm better resembles polynomial quality. It is possible to provide (fixed) roots modulo (fixed) small primes, but no selection by LLL. Enforcing a special Galois group, s.th. the polynomial has a good root property dramatically worsens the size property. Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 24

65 Summary Improving polynomial selection for the GNFS using lattice methods. We are able to construct polynomials with good size property. New definition of norm better resembles polynomial quality. It is possible to provide (fixed) roots modulo (fixed) small primes, but no selection by LLL. Enforcing a special Galois group, s.th. the polynomial has a good root property dramatically worsens the size property. Searching for a good root m by means of LLL did not work (yet). Mathias Herrmann, Alexander May, Maike Ritzenhofen Polynomial Selection Using Lattices 24