A heuristic quasi-polynomial algorithm for discrete logarithm in small characteristic
|
|
- Russell Weaver
- 5 years ago
- Views:
Transcription
1 ECC, Chennai October 8, 2014 A heuristic quasi-polynomial algorithm for discrete logarithm in small characteristic Razvan Barbulescu 1 Pierrick Gaudry 2 Antoine Joux 3 Emmanuel Thomé 2 IMJ-PRG, Paris Loria, Nancy LIP6, Paris R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 0 / 28
2 Context The discrete logarithm problem (DLP) In a cyclic group G, given a generator g and an element g a, FIND a. We can search the smallest positive integer solution a or, more common, the residue of a modulo a prime factor l of #G. Choices for G 1. elliptic curves (estimated of exponential difficulty); 2. multiplicative group of finite fields (subexponential) 2.1 small characteristic, e.g. F 2 n and F 3 n, 2.2 non-small characteristic, e.g. F p and F p 2 Example When G = (F p ), given two integers g and h, if it exists, FIND x in g x h mod p. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 1 / 28
3 Motivation factorization same complexity discrete log. in F p analogous pairings inversion over F 2 n relies on relies on discrete log. in F 2 n elliptic curves discrete log. over F 2 n F Q is the field of Q elements, Q prime power. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 2 / 28
4 Shanks baby-step giant-step algorithm Let K N and write the discrete log of x as x = x 0 + K x 1, with 0 x 0 < K and 0 x 1 < N/K. Algorithm 1. Compute Baby Steps: For all i in [0, K 1], compte g i. Store in a hash table the resulting pairs (g i, i). 2. Compute Giant Steps: For all j in [0, N/K ], compute hg Kj. If the resulting element is in the BS table, then get the corresponding i, and return x = i + Kj. Theorem Discrete logarithms in a cyclic group of order N can be computed in less than 2 N operations. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 3 / 28
5 Shanks baby-step giant-step algorithm Let K N and write the discrete log of x as x = x 0 + K x 1, with 0 x 0 < K and 0 x 1 < N/K. Algorithm 1. Compute Baby Steps: For all i in [0, K 1], compte g i. Store in a hash table the resulting pairs (g i, i). 2. Compute Giant Steps: For all j in [0, N/K ], compute hg Kj. If the resulting element is in the BS table, then get the corresponding i, and return x = i + Kj. Theorem Discrete logarithms in a cyclic group of order N can be computed in less than 2 N operations. Multiplicative group of finite fields is not a generic groups! R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 3 / 28
6 History For two constatnts α [0, 1] and c > 0, we put ) L Q (α, c) = exp (c + o(1))(log Q) α (log log Q) 1 α Put n = log Q. L Q (0) = n O(1) i.e. polynomial; L Q (1) = 2 O(n) i.e. exponential; L Q (1/2) 2 n ; DLP algorithms invented in L Q (1/3) 2 3 n ; DLP algorithms invented in R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 4 / 28
7 Smoothness Definition A polynomial in F q [t] is m-smooth if it factors into polynomials of degree less than or equal to m. Computation One can test if a polynomial is smooth by factoring it (probabilistic polynomial). Theorem (Panario Gourdon Flajolet) The probability that a degree-n polynomial is m-smooth is 1/u u(1+o(1)) where u = n m. Cases: n = D, m = D/6 gives a constant probability; n = D, m = 1 gives a probability 1/D! 1/D D. n = log q L x (α, ), m = log q L x (β, ) gives a probability of 1/L x (α β, ); R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 5 / 28
8 Obtaining relations The finite field F q k is represented as F q [t]/ϕ for an irreducible polynomial ϕ F q [t] of degree k. Example Take q = 3, k = 5, ϕ = t 5 + t 4 + 2t 3 + 1, g = t F 3 5. We have t 5 2(t + 1)(t 3 + t 2 + 2t + 1) mod ϕ R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 6 / 28
9 Obtaining relations The finite field F q k is represented as F q [t]/ϕ for an irreducible polynomial ϕ F q [t] of degree k. Example Take q = 3, k = 5, ϕ = t 5 + t 4 + 2t 3 + 1, g = t F 3 5. We have t 5 2(t + 1)(t 3 + t 2 + 2t + 1) mod ϕ t 6 2(t 2 + 1)(t 2 + t + 2) mod ϕ R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 6 / 28
10 Obtaining relations The finite field F q k is represented as F q [t]/ϕ for an irreducible polynomial ϕ F q [t] of degree k. Example Take q = 3, k = 5, ϕ = t 5 + t 4 + 2t 3 + 1, g = t F 3 5. We have t 5 2(t + 1)(t 3 + t 2 + 2t + 1) mod ϕ t 6 2(t 2 + 1)(t 2 + t + 2) mod ϕ t 7 2(t + 2)(t + 1)(t + 1) mod ϕ R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 6 / 28
11 Obtaining relations The finite field F q k is represented as F q [t]/ϕ for an irreducible polynomial ϕ F q [t] of degree k. Example Take q = 3, k = 5, ϕ = t 5 + t 4 + 2t 3 + 1, g = t F 3 5. We have t 5 2(t + 1)(t 3 + t 2 + 2t + 1) mod ϕ t 6 2(t 2 + 1)(t 2 + t + 2) mod ϕ t 7 2(t + 2)(t + 1)(t + 1) mod ϕ The last relation gives: 7 log g t log g log g (t + 2) + 2 log g (t + 1) mod 11 R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 6 / 28
12 Obtaining relations The finite field F q k is represented as F q [t]/ϕ for an irreducible polynomial ϕ F q [t] of degree k. Example Take q = 3, k = 5, ϕ = t 5 + t 4 + 2t 3 + 1, g = t F 3 5. We have t 5 2(t + 1)(t 3 + t 2 + 2t + 1) mod ϕ t 6 2(t 2 + 1)(t 2 + t + 2) mod ϕ t 7 2(t + 2)(t + 1)(t + 1) mod ϕ The last relation gives: 7 log g t 1 log g (t + 2) + 2 log g (t + 1) mod 11 Proposition If a F q and l is a factor of q k 1 coprime to (q 1), then log a 0 mod l. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 6 / 28
13 Obtaining relations The finite field F q k is represented as F q [t]/ϕ for an irreducible polynomial ϕ F q [t] of degree k. Example Take q = 3, k = 5, ϕ = t 5 + t 4 + 2t 3 + 1, g = t F 3 5. We have t 5 2(t + 1)(t 3 + t 2 + 2t + 1) mod ϕ t 6 2(t 2 + 1)(t 2 + t + 2) mod ϕ The last relation gives: t log g t 1 log g (t + 2) + 2 log g (t + 1) mod 11 8 log g (t + 1) = 1 log g (t + 2) mod 11 9 log g (t + 2) = 2 log g t mod 11 We find log g (t + 1) 158 mod 11 and log g (t + 2) 54 mod 11. Proposition If a F q and l is a factor of q k 1 coprime to (q 1), then log a 0 mod l. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 6 / 28
14 Descent Example (cont d) Let us compute log g P for an arbitrary polynomial, say P = t 4 + t + 2. We have P 2 t 4 + t 3 + 2t 2 + 2t + 2 mod ϕ P 3 2(t + 1)(t + 2)(t 2 + 1) mod ϕ P 4 (t + 1)(t + 2)t 2 mod ϕ. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 7 / 28
15 Descent Example (cont d) Let us compute log g P for an arbitrary polynomial, say P = t 4 + t + 2. We have P 2 t 4 + t 3 + 2t 2 + 2t + 2 mod ϕ P 3 2(t + 1)(t + 2)(t 2 + 1) mod ϕ P 4 (t + 1)(t + 2)t 2 mod ϕ. By taking discrete logarithms we obtain So log g P = log g P = 1 log g (t + 1) + 1 log g (t + 2) + 2 log g t. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 7 / 28
16 Discrete logarithms of constants Here l is a prime factor of the group order q k 1, larger than q 1. Elements of F q Elements of F q F q k a q 1 = 1, so we have Hence, are represented in F q [t]/ ϕ by constants a. They satisfy log g (a q 1 ) log g (1) 0 mod l. Since l is prime and larger than q 1, (q 1) log g a 0 mod l. log g a 0 mod l. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 8 / 28
17 Comments Index calculus family All L(1/2) and L(1/3) DLP algorithms follow the same scheme (of Kraitchik 1922): Relation collection; Linear algebra to get logs of factor base elements; Individual log, to handle any element. New algorithms Joux s L(1/4) algorithm still uses this terminology (but very different in nature). Quasi-polynomial time algorithm: it s time to stop speaking about factor base! R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 9 / 28
18 Records for fields F 2 n with prime n Let us compare to the factoring record: 768 bits in FFS is the choice in practice, and its variants Coppersmith (inseparable polynomials); Two rational sides FFS (Joux-Lercier). GIPS=giga instructions per second n date GIPS year algo. author Copp. Gordon,McCurley FFS Joux,Lercier Copp. Thomé FFS Joux,Lercier FFS Joux,Lercier FFS Caramel FFS Caramel 1 Using the same algorithm as for prime degrees. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 10 / 28
19 Records for fields F 2 n with prime n Let us compare to the factoring record: 768 bits in FFS is the choice in practice, and its variants Coppersmith (inseparable polynomials); Two rational sides FFS (Joux-Lercier). GIPS=giga instructions per second n date GIPS year algo. author Copp. Gordon,McCurley FFS Joux,Lercier Copp. Thomé FFS Joux,Lercier FFS Joux,Lercier FFS Caramel FFS Caramel The Caramel group completed the relation collection stage for n = 1039 with a computation of 384 GIPS years. Linear algebra must be adapted to larger sizes. 1 Using the same algorithm as for prime degrees. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 10 / 28
20 Composite degrees n Motivation To attack pairing-based cryptosystems, one can solve DLP in fields F p κn constant c 1. The security of pairings is evaluated under the hypothesis for a small DLP in F p n is equally hard when n is prime or composite. Theorem (Joux & Lercier 2006) Under the same assumptions as in the classical variante of FFS, if n has a small factor κ, then one can speed up 1. the relations collection phase by a factor κ; 2. the linear algebra stage by a factor κ 2. Joux-Lercier improvement in practice Two teams computed discrete logs in F 3 6n (pairings): a 2010 record for n = 71 (676 bits) using κ = 6; cost 14 GIPS year. a 2012 record for n = 97 (923 bits) using κ = 3; cost 290 GIPS years. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 11 / 28
21 Complexity improvements in 2013 for small characteristic Linear polynomials One computes discrete logs. of linear polynomials in polynomial time. Göloğlu, Granger, McGuire and Zumbrägel; Joux. Expressing log P as a sum of logs. of linear polynomials dominates the computations. Any polynomial Joux: L Q (1/4 + o(1)) operations; (this work): quasi-polynomial L Q (o(1)) operations. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 12 / 28
22 Main result Theorem (based on heuristics) Let K be any finite field F q k. A discrete logarithm in K can be computed in heuristic time max(q, k) O(log k). Cases: K = F 2 n, with prime n. Complexity is n O(log n). Much better than L 2 n(1/4 + o(1)) 2 4 n. K = F q k, with q = k O(1). Complexity is log Q O(log log Q), where Q = #K. Again, this is L Q (o(1)). K = F q k, with q L q k(α). Complexity is L q k(α + o(1)), i.e. better than Joux-Lercier or FFS for α < 1/3. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 13 / 28
23 A well-chosen model for F q 2k Simple case first We suppose first k q and k q + 2. Choosing ϕ (same as for Joux algorithm) Try random h 0, h 1 F q 2[t] with deg h 0, deg h 1 2 until T (t) := h 1 (t)t q h 0 (t) has an irreducible factor ϕ of degree k. Heuristic The existence of h 0 and h 1 is heuristic, but found in practice in O(k) trials. Properties of ϕ h 1 (t)t q h 0 (t) mod ϕ; ( ) P(t q h ) P 0 h 1 mod ϕ; ( ) h 0 h 1 P q P(t q ) P mod ϕ, where the tilde denotes the conjugation in F q 2. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 14 / 28
24 A famous identity Recall the identity x q x = α F q (x α). We further have x q y xy q = (α:β) P 1 (F q )(βx αy). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 15 / 28
25 A famous identity Recall the identity x q x = α F q (x α). We further have x q y xy q = (α:β) P 1 (F q )(βx αy). A machine to make relations x = t and y = 1: h 0 /h 1 t t q t α F q (t α). If the numerator of the left hand side is smooth, we obtain relations among linear polynomials. x = t + a, a F q, and y = 1: same relation. x = t + a, a F q 2, and y = 1: new relations. Joux algorithm uses this idea. Let P be the polynomial whose logarithm is requested. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 15 / 28
26 A famous identity Recall the identity x q x = α F q (x α). We further have x q y xy q = (α:β) P 1 (F q )(βx αy). A machine to make relations x = t and y = 1: h 0 /h 1 t t q t α F q (t α). If the numerator of the left hand side is smooth, we obtain relations among linear polynomials. x = t + a, a F q, and y = 1: same relation. x = t + a, a F q 2, and y = 1: new relations. Joux algorithm uses this idea. Let P be the polynomial whose logarithm is requested. x = ap + b and y = cp + d, a, b, c, d F q 2: let us show that the left side is congruent to a small degree polynomial, whereas the right hand side is smooth in some new sense. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 15 / 28
27 The right hand side is smooth (ap + b) q (cp + d) (ap + b)(cp + d) q = = = λ (α,β) P 1 (F q) (α,β) P 1 (F q) (α,β) P 1 (F q) β(ap + b) α(cp + d) ( cα + aβ)p (dα bβ) ( P ) dα bβ, aβ cα Here q + 1 out of the q elements of {1} {P + γ : γ F q 2} occur. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 16 / 28
28 The left hand side is small For m GL 2 (F q 2), let L m be the residue L m := h deg P 1 ( (ap + b) q (cp + d) (ap + b)(cp + d) q) mod ϕ(t). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 17 / 28
29 The left hand side is small For m GL 2 (F q 2), let L m be the residue L m := h deg P 1 ( (ap + b) q (cp + d) (ap + b)(cp + d) q) mod ϕ(t). We have deg L m 3 deg P. Indeed, we have L m = h deg P 1 (ã P(t q ) + b)(cp + d) (ap(t) + b)( c P(t q ) + d) ( ( ) ) ( ( ) ) = h deg P h0 h0 1 ã P + b (cp + d) (ap + b) c P + d. h 1 h 1 For a constant proportion of matrices m, L m is (deg P)/2-smooth. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 17 / 28
30 Procedure to break a polynomial P Each matrix m in the quotient set P q := PGL 2 (F q 2)/PGL 2 (F q ) such that L m is (deg P)/2-smooth leads to a different equation P e i,m i,m = λ (P + γ) vm(γ), where deg P i (deg P)/2; v m (γ) are integer exponents; λ is a costant in F q 2. i γ P 1 (F q 2) By taking discrete logarithm we find e i,m log P i,m γ i v m (γ) log(p + γ) mod l. Heuristic We have enough equations and we can combine them to obtain e i,m log P i,m log P mod l. i,m R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 18 / 28
31 Linear algebra step for P Since #PGL 2 (F q i) = q 3i q i, #P q = q 3 + q. A constant fraction give linear equations among logarithms, so the matrix below has more rows than columns. γ F q 2 m P q v m (γ) The heuristic states that we can combine the rows to obtain row (1, 0,..., 0). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 19 / 28
32 Arguments in favor of the heuristic Experiments The discriminant of matrices obtained for various polynomials P have no systematic common factor other than the divisors of q 3 q. The heuristic is used in the algorithm of Joux for degree two polynomials. For random instances of P, every randomly chosen matrix formed of q rows has maximal rank. Theory The full matrix of q 3 + q rows has maximal rank. We use the fact that there are a fixed number c 1 of blocks passing by each point of F q 2; there are a fixed number c 2 of blocks passing by two points. Does the matrix formed of a constant fraction of rows have maximal rank? R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 20 / 28
33 Building block of the quasi-polynomial algorithm We have just proved: Proposition (Under heuristic assumptions) There exists an algorithm whose complexity is polynomial in q and k and which can be used for the following two tasks. 1. Given an element of F q 2k represented by a polynomial P F q 2[t] with 2 deg P k 1, the algorithm returns an expression of log P as a linear combination of at most O(kq 2 ) logarithms log P i with deg P i 1 2 deg P and of log h The algorithm returns the logarithm of h 1 and the logarithms of all the elements of F q 2k of the form t + a, for a in F q 2. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 21 / 28
34 Complexity P deg = k deg = k/ deg = k/ deg = 1 Tree characteristics depth=log k because we half the degree at each level; arity=o(q 2 k) because the sons are polynomials in the LHS of the q 2 equations used; number of nodes=q O(log k) because k q + 2. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 22 / 28
35 Extending to the general case When q < k 2 we embed F q k in F q 2k with q = q log q k. The complexity q O(log k) transforms into max(q, k) O(log k). Note that q qk. The input size n is replaced by n log n. For any constant c ) ) ) exp (c(log n) 2 exp (c(log n + log log n) 2 = exp ((c + o(1))(log n) 2. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 23 / 28
36 Extending to the general case When q < k 2 we embed F q k in F q 2k with q = q log q k. The complexity q O(log k) transforms into max(q, k) O(log k). Note that q qk. The input size n is replaced by n log n. For any constant c ) ) ) exp (c(log n) 2 exp (c(log n + log log n) 2 = exp ((c + o(1))(log n) 2. Example 1. For F we compute logs in F = F The field F can be embedded in F q 2k with q = 3 6 and k = 509. Fields of composite degree (specific to pairings) embed in small fields. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 23 / 28
37 Hardness of DLP with respect to the size of characteristic ( ) The complexity of QPA when q = L q k(α) is L q k α + o(1) RSA 0 1/3 2/3 1 α R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 24 / 28
38 The traps of Cheng Wan Zhuang Trap In reaction to our preprint, Cheng, Wan and Zhuang noticed that our descent fails on divisors of h 1 t q h 0. Indeed, if P is such a divisor we cannot find relations i P e i,m i,m = λ γ P 1 (F q 2) (P + γ) v m(γ) mod (h 1 t q h 0 ), containing P in the RHS. Indeed, it forces P to occur in the LHS too, so it cannot be (deg P)/2-smooth. Our solution We have h D 1 P q h D 1 P(h 0 /h 1 ) mod x q h 1 h 0. The RHS is always divisible by P (it is problematic). Taking logs, we get D log h 1 + (q 1) log P = log Q, where Q is the RHS divided by P. In general, P Q, and, if deg h 0, h 1 2, then deg Q D. So we have related log P to other logarithms, and the descent can continue. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 25 / 28
39 Very weak fields Assume that k = q 1 (same is true for q + 1 and q). For many values of q we can take h 1 = 1 and h 0 = Ax for some generator A of F q 2. Then ϕ = x q 1 A. Then, for any a F q 2, we have (x + a) q = x q + ã = x q 1 x + ã = A(x + ã/a), where ã is the Frobenius conjugate of a. We obtain q log(x + a) = log(x + ã/a). Hence we can reduce the factor base by a factor k. For example for , the linear algebra time was accelerated by k 2 = Remark The smoothness probabilities are improved. For example, The proportion of matrices m P q which produce relations for the linear polynomials is 1/6! = 1/620 when max(deg h 0, deg h 1 ) = 2 and it is 1/3! for the weak case (Kummer). R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 26 / 28
40 Records Algorithms in practice 1. relations collection (degree one and two): variants of GGMZ or Joux algorithm; 2. descent (degree three and more): variants of Joux algorithm. No QPA descent yet. Kummer and twisted Kummer extensions field bitsize date CPU time author GF( ) 6120 Apr k h GGMZ GF(( ) 6168 May k h J GF( ) 9234 Jan k h GKZ General extensions of composite degree field bitsize date CPU time author GF( ) 1303 Jan 14 1k h AMOR GF( ) * 4404 Jan 14 52k h GKZ GF( ) 3796 Aug 14 9k h JP * using a non-general speed-up: target elements in a subfield. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 27 / 28
41 Consequences and perspectives Consequences DLP in small characteristic finite fields is asymptotically weak. Small characteristic pairings are broken for the sizes proposed for cryptography. Perspectives even more practical improvements and records; eliminating the heuristics (a new quasi-polynomial algorithm was proposed by Granger, Kleinjung and Zumbrägel)(next talk); improvements in non-small characteristic: multiple field variants, new methods of polynomial selection. R. Barbulescu, P. Gaudry, A. Joux, E. Thomé A quasi-polynomial algorithm 28 / 28
A quasi polynomial algorithm for discrete logarithm in small characteristic
CCA seminary January 10, 2014 A quasi polynomial algorithm for discrete logarithm in small characteristic Razvan Barbulescu 1 Pierrick Gaudry 2 Antoine Joux 3 Emmanuel Thomé 2 LIX, École Polytechnique
More informationA quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic
A quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic Razvan Barbulescu 1, Pierrick Gaudry 1, Antoine Joux 2,3, and Emmanuel Thomé 1 1 Inria, CNRS, University of
More informationDiscrete logarithms: Recent progress (and open problems)
Discrete logarithms: Recent progress (and open problems) CryptoExperts Chaire de Cryptologie de la Fondation de l UPMC LIP6 February 25 th, 2014 Discrete logarithms Given a multiplicative group G with
More informationOn the complexity of computing discrete logarithms in the field F
On the complexity of computing discrete logarithms in the field F 3 6 509 Francisco Rodríguez-Henríquez CINVESTAV-IPN Joint work with: Gora Adj Alfred Menezes Thomaz Oliveira CINVESTAV-IPN University of
More informationTraps to the BGJT-Algorithm for Discrete Logarithms
Submitted exclusively to the London Mathematical Society doi:10.1112/0000/000000 Traps to the BGJT-Algorithm for Discrete Logarithms Qi Cheng, Daqing Wan and Jincheng Zhuang Abstract In the recent breakthrough
More informationAlgorithmes de calcul de logarithme discret dans les corps finis
Algorithmes de calcul de logarithme discret dans les corps finis Grenoble, École de printemps C2 2014 E. Thomé CARAMEL /* */ C,A, /* */ R,a, /* */ M,E, L,i= 5,e, d[5],q[999 ){for ]={0};main(N (;i--;e=scanf("%"
More informationOn Generating Coset Representatives of P GL 2 (F q ) in P GL 2 (F q 2)
On Generating Coset Representatives of P GL 2 F q in P GL 2 F q 2 Jincheng Zhuang 1,2 and Qi Cheng 3 1 State Key Laboratory of Information Security Institute of Information Engineering Chinese Academy
More informationSolving a 6120-bit DLP on a Desktop Computer
Solving a 6120-bit DLP on a Desktop Computer Faruk Göloğlu, Robert Granger, Gary McGuire, and Jens Zumbrägel Claude Shannon Institute Complex & Adaptive Systems Laboratory School of Mathematical Sciences
More informationA brief overwiev of pairings
Bordeaux November 22, 2016 A brief overwiev of pairings Razvan Barbulescu CNRS and IMJ-PRG R. Barbulescu Overview pairings 0 / 37 Plan of the lecture Pairings Pairing-friendly curves Progress of NFS attacks
More informationElliptic curves: Theory and Applications. Day 4: The discrete logarithm problem.
Elliptic curves: Theory and Applications. Day 4: The discrete logarithm problem. Elisa Lorenzo García Université de Rennes 1 14-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 4 14-09-2017 1 /
More informationImproving NFS for the discrete logarithm problem in non-prime nite elds
Improving NFS for the discrete logarithm problem in non-prime nite elds Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, Francois Morain Institut national de recherche en informatique et en automatique
More informationA NEW PERSPECTIVE ON THE POWERS OF TWO DESCENT FOR DISCRETE LOGARITHMS IN FINITE FIELDS THORSTEN KLEINJUNG AND BENJAMIN WESOLOWSKI
A NEW PERSPECTIVE ON THE POWERS OF TWO DESCENT FOR DISCRETE LOGARITHMS IN FINITE FIELDS THORSTEN KLEINJUNG AND BENJAMIN WESOLOWSKI Abstract. A new proof is given for the correctness of the powers of two
More informationElliptic Curve Discrete Logarithm Problem
Elliptic Curve Discrete Logarithm Problem Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM October 19, 2009 Vanessa VITSE (UVSQ) Elliptic Curve Discrete Logarithm Problem October
More informationIndividual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm)
Individual Discrete Logarithm in GF(p k ) (last step of the Number Field Sieve algorithm) Aurore Guillevic INRIA Saclay / GRACE Team École Polytechnique / LIX ECC 2015, Sept. 28th Aurore Guillevic (INRIA/LIX)
More informationSolving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction
Solving Discrete Logarithms on a 170-bit MNT Curve by Pairing Reduction Aurore Guillevic and François Morain and Emmanuel Thomé University of Calgary, PIMS CNRS, LIX École Polytechnique, Inria, Loria SAC,
More informationDiscrete Logarithm Problem
Discrete Logarithm Problem Çetin Kaya Koç koc@cs.ucsb.edu (http://cs.ucsb.edu/~koc/ecc) Elliptic Curve Cryptography lect08 discrete log 1 / 46 Exponentiation and Logarithms in a General Group In a multiplicative
More informationImproving NFS for the discrete logarithm problem in non-prime finite fields
Improving NFS for the discrete logarithm problem in non-prime finite fields Razvan Barbulescu, Pierrick Gaudry, Aurore Guillevic, François Morain To cite this version: Razvan Barbulescu, Pierrick Gaudry,
More informationNon-generic attacks on elliptic curve DLPs
Non-generic attacks on elliptic curve DLPs Benjamin Smith Team GRACE INRIA Saclay Île-de-France Laboratoire d Informatique de l École polytechnique (LIX) ECC Summer School Leuven, September 13 2013 Smith
More informationBreaking pairing-based cryptosystems using η T pairing over GF (3 97 )
Breaking pairing-based cryptosystems using η T pairing over GF (3 97 ) Takuya Hayashi 1, Takeshi Shimoyama 2, Naoyuki Shinohara 3, and Tsuyoshi Takagi 1 1 Kyushu University, 744, Motooka, Nishi-ku, Fukuoka
More informationHyperelliptic curves
1/40 Hyperelliptic curves Pierrick Gaudry Caramel LORIA CNRS, Université de Lorraine, Inria ECC Summer School 2013, Leuven 2/40 Plan What? Why? Group law: the Jacobian Cardinalities, torsion Hyperelliptic
More informationArithmétique et Cryptographie Asymétrique
Arithmétique et Cryptographie Asymétrique Laurent Imbert CNRS, LIRMM, Université Montpellier 2 Journée d inauguration groupe Sécurité 23 mars 2010 This talk is about public-key cryptography Why did mathematicians
More informationEvidence that the Diffie-Hellman Problem is as Hard as Computing Discrete Logs
Evidence that the Diffie-Hellman Problem is as Hard as Computing Discrete Logs Jonah Brown-Cohen 1 Introduction The Diffie-Hellman protocol was one of the first methods discovered for two people, say Alice
More informationBlock Wiedemann likes Schirokauer maps
Block Wiedemann likes Schirokauer maps E. Thomé INRIA/CARAMEL, Nancy. /* EPI CARAMEL */ C,A, /* Cryptologie, Arithmétique : */ R,a, /* Matériel et Logiciel */ M,E, L,i= 5,e, d[5],q[999 ]={0};main(N ){for
More informationFactoring Algorithms Pollard s p 1 Method. This method discovers a prime factor p of an integer n whenever p 1 has only small prime factors.
Factoring Algorithms Pollard s p 1 Method This method discovers a prime factor p of an integer n whenever p 1 has only small prime factors. Input: n (to factor) and a limit B Output: a proper factor of
More informationBasic Algorithms in Number Theory
Basic Algorithms in Number Theory Algorithmic Complexity... 1 Basic Algorithms in Number Theory Francesco Pappalardi Discrete Logs, Modular Square Roots & Euclidean Algorithm. July 20 th 2010 Basic Algorithms
More informationSM9 identity-based cryptographic algorithms Part 1: General
SM9 identity-based cryptographic algorithms Part 1: General Contents 1 Scope... 1 2 Terms and definitions... 1 2.1 identity... 1 2.2 master key... 1 2.3 key generation center (KGC)... 1 3 Symbols and abbreviations...
More informationIntroduction to Elliptic Curve Cryptography. Anupam Datta
Introduction to Elliptic Curve Cryptography Anupam Datta 18-733 Elliptic Curve Cryptography Public Key Cryptosystem Duality between Elliptic Curve Cryptography and Discrete Log Based Cryptography Groups
More informationElliptic Curve Cryptography with Derive
Elliptic Curve Cryptography with Derive Johann Wiesenbauer Vienna University of Technology DES-TIME-2006, Dresden General remarks on Elliptic curves Elliptic curces can be described as nonsingular algebraic
More informationComputing Individual Discrete Logarithms Faster in GF(p n ) with the NFS-DL Algorithm
Computing Individual Discrete Logarithms Faster in GF(p n ) with the NFS-DL Algorithm Aurore Guillevic 1,2 1 Inria Saclay, Palaiseau, France 2 École Polytechnique/LIX, Palaiseau, France guillevic@lixpolytechniquefr
More informationThe number field sieve in the medium prime case
The number field sieve in the medium prime case Frederik Vercauteren ESAT/COSIC - K.U. Leuven Joint work with Antoine Joux, Reynald Lercier, Nigel Smart Finite Field DLOG Basis finite field is F p = {0,...,
More informationChapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations
Chapter 9 Mathematics of Cryptography Part III: Primes and Related Congruence Equations Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 9.1 Chapter 9 Objectives
More informationMathematics of Cryptography
UNIT - III Mathematics of Cryptography Part III: Primes and Related Congruence Equations 1 Objectives To introduce prime numbers and their applications in cryptography. To discuss some primality test algorithms
More informationNo.6 Selection of Secure HC of g = divisors D 1, D 2 defined on J(C; F q n) over F q n, to determine the integer m such that D 2 = md 1 (if such
Vol.17 No.6 J. Comput. Sci. & Technol. Nov. 2002 Selection of Secure Hyperelliptic Curves of g = 2 Based on a Subfield ZHANG Fangguo ( ) 1, ZHANG Futai ( Ξ) 1;2 and WANG Yumin(Π±Λ) 1 1 P.O.Box 119 Key
More informationProblème du logarithme discret sur courbes elliptiques
Problème du logarithme discret sur courbes elliptiques Vanessa VITSE Université de Versailles Saint-Quentin, Laboratoire PRISM Groupe de travail équipe ARITH LIRMM Vanessa VITSE (UVSQ) DLP over elliptic
More informationExtended Tower Number Field Sieve with Application to Finite Fields of Arbitrary Composite Extension Degree
Extended Tower Number Field Sieve with Application to Finite Fields of Arbitrary Composite Extension Degree Taechan Kim 1 and Jinhyuck Jeong 2 1 NTT Secure Platform Laboratories, Japan taechan.kim@lab.ntt.co.jp
More information1 The Fundamental Theorem of Arithmetic. A positive integer N has a unique prime power decomposition. Primality Testing. and. Integer Factorisation
1 The Fundamental Theorem of Arithmetic A positive integer N has a unique prime power decomposition 2 Primality Testing Integer Factorisation (Gauss 1801, but probably known to Euclid) The Computational
More informationComputing Discrete Logarithms. Many cryptosystems could be broken if we could compute discrete logarithms quickly.
Computing Discrete Logarithms Many cryptosystems could be broken if we could compute discrete logarithms quickly. The first discrete logarithm algorithms below apply in any group. They are about the best
More informationCover and Decomposition Index Calculus on Elliptic Curves made practical
Cover and Decomposition Index Calculus on Elliptic Curves made practical Application to a previously unreachable curve over F p 6 Vanessa VITSE Antoine JOUX Université de Versailles Saint-Quentin, Laboratoire
More informationBasic Algorithms in Number Theory
Basic Algorithms in Number Theory Algorithmic Complexity... 1 Basic Algorithms in Number Theory Francesco Pappalardi #2 - Discrete Logs, Modular Square Roots, Polynomials, Hensel s Lemma & Chinese Remainder
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 8 February 1, 2012 CPSC 467b, Lecture 8 1/42 Number Theory Needed for RSA Z n : The integers mod n Modular arithmetic GCD Relatively
More informationDiscrete Logarithm Computation in Hyperelliptic Function Fields
Discrete Logarithm Computation in Hyperelliptic Function Fields Michael J. Jacobson, Jr. jacobs@cpsc.ucalgary.ca UNCG Summer School in Computational Number Theory 2016: Function Fields Mike Jacobson (University
More information9 Knapsack Cryptography
9 Knapsack Cryptography In the past four weeks, we ve discussed public-key encryption systems that depend on various problems that we believe to be hard: prime factorization, the discrete logarithm, and
More informationIEEE P1363 / D9 (Draft Version 9). Standard Specifications for Public Key Cryptography
IEEE P1363 / D9 (Draft Version 9) Standard Specifications for Public Key Cryptography Annex A (informative) Number-Theoretic Background Copyright 1997,1998,1999 by the Institute of Electrical and Electronics
More informationCOMP4109 : Applied Cryptography
COMP409 : Applied Cryptography Fall 203 M. Jason Hinek Carleton University Applied Cryptography Day 3 public-key encryption schemes some attacks on RSA factoring small private exponent 2 RSA cryptosystem
More information8 Elliptic Curve Cryptography
8 Elliptic Curve Cryptography 8.1 Elliptic Curves over a Finite Field For the purposes of cryptography, we want to consider an elliptic curve defined over a finite field F p = Z/pZ for p a prime. Given
More informationA field F is a set of numbers that includes the two numbers 0 and 1 and satisfies the properties:
Byte multiplication 1 Field arithmetic A field F is a set of numbers that includes the two numbers 0 and 1 and satisfies the properties: F is an abelian group under addition, meaning - F is closed under
More informationCalcul d indice et courbes algébriques : de meilleures récoltes
Calcul d indice et courbes algébriques : de meilleures récoltes Alexandre Wallet ENS de Lyon, Laboratoire LIP, Equipe AriC Alexandre Wallet De meilleures récoltes dans le calcul d indice 1 / 35 Today:
More informationLecture Notes, Week 6
YALE UNIVERSITY DEPARTMENT OF COMPUTER SCIENCE CPSC 467b: Cryptography and Computer Security Week 6 (rev. 3) Professor M. J. Fischer February 15 & 17, 2005 1 RSA Security Lecture Notes, Week 6 Several
More informationAn Introduction to Elliptic Curve Cryptography
Harald Baier An Introduction to Elliptic Curve Cryptography / Summer term 2013 1/22 An Introduction to Elliptic Curve Cryptography Harald Baier Hochschule Darmstadt, CASED, da/sec Summer term 2013 Harald
More informationFaster index calculus for the medium prime case Application to 1175-bit and 1425-bit finite fields
Faster index calculus for the medium prime case Application to 1175-bit and 1425-bit finite fields Antoine Joux CryptoExperts and Université de Versailles Saint-Quentin-en-Yvelines, Laboratoire PRISM,
More informationLecture 6: Cryptanalysis of public-key algorithms.,
T-79.159 Cryptography and Data Security Lecture 6: Cryptanalysis of public-key algorithms. Helsinki University of Technology mjos@tcs.hut.fi 1 Outline Computational complexity Reminder about basic number
More informationGENERATION OF RANDOM PICARD CURVES FOR CRYPTOGRAPHY. 1. Introduction
GENERATION OF RANDOM PICARD CURVES FOR CRYPTOGRAPHY ANNEGRET WENG Abstract. Combining the ideas in [BTW] [GS], we give a efficient, low memory algorithm for computing the number of points on the Jacobian
More informationElliptic Curves I. The first three sections introduce and explain the properties of elliptic curves.
Elliptic Curves I 1.0 Introduction The first three sections introduce and explain the properties of elliptic curves. A background understanding of abstract algebra is required, much of which can be found
More informationOne can use elliptic curves to factor integers, although probably not RSA moduli.
Elliptic Curves Elliptic curves are groups created by defining a binary operation (addition) on the points of the graph of certain polynomial equations in two variables. These groups have several properties
More informationPublic-key Cryptography: Theory and Practice
Public-key Cryptography Theory and Practice Department of Computer Science and Engineering Indian Institute of Technology Kharagpur Chapter 2: Mathematical Concepts Divisibility Congruence Quadratic Residues
More informationElliptic Curves Spring 2013 Lecture #12 03/19/2013
18.783 Elliptic Curves Spring 2013 Lecture #12 03/19/2013 We now consider our first practical application of elliptic curves: factoring integers. Before presenting the elliptic curve method (ECM) for factoring
More informationLecture 7: ElGamal and Discrete Logarithms
Lecture 7: ElGamal and Discrete Logarithms Johan Håstad, transcribed by Johan Linde 2006-02-07 1 The discrete logarithm problem Recall that a generator g of a group G is an element of order n such that
More informationChapter 4 Finite Fields
Chapter 4 Finite Fields Introduction will now introduce finite fields of increasing importance in cryptography AES, Elliptic Curve, IDEA, Public Key concern operations on numbers what constitutes a number
More informationCRYPTOGRAPHY AND NUMBER THEORY
CRYPTOGRAPHY AND NUMBER THEORY XINYU SHI Abstract. In this paper, we will discuss a few examples of cryptographic systems, categorized into two different types: symmetric and asymmetric cryptography. We
More informationA New Attack on RSA with Two or Three Decryption Exponents
A New Attack on RSA with Two or Three Decryption Exponents Abderrahmane Nitaj Laboratoire de Mathématiques Nicolas Oresme Université de Caen, France nitaj@math.unicaen.fr http://www.math.unicaen.fr/~nitaj
More informationA Las Vegas algorithm to solve the elliptic curve discrete logarithm problem
A Las Vegas algorithm to solve the elliptic curve discrete logarithm problem Ayan Mahalanobis Vivek Mallick February 5, 018 Abstract In this paper, we describe a new Las Vegas algorithm to solve the elliptic
More informationComputing the RSA Secret Key is Deterministic Polynomial Time Equivalent to Factoring
Computing the RSA Secret Key is Deterministic Polynomial Time Equivalent to Factoring Alexander May Faculty of Computer Science, Electrical Engineering and Mathematics University of Paderborn 33102 Paderborn,
More informationAlgorithms for integer factorization and discrete logarithms computation
/* */ C,A, /* */ R,a, /* */ M,E, L,i= 5,e, d[5],q[999 ]={0};main(N ){for (;i--;e=scanf("%" "d",d+i));for(a =*d; ++i
More informationElliptic curves: Theory and Applications. Day 3: Counting points.
Elliptic curves: Theory and Applications. Day 3: Counting points. Elisa Lorenzo García Université de Rennes 1 13-09-2017 Elisa Lorenzo García (Rennes 1) Elliptic Curves 3 13-09-2017 1 / 26 Counting points:
More informationQuasi-reducible Polynomials
Quasi-reducible Polynomials Jacques Willekens 06-Dec-2008 Abstract In this article, we investigate polynomials that are irreducible over Q, but are reducible modulo any prime number. 1 Introduction Let
More informationA variant of the F4 algorithm
A variant of the F4 algorithm Vanessa VITSE - Antoine JOUX Université de Versailles Saint-Quentin, Laboratoire PRISM CT-RSA, February 18, 2011 Motivation Motivation An example of algebraic cryptanalysis
More informationThe Decisional Diffie-Hellman Problem and the Uniform Boundedness Theorem
The Decisional Diffie-Hellman Problem and the Uniform Boundedness Theorem Qi Cheng and Shigenori Uchiyama April 22, 2003 Abstract In this paper, we propose an algorithm to solve the Decisional Diffie-Hellman
More informationMathematics of Public Key Cryptography
Mathematics of Public Key Cryptography Eric Baxter April 12, 2014 Overview Brief review of public-key cryptography Mathematics behind public-key cryptography algorithms What is Public-Key Cryptography?
More informationConstructing Abelian Varieties for Pairing-Based Cryptography
for Pairing-Based CWI and Universiteit Leiden, Netherlands Workshop on Pairings in Arithmetic Geometry and 4 May 2009 s MNT MNT Type s What is pairing-based cryptography? Pairing-based cryptography refers
More informationIEEE P1363 / D13 (Draft Version 13). Standard Specifications for Public Key Cryptography
IEEE P1363 / D13 (Draft Version 13). Standard Specifications for Public Key Cryptography Annex A (Informative). Number-Theoretic Background. Copyright 1999 by the Institute of Electrical and Electronics
More informationRings. EE 387, Notes 7, Handout #10
Rings EE 387, Notes 7, Handout #10 Definition: A ring is a set R with binary operations, + and, that satisfy the following axioms: 1. (R, +) is a commutative group (five axioms) 2. Associative law for
More informationPolynomials over finite fields. Algorithms and Randomness
Polynomials over Finite Fields: Algorithms and Randomness School of Mathematics and Statistics Carleton University daniel@math.carleton.ca AofA 10, July 2010 Introduction Let q be a prime power. In this
More informationMATH 3030, Abstract Algebra Winter 2012 Toby Kenney Sample Midterm Examination Model Solutions
MATH 3030, Abstract Algebra Winter 2012 Toby Kenney Sample Midterm Examination Model Solutions Basic Questions 1. Give an example of a prime ideal which is not maximal. In the ring Z Z, the ideal {(0,
More informationMathematical Foundations of Cryptography
Mathematical Foundations of Cryptography Cryptography is based on mathematics In this chapter we study finite fields, the basis of the Advanced Encryption Standard (AES) and elliptical curve cryptography
More informationCounting points on hyperelliptic curves
University of New South Wales 9th November 202, CARMA, University of Newcastle Elliptic curves Let p be a prime. Let X be an elliptic curve over F p. Want to compute #X (F p ), the number of F p -rational
More informationA General Polynomial Selection Method and New Asymptotic Complexities for the Tower Number Field Sieve Algorithm
A General Polynomial Selection Method and New Asymptotic Complexities for the Tower Number Field Sieve Algorithm Palash Sarkar and Shashank Singh Indian Statistical Institute, Kolkata September 5, 2016
More informationALGEBRA. 1. Some elementary number theory 1.1. Primes and divisibility. We denote the collection of integers
ALGEBRA CHRISTIAN REMLING 1. Some elementary number theory 1.1. Primes and divisibility. We denote the collection of integers by Z = {..., 2, 1, 0, 1,...}. Given a, b Z, we write a b if b = ac for some
More informationSelecting polynomials for the Function Field Sieve
Selecting polynomials for the Function Field Sieve Razvan Barbulescu Université de Lorraine, CNRS, INRIA, France razvan.barbulescu@inria.fr Abstract The Function Field Sieve algorithm is dedicated to computing
More informationSecurity Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography
Security Issues in Cloud Computing Modern Cryptography II Asymmetric Cryptography Peter Schwabe October 21 and 28, 2011 So far we assumed that Alice and Bob both have some key, which nobody else has. How
More informationRSA Cryptosystem and Factorization
RSA Cryptosystem and Factorization D. J. Guan Department of Computer Science National Sun Yat Sen University Kaoshiung, Taiwan 80424 R. O. C. guan@cse.nsysu.edu.tw August 25, 2003 RSA Cryptosystem was
More informationBreaking pairing-based cryptosystems using η T pairing over GF (3 97 )
Breaking pairing-based cryptosystems using η T pairing over GF (3 97 ) Takuya Hayashi 1, Takeshi Shimoyama 2, Naoyuki Shinohara 3, and Tsuyoshi Takagi 1 1 Kyushu University 2 FUJITSU LABORATORIES Ltd.
More informationOn Partial Lifting and the Elliptic Curve Discrete Logarithm Problem
On Partial Lifting and the Elliptic Curve Discrete Logarithm Problem Qi Cheng 1 and Ming-Deh Huang 2 1 School of Computer Science The University of Oklahoma Norman, OK 73019, USA. Email: qcheng@cs.ou.edu.
More informationPublic Key Algorithms
Public Key Algorithms Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-09/
More informationCIS 6930/4930 Computer and Network Security. Topic 5.1 Basic Number Theory -- Foundation of Public Key Cryptography
CIS 6930/4930 Computer and Network Security Topic 5.1 Basic Number Theory -- Foundation of Public Key Cryptography 1 Review of Modular Arithmetic 2 Remainders and Congruency For any integer a and any positive
More information2x 1 7. A linear congruence in modular arithmetic is an equation of the form. Why is the solution a set of integers rather than a unique integer?
Chapter 3: Theory of Modular Arithmetic 25 SECTION C Solving Linear Congruences By the end of this section you will be able to solve congruence equations determine the number of solutions find the multiplicative
More informationCullen Numbers in Binary Recurrent Sequences
Cullen Numbers in Binary Recurrent Sequences Florian Luca 1 and Pantelimon Stănică 2 1 IMATE-UNAM, Ap. Postal 61-3 (Xangari), CP 58 089 Morelia, Michoacán, Mexico; e-mail: fluca@matmor.unam.mx 2 Auburn
More informationLecture 1: Introduction to Public key cryptography
Lecture 1: Introduction to Public key cryptography Thomas Johansson T. Johansson (Lund University) 1 / 44 Key distribution Symmetric key cryptography: Alice and Bob share a common secret key. Some means
More informationElliptic Curves Spring 2013 Lecture #8 03/05/2013
18.783 Elliptic Curves Spring 2013 Lecture #8 03/05/2013 8.1 Point counting We now consider the problem of determining the number of points on an elliptic curve E over a finite field F q. The most naïve
More informationGalois theory (Part II)( ) Example Sheet 1
Galois theory (Part II)(2015 2016) Example Sheet 1 c.birkar@dpmms.cam.ac.uk (1) Find the minimal polynomial of 2 + 3 over Q. (2) Let K L be a finite field extension such that [L : K] is prime. Show that
More informationAttacks on Elliptic Curve Cryptography Discrete Logarithm Problem (EC-DLP)
Attacks on Elliptic Curve Cryptography Discrete Logarithm Problem (EC-DLP) Mrs.Santoshi Pote 1, Mrs. Jayashree Katti 2 ENC, Usha Mittal Institute of Technology, Mumbai, India 1 Information Technology,
More informationTC10 / 3. Finite fields S. Xambó
TC10 / 3. Finite fields S. Xambó The ring Construction of finite fields The Frobenius automorphism Splitting field of a polynomial Structure of the multiplicative group of a finite field Structure of the
More informationSolving a 6120-bit DLP on a Desktop Computer
Solving a 6120-bit DLP on a Desktop Computer Faruk Göloğlu, Robert Granger, Gary McGuire, and Jens Zumbrägel Complex & Adaptive Systems Laboratory and School of Mathematical Sciences University College
More information14 Ordinary and supersingular elliptic curves
18.783 Elliptic Curves Spring 2015 Lecture #14 03/31/2015 14 Ordinary and supersingular elliptic curves Let E/k be an elliptic curve over a field of positive characteristic p. In Lecture 7 we proved that
More informationREMARKS ON THE NFS COMPLEXITY
REMARKS ON THE NFS COMPLEXITY PAVOL ZAJAC Abstract. In this contribution we investigate practical issues with implementing the NFS algorithm to solve the DLP arising in XTR-based cryptosystems. We can
More informationParshuram Budhathoki FAU October 25, Ph.D. Preliminary Exam, Department of Mathematics, FAU
Parshuram Budhathoki FAU October 25, 2012 Motivation Diffie-Hellman Key exchange What is pairing? Divisors Tate pairings Miller s algorithm for Tate pairing Optimization Alice, Bob and Charlie want to
More informationCover Page. The handle holds various files of this Leiden University dissertation
Cover Page The handle http://hdl.handle.net/1887/37019 holds various files of this Leiden University dissertation Author: Brau Avila, Julio Title: Galois representations of elliptic curves and abelian
More informationCPSC 467: Cryptography and Computer Security
CPSC 467: Cryptography and Computer Security Michael J. Fischer Lecture 9 September 30, 2015 CPSC 467, Lecture 9 1/47 Fast Exponentiation Algorithms Number Theory Needed for RSA Elementary Number Theory
More informationElliptic Curve Cryptography
Elliptic Curve Cryptography Elliptic Curves An elliptic curve is a cubic equation of the form: y + axy + by = x 3 + cx + dx + e where a, b, c, d and e are real numbers. A special addition operation is
More informationCPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Instructor: Michael Fischer Lecture by Ewa Syta Lecture 13 March 3, 2013 CPSC 467b, Lecture 13 1/52 Elliptic Curves Basics Elliptic Curve Cryptography CPSC
More informationLECTURE NOTES IN CRYPTOGRAPHY
1 LECTURE NOTES IN CRYPTOGRAPHY Thomas Johansson 2005/2006 c Thomas Johansson 2006 2 Chapter 1 Abstract algebra and Number theory Before we start the treatment of cryptography we need to review some basic
More information