Refined analysis to the extended tower number field sieve
Introduction
The discrete logarithm problem (DLP) in finite fields has played an important role in public key cryptography, firstly used to construct Diffie-Hellman key exchange protocol [13], later used as an important ingredient to build torus-based [33] and pairing-based [20], [10] cryptographic schemes besides other applications.
It has long been observed that the characteristic of the underlying finite field affects the hardness of the corresponding discrete logarithm problem. Denote where Q is the cardinality of the field . For simplicity, we omit Q and c when there is no confusion.
Let . When the characteristic is medium or large (), the state-of-art general purpose algorithm is the number field sieve (NFS) [15], [36], [23], [26]. When the characteristic is small (), the state-of-art general purpose algorithm is the quasi-polynomial time algorithm (QPA) [7], [16], [17], which derives from the function field sieve (FFS) [1], [2], [21]. While QPA enjoys heuristic and quasi-polynomial time complexity for the small characteristic case and fixed characteristic case respectively, NFS still runs in time.
In 2016, Kim and Barbulescu [26] presented the extended tower number field sieve (exTNFS) and achieved a new complexity in the medium prime case. When the extension degree n can factor into two coprime integers and some other conditions are satisfied, the best complexity of exTNFS in the medium prime case is . Later, Kim and Jeong [27] removed the coprime restriction. Sarkar and Singh [34] combined the SS polynomial selection methods [35] and exTNFS to further loosen the conditions. These recent progress has imposed a new concrete key size estimation of certain pairing-based cryptosystems [30], [5].
Briefly, NFS consists of three steps in general: polynomial selection, factor-base logarithm computation, and individual logarithm computation. In polynomial selection step, two suitable polynomials are selected as a setup. The property of the selected polynomials affects the efficiency of the latter two steps. In recent years, some efficient polynomial selection methods have been proposed [23], [29], [6], [35]. In the factor-base logarithm step, the logarithms among the factor-base are computed and stored in a database. For several discrete logarithms computation circumstances, such as batch-DLP and delayed-target DLP, the polynomial selection step and factor-base logarithm step can be computed only once. Then the efficiency of computing an individual logarithm will be more important. For instance, the Logjam attack [3] against the real-world Diffie-Hellman key exchange protocol highlights the power of faster individual DL method.
The individual logarithm step includes two important phases: smoothing phase and descent phase. In the smoothing phase, one randomizes the target element until it splits into several smooth elements. The complexity of this phase depends on the norm of the preimage of the target element. At Asiacrypt 2015, Guillevic [18] took advantage of the subfield of degree 1 or 2 to construct a preimage with smaller norm. It reduced the complexity of the smoothing phase significantly when n is small.
Some elements obtained in the smoothing phase may not be in the factor-base. In the descent phase, we establish the relation between these elements and other elements with smaller norm until all the elements are in the factor-base. There are some papers giving the complexity analysis to this phase, such as [12], [4], [14] for prime fields, [29] for large characteristic fields and [22], [9] for medium and large characteristic fields. Besides the classical NFS, [8] and [26] gave the analysis to the descent phase in TNFS and exTNFS, respectively.
Throughout the paper, we assume that the target finite field is , where with and the extension degree .
Notation. The results of the paper are the following:
- 1.
First, we show the heuristic complexity of exTNFS has a uniform formula where The equality holds if and only if , where t is the degree of the polynomials to be sieved.
- 2.
In the smoothing phase, we explicitly use the subfield to construct a preimage with coefficients bounded by . This can reduce the complexity in this phase and we show that we can take to be m in most of the cases, where m is the largest proper factor of n. In addition, we show that we can construct a preimage of lower degree with the same size of coefficients in some situations by combining our method and Guillevic's method.
- 3.
Since the improvement of the smoothing phase will impact the complexity of the descent phase, we give a precise analysis to the descent phase. We give the complexity formulae when sieving over degree-one polynomials and high-degree polynomials respectively. These prove that using high-degree polynomials can reduce the complexity and the complexity of descent phase is still negligible compared to the improved smoothing phase.
Paper organization: The rest of the paper is organized as follows. In Section 2, we briefly recall the exTNFS algorithm, known results of complexity analysis, and known results about the individual logarithm step. In Section 3, we give a uniform formula for the complexity of exTNFS. The analysis doesn't depend on a specific polynomial selection method. In Section 4, we construct a preimage with coefficients bounded by by exploring the subfield structure and taking advantage of exTNFS. Then, we show how to combine our method with Guillevic's method. In Section 5, we precisely analyze complexity of the descent phase and show that using high-degree polynomials can reduce the complexity. We also show that the complexity of smoothing phase still dominates the complexity of individual logarithm step. In Section 6, we conclude the paper.
Section snippets
The extended tower number field sieve
The tower number field sieve was first introduced by [37], and then rehabilitated by [8], and extended by [26]. Here, we briefly recall the exTNFS algorithm.
A uniform formula for the complexity of exTNFS
Currently, all known analyses to the complexity of exTNFS depend on some specific polynomial selection methods. This situation motivates us to give a uniform formula for the complexity of exTNFS. For a given polynomial selection method, this formula can directly give the complexity in this case. Hence, it can be used to evaluate the efficiency of a polynomial selection method. Besides, some intermediate results of our analysis will be used in Section 5 to determine the complexity of the descent
Using exTNFS to construct a preimage
As shown in [12], a preimage of smaller norm can yield a smaller complexity of the smoothing phase. In this section, we give a method to find a preimage of smaller norm when n is composite. Our method is based on exTNFS and it explores the subfield structure.
Firstly, we will give a direct way to use the subfield defined by h. Then we will discuss when we can set to be the largest proper subfield. Besides, we show how to combine our method and Guillevic's method to utilize multiple
Improving the descent phase
Since the work in [19] and our work have reduced the complexity of the smoothing phase, it is meaningful to investigate whether the complexity of descent phase is still negligible compared to the smoothing phase. In this section, we will prove this assertion.
The complexity of this phase depends on the sieve technique. First, we consider to sieve over degree-one polynomials, which is consistent with most work. The results show that when sieving over degree-one polynomials, the complexity of
Conclusion
Recent progress of exTNFS has imposed a new concrete parameter security estimation for some cryptosystems, such as some pairing-based cryptosystem. In this work, we give a refined analysis to the exTNFS. First, we give a uniform complexity formula for exTNFS. We take the degree of polynomials to be sieved into consideration and this analysis doesn't depend on a specific polynomial selection method. Then, we use exTNFS to explicitly construct a subfield and find a preimage of the target element
Declaration of Competing Interest
The authors declared that they have no conflicts of interest to this work.
Acknowledgements
This research was supported by National Natural Science Foundation of China (Grant No. 61502481).
References (39)
- et al.
Function field sieve method for discrete logarithms over finite fields
Inf. Comput.
(1999) - et al.
On a problem of Oppenheim concerning “factorisatio numerorum”
J. Number Theory
(1983) The function field sieve
- et al.
Imperfect forward secrecy: how Diffie-Hellman fails in practice
Algorithms of discrete logarithm in finite fields
(2013)- et al.
Updating key size estimations for pairings
J. Cryptol.
(2018) - et al.
Improving NFS for the discrete logarithm problem in non-prime finite fields
- et al.
A heuristic quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic
- et al.
The tower number field sieve
- et al.
The multiple number field sieve for medium- and high-characteristic finite fields
LMS J. Comput. Math.
(2014)
Identity-based encryption from the Weil pairing
SIAM J. Comput.
An algorithm to solve the discrete logarithm problem with the number field sieve
New directions in cryptography
IEEE Trans. Inf. Theory
A kilobit hidden SNFS discrete logarithm computation
Discrete logarithms in using the number field sieve
SIAM J. Discrete Math.
On the powers of 2
On the discrete logarithm problem in finite fields of fixed characteristic
Trans. Am. Math. Soc.
Computing individual discrete logarithms faster in with the NFS-DL algorithm
Faster individual discrete logarithms in finite fields of composite extension degree
Math. Comput.
Cited by (2)
Constructing CM Fields for NFS to Accelerate DL Computation in Non-Prime Finite Fields
2023, IEEE Transactions on Information TheoryRelation collection using Pollard special-q sieving to solve integer factorization and discrete logarithm problem
2021, Journal of Supercomputing