Small Characteristic Finite Fields Research Articles

Faster individual discrete logarithms in finite fields of composite extension degree

Computing discrete logarithms in finite fields is a main concern in cryptography. The best algorithms in large and medium characteristic fields (e.g., $\rm {GF}(p^2)$, $\rm {GF}(p^{12})$) are the Number Field Sieve and its variants (special, high-degree, tower). The best algorithms in small characteristic finite fields (e.g., $\rm {GF}(3^{6 \cdot 509})$) are the Function Field Sieve, Joux’s algorithm, and the quasipolynomial-time algorithm. The last step of this family of algorithms is the individual logarithm computation. It computes a smooth decomposition of a given target in two phases: an initial splitting, then a descent tree. While new improvements have been made to reduce the complexity of the dominating relation collection and linear algebra steps, resulting in a smaller factor basis (database of known logarithms of small elements), the last step remains at the same level of difficulty. Indeed, we have to find a smooth decomposition of a typically large element in the finite field. This work improves the initial splitting phase and applies to any nonprime finite field. It is very efficient when the extension degree is composite. It exploits the proper subfields, resulting in a much more smooth decomposition of the target. This leads to a new trade-off between the initial splitting step and the descent step in small characteristic. Moreover it reduces the width and the height of the subsequent descent tree.

Smoothness Test for Polynomials Defined Over Small Characteristic Finite Fields

The problem of determining whether a polynomial defined over a finite field ring is smooth or not with respect to a given degree, is the most intensive arithmetic operation of the so-called descent phase of index-calculus algorithms. In this paper, we present an analysis and efficient implementation of Coppersmith’s smoothness test for polynomials defined over finite fields with characteristic three. As a case study, we review the best strategies for obtaining a fast field and polynomial arithmetic for polynomials defined over the ring $$F_q[X],$$ with $$q=3^6,$$ and report the timings achieved by our library when computing the smoothness test applied to polynomials of several degrees defined in that ring. This software library was recently used in Adj et al. (Cryptology 2016. http://eprint.iacr.org/2016/914 ), as a building block for achieving a record computation of discrete logarithms over the 4841-bit field $${{\mathbb {F}}}_{3^{6\cdot 509}}$$ .

Computing discrete logarithms in cryptographically-interesting characteristic-three finite fields

Since 2013 there have been several developments in algorithms for computing discrete logarithms in small-characteristic finite fields, culminating in a quasi-polynomial algorithm. In this paper, we report on our successful computation of discrete logarithms in the cryptographically-interesting characteristic-three finite field $\mathbb{F}_{3^{6.509}}$ using these new algorithms; prior to 2013, it was believed that this field enjoyed a security level of 128 bits. We also show that a recent idea of Guillevic can be used to compute discrete logarithms in the cryptographically-interesting finite field $\mathbb{F}_{3^{6.709}}$ using essentially the same resources as we expended on the $\mathbb{F}_{3^{6.509}}$ computation. Finally, we argue that discrete logarithms in the finite field $\mathbb{F}_{3^{6.1429}}$ can feasibly be computed today; this is significant because this cryptographically-interesting field was previously believed to enjoy a security level of 192 bits.

Technical history of discrete logarithms in small characteristic finite fields

Due to its use in cryptographic protocols such as the Diffie---Hellman key exchange, the discrete logarithm problem attracted a considerable amount of attention in the past 40 years. In this paper, we summarize the key technical ideas and their evolution for the case of discrete logarithms in small characteristic finite fields. This road leads from the original belief that this problem was hard enough for cryptographic purpose to the current state of the art where the algorithms are so efficient and practical that the problem can no longer be considered for cryptographic use.

Computing discrete logarithms using Joux's algorithm

In 2013, Joux presented a new algorithm for solving the discrete logarithm problem in finite fields of small characteristic with a main novelty involving the resolution of bilinear equation systems. The algorithm improved significantly all previous methods for this purpose. We used Joux’s algorithm to compute discrete logarithms in the 1303-bit finite field F36·137 and illustrated for the first time its effectiveness in ‘general’ small-characteristic finite fields with very modest computational resources.

Weakness of [formula omitted] and [formula omitted] for discrete logarithm cryptography

In the past two years, there have been several dramatic improvements in algorithms for computing discrete logarithms in small-characteristic finite fields. In this paper, we examine the effectiveness of these new algorithms for computing discrete logarithms in F36⋅1429 and F24⋅3041. The intractability of the discrete logarithm problem in these fields is necessary for the security of bilinear pairings derived from supersingular curves with embedding degree 6 and 4 defined, respectively, over F31429 and F23041; these curves were believed to enjoy a security level of 192 bits against attacks by Coppersmith's algorithm. Our analysis shows that these pairings offer security levels of at most 96 and 129 bits, respectively, leading us to conclude that they are dead for pairing-based cryptography.

Sparse polynomials, redundant bases, gauss periods, and efficient exponentiation of primitive elements for small characteristic finite fields

Gauss periods give an exponentiation algorithm that is fast for many finite fields but slow for many other fields. The current paper presents a different method for construction of elements that yield a fast exponentiation algorithm for finite fields where the Gauss period method is slow or does not work. The basic idea is to use elements of low multiplicative order and search for primitive elements that are binomial or trinomial of these elements. Computational experiments indicate that such primitive elements exist, and it is shown that they can be exponentiated fast.