4,678 research outputs found
A kilobit hidden SNFS discrete logarithm computation
We perform a special number field sieve discrete logarithm computation in a
1024-bit prime field. To our knowledge, this is the first kilobit-sized
discrete logarithm computation ever reported for prime fields. This computation
took a little over two months of calendar time on an academic cluster using the
open-source CADO-NFS software. Our chosen prime looks random, and
has a 160-bit prime factor, in line with recommended parameters for the Digital
Signature Algorithm. However, our p has been trapdoored in such a way that the
special number field sieve can be used to compute discrete logarithms in
, yet detecting that p has this trapdoor seems out of reach.
Twenty-five years ago, there was considerable controversy around the
possibility of back-doored parameters for DSA. Our computations show that
trapdoored primes are entirely feasible with current computing technology. We
also describe special number field sieve discrete log computations carried out
for multiple weak primes found in use in the wild. As can be expected from a
trapdoor mechanism which we say is hard to detect, our research did not reveal
any trapdoored prime in wide use. The only way for a user to defend against a
hypothetical trapdoor of this kind is to require verifiably random primes
Security Estimates for Quadratic Field Based Cryptosystems
We describe implementations for solving the discrete logarithm problem in the
class group of an imaginary quadratic field and in the infrastructure of a real
quadratic field. The algorithms used incorporate improvements over
previously-used algorithms, and extensive numerical results are presented
demonstrating their efficiency. This data is used as the basis for
extrapolations, used to provide recommendations for parameter sizes providing
approximately the same level of security as block ciphers with
and -bit symmetric keys
Algorithms in algebraic number theory
In this paper we discuss the basic problems of algorithmic algebraic number
theory. The emphasis is on aspects that are of interest from a purely
mathematical point of view, and practical issues are largely disregarded. We
describe what has been done and, more importantly, what remains to be done in
the area. We hope to show that the study of algorithms not only increases our
understanding of algebraic number fields but also stimulates our curiosity
about them. The discussion is concentrated of three topics: the determination
of Galois groups, the determination of the ring of integers of an algebraic
number field, and the computation of the group of units and the class group of
that ring of integers.Comment: 34 page
Splitting Behavior of -Polynomials
We analyze the probability that, for a fixed finite set of primes S, a
random, monic, degree n polynomial f(x) with integer coefficients in a box of
side B around 0 satisfies: (i) f(x) is irreducible over the rationals, with
splitting field over the rationals having Galois group ; (ii) the
polynomial discriminant Disc(f) is relatively prime to all primes in S; (iii)
f(x) has a prescribed splitting type at each prime p in S.
The limit probabilities as are described in terms of values of
a one-parameter family of measures on , called splitting measures, with
parameter evaluated at the primes p in S. We study properties of these
measures. We deduce that there exist degree n extensions of the rationals with
Galois closure having Galois group with a given finite set of primes S
having given Artin symbols, with some restrictions on allowed Artin symbols for
p<n. We compare the distributions of these measures with distributions
formulated by Bhargava for splitting probabilities for a fixed prime in
such degree extensions ordered by size of discriminant, conditioned to be
relatively prime to .Comment: 33 pages, v2 34 pages, introduction revise
Computing Hilbert class polynomials with the Chinese Remainder Theorem
We present a space-efficient algorithm to compute the Hilbert class
polynomial H_D(X) modulo a positive integer P, based on an explicit form of the
Chinese Remainder Theorem. Under the Generalized Riemann Hypothesis, the
algorithm uses O(|D|^(1/2+o(1))log P) space and has an expected running time of
O(|D|^(1+o(1)). We describe practical optimizations that allow us to handle
larger discriminants than other methods, with |D| as large as 10^13 and h(D) up
to 10^6. We apply these results to construct pairing-friendly elliptic curves
of prime order, using the CM method.Comment: 37 pages, corrected a typo that misstated the heuristic complexit
On the ideal shortest vector problem over random rational primes
Any ideal in a number field can be factored into a product of prime ideals.
In this paper we study the prime ideal shortest vector problem (SVP) in the
ring , a popular choice in the design of ideal lattice
based cryptosystems. We show that a majority of rational primes lie under prime
ideals admitting a polynomial time algorithm for SVP. Although the shortest
vector problem of ideal lattices underpins the security of Ring-LWE
cryptosystem, this work does not break Ring-LWE, since the security reduction
is from the worst case ideal SVP to the average case Ring-LWE, and it is
one-way
Computing -th roots in number fields
We describe several algorithms for computing -th roots of elements in a
number field , where is an odd prime-power integer. In particular we
generalize Couveignes' and Thom\'e's algorithms originally designed to compute
square-roots in the Number Field Sieve algorithm for integer factorization. Our
algorithms cover most cases of and and allow to obtain reasonable
timings even for large degree number fields and large exponents . The
complexity of our algorithms is better than general root finding algorithms and
our implementation compared well in performance to these algorithms implemented
in well-known computer algebra softwares. One important application of our
algorithms is to compute the saturation phase in the Twisted-PHS algorithm for
computing the Ideal-SVP problem over cyclotomic fields in post-quantum
cryptography.Comment: 9 pages, 4 figures. Associated experimental code provided at
https://github.com/ob3rnard/eth-root
- …