7 research outputs found
Root optimization of polynomials in the number field sieve
The general number field sieve (GNFS) is the most efficient algorithm known
for factoring large integers. It consists of several stages, the first one
being polynomial selection. The quality of the chosen polynomials in polynomial
selection can be modelled in terms of size and root properties. In this paper,
we describe some algorithms for selecting polynomials with very good root
properties.Comment: 16 pages, 18 reference
An Implementation of the Extended Tower Number Field Sieve using 4d Sieving in a Box and a Record Computation in Fp4
We report on an implementation of the Extended Tower Number Field Sieve
(ExTNFS) and record computation in a medium characteristic finite field Fp4 of
512 bits size. We show that sieving in a box (orthotope) for collecting
relations for ExTNFS is still fast in 4 dimensions
Root optimization of polynomials in the number field sieve
International audienceThe general number field sieve (GNFS) is the most efficient algorithm known for factoring large integers. It consists of several stages, the first one being polynomial selection. The quality of the chosen polynomials in polynomial selection can be modelled in terms of size and root properties. In this paper, we describe some algorithms for selecting polynomials with very good root properties
Solving a 676-Bit Discrete Logarithm Problem in GF(36n )
Pairings on elliptic curves over finite fields are crucial for constructing various cryptographic schemes. The \eta_T pairing on supersingular curves over GF(3^n) is particularly popular since it is efficiently implementable. Taking into account the Menezes-Okamoto-Vanstone (MOV) attack, the discrete logarithm problem (DLP) in GF(3^{6n}) becomes a concern for the security of cryptosystems using \eta_T pairings in this case. In 2006, Joux and Lercier proposed a new variant of the function field sieve in the medium prime case, named JL06-FFS. We have, however, not yet found any practical implementations on JL06-FFS over GF(3^{6n}). Therefore, we first fulfilled such an implementation and we successfully set a new record for solving the DLP in GF(3^{6n}), the DLP in GF(3^{6 \cdot 71}) of 676-bit size. In addition, we also compared JL06-FFS and an earlier version, named JL02-FFS, with practical experiments. Our results confirm that the former is several times faster than the latter under certain conditions
Relation collection for the Function Field Sieve
International audienceIn this paper, we focus on the relation collection step of the Function Field Sieve (FFS), which is to date the best known algorithm for computing discrete logarithms in small-characteristic finite fields of cryptographic sizes. Denoting such a finite field by GF(p^n), where p is much smaller than n, the main idea behind this step is to find polynomials of the form a(t)-b(t)x in GF(p)[t][x] which, when considered as principal ideals in carefully selected function fields, can be factored into products of low-degree prime ideals. Such polynomials are called ''relations'', and current record-sized discrete-logarithm computations require billions of them. Collecting relations is therefore a crucial and extremely expensive step in FFS, and a practical implementation thereof requires heavy use of cache-aware sieving algorithms, along with efficient polynomial arithmetic over GF(p)[t]. This paper presents the algorithmic and arithmetic techniques which were put together as part of a new implementation of FFS, aimed at medium- to record-sized computations, and planned for public release in the near future
We Are on the Same Side. Alternative Sieving Strategies for the Number Field Sieve
The Number Field Sieve (NFS) is the state-of-the art algorithm for integer
factoring, and sieving is a crucial step in the NFS. It is a very
time-consuming operation, whose goal is to collect many relations. The
ultimate goal is to generate random smooth integers mod with their prime
decomposition, where smooth is defined on the rational and algebraic sides
according to two prime factor bases.
In modern factorization tool, such as \textsf{Cado-NFS}, sieving is split into
different stages depending on the size of the primes, but defining good
parameters for all stages is based on heuristic and practical arguments. At
the beginning, candidates are sieved by small primes on both sides, and if
they pass the test, they continue to the next stages with bigger primes, up to
the final one where we factor the remaining part using the ECM algorithm. On
the one hand, first stages are fast but many false relations pass them, and we
spend a lot of time with useless relations. On the other hand final stages are
more time demanding but outputs less relations. It is not easy to evaluate the
performance of the best strategy on the overall sieving step since it depends
on the distribution of numbers that results at each stage.
In this article, we try to examine different sieving strategies to speed up
this step since many improvements have been done on all other steps of the
NFS. Based on the relations collected during the RSA-250 factorization and all
parameters, we try to study different strategies to better understand this
step. Many strategies have been defined since the discovery of NFS, and we
provide here an experimental evaluation