International Association for Cryptologic Research (IACR)
Doi
Abstract
We propose a generalization of exTNFS algorithm recently introduced by Kim and Barbulescu (CRYPTO 2016). The algorithm, exTNFS, is a state-of-the-art algorithm for discrete logarithm in Fpn in the medium prime case, but it only applies when n=ηκ is a composite with nontrivial factors η and κ such that gcd(η,κ)=1. Our generalization, however, shows that exTNFS algorithm can be also adapted to the setting with an arbitrary composite n maintaining its best asymptotic complexity. We show that one can solve discrete logarithm in medium case in the running time of Lpn(1/3,348/9) (resp. Lpn(1/3,1.71) if multiple number fields are used), where n is an \textit{arbitrary composite}. This should be compared with a recent variant by Sarkar and Singh (Asiacrypt 2016) that has the fastest running time of Lpn(1/3,364/9) (resp. Lpn(1/3,1.88)) when n is a power of prime 2. When p is of special form, the complexity is further reduced to Lpn(1/3,332/9). On the practical side, we emphasize that the keysize of pairing-based cryptosystems should be updated following to our algorithm if the embedding degree n remains composite