summary:We obtain lower bounds on degree and additive complexity of real polynomials approximating the discrete logarithm in finite fields of even characteristic. These bounds complement earlier results for finite fields of odd characteristic

Brandstätter, Nina

Winterhof, Arne

English

Institute of Mathematics AS CR, v. v. i.

Archivum MathematicumNina Brandstätter; Arne WinterhofApproximation of the discrete logarithm in finite fields of even characteristic by realpolynomialsArchivum Mathematicum, Vol. 42 (2006), No. 1, 43--50Persistent URL: http://dml.cz/dmlcz/107980Terms of use:© Masaryk University, 2006Institute of Mathematics of the Academy of Sciences of the Czech Republic provides access todigitized documents strictly for personal use. Each copy of any part of this document must containthese Terms of use.This paper has been digitized, optimized for electronic delivery and stampedwith digital signature within the project DML-CZ: The Czech Digital MathematicsLibrary http://project.dml.czARCHIVUM MATHEMATICUM (BRNO)Tomus 42 (2006), 43 – 50APPROXIMATION OF THE DISCRETE LOGARITHM INFINITE FIELDS OF EVEN CHARACTERISTIC BY REALPOLYNOMIALSNINA BRANDSTÄTTER AND ARNE WINTERHOFAbstract. We obtain lower bounds on degree and additive complexity ofreal polynomials approximating the discrete logarithm in finite fields of evencharacteristic. These bounds complement earlier results for finite fields ofodd characteristic.1. IntroductionPut q = pr where p is a prime and r is a positive integer. Denote by Fq the finitefield of order q. Moreover, let α be a defining element of Fq, i.e., Fq = Fp(α) and{1, α, α2, . . . , αr−1} is a (polynomial) basis of Fq over Fp. We order the elementsξ0, ξ1, . . . , ξq−1 of Fq in the following way,ξk = k1 + k2α+ . . .+ krαr−1ifk = k1 + k2p+ . . .+ krpr−1, 0 ≤ k1, k2, . . . , kr < p ,for 0 ≤ k ≤ q − 1. Let γ be a primitive element of Fq. The discrete logarithm(or index) of a nonzero element ξ ∈ Fq to the base γ, denoted indγ(ξ), is theunique integer l with 0 ≤ l ≤ q − 2 such that ξ = γl. The discrete logarithmproblem is to find a computationally feasible method for determining the discretelogarithm. The security of many public-key cryptosystems depends on the pre-sumed intractability of the discrete logarithm problem (see e. g. [13]). This paperprovides some theoretical support to this assumption of hardness of the discretelogarithm problem. In the monograph [22] (or its predecessor [21]) and the seriesof papers [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 14, 15, 16, 25, 26] several results onthe discrete logarithm problem supporting the assumption of its hardness wereproven. In particular, in [22, Chapter 11] several results on the complexity of realpolynomials approximating the discrete logarithm in the case r = 1 are given. In2000 Mathematics Subject Classification. 11T24, 11T71, 94A60.Key words and phrases. Discrete logarithm, polynomial approximation, character sums.Received September 10, 2004.44 N. BRANDSTÄTTER AND A. WINTERHOFthe case p > 2 most of these results can be extended to arbitrary r in a ratherstraightforward way along the lines of [7, 8, 16, 25]. However, in the case p = 2 sev-eral new ideas are needed. For example for p = 2 we have no quadratic characterand need a compensation. In this article we prove two results on approximationpolynomials of the discrete logarithm in the case q = 2r. In Section 3 we provea lower bound on the additive complexity of an interpolation polynomial and inSection 4 we prove a lower bound on the degree of polynomials which determinethe rightmost bit of the discrete logarithm in Fq for a large set of given data.2. PreliminariesThe additive complexity C±(f) of a polynomial f(X) is the smallest numberof ’+’ and ’−’ signs necessary to write down this polynomial. In [17, 18] thenumber of different zeros of a real polynomial was estimated in terms of its additivecomplexity.Lemma 1. For a nonzero polynomial f(X) ∈ R[X ] having N different real zeroswe haveC±(f) ≥(15log2(N))1/2,where log2(N) is the binary logarithm.Put eT (z) = exp(2πiz/T ).Lemma 2. For any integer 1 ≤ N ≤ T we haveT−1∑u=1∣∣∣N−1∑n=0eT (un)∣∣∣≤ T( 4π2lnT + 0.8),where lnT denotes the natural logarithm.Proof. We haveT−1∑u=1∣∣∣N−1∑n=0eT (un)∣∣∣=T−1∑u=1∣∣∣sin(πNu/T )sin(πu/T )∣∣∣≤4π2T lnT + 0.38T + 0.608 + 0.116gcd(N,T )2Tby [1, Theorem 1]. For the following bound on incomplete character sums see [24, Section 3, p. 469].Lemma 3. Let χ be a nontrivial multiplicative character of Fq and f(X) ∈ Fq[X ]a monic polynomial which is not an ordχ-th power and has m different zeros inits splitting field over Fq. Then we have for any additive subgroup V of Fq anda ∈ F∗q,∣∣∣∑ξ∈Vχ(af(ξ))∣∣∣≤ mq1/2 .APPROXIMATION OF THE DISCRETE LOGARITHM 45Lemma 4. Let q = 2r. Under the conditions of Lemma 3 we have∣∣∣K−1∑k=0χ(af(ξk))∣∣∣≤ mrq1/2 , 1 ≤ K ≤ q .Proof. The set {ξ0, . . . , ξK−1} can be written as union of at most r cosets ofadditive subgroups. Hence, the result follows by Lemma 3. 3. InterpolationIn this section we deal with arbitrary finite fields but focus on small character-istic including characteristic 2.Theorem 1. Let f(X) ∈ R[X ] be a polynomial such thatindγ(ξk) = f(k) for all k ∈ Sfor a set S ⊆ {1, . . . , q − 1} of cardinality |S| = q − 1 − s. Then we havedeg f ≥q/p− 12− sandC±(f) ≥(120log2(q/p− 12− s))1/2− 1 .Proof. Let R be the set of all k ∈ S with 1 ≤ k ≤ qp − 1 such thatindγ(ξk) = f(k) and indγ(ξkp) = f(kp) .Then we have |R| ≥ q/p− 1 − 2s. For each k ∈ R we have eitherf(kp) = indγ(ξkp) = indγ(αξk) = indγ(ξk) + indγ(α) = f(k) + indγ(α)orf(kp) = indγ(αξk) = indγ(ξk) + indγ(α) − q + 1 = f(k) + indγ(α) − q + 1 .Hence, at least one of the polynomialshω(X) = f(pX) − f(X) − ωwith ω ∈ {indγ(α), indγ(α) − q + 1} has at least |R|/2 zeros. The polynomialshω(X) are not identically zero since hω(0) = −ω 6= 0 and it followsdeg f ≥ deg hω ≥q/p− 12− s .Lemma 1 yieldsC±(hω) ≥(15log2(q/p− 12− s))1/2and C±(hω) ≤ 2C±(f) + 2 implies the result. 46 N. BRANDSTÄTTER AND A. WINTERHOFRemarks. 1. For p > 2 we may also use the relationindγ(ξ2k) ≡ indγ(ξk) + indγ(2) mod q − 1if k = k1 + k2p+ . . .+ krpr−1 with 0 ≤ k1, k2, . . . , kr ≤ (p− 1)/2 to obtaindeg f ≥((p+ 1)/2)r − 12− sandC±(f) ≥(120log2(((p+ 1)/2)r − 12− s))1/2− 1which improves Theorem 1 for large p with respect to r. This approach works alsofor an arbitrary basis instead of a polynomial basis in the definition of the ξk.2. For rational interpolation polynomials f(X) ∈ Q[X ] we may also use the lowerbound on the additive complexity of [19, 20] to improve Theorem 1.4. ApproximationNow we restrict ourselves to the case of even characteristic and prove a resulton polynomials which determine the rightmost bit of the discrete logarithm.Theorem 2. Let q = 2r with r ≥ 3, 1 ≤ H ≤ q− 1, and let f(X) ∈ R[X ] be suchthat for all k of a subset S ⊆ {1, . . . , H} of cardinality |S| = H − s we havef(k) ≥ 0 , if indγ(ξk) is even,f(k) < 0 , otherwise.Then we havedeg f ≥29(H − 1) − 4.2r q1/2(4π2ln(q − 1) + 0.8)2− 2s− 1 .Proof. Let χ be a primitive character of Fq and put η := χ(γ)−1. For 0 ≤ l ≤ q−2and ξ ∈ F∗q we putψl(ξ) :={1 , if ξ = γl ,0 , otherwise,andψ(ξ) :={1 , if ξ = γ2m with 0 ≤ m ≤ q/2 − 1 ,−1 , otherwise.Note thatψl(ξ) =1q − 1q−2∑j=0ηjlχj(ξ)APPROXIMATION OF THE DISCRETE LOGARITHM 47andψ(ξ) = 2q/2−1∑m=0ψ2m(ξ) − 1 .PutT := {1 ≤ k ≤ H : k even and ψ(ξk) 6= ψ(ξk + 1)} .For all k ∈ T we have ξk+1 = ξk + 1.The number of k ∈ T such that either k /∈ S or k + 1 /∈ S is at most 2s+ 1.So we have f(k)f(k + 1) < 0 for at least |T | − 2s− 1 different k. The polynomialf changes its sign at least |T | − 2s− 1 times and has at least so many zeros. Sowe havedeg f ≥ |T | − 2s− 1.On the other hand we have|T | = −∑k∈Tψ(ξk)ψ(ξk + 1)= −⌊H/2⌋∑k=1ψ(ξ2k)ψ(ξ2k + 1) + ⌊H/2⌋ − |T | .Hence, with ξ2k = αξk for 0 ≤ k ≤ q/2 − 1 we get|T | = −12⌊H/2⌋∑k=1ψ(αξk)ψ(αξk + 1) +12⌊H/2⌋ .Next we useψ(ξ)ψ(ξ + 1) = 4q/2−1∑m1,m2=0ψ2m1(ξ)ψ2m2(ξ + 1) − 2q/2−1∑m=0(ψ2m(ξ) + ψ2m(ξ + 1)) + 1andψ2m1(ξ)ψ2m2(ξ + 1) =1(q − 1)2q−2∑j1,j2=0η2(j1m1+j2m2)χj1(ξ)χj2 (ξ + 1)to get|T | = −2q/2−1∑m1,m2=0⌊H/2⌋∑k=1ψ2m1(αξk)ψ2m2(αξk + 1)+q/2−1∑m=0⌊H/2⌋∑k=1(ψ2m(αξk) + ψ2m(αξk + 1))48 N. BRANDSTÄTTER AND A. WINTERHOF=−2(q − 1)2q−2∑j1,j2=0q/2−1∑m1,m2=0η2(j1m1+j2m2)⌊H/2⌋∑k=1χj1(αξk)χj2(αξk + 1)+1q − 1q−2∑j=0q/2−1∑m=0η2jm⌊H/2⌋∑k=1(χj(αξk) + χj(αξk + 1)) .The summand for j1 = j2 = 0 in the first sum,−q22(q − 1)2⌊H/2⌋ ,and the summand for j = 0 in the second sum,qq − 1⌊H/2⌋ ,add tot :=(q − 2)q2(q − 1)2⌊H/2⌋ ≥29(H − 1) , q ≥ 4 .So we have∣∣|T | − t∣∣ ≤2(q − 1)2q−2∑j1,j2=1∣∣∣q/2−1∑m1,m2=0η2(j1m1+j2m2)∣∣∣∣∣∣⌊H/2⌋∑k=1χj1(αξk)χj2 (αξk + 1)∣∣∣+∣∣∣1q − 1−q(q − 1)2∣∣∣q−2∑j=1∣∣∣q/2−1∑m=0η2jm∣∣∣∣∣∣⌊H/2⌋∑k=1(χj(αξk) + χj(αξk + 1))∣∣∣< 4rq1/2( 4π2ln(q − 1) + 0.8)2+2rq − 1q1/2( 4π2ln(q − 1) + 0.8)< 4.2r q1/2( 4π2ln(q − 1) + 0.8)2by Lemmas 2 and 4 and the result follows. For odd characteristic the knowledge of the rightmost bit of the discrete log-arithm of an element ξ is equivalent to knowing if ξ is a square. In this case ψdefined in the proof of Theorem 2 is the quadratic character and we may applycharacter sum bounds of [23] much earlier. For even characteristic all elements ofFq are squares and ψ is not multiplicative.Acknowledgment. The authors are supported by the Austrian Academy ofSciences and by the Austrian Science Fund (FWF) grant S8313.APPROXIMATION OF THE DISCRETE LOGARITHM 49References[1] Cochrane, T., On a trigonometric inequality of Vinogradov, J. Number Theory 27 (1987),9–16.[2] Coppersmith, D. and Shparlinski, I., On polynomial approximation of the discrete logarithmand the Diffie-Hellman mapping, J. Cryptology 13 (2000), 339–360.[3] Ding, C. and Helleseth, T., On cyclotomic generator of order r, Inform. Process. Lett. 66(1998), 21–25.[4] Kiltz, E. and Winterhof, A., Polynomial interpolation of cryptographic functions related toDiffie-Hellman and discrete logarithm problem, Discrete Appl. Math. 154 (2006), 326–336.[5] Konyagin, S., Lange, T. and Shparlinski, I., Linear complexity of the discrete logarithm,Des. Codes Cryptogr. 28 (2003), 135–146.[6] Lange, T. and Winterhof, A., Polynomial interpolation of the elliptic curve and XTR dis-crete logarithm, Lecture Notes in Comput. Sci. 2387 (2002), 137–143.[7] Lange, T. and Winterhof, A., Incomplete character sums over finite fields and their appli-cation to the interpolation of the discrete logarithm by Boolean functions, Acta Arith. 101(2002), 223–229.[8] Lange, T. and Winterhof, A., Interpolation of the discrete logarithm in Fq by Booleanfunctions and by polynomials in several variables modulo a divisor of q − 1, Discrete Appl.Math. 128 (2003), 193–206.[9] Meidl, W. and Winterhof, A., Lower bounds on the linear complexity of the discrete loga-rithm in finite fields, IEEE Trans. Inform. Theory 47 (2001), 2807–2811.[10] Meletiou, G. C., Explicit form for the discrete logarithm over the field GF(p, k), Arch. Math.(Brno) 29 (1993), 25–28.[11] Meletiou, G. C., Explicit form for the discrete logarithm over the field GF(p, k), Bul. Inst.Politeh. Iaşi. Secţ. I. Mat. Mec. Teor. Fiz. 41(45) (1995), 1–4.[12] Meletiou, G. C. and Mullen, G. L., A note on discrete logarithms in finite fields, Appl.Algebra Engrg. Comm. Comput. 3 (1992), 75–78.[13] Menezes, A. J., van Oorschot, P. C. and Vanstone, S. A. Handbook of applied cryptography,CRC Press, Boca Raton, FL 1997.[14] Mullen, G. L. and White, D., A polynomial representation for logarithms in GF(q), ActaArith. 47 (1986), 255–261.[15] Niederreiter, H., A short proof for explicit formulas for discrete logarithms in finite fields,Appl. Algebra Engrg. Comm. Comput. 1 (1990), 55–57.[16] Niederreiter, H. and Winterhof, A., Incomplete character sums and polynomial interpolationof the discrete logarithm, Finite Fields Appl. 8 (2002), 184–192.[17] Risler, J.-J., Khovansky’s theorem and complexity theory, Rocky Mountain J. Math. 14(1984), 851–853.[18] Risler, J.-J., Additive complexity of real polynomials, SIAM J. Comp. 14 (1985), 178–183.[19] Rojas, J. M., Additive complexity and p-adic roots of polynomials, Lecture Notes in Comput.Sci. 2369 (2002), 506–516.[20] Rojas, J. M., Arithmetic multivariate Descartes’ rule, Amer. J. Math. 126 (2004), 1–30.[21] Shparlinski, I., Number theoretic methods in cryptography. Complexity lower bounds,Birkhäuser, Basel 1999.[22] Shparlinski, I., Cryptographic applications of analytic number theory. Complexity lowerbounds and pseudorandomness, Birkhäuser, Basel 2003.[23] Winterhof, A., Some estimates for character sums and applications, Des. Codes Cryptogr.22 (2001), 123–131.50 N. BRANDSTÄTTER AND A. WINTERHOF[24] Winterhof, A., Incomplete additive character sums and applications, In: Jungnickel, D. andNiederreiter, H. (eds.): Finite fields and applications, 462–474, Springer, Heidelberg 2001.[25] Winterhof, A., Polynomial interpolation of the discrete logarithm, Des. Codes Cryptogr. 25(2002), 63–72.[26] Winterhof, A., A note on the linear complexity profile of the discrete logarithm in finitefields, Progress Comp. Sci. Appl. Logic 23 (2004), 359–367.Johann Radon Institute for Computational and Applied MathematicsAustrian Academy of SciencesAltenberger Straße 69, A-4040 Linz, AustriaE-mail: nina.brandstaetteroeaw.ac.at,arne.winterhofoeaw.ac.at

Approximation of the discrete logarithm in finite fields of even characteristic by real polynomials

http://dml.cz/bitstream/handle/10338.dmlcz/107980/ArchMathRetro_042-2006-1_5.pdf

Approximation of the discrete logarithm in finite fields of even characteristic by real polynomials

Abstract

Similar works

Full text

Available Versions

Institute of Mathematics AS CR, v. v. i.