UNIVERSITY of CALGARY Unconditional Class Group
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Improvements in Computing Discrete Logarithms in Finite Fields
ISSN (Print): 2476-8316 ISSN (Online): 2635-3490 Dutse Journal of Pure and Applied Sciences (DUJOPAS), Vol. 5 No. 1a June 2019 Improvements in Computing Discrete Logarithms in Finite Fields 1*Ali Maianguwa Shuaibu, 2Sunday Babuba & 3James Andrawus 1, 2,3 Department of Mathematics, Federal University Dutse, Jigawa State Email: [email protected] Abstract The discrete logarithm problem forms the basis of numerous cryptographic systems. The most efficient attack on the discrete logarithm problem in the multiplicative group of a finite field is via the index calculus. In this paper, we examined a non-generic algorithm that uses index calculus. If α is a generator × × for 퐹푝 then the discrete logarithm of 훽 ∈ 퐹푝 with respect to 훼 is also called the index of 훽 (with respect to 훼), whence the term index calculus. This algorithm depends critically on the distribution of smooth numbers (integers with small prime factors), which naturally leads to a discussion of two algorithms for factoring integers that also depend on smooth numbers: the Pollard 푝 − 1method and the elliptic curve method. In conclusion, we suggest improved elliptic curve as well as hyperelliptic curve cryptography methods as fertile ground for further research. Keywords: Elliptic curve, Index calculus, Multiplicative group, Smooth numbers Introduction 푥 It is known that the logarithm 푙표푔푏 푎 is a number x such that 푏 = 푎, for given numbers a and b. Similarly, in any group G, powers 푏푘 can be defined for all integers 푘, and 푘 the discrete logarithm푙표푔푏 푎 is an integer k such that 푏 = 푎. In number theory,푥 = 푥 푖푛푑푟푎(푚표푑 푚) is read as the index of 푎 to the base r modulo m which is equivalent to 푟 = 푎(푚표푑 푚) if r is the primitive root of m and greatest common divisor, 푔푐푑( 푎, 푚) = 1. -
The Index Calculus Method Using Non-Smooth Polynomials
MATHEMATICS OF COMPUTATION Volume 70, Number 235, Pages 1253{1264 S 0025-5718(01)01298-4 Article electronically published on March 7, 2001 THE INDEX CALCULUS METHOD USING NON-SMOOTH POLYNOMIALS THEODOULOS GAREFALAKIS AND DANIEL PANARIO Abstract. We study a generalized version of the index calculus method for n the discrete logarithm problem in Fq ,whenq = p , p is a small prime and n !1. The database consists of the logarithms of all irreducible polynomials of degree between given bounds; the original version of the algorithm uses lower bound equal to one. We show theoretically that the algorithm has the same asymptotic running time as the original version. The analysis shows that the best upper limit for the interval coincides with the one for the original version. The lower limit for the interval remains a free variable of the process. We provide experimental results that indicate practical values for that bound. We also give heuristic arguments for the running time of the Waterloo variant and of the Coppersmith method with our generalized database. 1. Introduction Let G denote a group written multiplicatively and hgi the cyclic subgroup gen- erated by g 2 G.Giveng and y 2hgi,thediscrete logarithm problem for G is to find the smallest integer x such that y = gx.Theintegerx is called the discrete logarithm of y in the base g, and is written x =logg y. The main reason for the intense current interest on the discrete logarithm prob- lem (apart from being interesting on a purely mathematical level) is that the se- curity of many public-key cryptosystems depends on the assumption that finding discrete logarithms is hard, at least for certain groups. -
Index Calculus in the Trace Zero Variety 3
INDEX CALCULUS IN THE TRACE ZERO VARIETY ELISA GORLA AND MAIKE MASSIERER Abstract. We discuss how to apply Gaudry’s index calculus algorithm for abelian varieties to solve the discrete logarithm problem in the trace zero variety of an elliptic curve. We treat in particular the practically relevant cases of field extensions of degree 3 or 5. Our theoretical analysis is compared to other algorithms present in the literature, and is complemented by results from a prototype implementation. 1. Introduction Given an elliptic curve E defined over a finite field Fq, consider the group E(Fqn ) of rational points over a field extension of prime degree n. Since E is defined over Fq, the group E(Fqn ) contains the subgroup E(Fq) of Fq-rational points of E. Moreover, it contains the subgroup Tn of − points P E(F n ) whose trace P + ϕ(P )+ ... + ϕn 1(P ) is zero, where ϕ denotes the Frobenius ∈ q homomorphism on E. The group Tn is called the trace zero subgroup of E(Fqn ), and it is the group of Fq-rational points of the trace zero variety relative to the field extension Fqn Fq. In this paper, we study the hardness of the DLP in the trace zero variety. Our| interest in this question has several motivations. First of all, supersingular trace zero varieties can achieve higher security per bit than supersingular elliptic curves, as shown by Rubin and Silverberg in [RS02, RS09] and by Avanzi and Cesena in [AC07, Ces10]. Ideally, in pairing-based proto- F∗ cols the embedding degree k is such that the DLP in Tn and in qkn have the same complexity. -
Integer Factorization and Computing Discrete Logarithms in Maple
Integer Factorization and Computing Discrete Logarithms in Maple Aaron Bradford∗, Michael Monagan∗, Colin Percival∗ [email protected], [email protected], [email protected] Department of Mathematics, Simon Fraser University, Burnaby, B.C., V5A 1S6, Canada. 1 Introduction As part of our MITACS research project at Simon Fraser University, we have investigated algorithms for integer factorization and computing discrete logarithms. We have implemented a quadratic sieve algorithm for integer factorization in Maple to replace Maple's implementation of the Morrison- Brillhart continued fraction algorithm which was done by Gaston Gonnet in the early 1980's. We have also implemented an indexed calculus algorithm for discrete logarithms in GF(q) to replace Maple's implementation of Shanks' baby-step giant-step algorithm, also done by Gaston Gonnet in the early 1980's. In this paper we describe the algorithms and our optimizations made to them. We give some details of our Maple implementations and present some initial timings. Since Maple is an interpreted language, see [7], there is room for improvement of both implementations by coding critical parts of the algorithms in C. For example, one of the bottle-necks of the indexed calculus algorithm is finding and integers which are B-smooth. Let B be a set of primes. A positive integer y is said to be B-smooth if its prime divisors are all in B. Typically B might be the first 200 primes and y might be a 50 bit integer. ∗This work was supported by the MITACS NCE of Canada. 1 2 Integer Factorization Starting from some very simple instructions | \make integer factorization faster in Maple" | we have implemented the Quadratic Sieve factoring al- gorithm in a combination of Maple and C (which is accessed via Maple's capabilities for external linking). -
Quantum Arithmetics and the Relationship Between Real and P-Adic Physics
Quantum Arithmetics and the Relationship between Real and p-Adic Physics M. Pitk¨anen Email: [email protected]. http://tgd.wippiespace.com/public_html/. November 7, 2011 Abstract This chapter suggests answers to the basic questions of the p-adicization program, which are following. 1. Is there a duality between real and p-adic physics? What is its precice mathematic formula- tion? In particular, what is the concrete map p-adic physics in long scales (in real sense) to real physics in short scales? Can one find a rigorous mathematical formulationof canonical identification induced by the map p ! 1=p in pinary expansion of p-adic number such that it is both continuous and respects symmetries. 2. What is the origin of the p-adic length scale hypothesis suggesting that primes near power of two are physically preferred? Why Mersenne primes are especially important? The answer to these questions proposed in this chapter relies on the following ideas inspired by the model of Shnoll effect. The first piece of the puzzle is the notion of quantum arithmetics formulated in non-rigorous manner already in the model of Shnoll effect. 1. Quantum arithmetics is induced by the map of primes to quantum primes by the standard formula. Quantum integer is obtained by mapping the primes in the prime decomposition of integer to quantum primes. Quantum sum is induced by the ordinary sum by requiring that also sum commutes with the quantization. 2. The construction is especially interesting if the integer defining the quantum phase is prime. One can introduce the notion of quantum rational defined as series in powers of the preferred prime defining quantum phase. -
Quantum Arithmetics and the Relationship Between Real and P-Adic Physics
CONTENTS 1 Quantum Arithmetics and the Relationship between Real and p-Adic Physics M. Pitk¨anen, June 19, 2019 Email: [email protected]. http://tgdtheory.com/public_html/. Recent postal address: Rinnekatu 2-4 A 8, 03620, Karkkila, Finland. Contents 1 Introduction 4 1.1 Overall View About Variants Of Quantum Integers . .5 1.2 Motivations For Quantum Arithmetics . .6 1.2.1 Model for Shnoll effect . .6 1.2.2 What could be the deeper mathematics behind dualities? . .6 1.2.3 Could quantum arithmetics allow a variant of canonical identification re- specting both symmetries and continuity? . .7 1.2.4 Quantum integers and preferred extremals of K¨ahleraction . .8 1.3 Correspondence Along Common Rationals And Canonical Identification: Two Man- ners To Relate Real And P-Adic Physics . .8 1.3.1 Identification along common rationals . .8 1.3.2 Canonical identification and its variants . .9 1.3.3 Can one fuse the two views about real-p-adic correspondence . .9 1.4 Brief Summary Of The General Vision . 10 1.4.1 Two options for quantum integers . 11 1.4.2 Quantum counterparts of classical groups . 11 2 Various options for Quantum Arithmetics 12 2.1 Comparing options I and II . 12 2.2 About the choice of the quantum parameter q ..................... 14 2.3 Canonical identification for quantum rationals and symmetries . 15 2.4 More about the non-uniqueness of the correspondence between p-adic integers and their quantum counterparts . 16 2.5 The three basic options for Quantum Arithmetics . 18 CONTENTS 2 3 Could Lie groups possess quantum counterparts with commutative elements exist? 18 3.1 Quantum counterparts of special linear groups . -
INDEX CALCULUS in the TRACE ZERO VARIETY 1. Introduction
INDEX CALCULUS IN THE TRACE ZERO VARIETY ELISA GORLA AND MAIKE MASSIERER Abstract. We discuss how to apply Gaudry's index calculus algorithm for abelian varieties to solve the discrete logarithm problem in the trace zero variety of an elliptic curve. We treat in particular the practically relevant cases of field extensions of degree 3 or 5. Our theoretical analysis is compared to other algorithms present in the literature, and is complemented by results from a prototype implementation. 1. Introduction Given an elliptic curve E defined over a finite field Fq, consider the group E(Fqn ) of rational points over a field extension of prime degree n. Since E is defined over Fq, the group E(Fqn ) contains the subgroup E(Fq) of Fq-rational points of E. Moreover, it contains the subgroup Tn of n−1 points P 2 E(Fqn ) whose trace P + '(P ) + ::: + ' (P ) is zero, where ' denotes the Frobenius homomorphism on E. The group Tn is called the trace zero subgroup of E(Fqn ), and it is the group of Fq-rational points of the trace zero variety relative to the field extension Fqn jFq. In this paper, we study the hardness of the DLP in the trace zero variety. Our interest in this question has several motivations. First of all, supersingular trace zero varieties can achieve higher security per bit than supersingular elliptic curves, as shown by Rubin and Silverberg in [RS02, RS09] and by Avanzi and Cesena in [AC07, Ces10]. Ideally, in pairing-based proto- ∗ cols the embedding degree k is such that the DLP in Tn and in Fqkn have the same complexity. -
Minsquare Factors and Maxfix Covers of Graphs
Minsquare Factors and Maxfix Covers of Graphs Nicola Apollonio1 and Andr´as Seb˝o2 1 Department of Statistics, Probability, and Applied Statistics University of Rome “La Sapienza”, Rome, Italy 2 CNRS, Leibniz-IMAG, Grenoble, France Abstract. We provide a polynomial algorithm that determines for any given undirected graph, positive integer k and various objective functions on the edges or on the degree sequences, as input, k edges that minimize the given objective function. The tractable objective functions include linear, sum of squares, etc. The source of our motivation and at the same time our main application is a subset of k vertices in a line graph, that cover as many edges as possible (maxfix cover). Besides the general al- gorithm and connections to other problems, the extension of the usual improving paths for graph factors could be interesting in itself: the ob- jects that take the role of the improving walks for b-matchings or other general factorization problems turn out to be edge-disjoint unions of pairs of alternating walks. The algorithm we suggest also works if for any sub- set of vertices upper, lower bound constraints or parity constraints are given. In particular maximum (or minimum) weight b-matchings of given size can be determined in polynomial time, combinatorially, in more than one way. 1 Introduction Let G =(V,E) be a graph that may contain loops and parallel edges, and let k>0 be an integer. The main result of this work is to provide a polynomial algorithm for finding a subgraph of cardinality k that minimizes some pregiven objective function on the edges or the degree sequences of the graph. -
The Past, Evolving Present and Future of Discrete Logarithm
The Past, evolving Present and Future of Discrete Logarithm Antoine Joux, Andrew Odlyzko and Cécile Pierrot Abstract The first practical public key cryptosystem ever published, the Diffie-Hellman key exchange algorithm, relies for its security on the assumption that discrete logarithms are hard to compute. This intractability hypothesis is also the foundation for the security of a large variety of other public key systems and protocols. Since the introduction of the Diffie-Hellman key exchange more than three decades ago, there have been substantial algorithmic advances in the computation of discrete logarithms. However, in general the discrete logarithm problem is still considered to be hard. In particular, this is the case for the multiplicative group of finite fields with medium to large characteristic and for the additive group of a general elliptic curve. This paper presents a current survey of the state of the art concerning discrete logarithms and their computation. 1 Introduction 1.1 The Discrete Logarithm Problem Many popular public key cryptosystems are based on discrete exponentiation. If G is a multi- plicative group, such as the group of invertible elements in a finite field or the group of points on an elliptic curve, and g is an element of G, then gx is the discrete exponentiation of base g to the power x. This operation shares basic properties with ordinary exponentiation, for example gx+y = gx · gy. The inverse operation is, given h in G, to determine a value of x, if it exists, such that h = gx. Such a number x is called a discrete logarithm of h to the base g, since it shares many properties with the ordinary logarithm. -
Cover and Decomposition Index Calculus on Elliptic Curves Made Practical
Cover and Decomposition Index Calculus on Elliptic Curves made practical Application to a previously unreachable curve over Fp6 Antoine Joux1 and Vanessa Vitse2 1 DGA and Universit´ede Versailles Saint-Quentin, Laboratoire PRISM, 45 avenue des Etats-Unis,´ F-78035 Versailles cedex, France [email protected] 2 Universit´ede Versailles Saint-Quentin, Laboratoire PRISM, 45 avenue des Etats-Unis,´ F-78035 Versailles cedex, France [email protected] Abstract. We present a new \cover and decomposition" attack on the elliptic curve discrete logarithm problem, that combines Weil descent and decomposition-based index calculus into a single discrete logarithm algorithm. This attack applies, at least theoretically, to all composite degree extension fields, and is particularly well-suited for curves defined 3 over Fp6 . We give a real-size example of discrete logarithm computations on a curve over a 151-bit degree 6 extension field, which would not have been practically attackable using previously known algorithms. Key words: elliptic curve, discrete logarithm, index calculus, Weil descent, decomposition attack 1 Introduction Elliptic curves are used in cryptography to provide groups where the discrete logarithm problem is thought to be difficult. We recall that given a finite group G (written additively) and two elements P; Q 2 G, the discrete logarithm problem (DLP) consists in computing, when it exists, an integer x such that Q = xP . When elliptic curves are used in cryptographic applications, the DLP is usually considered to be as difficult as in a generic group of the same size [31]. As a consequence, for a given security level, the key size is much smaller than for other popular cryptosystems based on factorization or discrete logarithms in finite fields. -
RSA, Integer Factorization, Diffie–Hellman, Discrete Logarithm
RSA, integer factorization, Diffie–Hellman, discrete logarithm computation Aurore Guillevic Inria Nancy, France November 12, 2020 1/71 Aurore Guillevic [email protected] • L1-L2 at Université de Bretagne Sud, Lorient (2005–2007) • L3 Vannes (2007–2008) • M1-M2 maths and cryptography at Université de Rennes 1 (2008–2010) • internship and PhD at Thales Communication, Gennevilliers (92) • post-doc at Inria Saclay (2 years) and Calgary (Canada, 1 year) • researcher in cryptography at Inria Nancy since November 2016 • adjunct assistant professor at Polytechnique (2017–2020) 2/71 Outline Preliminaries RSA, and integer factorization problem Naive methods Quadratic sieve Number Field Sieve Bad randomness: gcd, Coppersmith attacks Diffie-Hellman, and the discrete logarithm problem Generic algorithms of square root complexity Pairings 3/71 Introduction: public-key cryptography Introduced in 1976 (Diffie–Hellman, DH) and 1977 (Rivert–Shamir–Adleman, RSA) Asymmetric means distinct public and private keys • encryption with a public key • decryption with a private key • deducing the private key from the public key is a very hard problem Two hard problems: • Integer factorization (for RSA) • Discrete logarithm computation in a finite group (for Diffie–Hellman) 4/71 Textbooks Alfred Menezes, Paul C. van Oorschot, and Scott A. Vanstone. Handbook of Applied Cryptography. CRC Press, 1996. Christof Paar and Jan Pelzl. Understanding Cryptography, a Textbook for Students and Practitioners. Springer, 2010. (Two texbooks [PP10] (Paar and Pelzl) are available at the library at Lorient, code 005.8 PAA). Relvant chapters: 6, 7, 8, and 10. During lockdown, the library is opened: see La BU sur rendez-vous https://www-actus.univ-ubs.fr/fr/index/actualites/scd/ covid-19-la-bu-sur-rdv.html Lecture notes: https://gitlab.inria.fr/guillevi/enseignement/ (Lorient → Master-CSSE.md) 5/71 Textbooks The Handbook is available in PDF for free. -
Exact Formulas for the Generalized Sum-Of-Divisors Functions)
Exact Formulas for the Generalized Sum-of-Divisors Functions Maxie D. Schmidt School of Mathematics Georgia Institute of Technology Atlanta, GA 30332 USA [email protected] [email protected] Abstract We prove new exact formulas for the generalized sum-of-divisors functions, σα(x) := dα. The formulas for σ (x) when α C is fixed and x 1 involves a finite sum d x α ∈ ≥ over| all of the prime factors n x and terms involving the r-order harmonic number P ≤ sequences and the Ramanujan sums cd(x). The generalized harmonic number sequences correspond to the partial sums of the Riemann zeta function when r > 1 and are related to the generalized Bernoulli numbers when r 0 is integer-valued. ≤ A key part of our new expansions of the Lambert series generating functions for the generalized divisor functions is formed by taking logarithmic derivatives of the cyclotomic polynomials, Φ (q), which completely factorize the Lambert series terms (1 qn) 1 into n − − irreducible polynomials in q. We focus on the computational aspects of these exact ex- pressions, including their interplay with experimental mathematics, and comparisons of the new formulas for σα(n) and the summatory functions n x σα(n). ≤ 2010 Mathematics Subject Classification: Primary 30B50; SecondaryP 11N64, 11B83. Keywords: Divisor function; sum-of-divisors function; Lambert series; cyclotomic polynomial. Revised: April 23, 2019 arXiv:1705.03488v5 [math.NT] 19 Apr 2019 1 Introduction 1.1 Lambert series generating functions We begin our search for interesting formulas for the generalized sum-of-divisors functions, σα(n) for α C, by expanding the partial sums of the Lambert series which generate these functions in the∈ form of [5, 17.10] [13, 27.7] § § nαqn L (q) := = σ (m)qm, q < 1.