Discrete Logarithm Computation in Finite Fields Fpn with NFS Variants

Discrete logarithm computation in ﬁnite ﬁelds Fpn with NFS variants and consequences in pairing-based cryptography

Aurore Guillevic

Inria Nancy, Caramba team

01/03/2019 Séminaire de cryptographie, Rennes Joint work with Shashank Singh, IISER Bhopal, India

1/34 Asymmetric cryptography

Factorization (RSA cryptosystem)

Discrete logarithm problem (use in Diﬃe-Hellman, etc) Given a ﬁnite cyclic group (G, ·), a generator g and h ∈ G, compute x s.t. h = g x . → can invert the exponentiation function (g, x) 7→ g x ? Common choice of G:

I prime finite field Fp = Z/pZ (1976) I characteristic 2 field F2n I elliptic curve E(Fp) (1985)

2/34 → Choose G of large prime order (no subgroup) √ → complexity of inverting exponentiation in O( #G) √ → security level 128 bits means #G ≥ 2128 analogy with symmetric crypto, keylength 128 bits (16 bytes)

Discrete log problem

3/34 Discrete log problem

How fast can you invert the exponentiation function (g, x) 7→ g x ? I g ∈ G generator, ∃ always a preimage x ∈ {1,..., #G} I naive search, try them all: #G tests I random walk in G, cycle path ﬁnding algorithm in√ a connected graph Floyd → Pollard, baby-step-giant-step, O( #G) (the cycle path encodes the answer) I parallel search in each distinct subgroup (Pohlig-Hellman) I algorithmic reﬁnements → Choose G of large prime order (no subgroup) √ → complexity of inverting exponentiation in O( #G) √ → security level 128 bits means #G ≥ 2128 analogy with symmetric crypto, keylength 128 bits (16 bytes)

3/34 better way? → Use additional structure of G.

Discrete log problem

How fast can you invert the exponentiation function (g, x) 7→ g x ? √ G cyclic group of prime order, complexity O( #G).

4/34 → Use additional structure of G.

Discrete log problem

How fast can you invert the exponentiation function (g, x) 7→ g x ? √ G cyclic group of prime order, complexity O( #G).

better way?

4/34 Discrete log problem

How fast can you invert the exponentiation function (g, x) 7→ g x ? √ G cyclic group of prime order, complexity O( #G).

better way? → Use additional structure of G.

4/34 Discrete log problem when G = (Z/pZ)∗

Index calculus algorithm, prequel of the Number Field Sieve algorithm (NFS) ∗ I p prime, (p − 1)/2 prime, G = (Z/pZ) , gen. g, target h I get many multiplicative relations in G t e1 e2 ei g = g1 g2 ··· gi (mod p), g, g1, g2,..., gi ∈ G 0 0 0 e1 e2 ei I ﬁnd a relation h = g1 g2 ··· gi (mod p) I take logarithm: linear relations t = e1 logg g1 + e2 logg g2 + ... + ei logg gi (mod p − 1) . . 0 0 0 logg h = e1 logg g1 + e2 logg g2 + ... + ei logg gi (mod p − 1) I solve a linear system

I get x = logg h

5/34 Index calculus in (Z/pZ)∗: example

p = 1019 prime, g = 2, p − 1 = 2 × 509 prime

2909 = 90 = 2 · 32 · 5 1 2 1 909 10     2 = 5 = 5 0 0 1  10  848 3 →  ·~x =   mod 1018 2 = 135 = 3 · 5 0 3 1 848 2960 = 12 = 22 · 3 2 1 0 960

Linear system solving mod 2, mod 509, Chinese remainder th.: log2 2 = 1, log2 3 = 958, log2 5 = 10.

Target h = 314 g 372h = 24 · 52 mod p log2 h = 4 + 2 · 10 − 372 mod 1018 = 670 from [15], F. Morain

6/34 Improvements in the 80’s, 90’s:

I Multiplicative relations in number ﬁelds I Relation collection to get small integers to factor I Better sparse linear algebra I Independent target h

Index calculus in (Z/pZ)∗: example

Trick Multiplicative relations over the integers g1, g2,..., gi ←→ small prime integers

7/34 Index calculus in (Z/pZ)∗: example

Trick Multiplicative relations over the integers g1, g2,..., gi ←→ small prime integers Improvements in the 80’s, 90’s:

I Multiplicative relations in number ﬁelds I Relation collection to get small integers to factor I Better sparse linear algebra I Independent target h

7/34 Coppersmith–Odlyzko–Schroeppel 1986: Z[i]

Idea: enumerate in a clever way the relations reduce the size of the integers to factor If p = 1 mod 4, ∃ A s.t. A2 = −1 mod p. √ Let U/V ≡ A mod p and |U|, |V | < p (p = U2 + V 2).

algebraic side rational side f = x 2 + 1 g = Vx + U f (U/V ) = 0 mod p g(U/V ) = 0 mod p a + bi ∈ Z[i] aV + bU ∈ Z factor in Z[i] factor in Z → factor Norm(a − bi) in Z

2 2 √ integer a + b > 2 max(a, b) integer > 2 max(a, b) p √ Enumerate enough (a, b) pairs s.t. |a|, |b| p

8/34 Example in Z[i]

p = 1109 = 1 mod 4, r = (p − 1)/4 = 277 prime p = 222 + 252 max(|a|, |b|) = A = 20, B = 13 smoothness bound

Fr = {2, 3, 5, 7, 11, 13} primes up to B

Algebraic side: i2 = −1, (1 + i)(1 − i) = 2, (2 + i)(2 − i) = 5, (2 + 3i)(2 − 3i) = 13

Fa = {−1, i} ∪ {1 + i, 1 − i, 2 + i, 2 − i, 2 + 3i, 2 − 3i} “primes” of norm up to B

9/34 Example in Z[i]

2 2 a + bi a + b factor in Z[i] aV + bU factor in Z −17 + 19i 650= 2 · 52 · 13 −(1 − i)(2 + i)2(2 − 3i) −7 −7 −11 + 2i 125= 53 i(2 + i)3 −231 −3 · 7 · 11 −6 + 17i 325= 52 · 13 (2 + i)2(2 + 3i) 224 25 · 7 −4 + 7i 65= 5 · 13 i(2 − i)(2 + 3i) 54 2 · 33 −3 + 4i 25= 52 −(2 − i)2 13 13 −2 + i 5= 5 −(2 − i) −28 −22 · 7 −2 + 3i 13= 13 −(2 − 3i) 16 24 −2 + 11i 125= 53 −(2 − i)3 192 26 · 3 −1 + i 2= 2 −(1 − i) −3 −3 i 1= 1 i 22 2 · 11 1 + 3i 10= 2 · 5 (1 + i)(2 + i) 91 7 · 13 1 + 5i 26= 2 · 13 −(1 − i)(2 − 3i) 135 33 · 5 2 + i 5= 5 (2 + i) 72 23 · 32 5 + i 26= 2 · 13 −i(1 + i)(2 + 3i) 147 3 · 72

10/34 Example in Z[i]

−1 i (1 + i)(1 − i)(2 + i)(2 − i)(2 + 3i)(2 − 3i) 2 3 5 7 11 13 1/V  120000000000000     000120010001001     110030000101101     000020105001001     010001101300001       100002000000011     000001002001001    M =  100000014000001     100003006100001       000100000100001     010000001000101     001010000001011     100100010310001       000010003200001  111000100102001

11/34 Example in Z[i]

Right kernel mod (p − 1)/4 = 277: v = (0, 0, 1, 1, 168, 189, 136, 125, 275, 116, 197, 209, 119, 16, 160) Virtual logarithms

Target 314, generator g = 2 g 2 · 314 = 147 = 3 · 72 logg 314 = (logv 3 + 2 logv 7 − 2 logv 2)/ logv 2 = 8 mod (p − 1)/4 g 8/314 = 354, 354 = 23(p−1)/4 of order 4, 2839 = 314 mod p

logg 314 = 839

12/34 Number Field Sieve today

polynomial linear rel. collect. descent selection as sieving algebra h, g

p log db x

precomputation individual log

slide N. Heninger

13/34 Latest DL record computation: 768-bit Fp

Kleinjung, Diem, A. Lenstra, Priplata, Stahlke, Eurocrypt’2017. p = b2766 × πc + 62762 prime, 768 bits, 232 decimal digits, p =

1219344858334286932696341909195796109526657386154251328029 2736561757668709803065055845773891258608267152015472257940 7293588325886803643328721799472154219914818284150580043314 8410869683590659346847659519108393837414567892730579162319

(p − 1)/2 prime f (x)=140x 4 + 34x 3 + 86x 2 + 5x − 55 g(x)=370863403886416141150505523919527677231932618184100095924x 3 −1937981312833038778565617469829395544065255938015920309679x 2 −217583293626947899787577441128333027617541095004734736415x +277260730400349522890422618473498148528706115003337935150 12 Enumerate (∼ 10 ) all f (x) s.t. |fi | 6 165 1/4 By construction, |gi | ≈ p

14/34 Latest DL record computation: 768-bit Fp

gcd(f , g) = 1 in Q[x] ∃ root m s.t. f (m) = g(m) = 0 (mod p), m =

4290295629231970357488936064013995423387122927373167219112 8794979019508571426956110520280493413148710512618823586632 1484497413188392653246206774027756646444183240629650904112 110269916261074281303302883725258878464313312196475775222

32 Multiplicative relations: for all |ai | ≤ A ≈ 2 , gcd(a0, a1) = 1

I factors Normf = Resultant(f , a0 + a1x) ≈ 130 bits, 39 dd I factors Normg = Resultant(g, a0 + a1x) ≈ 290 bits, 87 dd Linear algebra: square sparse matrix of 23.5 · 106 rows Total time: 5300 core-years on Intel Xeon E5-2660 2.2GHz

15/34 Complexity and key-sizes for cryptography

[Lenstra-Verheul’01] gives RSA key-sizes Security estimates use I asymptotic complexity of the best known algorithm (here NFS) I latest record computation (now 768-bit) I extrapolation

16/34 Complexity

Subexponential asymptotic complexity:

(c+o(1))(log pn)α(log log pn)1−α Lpn (α, c) = e

I α = 1: exponential I α = 0: polynomial I 0 < α < 1: sub-exponential (including NFS) 1. polynomial selection (precomp., 5% to 10% of total time)

2. relation collection Lpn (1/3, c)

3. linear algebra Lpn (1/3, c) 0 4. individual discrete log computation Lpn (1/3, c < c)

17/34 0 8.2 68.32 LN (1/3, 1.923)/2 (DL-768 ↔ 2 ) 0 14 67 LN (1/3, 1.923)/2 (RSA-768 ↔ 2 ) log2 cost 192 176 160 144 128 112 96 80 64 1024 2048 3072 4096 5120 6144 7168 8192

log2 p

18/34 Why ﬁnite ﬁelds in 2019?

because old crypto in Fp is still in use cpx = Lp(1/3, 1.923) since 1993: very-well known because of pairings: Fpn since 2000

Key length

I keylength.com I France: ANSSI RGS B RSA modulus and prime ﬁelds for DL: 3072 to 3200 bits sub-exponential complexity to invert DL in Fp

Elliptic curves: over prime ﬁeld of 256 bits (much smaller) exponential cpx. to invert DL in E(Fp)

19/34 Key length

I keylength.com I France: ANSSI RGS B RSA modulus and prime ﬁelds for DL: 3072 to 3200 bits sub-exponential complexity to invert DL in Fp

Elliptic curves: over prime ﬁeld of 256 bits (much smaller) exponential cpx. to invert DL in E(Fp)

Why ﬁnite ﬁelds in 2019?

because old crypto in Fp is still in use cpx = Lp(1/3, 1.923) since 1993: very-well known because of pairings: Fpn since 2000

19/34 Cryptographic pairing: black-box properties

(G1, +), (G2, +), (GT , ·) three cyclic groups of large prime order r Bilinear Pairing: map e : G1 × G2 → GT

1. bilinear: e(P1 + P2, Q) = e(P1, Q) · e(P2, Q), e(P, Q1 + Q2) = e(P, Q1) · e(P, Q2)

2. non-degenerate: e(g1, g2) 6= 1 for hg1i = G1, hg2i = G2 3. eﬃciently computable. Mostly used in practice:

e([a]P, [b]Q) = e([b]P, [a]Q) = e(P, Q)ab .

; Many applications in asymmetric cryptography.

20/34 Examples of application

I 1984: idea of identity-based encryption formalized by Shamir I 1999: ﬁrst practical identity-based cryptosystem of Sakai-Ohgishi-Kasahara I 2000: constructive pairings, Joux’s tri-partite key-exchange I 2001: IBE of Boneh-Franklin, short signatures Boneh-Lynn-Shacham Rely on I Discrete Log Problem (DLP): given g, h ∈ G, compute x s.t. g x = h Diﬃe-Hellman Problem (DHP) I bilinear DLP and DHP Given G1, G2, GT , g1, g2, gT and h ∈ GT , compute P ∈ G1 s.t. e(P, g2) = h, or Q ∈ G2 s.t. e(g1, Q) = h x x x x if gT = h then e(g1 , g2) = e(g1, g2 ) = gT = h I pairing inversion problem

21/34 Examples of application

Pairings are bilinear maps satisfying DH-like assumptions, and provide I Identity-based encryption (IBE) I Broadcast encryption with eﬃcient key distribution and rekeying I signatures I (short) signatures (Boneh–Lynn–Shacham) I aggregate signatures I zero-knowledge (ZK) proofs I non-interactive ZK proofs (NIZK) I ZK-SNARK (Z-cash) Multilinear maps are not as eﬃcient as elliptic pairings yet.

22/34 I inversion of e : hard problem (exponential) discrete logarithm computation in E( ) : hard problem I √ Fp (exponential, in O( r)) ∗ I discrete logarithm computation in Fpn : easier, subexponential → take a large enough ﬁeld

Attacks

Pairing-based cryptography