Extended Tower Number Field Sieve: A New Complexity for the Medium Prime Case? Taechan Kim1 and Razvan Barbulescu2 1 NTT Secure Platform Laboratories, Japan
[email protected] 2 CNRS, Univ Paris 6, Univ Paris 7, France
[email protected] Abstract. We introduce a new variant of the number field sieve algo- rithm for discrete logarithms in Fpn called exTNFS. The most important modification is done in the polynomial selection step, which determines the cost of the whole algorithm: if one knows how to select good polynomials to tackle discrete logarithms in Fpκ , exTNFS allows to use this method when tackling Fpηκ whenever gcd(η; κ) = 1. This simple fact has consequences on the asymptotic complexity of NFS in the medium prime case, where the p3 p3 n complexity is reduced from LQ(1=3; 96=9) to LQ(1=3; 48=9), Q = p , respectively from LQ(1=3; 2:15) to LQ(1=3; 1:71) if multiple number fields are used. On the practical side, exTNFS can be used when n = 6 and n = 12 and this requires to updating the keysizes used for the associated pairing-based cryptosystems. Keywords: Discrete Logarithm Problem; Number Field Sieve; Finite Fields; Cryptanalysis 1 Introduction The discrete logarithm problem (DLP) is at the foundation of a series of public key cryptosystems. Over a generic group of cardinality N, thep best known algorithm to solve the DLP has an exponential running time of O( N). However, if the group has a special structure one can design better algorithms, as is the case for the multiplicative group of finite fields FQ = Fpn where the DLP can be solved much more efficiently than in the exponential time.