Discrete Logarithm Computation in Finite Fields Fpn with NFS Variants

Discrete Logarithm Computation in Finite Fields Fpn with NFS Variants

Discrete logarithm computation in finite fields Fpn with NFS variants and consequences in pairing-based cryptography Aurore Guillevic Inria Nancy, Caramba team 01/03/2019 Séminaire de cryptographie, Rennes Joint work with Shashank Singh, IISER Bhopal, India 1/34 Asymmetric cryptography Factorization (RSA cryptosystem) Discrete logarithm problem (use in Diffie-Hellman, etc) Given a finite cyclic group (G, ·), a generator g and h ∈ G, compute x s.t. h = g x . → can invert the exponentiation function (g, x) 7→ g x ? Common choice of G: I prime finite field Fp = Z/pZ (1976) I characteristic 2 field F2n I elliptic curve E(Fp) (1985) 2/34 → Choose G of large prime order (no subgroup) √ → complexity of inverting exponentiation in O( #G) √ → security level 128 bits means #G ≥ 2128 analogy with symmetric crypto, keylength 128 bits (16 bytes) Discrete log problem How fast can you invert the exponentiation function (g, x) 7→ g x ? I g ∈ G generator, ∃ always a preimage x ∈ {1,..., #G} I naive search, try them all: #G tests I random walk in G, cycle path finding algorithm in√ a connected graph Floyd → Pollard, baby-step-giant-step, O( #G) (the cycle path encodes the answer) I parallel search in each distinct subgroup (Pohlig-Hellman) I algorithmic refinements 3/34 Discrete log problem How fast can you invert the exponentiation function (g, x) 7→ g x ? I g ∈ G generator, ∃ always a preimage x ∈ {1,..., #G} I naive search, try them all: #G tests I random walk in G, cycle path finding algorithm in√ a connected graph Floyd → Pollard, baby-step-giant-step, O( #G) (the cycle path encodes the answer) I parallel search in each distinct subgroup (Pohlig-Hellman) I algorithmic refinements → Choose G of large prime order (no subgroup) √ → complexity of inverting exponentiation in O( #G) √ → security level 128 bits means #G ≥ 2128 analogy with symmetric crypto, keylength 128 bits (16 bytes) 3/34 better way? → Use additional structure of G. Discrete log problem How fast can you invert the exponentiation function (g, x) 7→ g x ? √ G cyclic group of prime order, complexity O( #G). 4/34 → Use additional structure of G. Discrete log problem How fast can you invert the exponentiation function (g, x) 7→ g x ? √ G cyclic group of prime order, complexity O( #G). better way? 4/34 Discrete log problem How fast can you invert the exponentiation function (g, x) 7→ g x ? √ G cyclic group of prime order, complexity O( #G). better way? → Use additional structure of G. 4/34 Discrete log problem when G = (Z/pZ)∗ Index calculus algorithm, prequel of the Number Field Sieve algorithm (NFS) ∗ I p prime, (p − 1)/2 prime, G = (Z/pZ) , gen. g, target h I get many multiplicative relations in G t e1 e2 ei g = g1 g2 ··· gi (mod p), g, g1, g2,..., gi ∈ G 0 0 0 e1 e2 ei I find a relation h = g1 g2 ··· gi (mod p) I take logarithm: linear relations t = e1 logg g1 + e2 logg g2 + ... + ei logg gi (mod p − 1) . 0 0 0 logg h = e1 logg g1 + e2 logg g2 + ... + ei logg gi (mod p − 1) I solve a linear system I get x = logg h 5/34 Index calculus in (Z/pZ)∗: example p = 1019 prime, g = 2, p − 1 = 2 × 509 prime 2909 = 90 = 2 · 32 · 5 1 2 1 909 10 2 = 5 = 5 0 0 1 10 848 3 → ·~x = mod 1018 2 = 135 = 3 · 5 0 3 1 848 2960 = 12 = 22 · 3 2 1 0 960 Linear system solving mod 2, mod 509, Chinese remainder th.: log2 2 = 1, log2 3 = 958, log2 5 = 10. Target h = 314 g 372h = 24 · 52 mod p log2 h = 4 + 2 · 10 − 372 mod 1018 = 670 from [15], F. Morain 6/34 Improvements in the 80’s, 90’s: I Multiplicative relations in number fields I Relation collection to get small integers to factor I Better sparse linear algebra I Independent target h Index calculus in (Z/pZ)∗: example Trick Multiplicative relations over the integers g1, g2,..., gi ←→ small prime integers 7/34 Index calculus in (Z/pZ)∗: example Trick Multiplicative relations over the integers g1, g2,..., gi ←→ small prime integers Improvements in the 80’s, 90’s: I Multiplicative relations in number fields I Relation collection to get small integers to factor I Better sparse linear algebra I Independent target h 7/34 Coppersmith–Odlyzko–Schroeppel 1986: Z[i] Idea: enumerate in a clever way the relations reduce the size of the integers to factor If p = 1 mod 4, ∃ A s.t. A2 = −1 mod p. √ Let U/V ≡ A mod p and |U|, |V | < p (p = U2 + V 2). algebraic side rational side f = x 2 + 1 g = Vx + U f (U/V ) = 0 mod p g(U/V ) = 0 mod p a + bi ∈ Z[i] aV + bU ∈ Z factor in Z[i] factor in Z → factor Norm(a − bi) in Z 2 2 √ integer a + b > 2 max(a, b) integer > 2 max(a, b) p √ Enumerate enough (a, b) pairs s.t. |a|, |b| p 8/34 Example in Z[i] p = 1109 = 1 mod 4, r = (p − 1)/4 = 277 prime p = 222 + 252 max(|a|, |b|) = A = 20, B = 13 smoothness bound Fr = {2, 3, 5, 7, 11, 13} primes up to B Algebraic side: i2 = −1, (1 + i)(1 − i) = 2, (2 + i)(2 − i) = 5, (2 + 3i)(2 − 3i) = 13 Fa = {−1, i} ∪ {1 + i, 1 − i, 2 + i, 2 − i, 2 + 3i, 2 − 3i} “primes” of norm up to B 9/34 Example in Z[i] 2 2 a + bi a + b factor in Z[i] aV + bU factor in Z −17 + 19i 650= 2 · 52 · 13 −(1 − i)(2 + i)2(2 − 3i) −7 −7 −11 + 2i 125= 53 i(2 + i)3 −231 −3 · 7 · 11 −6 + 17i 325= 52 · 13 (2 + i)2(2 + 3i) 224 25 · 7 −4 + 7i 65= 5 · 13 i(2 − i)(2 + 3i) 54 2 · 33 −3 + 4i 25= 52 −(2 − i)2 13 13 −2 + i 5= 5 −(2 − i) −28 −22 · 7 −2 + 3i 13= 13 −(2 − 3i) 16 24 −2 + 11i 125= 53 −(2 − i)3 192 26 · 3 −1 + i 2= 2 −(1 − i) −3 −3 i 1= 1 i 22 2 · 11 1 + 3i 10= 2 · 5 (1 + i)(2 + i) 91 7 · 13 1 + 5i 26= 2 · 13 −(1 − i)(2 − 3i) 135 33 · 5 2 + i 5= 5 (2 + i) 72 23 · 32 5 + i 26= 2 · 13 −i(1 + i)(2 + 3i) 147 3 · 72 10/34 Example in Z[i] −1 i (1 + i)(1 − i)(2 + i)(2 − i)(2 + 3i)(2 − 3i) 2 3 5 7 11 13 1/V 120000000000000 000120010001001 110030000101101 000020105001001 010001101300001 100002000000011 000001002001001 M = 100000014000001 100003006100001 000100000100001 010000001000101 001010000001011 100100010310001 000010003200001 111000100102001 11/34 Example in Z[i] Right kernel mod (p − 1)/4 = 277: v = (0, 0, 1, 1, 168, 189, 136, 125, 275, 116, 197, 209, 119, 16, 160) Virtual logarithms Target 314, generator g = 2 g 2 · 314 = 147 = 3 · 72 logg 314 = (logv 3 + 2 logv 7 − 2 logv 2)/ logv 2 = 8 mod (p − 1)/4 g 8/314 = 354, 354 = 23(p−1)/4 of order 4, 2839 = 314 mod p logg 314 = 839 12/34 Number Field Sieve today polynomial linear rel. collect. descent selection as sieving algebra h, g p log db x precomputation individual log slide N. Heninger 13/34 Latest DL record computation: 768-bit Fp Kleinjung, Diem, A. Lenstra, Priplata, Stahlke, Eurocrypt’2017. p = b2766 × πc + 62762 prime, 768 bits, 232 decimal digits, p = 1219344858334286932696341909195796109526657386154251328029 2736561757668709803065055845773891258608267152015472257940 7293588325886803643328721799472154219914818284150580043314 8410869683590659346847659519108393837414567892730579162319 (p − 1)/2 prime f (x)=140x 4 + 34x 3 + 86x 2 + 5x − 55 g(x)=370863403886416141150505523919527677231932618184100095924x 3 −1937981312833038778565617469829395544065255938015920309679x 2 −217583293626947899787577441128333027617541095004734736415x +277260730400349522890422618473498148528706115003337935150 12 Enumerate (∼ 10 ) all f (x) s.t. |fi | 6 165 1/4 By construction, |gi | ≈ p 14/34 Latest DL record computation: 768-bit Fp gcd(f , g) = 1 in Q[x] ∃ root m s.t. f (m) = g(m) = 0 (mod p), m = 4290295629231970357488936064013995423387122927373167219112 8794979019508571426956110520280493413148710512618823586632 1484497413188392653246206774027756646444183240629650904112 110269916261074281303302883725258878464313312196475775222 32 Multiplicative relations: for all |ai | ≤ A ≈ 2 , gcd(a0, a1) = 1 I factors Normf = Resultant(f , a0 + a1x) ≈ 130 bits, 39 dd I factors Normg = Resultant(g, a0 + a1x) ≈ 290 bits, 87 dd Linear algebra: square sparse matrix of 23.5 · 106 rows Total time: 5300 core-years on Intel Xeon E5-2660 2.2GHz 15/34 Complexity and key-sizes for cryptography [Lenstra-Verheul’01] gives RSA key-sizes Security estimates use I asymptotic complexity of the best known algorithm (here NFS) I latest record computation (now 768-bit) I extrapolation 16/34 Complexity Subexponential asymptotic complexity: (c+o(1))(log pn)α(log log pn)1−α Lpn (α, c) = e I α = 1: exponential I α = 0: polynomial I 0 < α < 1: sub-exponential (including NFS) 1. polynomial selection (precomp., 5% to 10% of total time) 2. relation collection Lpn (1/3, c) 3. linear algebra Lpn (1/3, c) 0 4. individual discrete log computation Lpn (1/3, c < c) 17/34 0 8.2 68.32 LN (1/3, 1.923)/2 (DL-768 ↔ 2 ) 0 14 67 LN (1/3, 1.923)/2 (RSA-768 ↔ 2 ) log2 cost 192 176 160 144 128 112 96 80 64 1024 2048 3072 4096 5120 6144 7168 8192 log2 p 18/34 Why finite fields in 2019? because old crypto in Fp is still in use cpx = Lp(1/3, 1.923) since 1993: very-well known because of pairings: Fpn since 2000 Key length I keylength.com I France: ANSSI RGS B RSA modulus and prime fields for DL: 3072 to 3200 bits sub-exponential complexity to invert DL in Fp Elliptic curves: over prime field of 256 bits (much smaller) exponential cpx.

View Full Text

Details

  • File Type
    pdf
  • Upload Time
    -
  • Content Languages
    English
  • Upload User
    Anonymous/Not logged-in
  • File Pages
    51 Page
  • File Size
    -

Download

Channel Download Status
Express Download Enable

Copyright

We respect the copyrights and intellectual property rights of all users. All uploaded documents are either original works of the uploader or authorized works of the rightful owners.

  • Not to be reproduced or distributed without explicit permission.
  • Not used for commercial purposes outside of approved use cases.
  • Not used to infringe on the rights of the original creators.
  • If you believe any content infringes your copyright, please contact us immediately.

Support

For help with questions, suggestions, or problems, please contact us