In C. Fieker and D.R. Kohel, editors, Algorithmic Number Theory: 5th International Sym- posium, ANTS-V, Sydney, Australia, July 7-12, 2002. Proceedings, volume 2369 of Lecture Notes in Computer Science, pages 431–445. Springer Berlin / Heidelberg, July 2002. The Function Field Sieve is quite special Antoine Joux1 and Reynald Lercier2 1 DCSSI Crypto Lab, 51, Bd de Latour Maubourg F-75700 Paris 07 SP, France [email protected] 2 CELAR, Route de Laillé F-35570 Bruz, France [email protected] Abstract. In this paper, we describe improvements to the function field sieve (FFS) for the discrete logarithm problem in Fpn , when p is small. Our main contribution is a new way to build the algebraic function fields needed in the algorithm. With this new construction, the heuristic complexity is as good as the complexity of the construction proposed by Adleman and Huang [2], i.e Lpn [1/3, c] = n 1 n 2 1 exp((c + o(1)) log(p ) 3 log(log(p )) 3 ) where c = (32/9) 3 . With either of these constructions the FFS becomes an equivalent of the special number field sieve used to factor integers of the form AN ±B. From an asymptotic point of view, this is faster than older algorithm such as Coppersmith’s algorithm and Adleman’s original FFS. From a practical viewpoint, we argue that our construction has better properties than the construction of Adleman and Huang. We demonstrate the efficiency of the algorithm by successfully computing discrete logarithms in a large finite field of characteristic two, namely F2521 . 1 Introduction Due to their cryptographic significances, the integer factorization problem and the discrete logarithm problem in finite fields have been extensively studied in the last decades. The best methods currently known to solve these problems are index calculus techniques. In the field of integer factorization, the number field sieve (NFS) [15] having surpassed its ancestor, the quadratic sieve [24], is now the faster of the known factoring algorithm. It exists in two flavors, the general number field sieve which can factor any integer and the special number field sieve which is useful for numbers of a special form: many integers of the form AN ± B were factored using the special number field sieve. The latest example is the factorization of 2773 + 1 at CWI [21]. For the computation of discrete logarithms in prime fields, the situation is similar. The quadratic sieve has an analog called the gaussian integer method [6, 13]. Similarly a variant of the number field sieve [23] can be used for computing discrete logarithms. Furthermore, as for factorization, we can distinguish between the general number field sieve and the special number field sieve. For example a computation of discrete logarithms modulo p = (739 · 7149 − 736)/3 can be found in [27]. In this paper, we address the case of discrete logarithm computations in Fpn , when p is small. The best known practical method for the typical case p = 2 is due to Coppersmith [5]. It was used in 1992 by Gordon and McCurley [11] to compute discrete logarithms in F2401 . In the same paper, the sieving part of the discrete logarithm computation for F2503 was also reported. More recently, the sieving part of a discrete logarithm computation in F2607 using Coppersmith’s method has been performed [25]. The linear algebra step of this computation has been finished very recently [26]. From a more theoretical viewpoint, there exists an analog of the general number field sieve called the function field sieve (FFS), which is not restricted to p = 2 [1, 2]. From a practical viewpoint, only Coppersmith’s algorithm was considered by now in the characteristic two case [7]. Adleman and Huang [2] showed that the asymptotics of the function field sieve can be largely im- proved. In fact, with these improvements the function field sieve becomes an equivalent of the special number field sieve. In this paper, we propose a different method that achieves the same complexity. Moreover, in most cases, our method is faster. As a consequence, both the asymptotic complexity and the practical implementation turn out to be better than in older works. We finally illustrate this result by a computation in F2521 . 1 2 2 Algorithmic considerations The function field sieve was introduced in [1] for computing discrete logarithms in Fpn with small values of p. It is quite similar to the number field sieve and it has a complexity of the same order Lpn [1/3]. However, there are some crucial differences that allow large improvements. Most notably, a field such as Fpn can be represented in many different ways. In Coppersmith’s algorithm [5], as in the work of Adleman and Huang [2], the key idea was to select a “small representation” of the finite field, more precisely, this is done by selecting a polynomial λ(t) of degree as low as possible, such that tn − λ(t) is irreducible. Once λ(t) is chosen, it is possible to find two good polynomials having a common root in this field. Clearly, these two constructions focus on a small subset of the possible representations of Fpn . In this paper, we propose a construction that allows a much larger varieties of possible representations. This extra degree of freedom reduces the task of choosing good polynomials at the beginning of the function field sieve algorithm. It turns out that this method keeps the good complexity proved by Adleman and Huang (cf. section 3). Moreover, the selected polynomials are somewhat better. In term of the asymptotic complexity, this is hidden in the o(1), however this yields a significant decrease of the practical run times. In this section, we mostly focus on our new polynomial selection phase. As a foreword, let us recall that the method we use to compute discrete logarithms in a field Fpn is derived from the well known Pollig–Hellman method. The first step is to factor pn − 1. For any small factor ` of pn − 1, discrete logarithms modulo ` can be found using the Pollard Rho method. For the remaining prime factors ` of pn −1, we use the index-calculus method described here. Finally, we combine the results thanks to the Chinese Remainder Theorem in order to get a result modulo pn − 1. Therefore, in the sequel, we will assume that we are computing discrete logarithms modulo a large prime factor ` of pn − 1. This is not an issue since computing the prime factors of pn − 1 can be done with the special number field sieve with a complexity of the same order Lpn [1/3]. 2.1 Representation of Fpn One classical way to work with Fpn consists in handling equivalence classes in the quotient of the com- mutative ring Fp[t] by one of its proper maximal ideals f(t)Fp[t] where f(t) is an irreducible element of Fp[t] of degree n. Each equivalence class is then uniquely determined by a polynomial of Fp[t] of degree strictly smaller than n. Consequently, any element of Fpn can be seen as a polynomial of degree smaller than n. With such a representation, adding two elements of Fpn is the same as adding two elements of Fp[t]. Multiplying two elements of Fpn is the same as multiplying two elements of Fp[t] and reducing the result modulo f(t). Since there are numerous irreducible elements of degree n in Fp[t], there are numerous ways to represent Fpn . The computation of the map between two representations consists in computing the roots over one representation of Fpn of a polynomial of degree n whose coefficients are in Fp. From an algorithmic viewpoint, this is known as the “equal degree factorization” problem. This can be done quite efficiently since there exists algorithms for this task whose complexity is polynomial in log pn (a good survey can be found in [16]). As a consequence, if some particular representation of Fpn is well suited to discrete logarithm computations, it is a simple matter to switch from a given representation to the more adapted one. In the sequel, we take that step for granted and forget about the given initial representation. 2.2 General principle of the FFS The Function Field Sieve algorithm is an “index-calculus” method. So it can be seen at a high level of abstraction as a two steps algorithm. Step 1: One fixes a subset S = {γ1, . , γ|S|} of Fpn ' Fp[t] called the factor base and tries to collect relations between products of elements of S. So, we have equations of the form X logx γ = 0 (1) (,γ)∈Z×S 3 where x is a generator of the multiplicative subgroup of order ` in Fpn . When enough such relations are collected, one obtains the quantities logx γ via the inversion modulo ` of the corresponding linear system. Step 2: To find the discrete logarithm of an element y which is not in S, one tries random integers ν until xν y is a product of elements of S. Then X logx y = −ν + logx γ mod `. (2) (,γ)∈Z×S The way how the factor base S is chosen is specific to each variation. In the original Function Field Sieve as described by Adleman, the factor base is the image by a morphism φ in Fpn of the generators of two sets Sα and Sβ. The set Sα is a set of Fp-rational principal places in the rational function field Fp(t). The set Sβ is a set of Fp-rational principal places defined in an algebraic function field. Once a random polynomial µ(t) ∈ Fp[t] has been chosen, this function field is defined by an absolutely 0 Pd Pd i j irreducible bivariate polynomial H(t, X) = i=0 j=0 hi,jX t such that H(t, µ(t)) = 0 mod f(t).