## On the bounded sum-of-digits discrete logarithm problem in finite fields (2004)

### Cached

### Download Links

- [cr.yp.to]
- [www.cs.ou.edu]
- [www.iacr.org]
- [www.iacr.org]
- [arxiv.org]
- DBLP

### Other Repositories/Bibliography

Venue: | In Proc. of the 24th Annual International Cryptology Conference (CRYPTO |

Citations: | 4 - 1 self |

### BibTeX

@INPROCEEDINGS{Cheng04onthe,

author = {Qi Cheng},

title = {On the bounded sum-of-digits discrete logarithm problem in finite fields},

booktitle = {In Proc. of the 24th Annual International Cryptology Conference (CRYPTO},

year = {2004},

pages = {201--212},

publisher = {Springer-Verlag}

}

### OpenURL

### Abstract

Abstract. In this paper, we study the bounded sum-of-digits discrete logarithm problem in finite fields. Our results concern primarily with fields Fqn where n|q − 1. The fields are called Kummer extensions of Fq. It is known that we can efficiently construct an element g with order greater than 2 n in the fields. Let Sq(•) be the function from integers to the sum of digits in their q-ary expansions. We first present an algorithm that given g e (0 ≤ e < q n) finds e in random polynomial time, provided that Sq(e) < n. We then show that the problem is solvable in random polynomial time for most of the exponent e with Sq(e) < 1.32n, by exploring an interesting connection between the discrete logarithm problem and the problem of list decoding of Reed-Solomon codes, and applying the Guruswami-Sudan algorithm. As a side result, we obtain a sharper lower bound on the number of congruent polynomials generated by linear factors than the one based on Stothers-Mason ABC-theorem. We also prove that in the field Fqq−1, the bounded sum-of-digits discrete logarithm with respect to g can be computed in random time O(f(w) log 4 (q q−1)), where f is a subexponential function and w is the bound on the q-ary sum-of-digits of the exponent, hence the problem is fixed parameter tractable. These results are shown to be generalized to Artin-Schreier extension Fpp where p is a prime. Since every finite field has an extension of reasonable degree which is a Kummer extension, our result reveals an unexpected property of the discrete logarithm problem, namely, the bounded sum-of-digits discrete logarithm problem in any given finite field becomes polynomial time solvable in certain low degree extensions. 1

### Citations

871 | Parametrized Complexity
- Downey, Fellows
- 1999
(Show Context)
Citation Context ...tz [10], where they consider the prime finite fields and the bounded Hamming weight exponents. Their problem is listed among the most important open problems in the theory of parameterized complexity =-=[9]-=-. From the above discussions, it is certainly more relevant to cryptography to treat the finite fields with small characteristic and exponents with bounded sum-of-digits. Unlike the case of the intege... |

247 | Improved decoding of Reed-Solomon and Algebraic-Geometric codes
- Guruswami, Sudan
- 1999
(Show Context)
Citation Context ... of the list decoding problem of Reed-Solomon codes. It turns out that there are only a few of such polynomials, and they can be found efficiently as long as k ≥ √ nd. Proposition 1. (Guruswami-Sudan =-=[12]-=- ) Given n distinct elements x0, x1, · · · , xn−1 ∈ Fq, n values y0, y1, · · · , yn−1 ∈ Fq and a natural number d, there are at most O( √ n 3 d) many univariate polynomials t(x) ∈ Fq[x] of degree at m... |

48 |
An Implementatin for a Fast Public-Key Cryptosystem
- Agnew, Mullin, et al.
- 1991
(Show Context)
Citation Context ...lar, in the cryptosystem based on the discrete logarithm problem in finite fields of small characteristic, using small sum-of-digits exponents is very attractive, due to the existence of normal bases =-=[1]-=-. It is proposed and implemented for smart cards and mobile devices, where the computing power is severely limited. Although attacks exploring the specialty were proposed [14], none of them have polyn... |

28 | Discrete logarithms: the past and the future
- Odlyzko
(Show Context)
Citation Context ...ator g of a subgroup of F ∗ qn and g′ in the subgroup. The general purpose algorithms to solve the discrete logarithm problem are the number field sieve and the function field sieve (for a survey see =-=[13]-=-). They have time complexity exp(c(log q n ) 1/3 (log log q n ) 2/3 ) for some constant c, when q is small, or n is small. Suppose we want to compute the discrete logarithm of ge with respect to base ... |

23 | Some baby-step giant-step algorithms for the low hamming weight discrete logarithm problem
- Stinson
(Show Context)
Citation Context ...existence of normal bases [1]. It is proposed and implemented for smart cards and mobile devices, where the computing power is severely limited. Although attacks exploring the specialty were proposed =-=[14]-=-, none of them have polynomial time complexity. Let Fqn be a finite field. For β ∈ Fqn, if β, βq , βq2 , · · · , βqn−1 form a linear basis of Fq n over Fq, we call them a normal basis. It is known tha... |

18 | Proving primality in essentially quartic random time
- Bernstein
(Show Context)
Citation Context ...oncluding Remarks A novel idea in the celebrated AKS primality testing algorithm, is to construct a subgroup of large cardinality through linear elements in finite fields. The subsequent improvements =-=[6, 7, 4]-=- rely on constructing a single element of large order. It is speculated that these ideas will be useful in attacking the integer factorization problem. In this paper, we show that they do affect the d... |

14 | Fixed-Parameter Complexity and Cryptography
- Fellows, Koblitz
- 1993
(Show Context)
Citation Context ...ime f(w) log c (qn ) and solves the discrete logarithm problem in Fqn, for some function f and a constant c? A similar problem has been raised from the parametric point of view by Fellows and Koblitz =-=[10]-=-, where they consider the prime finite fields and the bounded Hamming weight exponents. Their problem is listed among the most important open problems in the theory of parameterized complexity [9]. Fr... |

9 | Normal bases over finite fields - Gao - 1993 |

9 |
On some subgroups of the multiplicative group of finite rings
- Voloch
(Show Context)
Citation Context ...{(e1, e2, · · · , en)| � ei < n − 1, ei ≥ 0}, then all the polynomials are in different congruent classes. This gives a lower bound of 4 n . Through a clever use of Stothers-Mason ABC-theorem, Voloch =-=[15]-=- and Berstein [5] proved that if � ei < 1.1n, then at most 4 such polynomials can fall in the same congruent class, hence obtained a lower bound of 4.27689 n . We improve their result and obtain a low... |

6 |
zur Gathen. Efficient exponentiation in finite fields (extended abstract
- von
- 1991
(Show Context)
Citation Context ...hiftings and at most Sq(e) many of multiplications. Furthermore, the exponentiation algorithm can be parallelized, which is a property not enjoyed by the large characteristic fields. For details, see =-=[16]-=-. 1.1 Related Work The discrete logarithm problem in finite field Fqn, is to compute an integer e such that g ′ = ge , given a generator g of a subgroup of F ∗ qn and g′ in the subgroup. The general p... |

5 |
Sharpening ”Primes is in P” for a large family of numbers. http://arxiv.org/abs/math.NT/0211334
- Berrizbeitia
- 2002
(Show Context)
Citation Context ...oncluding Remarks A novel idea in the celebrated AKS primality testing algorithm, is to construct a subgroup of large cardinality through linear elements in finite fields. The subsequent improvements =-=[6, 7, 4]-=- rely on constructing a single element of large order. It is speculated that these ideas will be useful in attacking the integer factorization problem. In this paper, we show that they do affect the d... |

5 | Primality proving via one round in ECPP and one iteration in AKS
- Cheng
- 2003
(Show Context)
Citation Context ...oncluding Remarks A novel idea in the celebrated AKS primality testing algorithm, is to construct a subgroup of large cardinality through linear elements in finite fields. The subsequent improvements =-=[6, 7, 4]-=- rely on constructing a single element of large order. It is speculated that these ideas will be useful in attacking the integer factorization problem. In this paper, we show that they do affect the d... |

4 |
Constructing finite field extensions with large order elements
- Cheng
- 2004
(Show Context)
Citation Context ...ow on we assume the model Fq[x]/(x n − a).sConsider the subgroup generated by g = α + b in (Fq[x]/(xn − a)) ∗ , recall that b ∈ F ∗ q and α = x (mod xn − a). The generator g has order greater than 2n =-=[8]-=-, and has a very nice property as follows. Denote a q−1 n by h, we have and more generally g q = (α + b) q = α q + b = a q−1 n α + b = hα + b, (α + b) qi = α qi + b = h i α + b. In other words, we obt... |

3 |
Sharper ABC-based bounds for congruent polynomials
- Bernstein
(Show Context)
Citation Context ...en)| � ei < n − 1, ei ≥ 0}, then all the polynomials are in different congruent classes. This gives a lower bound of 4 n . Through a clever use of Stothers-Mason ABC-theorem, Voloch [15] and Berstein =-=[5]-=- proved that if � ei < 1.1n, then at most 4 such polynomials can fall in the same congruent class, hence obtained a lower bound of 4.27689 n . We improve their result and obtain a lower bound of 5.177... |

2 |
Algorithmic Number theory, volume I
- Bach, Shallit
- 1996
(Show Context)
Citation Context ... to do is to factor u(y) over Fq[x]/(x n − a), and to evaluate v(y) at one of the roots. Factoring polynomials over finite fields is a well-studied problem in computational number theory, we refer to =-=[3]-=- for a complete survey of results. The random algorithm runs in expected time O(dn(dn + log q n )(dn log q n ) 2 ), and the deterministic algorithm runs in time O(dn(dn + q)(dn log q n ) 2 ). From now... |