## Discrete logarithms in gf(p) using the number field sieve (1993)

Venue: | SIAM J. Discrete Math |

Citations: | 67 - 1 self |

### BibTeX

@ARTICLE{Gordon93discretelogarithms,

author = {Daniel M. Gordon},

title = {Discrete logarithms in gf(p) using the number field sieve},

journal = {SIAM J. Discrete Math},

year = {1993},

volume = {6},

pages = {124--138}

}

### Years of Citing Articles

### OpenURL

### Abstract

Recently, several algorithms using number field sieves have been given to factor a number n in heuristic expected time Ln[1/3; c], where Ln[v; c] = exp{(c + o(1))(log n) v (log log n) 1−v}, for n → ∞. In this paper we present an algorithm to solve the discrete logarithm problem for GF (p) with heuristic expected running time Lp[1/3; 3 2/3]. For numbers of a special form, there is an asymptotically slower but more practical version of the algorithm.

### Citations

739 | Factoring polynomials with rational coefficients
- LENSTRA, LENSTRA, et al.
- 1982
(Show Context)
Citation Context ...inant of f. If this happens for a particular m, we may choose a different m, or alter f by adding m to some ai and subtracting 1 from ai+1. The irreducibility of the new f may be checked quickly; see =-=[15]-=-. Note that ∆f = (−1) k(k−1)/2R(f, f ′ ) may be calculated efficiently. R(f, g) here denotes the resultant of f and g. Let α ∈ C denote a root of f, K = Q(α), and OK denote the ring of integers in K. ... |

309 |
Approximate formulas for some functions of prime numbers
- Rosser, Schoenfeld
- 1962
(Show Context)
Citation Context ... have � vi � ≤ E 1/2 T for each row vi of A. Thus by Hadamard’s inequality, the absolute value of the determinant of any submatrix of A is at most (E 1/2 T ) T . From results of Rosser and Schoenfeld =-=[22]-=-, it follows that the number of distinct prime factors of any such non-zero determinant is less than 2T . However, from the same reference, the number π(ET log T ) of primes q ≤ ET log T exceeds ET/3.... |

244 |
On Lov~z' lattice reduction and the nearest lattice point problem
- BABAI
- 1986
(Show Context)
Citation Context ...ourse, existence is not enough. For the algorithm, we shall need to find such a nontrivial relation. This can be done using an application of the Lenstra, Lenstra, Lovász (LLL) algorithm due to Babai =-=[2]-=-. For a lattice L, let λ(L) be the length of the shortest nonzero vector in L. Theorem 4 Let b1, . . . , bn be vectors in Z n with Euclidean length less than N, and let L denote the lattice generated ... |

244 |
Factoring integers with elliptic curves
- Lenstra
- 1987
(Show Context)
Citation Context ...m numbers of the same size. The elliptic curve method (ECM) for factoring an integer n depends on finding an elliptic curve for which the order of the curve modulo a prime divisor of n is smooth (see =-=[14]-=-). The following conjecture implies that enough such curves exist so that the ECM can expect to find one in reasonable time. Conjecture 1 Given the conditions of Theorem 1, the probability that a rand... |

185 |
Solving Sparse Linear Equations over Finite Fields
- Wiedemann
- 1986
(Show Context)
Citation Context ...t Â is nonsingular mod q0. Step 2: Attempt to express vr0+1 as a linear combination of v1, . . . , vr0 mod q for each prime q ≤ ET log T . We attempt this via Wiedemann’s coordinate recurrence method =-=[24]-=-. Let P denote the product of the primes q for which we are successful, and let P ′ denote the product of the remaining primes up to ET log T . If P ′ > (E 1/2 T ) T , then return to step 1 and begin ... |

159 | Factoring polynomials over large finite fields - Berlekamp - 1970 |

138 |
Transcendental Number Theory
- Baker
- 1975
(Show Context)
Citation Context ...algorithm ever failed because of this, we could repeat it with a lattice L ′ m where one coordinate lj is replaced by ⌈2 m lj⌉ instead of ⌊2 m lj⌋. By the Gelfond-Schneider Theorem (see, for example, =-=[3]-=-) the lattices are different, since 2 m lj cannot be an integer. Therefore no vector c which is not a root of unity with cj �= 0 could be zero in both Lm and L ′ m, and at least one lattice (say Lm) h... |

91 | Discrete Logarithms in finite fields and their cryptographic significance - Odlyzko - 1984 |

78 |
On a problem of Oppenheim concerning “factorisatio numerorum
- Canfield, Erdös, et al.
- 1983
(Show Context)
Citation Context ...gers ≤ x which are y-smooth. We need results about the probabilities of various rational and algebraic integers being smooth. The following special case of a theorem of Canfield, Erdős, and Pomerance =-=[7]-=- gives an estimate for the probability of a number in a given range being smooth. Theorem 1 Suppose 0 < w < v ≤ 1, γ > 0, and δ > 0 are fixed. Let x and y be functions of p such that x = Lp[v; γ] and ... |

74 |
On Wiedemann’s method of solving sparse linear systems
- Kaltofen, Saunders
- 1991
(Show Context)
Citation Context ...nd the entries in A are all at most T in absolute value, we need to be able to find a linear relation over Q for the rows of A. This may be done by the following algorithm, due to Pomerance [21] (see =-=[12]-=- for an alternative algorithm). Algorithm M: Let A be a (T + 1) × T matrix over Z, with each row having at most E non-zero entries, each of absolute value at most T . This probabilistic algorithm retu... |

71 | The number field sieve, The
- Lenstra, Lenstra, et al.
- 1993
(Show Context)
Citation Context ...ds described in [9], find discrete logarithms for GF (p) in expected time Lp[1/2; 1]. The idea of using number field sieves has been used recently for factoring. Lenstra, Lenstra, Manasse and Pollard =-=[16]-=- have used a number field sieve to obtain rapid factorizations of numbers of the form r e ±s, for small r and s. Buhler, Lenstra and Pomerance [6] have generalized this method to factor general number... |

39 | Odlyzko, “Computation of discrete loga- rithms in prime fields
- LaMacchia, M
- 1991
(Show Context)
Citation Context ...n used in the construction of several cryptographic systems (see for example [18]). The most successful implementation of a discrete logarithm algorithm for GF (p) to date is by Odlyzko and LaMacchia =-=[13]-=-, who solved the discrete logarithm problem modulo primes of 58 and 67 digits using the Gaussian integers method. This 1smethod, introduced by Coppersmith, Odlyzko and Schroeppel in [9], uses a comple... |

39 | Searching for primitive roots in finite fields
- Shoup
- 1992
(Show Context)
Citation Context ...lgorithm, and then test if an a ′ is a generator by checking that (a ′ ) (p−1)/q �≡ 1 (mod p) for each prime q dividing p − 1. There is no guarantee that a small generator exists, but Shoup has shown =-=[23]-=- that the Extended Riemann Hypothesis implies that there is a constant c such that for all primes p, GF (p) ∗ has a generator less than c ω(p − 1) 4 (log(ω(p − 1)) + 1) 4 log 2 p. Here ω(n) is the num... |

23 |
The discrete logarithm problem, in Cryptology and Computational
- McCurley
- 1990
(Show Context)
Citation Context ...to find an integer x (if any exists) such that a x ≡ b (mod p). (1) The difficulty of computing discrete logarithms has been used in the construction of several cryptographic systems (see for example =-=[18]-=-). The most successful implementation of a discrete logarithm algorithm for GF (p) to date is by Odlyzko and LaMacchia [13], who solved the discrete logarithm problem modulo primes of 58 and 67 digits... |

22 |
Factoring numbers using singular integers
- Adleman
- 1991
(Show Context)
Citation Context ...to obtain rapid factorizations of numbers of the form r e ±s, for small r and s. Buhler, Lenstra and Pomerance [6] have generalized this method to factor general numbers n in time Ln[1/3; c]. Adleman =-=[1]-=- and Coppersmith [8] have suggested further improvements. Some necessary facts and heuristic assumptions about algebraic number theory and linear algebra computations will be discussed in Section 2. I... |

21 |
Discrete logarithms in gf(p
- Coppersmith, Odlyzko, et al.
- 1986
(Show Context)
Citation Context ...and LaMacchia [13], who solved the discrete logarithm problem modulo primes of 58 and 67 digits using the Gaussian integers method. This 1smethod, introduced by Coppersmith, Odlyzko and Schroeppel in =-=[9]-=-, uses a complex quadratic field to aid the sieving process. Define Lx[v; c] = exp{(c + o(1))(log x) v (log log x) 1−v }, (2) for x → ∞. The Gaussian integers method, as well as several other methods ... |

20 |
rigorous factorization and discrete logarithm algorithms, in: Discrete Algorithms and Complexity
- Pomerance, Fast
- 1987
(Show Context)
Citation Context ...s a reasonable heuristic assumption that the equations will have full rank, and most discrete logarithm algorithms involve a similar assumption. An exception is the rigorous algorithm of Pomerance in =-=[20]-=-, but we have no version of his Lemma 4.1 which works in this setting. 4 Runtime Analysis We will choose two parameters to optimize the performance: the size of B will be Lp[1/3; δ], and the size of m... |

17 |
An extension of a theorem
- Filaseta, Solan
- 1999
(Show Context)
Citation Context ...an m of suitable size, and finding the base m representation of p, say p = �k i=0 aimi . Then f(x) = �k i=0 aixi satisfies f(m) = p, and is irreducible by a theorem of Brillhart, Filaseta and Odlyzko =-=[5]-=-. We also require that p does not divide ∆f , the discriminant of f. If this happens for a particular m, we may choose a different m, or alter f by adding m to some ai and subtracting 1 from ai+1. The... |

17 |
rigorous factorization and discrete logarithm algorithms
- Fast
(Show Context)
Citation Context ...s a reasonable heuristic assumption that the equations will have full rank, and most discrete logarithm algorithms involve a similar assumption. An exception is the rigorous algorithm of Pomerance in =-=[20]-=-, but we have no version of his Lemma 4.1 which works in this setting. 4 Runtime Analysis We will choose two parameters to optimize the performance: the size of B will be Lp[1/3; δ], and the size of m... |

10 | On the distribution in short intervals of integers having no large prime factor - Friedlander, Lagarias - 1987 |

5 |
Private communication
- Pomerance
- 1996
(Show Context)
Citation Context ...re S > T and the entries in A are all at most T in absolute value, we need to be able to find a linear relation over Q for the rows of A. This may be done by the following algorithm, due to Pomerance =-=[21]-=- (see [12] for an alternative algorithm). Algorithm M: Let A be a (T + 1) × T matrix over Z, with each row having at most E non-zero entries, each of absolute value at most T . This probabilistic algo... |

4 |
Factoring integers with the number field sieve, preprint
- Pomerance
(Show Context)
Citation Context ...for factoring. Lenstra, Lenstra, Manasse and Pollard [16] have used a number field sieve to obtain rapid factorizations of numbers of the form r e ±s, for small r and s. Buhler, Lenstra and Pomerance =-=[6]-=- have generalized this method to factor general numbers n in time Ln[1/3; c]. Adleman [1] and Coppersmith [8] have suggested further improvements. Some necessary facts and heuristic assumptions about ... |

4 |
On the maximal modulus of conjugates of an algebraic integer
- Dobrowolski
- 1978
(Show Context)
Citation Context ... . , log |σr1(x)|, 2 log |σr1+1(x)|, . . . , 2 log |σr(x)|). This mapping sends the units in OK into a lattice L ∈ R r , with roots of unity mapped to the origin. The following theorem of Dobrowolski =-=[10]-=- shows that other units cannot be too close to the origin. Lemma 1 Let γ be a nonzero algebraic integer in K, and denote by |γ| the maximal modulus of its conjugates. Then only if γ is a root of unity... |

1 |
Modifications to the number field sieve, preprint
- Coppersmith
(Show Context)
Citation Context ...orizations of numbers of the form r e ±s, for small r and s. Buhler, Lenstra and Pomerance [6] have generalized this method to factor general numbers n in time Ln[1/3; c]. Adleman [1] and Coppersmith =-=[8]-=- have suggested further improvements. Some necessary facts and heuristic assumptions about algebraic number theory and linear algebra computations will be discussed in Section 2. In Section 3 an overv... |

1 | A rigorous time bound for factoring integers, preprint - Pomerance |

1 |
Class numbers and units
- Zantema
- 1982
(Show Context)
Citation Context ... f, K = Q(α), and OK denote the ring of integers in K. If s is a prime number not dividing the index [OK : Z[α]], then its factorization in OK is given by the following proposition (see, for example, =-=[25]-=-). Proposition 1 For a prime number s not dividing the index, suppose f factors in GF (s)[x] as f(x) ≡ � gi(x) ei mod s, (4) i with each gi monic and irreducible mod s, and gi �≡ gj � for i �= j. Then... |