## On the Discrete Logarithm Problem on Algebraic Tori (2005)

### Cached

### Download Links

- [homes.esat.kuleuven.be]
- [homes.esat.kuleuven.ac.be]
- [www.iacr.org]
- [homes.esat.kuleuven.be]
- DBLP

### Other Repositories/Bibliography

Venue: | In Advances in Cryptology (CRYPTO 2005), Springer LNCS 3621, 66–85 |

Citations: | 10 - 3 self |

### BibTeX

@INPROCEEDINGS{Granger05onthe,

author = {R. Granger and F. Vercauteren},

title = {On the Discrete Logarithm Problem on Algebraic Tori},

booktitle = {In Advances in Cryptology (CRYPTO 2005), Springer LNCS 3621, 66–85},

year = {2005},

pages = {66--85},

publisher = {Springer}

}

### OpenURL

### Abstract

Abstract. Using a recent idea of Gaudry and exploiting rational representations of algebraic tori, we present an index calculus type algorithm for solving the discrete logarithm problem that works directly in these groups. Using a prototype implementation, we obtain practical upper bounds for the difficulty of solving the DLP in the tori T2(Fpm)and T6(Fpm) for various p and m. Our results do not affect the security of the cryptosystems LUC, XTR, or CEILIDH over prime fields. However, the practical efficiency of our method against other methods needs further examining, for certain choices of p and m in regions of cryptographic interest. 1

### Citations

2714 | New directions in cryptography, in
- Diffie, Hellman
(Show Context)
Citation Context ...ds further examining, for certain choices of p and m in regions of cryptographic interest. 1 Introduction The first instantiation of public key cryptography, the Diffie-Hellman key agreement protocol =-=[5]-=-, was based on the assumption that discrete logarithms in finite fields are hard to compute. Since then, the discrete logarithm problem (DLP) has been used in a variety of cryptographic protocols, suc... |

2467 | S.: Handbook of Applied Cryptography
- Menezes, Oorschot, et al.
- 1996
(Show Context)
Citation Context ...oper subfield. Lacking any knowledge to the contrary, the security of this cryptosystem has been based on two assumptions: firstly, the group G should be large enough such that square root algorithms =-=[18]-=- are infeasible and secondly, the minimal finite field in which G embeds should be large enough to thwart index calculus type attacks [18]. In these attacks one does not make any use of the particular... |

1113 |
A public key cryptosystem and a signature scheme based on discrete logarithms
- ElGamal
- 1985
(Show Context)
Citation Context ... finite fields are hard to compute. Since then, the discrete logarithm problem (DLP) has been used in a variety of cryptographic protocols, such as the signature and encryption schemes due to ElGamal =-=[6]-=- and its variants. During the 1980’s, these schemes were formulated in the full multiplicative group of a finite field Fp. To speed-up exponentiation and obtain shorter signatures, Schnorr [24] propos... |

583 |
Efficient Signature Generation by Smart Cards
- Schnorr
- 1991
(Show Context)
Citation Context ...ElGamal [6] and its variants. During the 1980’s, these schemes were formulated in the full multiplicative group of a finite field Fp. To speed-up exponentiation and obtain shorter signatures, Schnorr =-=[24]-=- proposed to work in a small prime order subgroup of the multiplicative group F × p of a prime finite field. Most modern DLP-based cryptosystems, such as the Digital Signature Algorithm (DSA) [9], fol... |

248 | A New Efficient Algorithm for Computing Gröbner Basis without Reduction to Zero: F5
- Faugère
- 2002
(Show Context)
Citation Context ... nor the numbers of terms. To determine the properties of these systems of equations we computed the Gröbner basis w.r.t. the lexicographic ordering using the Magma implementation of the F4-algorithm =-=[7]-=- and concluded the following: – The ideal generated by the system non-linear equations is zero-dimensional, which implies that there is only a finite number of candidates for the σi. – After homogeniz... |

201 |
A subexponential algorithm for discrete logarithms over all finite fields
- Adleman, DeMarrais
- 1993
(Show Context)
Citation Context ...r certain very specific combinations of q and m, for example when m! ≈ q, the algorithms run in expected time Lqm(1/2, c), which is comparable to the index calculus algorithm by Adleman and DeMarrais =-=[1]-=-. However, our focus will be on parameter ranges of practical cryptographic interest rather than asymptotic results. A complexity analysis and prototype implementation of these algorithms, show that t... |

100 | New explicit conditions of elliptic curve traces for fr-reduction,” IEICE transactions on fundamentals of electronics, communications and computer sciences
- Miyaji, Takano
- 2001
(Show Context)
Citation Context ...ay also be exploited by the cryptanalyst. In practice, the DLP in T2 and T6 are most important, since they determine the security of the cryptosystems LUC [25], XTR [16], CEILIDH [22], and MNT curves =-=[19]-=-. We stress that when defined over prime fields Fp, the security of these cryptosystems is not affected by our algorithm. Over extension fields however, this is not always the case. In this paper, we ... |

87 | Discrete logarithms in finite fields and their cryptographic significance
- Odlyzko
(Show Context)
Citation Context ...degrees. This has led some researchers to suspect that such fields may be cryptographically weak. For instance, in 1984 Odlyzko stated that fields with a composite extension degree ‘may be very weak’ =-=[21]-=-. The main result of this paper shows that these concerns may indeed be valid. A naive attempt to exploit the available subfield structure of extension fields in solving discrete logarithms, naturally... |

80 | The XTR public key system
- Lenstra, Verheul
- 2000
(Show Context)
Citation Context ...y use of the particular form of the minimal surrounding finite field, i.e., Fpn, but only its size and the size of the subgroup of cryptographic interest. More recent proposals, such as LUC [25], XTR =-=[16]-=- and CEILIDH [22], improve upon Schnorr’s and Lenstra’s idea, the latter two working in a subgroup G ⊂ F × q6 with |G| | Φ6(q) = q2 − q + 1, where q is a prime power. Brouwer, Pellikaan and Verheul [2... |

72 | Solving large sparse linear systems over finite fields
- LaMacchia, Odlyzko
- 1991
(Show Context)
Citation Context ... · (m 3 + m 2 log q)) . operations in Fq. Since in each row of the final relations matrix there will be O(m) non-zero elements, we conclude that finding a kernel vector using sparse matrix techniques =-=[13]-=- requires O(mq 2 ) operations in Z/(q m + 1)Z or about O(m 3 q 2 ) operations in Fq. This proves the following theorem. Theorem 1. The expected running time of the T2-algorithm to compute DLOGs in T2(... |

54 |
A theoretical basis for the reduction of polynomials to canonical forms
- Buchberger
- 1976
(Show Context)
Citation Context ... represent each point. The torus T2 is one-dimensional, rational, and has the following equivalent affine representation: T2(Fqm) = where O is the point at infinity. � z − γ z + γ : z ∈ Fq m � ∪ {O}, =-=(3)-=- Here a point g = g0 + g1γ ∈ T2(Fqm) in the Fq2m representation has a corresponding representation as given above by the rational function z = −(1 + g0)/g1 if g1 �= 0, whilst the elements −1 and 1 map... |

52 | A double large prime variation for small genus Hyper Elliptic index calculus”, Cryptology ePrint Archive, Report 2004/153, 2004. Available at http://eprint.iacr.org/ AUTHORS P. Vijayakumar is currently working as Assistant Professor (Sr.) in School Electr
- Gaudry, Thome
(Show Context)
Citation Context ...by reducing the size of the decomposition base, the complexity may be reduced to O(q 2−2/m ) for q → ∞ using the results of Thériault [26], and a refinement reported independently by Gaudry and Thomé =-=[11]-=- and Nagao [20]. The expected running time of the T2-algorithm is minimal when the relation stage and the linear algebra stage take comparable time, i.e. when m! · q · (m 3 + m 2 log q) � m 3 q 2 or m... |

48 |
Résolution des systèmes d'équations algébriques
- Lazard
- 1981
(Show Context)
Citation Context ... – After homogenizing the system of equations, we concluded that there is only a finite number of solutions at infinity. This property is quite important, since we can then use an algorithm by Lazard =-=[14]-=- with proven complexity. – The Gröbner basis w.r.t. the lexicographic ordering satisfies the so called Shape Lemma, i.e. the basis has the following structure: σ1 − g1(σ2m), σ2 − g2(σ2m), . . . , σ2m−... |

44 | Index calculus attack for hyperelliptic curves of small genus - Thériault - 2003 |

39 |
A public-key cryptosystem and a digital signature system based on the Lucas function analogue to discrete Logarithms
- Smith, Skinner
- 2004
(Show Context)
Citation Context ...ot make any use of the particular form of the minimal surrounding finite field, i.e., Fpn, but only its size and the size of the subgroup of cryptographic interest. More recent proposals, such as LUC =-=[25]-=-, XTR [16] and CEILIDH [22], improve upon Schnorr’s and Lenstra’s idea, the latter two working in a subgroup G ⊂ F × q6 with |G| | Φ6(q) = q2 − q + 1, where q is a prime power. Brouwer, Pellikaan and ... |

27 | Doing more with fewer bits
- Brouwer, Pellikaan, et al.
- 1999
(Show Context)
Citation Context ...6] and CEILIDH [22], improve upon Schnorr’s and Lenstra’s idea, the latter two working in a subgroup G ⊂ F × q6 with |G| | Φ6(q) = q2 − q + 1, where q is a prime power. Brouwer, Pellikaan and Verheul =-=[2]-=- were the first to give a cryptographic application of effectively representing elements in G using only two Fq-elements, instead of six, effectively reducing the communication cost by a factor of thr... |

27 |
186 digital signature standard
- FIPS
- 1994
(Show Context)
Citation Context ...orr [24] proposed to work in a small prime order subgroup of the multiplicative group F × p of a prime finite field. Most modern DLP-based cryptosystems, such as the Digital Signature Algorithm (DSA) =-=[9]-=-, follow Schnorr’s idea. Lenstra [15] showed that by working in a prime order subgroup G of F × p m, for extensions that admit an optimal normal basis, one can obtain a further ⋆ The work described in... |

26 | Torus-based cryptography
- Rubin, Silverberg
(Show Context)
Citation Context ...icular form of the minimal surrounding finite field, i.e., Fpn, but only its size and the size of the subgroup of cryptographic interest. More recent proposals, such as LUC [25], XTR [16] and CEILIDH =-=[22]-=-, improve upon Schnorr’s and Lenstra’s idea, the latter two working in a subgroup G ⊂ F × q6 with |G| | Φ6(q) = q2 − q + 1, where q is a prime power. Brouwer, Pellikaan and Verheul [2] were the first ... |

22 |
Using cyclotomic polynomials to construct efficient discrete logarithm cryptosystems over finite fields
- Lenstra
- 1997
(Show Context)
Citation Context ... prime order subgroup of the multiplicative group F × p of a prime finite field. Most modern DLP-based cryptosystems, such as the Digital Signature Algorithm (DSA) [9], follow Schnorr’s idea. Lenstra =-=[15]-=- showed that by working in a prime order subgroup G of F × p m, for extensions that admit an optimal normal basis, one can obtain a further ⋆ The work described in this paper has been supported in par... |

21 | Index calculus for abelian varieties and the elliptic curve discrete logarithm problem. Cryptology ePrint Archive, Report 2004/073. Available from http://eprint.iacr.org/2004/073
- Gaudry
(Show Context)
Citation Context ...Fq) and consequently show that the hardness of the DLP can depend on the form of the minimal surrounding finite field. The algorithm is based on the purely algebraic index calculus approach by Gaudry =-=[10]-=- and exploits the compact representation of elements of rational tori. The very existence of such an algorithm shows that the lower communication cost offered by these tori, may also be exploited by t... |

13 | Using primitive subgroups to do more with fewer bits - Rubin, Silverberg |

12 | On the discrete logarithm problem in elliptic curves II. 2011. http://www.math.uni-leipzig.de/ ~diem/preprints/dlp-ell-curves-II.pdf
- Diem
(Show Context)
Citation Context ...techniques in this paper can be made fully practical and optimized, then they may weaken the security of practical systems based on T30. In the near future we wish to investigate the approach by Diem =-=[4]-=-, who allows a larger decomposition base when necessary. The disadvantage of this approach is that it destroys the symmetric nature of the polynomials defining the decomposition of a random element ov... |

11 | Improvement of Thériault algorithm of index calculus for Jacobian of hyperelliptic curves of small genus. Cryptology ePrint Archive, Report 2004/161. Available from http://eprint.iacr.org/2004/161
- Nagao
(Show Context)
Citation Context ... size of the decomposition base, the complexity may be reduced to O(q 2−2/m ) for q → ∞ using the results of Thériault [26], and a refinement reported independently by Gaudry and Thomé [11] and Nagao =-=[20]-=-. The expected running time of the T2-algorithm is minimal when the relation stage and the linear algebra stage take comparable time, i.e. when m! · q · (m 3 + m 2 log q) � m 3 q 2 or m! � q. The comp... |

11 | Asymptotically optimal communication for torusbased cryptography - Dijk, Woodruff |

8 | Practical cryptography in high dimensional tori
- Dijk, Granger, et al.
(Show Context)
Citation Context ...lways the case. In this paper, we provide a detailed description of our algorithm for T2(Fqm) and T6(Fqm). Note that this includes precisely the systems presented in [17], and also those described in =-=[28, 27]-=- via the inclusion of Tn(Fp) in T2(Fpn/2) and T6(Fpn/6) when n is divisible by two or six, respectively, which for efficiency reasons is always the case. Our method is fully exponential for fixed m an... |

7 | A comparison of CEILIDH and XTR - Granger, Page, et al. - 2004 |

6 |
XTR extended to GF(p 6m
- Lim, Kim, et al.
(Show Context)
Citation Context ...ement over the existing attacks on LUC [25], XTR [16], CEILIDH [22] or MNT curves [19] as long as these systems are defined over Fp. However, the security of XTR over extension fields, as proposed in =-=[17]-=- or of the recent proposal that works in T30(Fp) [27], needs to be reassessed as shown below. 17sPollard-Rho in a subgroup of prime order � 2 160 As for the T2-algorithm, the third column of Table 2 c... |