DISCRETE LOGARITHMS Elliptic Curve Cryptography December 2019 - - PowerPoint PPT Presentation

DISCRETE LOGARITHMS

IN QUASI-POLYNOMIAL TIME

IN FINITE FIELDS OF SMALL CHARACTERISTIC

Benjamin Wesolowski

ECC 2019: 23rd Workshop on Elliptic Curve Cryptography December 2019 Bochum, Germany

Based on a joint work with

Thorsten Kleinjung

RIGOROUS OR HEURISTIC

If it seems to work, is it good enough?

RIGOROUS ALGORITHMS FOR DLP

Discrete logarithm problem (DLP) in finite fields of fixed characteristic (𝔾pn with p fixed and n → ∞… think 𝔾2n):

• Given a generator g of 𝔾pn and an arbitrary element h, find an

integer m such that h = gm

➡ Pomerance (1987) proved complexity Lpn(1/2) ➡ We prove it can be done in quasi-polynomial time

×

Lpn(α) = eO((log pn)α (log log pn)1 – α) quasi-poly(log pn) = e (log log pn)O(1)

nO(1)

= e

log(n)O(1)

= e For constant p:

RIGOROUS ALGORITHMS FOR DLP

Discrete logarithm problem (DLP) in finite fields of fixed characteristic (𝔾pn with p fixed and n → ∞… think 𝔾2n):

• Given a generator g of 𝔾pn and an arbitrary element h, find an

integer m such that h = gm

➡ Pomerance (1987) proved complexity Lpn(1/2) ➡ We prove it can be done in quasi-polynomial time

Theorem: Given any prime number p and any positive integer n, the discrete logarithm problem in the group 𝔾pn can be solved in expected time (pn)

× ×

2log2(n) + O(1)

TIMELINE

1968 MILLER, WESTERN NO COMPLEXITY 1976 DIFFIE, HELLMAN BEST KNOWN O(Q1/2) 1979 ADLEMAN L(1/2) IN LARGE CHAR. 1982 HELLMAN, REYNERI L(1/2) 1984 COPPERSMITH L(1/3) 1987 POMERANCE L(1/2) 2013 JOUX L(1/4) 2013 BARBULESCU, GAUDRY, JOUX, THOME QUASI-POLY 2014 GRANGER, KLEINJUNG, ZUMBRAGEL QUASI-POLY 1922 KRAIT CHIK NO COMPLEXITY

... ...

2019 THIS WORK (KLEINJUNG, W.) QUASI-POLY

A RIGOROUS ALGORITHM

Finely crafted and analysed by Pomerance in 1987

AN INDEX CALCULUS ALGORITHM

• 𝔾pn = 𝔾p[x]/(J), generator g ∊ 𝔾pn
• Factor base 𝔊 = { f ∊ 𝔾p[x] | deg(f) ≤ B, monic, irred.} ∪ {g}
• Index calculus:

➡ Relation collection: collect relations of the form ➡ Linear algebra: the relations form a linear system with

unknowns logg f. Solve it, recover the values logg f

➡ Individual logarithm: given h ∊ 𝔾pn, compute logg h

∑ ef logg f = r (mod pn – 1)

f ∊ 𝔊

×

INDEX CALCULUS FROM DESCENT

• Descent: given h ∊ 𝔾pn find integers ef, for f in 𝔊, such that

➡ Relation collection: generate random r ∊ [1, pn – 1], ➡ Individual logarithm: given h,

descent(h)

{

h = ∏ f ef

f ∊ 𝔊

r = logg(descent(gr)) = ∑ ef logg f

f ∊ 𝔊

logg h = logg(descent(h)) = ∑ ef logg f

f ∊ 𝔊

×

SUMMARY

EFFICIENT DESCENT ALGORITHM EFFICIENT ALGORITHM FOR COMPUTING LOGARITHMS P O M E R A N C E : T H E R E I S A D E S C E N T O F C O M P L E X I T Y L ( 1 / 2 ) S O O N E C A N S O L V E D L P I N T I M E L ( 1 / 2 )

A ZIGZAG DESCENT

Descending one step at a time

A HEURISTIC QUASI-POLYNOMIAL ALGORITHM

Theorem (Granger, Kleinjung, Zumbrägel): the DLP in fixed characteristic can be solved in expected quasi-poly. time in fields that admit a suitable representation

• Suitable representation? Field 𝔾q4[x]/(J) where J is an

irreducible polynomial in 𝔾q4[x] such that with h0 and h1 polynomials in 𝔾q4[x] of degree at most 2

• Expected time qlog2(deg(J))

xq ≡ h0/h1 mod J

A DESCENT IS SUFFICIENT

A descent algorithm is sufficient

• Fix the factor base 𝔊 = { linear polynomials in 𝔾q4[x] }
• Descent: Given any polynomial Q in 𝔾q4[x] find integers ef, for f

in 𝔊, such that

• Main ingredient of the descent, degree 2 to 1 elimination:

given a degree 2 polynomial over an extension k of 𝔾q4, rewrite it as a product of degree 1 polynomials over k

Q ≡ ∏ f ef mod J.

f ∊ 𝔊

The zigzag descent: transform the degree 2 to 1 elimination into a full descent algorithm

ZIGZAG DESCENT

2

Factorisation into quadratics over 𝔾qd2e – 1

1

D e g r e e 2 t

• 1

e l i m i n a t i

• n

2

Norm

1 2 1 1 2

𝔾q4 𝔾q8 𝔾q4·2e – 1 𝔾q4·2e – 2

2 2 2 2

2e

The zigzag descent: transform the degree 2 to 1 elimination into a full descent algorithm

ZIGZAG DESCENT

2

Factorisation into quadratics over 𝔾qd2e – 1

1

D e g r e e 2 t

• 1

e l i m i n a t i

• n

2

Norm

1 2 1 1 2

𝔾q4

2e

Rewrite as irreducible

• f degree 2e

D

Q in 𝔾q4[x]

• f degree D

𝔾q8 𝔾q4·2e – 1 𝔾q4·2e – 2

2 2 2 2

SUMMARY

DEGREE 2 TO 1 ELIMINATION EFFICIENT ALGORITHM FOR COMPUTING LOGARITHMS DESCENT ALGORITHM

GKZ’S DEGREE 2 TO 1 ELIMINATION

A building block

POLYNOMIALS WITH HIGHER SPLITTING PROBABILITY

Fix an extension k of 𝔾q4, and let Q an irred. quadratic in k[x]

• Key idea (from [GGMZ13]): polynomials of the form

have a high probability to split over k (around q–3)

• Let V be the vector space of dimension 4 of these polynomials,

i.e., V = span(xq + 1, xq, x, 1) ⊂ k[x]

αxq + 1 + βxq + γx + δ in k[x]

Göloğlu, Granger, McGuire, and Zumbrägel. On the function field sieve and the impact of higher splitting probabilities. CRYPTO 2013.

• V = span(xq + 1, xq, x, 1) ⊂ k[x]
• We have xq ≡ h0/h1 mod J, so
• Consider the vector subspace VQ of dimension 2 in V, where Q

divides the right-hand side:

SMOOTH RELATIONS

αxh0 + βh0 + γxh1 + δh1 αxq + 1 + βxq + γx + δ ≡ mod J h1 Splits with high probability n u m e r a t

• r
• f

d e g r e e 3

VQ = {αxq + 1 + βxq + γx + δ | αxh0 + βh0 + γxh1 + δh1 ≡ 0 mod Q}

THE DEGREE 2 TO 1 ELIMINATION

• For any f = αxq + 1 + βxq + γx + δ in VQ,
• The quotient L0 = (αxh0 + βh0 + γxh1 + δh1)/Q is linear
• If f splits into linears L1,…,Lq + 1 in k[x], then
• Algorithm: choose random f ∊ VQ until it splits over k

h1f ≡ αxh0 + βh0 + γxh1 + δh1 mod J Q ≡ h1 L0 L1 … Lq + 1 mod J

–1

h1f ≡ L0Q mod J

SUMMARY

DEGREE 2 TO 1 ELIMINATION ALGORITHM FOR COMPUTING DISCRETE LOGARITHMS DESCENT ALGORITHM D O N E , A S S U M I N G W E H A V E A S U I T A B L E M O D E L F O R T H E F I E L D !

ELLIPTIC CURVE MODEL

A convenient model for the finite field

HEURISTIC MODEL

• Model 𝔾q4[x]/(J) used in heuristic algorithms
• Good: the relation xq ≡ h0/h1, i.e., the Frobenius is congruent

to a small degree rational map

• Bad: we cannot prove this model always exists
• For our new rigorous algorithm: other model that always exists

and has a ‘small degree’ Frobenius?

• Construct a model for 𝔾qn where the q-Frobenius is congruent to

a small degree rational map…

• Use elliptic curves!

FINITE FIELDS FROM ELLIPTIC CURVES

FINITE FIELDS FROM ELLIPTIC CURVES

• Construct a model for 𝔾qn where the q-Frobenius is congruent to

a small degree rational map…

• Let E/𝔾q be an elliptic curve such that E(𝔾q) has a point Q of
• rder n
• Let S ∊ E such that S (q) = S + Q. Then
• Q of order n implies (qn) is the first Frobenius fixing S
• 𝔾qn = residue field of S over 𝔾q

S (qi) = S (qi – 1) + Q = S (qi – 2) + 2Q = … = S + iQ

?

FINITE FIELDS FROM ELLIPTIC CURVES

• 𝔾qn = residue field of S over 𝔾q
• ‘Coordinate ring of E’ = 𝔾q[E] = 𝔾q[x,y] / (y2 – x3 – ax – b)
• ‘Residue field of S’ = 𝔾q[E]/∼ where

?

f ∼ g ⟺ f(S) = g(S)

FROBENIUS AS A SMALL DEGREE MAP

• Let φq : E → E : P ↦ P (q) be the q-Frobenius
• For R ∊ E let τR : E → E : P ↦ P + R be the translation by R
• For any f ∊ 𝔾q[E]/∼ = 𝔾qn, we have

"Frobenius = translation by Q"

i s t h e n e w "x

q ≡ h 0/h 1 mod J"

f ∘ φq ∼ f ∘ τQ

f ∘ φq(S) = f (S (q)) = f (S+Q) = f ∘ τQ(S)

PROVABLE MODEL

• We want to solve DLP in 𝔾qn: find E/𝔾q with a point of order n
• Theorem (Waterhouse, 1969): For any integer t coprime to q

such that |t| ≤ 2q1/2, there is an ordinary elliptic curve E/𝔾q such that |E(𝔾q)| = q + 1 − t.

• If n2 ≤ 2q1/2, there exists E/𝔾q that contains a point of order n
• To solve DLP in 𝔾pn, solve it in a small extension 𝔾qn such that

n2 ≤ 2q1/2

NEW ELIMINATIONS

Eliminations in the elliptic curve model

two points (0, y) with y2 = b

DEGREES

Fix an extension k of 𝔾q

• k(E) = k(x,y) / (y2 – x3 – ax – b)
• ‘Degree of f ∊ k(E)’ = number of solutions of f(P) = 0, P ∊ E
• x ∊ k(E) has degree 2

SPLITTING POLYNOMIALS

Fix an extension k of 𝔾q

• V = span(xq + 1, xq, x, 1) ⊂ k(E)
• Random f ∊ V splits with high probability into ‘linear factors’

L1,…,Lq + 1 defined over k

• Each Li is of the form x – a, they are of degree 2…
• No ‘degree 2 to 1’ elimination… Can we do ‘3 to 2’?
• Let D in k(E) of degree 3

A FIRST ATTEMPT…

• Let
• For any f ∊ Y(k),

has degree 4 – 3 = 1

• Suppose f = L1 … Lq+1 where each Li is linear in k[x] (so Li has

degree 2 in k(E))

• Algorithm: choose random f ∊ Y(k) until f splits over k

Y = {αxq+1 + βxq + γx + δ | α(x∘τQ)x + β(x∘τQ) + γx + δ ≡ 0 mod D} ⊂ ℙ(V)

g = (α(x∘τQ)x + β(x∘τQ) + γx + δ)/D degrees 1 and 2 D ≡ L1 … Lq+1 g –1 Warning: hand-wavy Degree 3 to degree 2 elimination??

A FIRST ATTEMPT…

• Y = ℙ(ker(V → ‘k(E)/D’))
• V has dimension 4, ‘k(E)/D’ has dimension deg(D) = 3, the

kernel is expected to have dimension 1: Y is a single point

• Bad: Y is too small, we need a curve…

Y = {αxq+1 + βxq + γx + δ | α(x∘τQ)x + β(x∘τQ) + γx + δ ≡ 0 mod D} ⊂ ℙ(V)

AN EXTRA DEGREE OF FREEDOM

Fix an extension k of 𝔾q, and let D in k(E) of degree 3

• V = span(xq + 1, xq, x, 1) ⊂ k(E)
• For any P ∊ E let
• For any f ∊ V, f ∘ τP ≡ ψP(f)

ψP : V → k(E) : 1 ↦ 1 x ↦ x ∘ τP xq ↦ x ∘ τQ+P(q) xq + 1 ↦ (x ∘ τP)(x ∘ τQ+P(q))

{

Splits with high probability into degree 2’s Degree 4

DEGREE 3 TO DEGREE 2 ELIMINATION

• For any (f, P) ∊ X(k), g = ψP(f)/D has degree 4 – 3 = 1
• Suppose f = L1 … Lq+1 where each Li is linear in k[x]
• Algorithm: choose random (f, P) ∊ X(k) until f splits over k

X = {(f,P) | ψP(f) ≡ 0 mod D} ⊂ ℙ(V) × E degrees 1 and 2 D = ψP(f) g –1 ≡ (L1 ∘ τP) … (Lq+1 ∘ τP) g –1 Warning: hand-wavy Degree 3 to degree 2 elimination

DEGREE 2 TO 1 ELIMINATION ALGORITHM FOR COMPUTING DISCRETE LOGARITHMS DESCENT ALGORITHM H E U R I S T I C ZIG-ZAG DESCENT

DEGREE 3 TO 2 ELIMINATION ALGORITHM FOR COMPUTING DISCRETE LOGARITHMS DESCENT ALGORITHM R I G O R O U S ZIG-ZAG DESCENT

DEGREE 4 TO 2 ELIMINATION ALGORITHM FOR COMPUTING DISCRETE LOGARITHMS DESCENT ALGORITHM DEGREE 3 TO 2 ELIMINATION DEGREE 4 TO 3 ELIMINATION + RIGOROUS RIGOROUS RIGOROUS! ZIG-ZAG DESCENT

PROOF STRATEGY

Irreducible covers

WHAT REMAINS TO BE PROVED?

• Algorithm: choose random (f, P) ∊ X(k) until f splits over k
• For how many (f,P) ∊ X(k) does f split over k?

IRREDUCIBLE CURVES

A CURVE IS IRREDUCIBLE IF IT IS NOT A UNION OF TWO SUB-CURVES

C1 C2

C1 AND C2 ARE BOTH IRREDUCIBLE

IRREDUCIBLE CURVES

A CURVE IS IRREDUCIBLE IF IT IS NOT A UNION OF TWO SUB-CURVES

C1 U C2

C1 AND C2 ARE BOTH IRREDUCIBLE C1 U C2 IS NOT IRREDUCIBLE

IRREDUCIBLE CURVES

A CURVE IS IRREDUCIBLE IF IT IS NOT A UNION OF TWO SUB-CURVES

C1 U C2

A CURVE IS ABSOLUTELY IRREDUCIBLE IF IT IS IRREDUCIBLE OVER THE ALGEBRAIC CLOSURE OF THE FIELD OF DEFINITION

CURVES AND MORPHISMS

• A morphism of curves is a map C → D described by

polynomials in the coordinates

• A morphism between absolutely irreducible curves is either

constant or surjective over the algebraic closure

PROOF STRATEGY

For how many (f,P) ∊ X(k) does f split over k?

• Construct a curve C defined over k, and a surjective morphism

θ : C → X such that

➡ For any point z in C(k), the polynomial in θ(z) splits over k ➡ C is absolutely irreducible

• By the absolute irreducibility, C(k) has a lot of points, therefore

a lot of polynomials in X(k) split over k H a s s e

• W

e i l b

• u

n d s : a b s

• l

u t e l y i r r e d u c i b l e c u r v e s h a v e a l

• t
• f

r a t i

• n

a l p

• i

n t s

Method from: Kleinjung, Wesolowski. A new perspective on the powers of two descent for discrete logarithms in finite fields. ANTS–XIII, 2018.

OPEN QUESTIONS

A DETERMINISTIC ALGORITHM? A P O L Y N O M I A L T I M E A L G O R I T H M ?

IS SMALL-CHAR-DLP IN P?

MEDIUM AND LARGE CHARACTERISTIC?

DISCRETE LOGARITHMS

IN QUASI-POLYNOMIAL TIME

IN FINITE FIELDS OF SMALL CHARACTERISTIC

Benjamin Wesolowski

ECC 2019: 23rd Workshop on Elliptic Curve Cryptography December 2019 Bochum, Germany

Based on a joint work with

Thorsten Kleinjung