Attacking a Binary GLS Elliptic Curve with Magma

Abstract

In this paper we present a complete Magma implementation for solving the discrete logarithm problem (DLP) on a binary GLS curve defined over the field $\mathbb {F}_{2^{62}}$. For this purpose, we constructed a curve vulnerable against the gGHS Weil descent attack and adapted the algorithm proposed by Enge and Gaudry to solve the DLP on the Jacobian of a genus-32 hyperelliptic curve. Furthermore, we describe a mechanism to check whether a randomly selected binary GLS curve is vulnerable against the gGHS attack. Such method works with all curves defined over binary fields and can be applied to each element of the isogeny class.

A Analyzing the Enge-Gaudry Algorithm Balance

In this Section, we analyzed the balance between the relations collection and the linear algebra phases of the dynamic-base Enge-Gaudry algorithm over a Jacobian of a hyperelliptic curve of genus 45 defined over $\mathbb {F}_{2^2}$. The subgroup of interest is of size $r = 2934347646102267239451433$ of approximately 81.27 bits.

After performing the theoretical balancing computations presented in Sect. 6, we saw that our factor base should be composed by irreducible polynomials of degree up to $m = [5,8]$. For that reason, we used this range as a reference for our factor base limit selection. The results are presented below (Table 6).

Table 6. Details of different Enge-Gaudry algorithm settings

Compared with the example in Sect. 6, we had a large number of factors per relation. As a result, more irreducible polynomials were added to the factor base and consequently, the relations collection phase became more costly. In addition, the ratios $\alpha / \beta$ were greater than the ones presented in the genus-32 example (see Table 5).

Fig. 3.

Timings for the Enge-Gaudry algorithm with dynamic factor base

The most efficient configuration ($d = 10$) was unbalanced, the relations collection was about 36 times slower than the linear algebra phase. However, the genus-45 example provided a more balanced Enge-Gaudry algorithm, since the best setting for the genus-32 curve was unbalanced by a factor of 253. One possible reason is that, here, each linear algebra steps computed over operands of about 81 bits, which are $2^{30}$ bigger than the operands processed in the genus-32 linear algebra steps.

We expect that, for curves with larger genus, with respectively larger subgroups, a fully balanced configuration can be found. The results for each setting in the 45-genus example is shown in Fig. 3.

Fig. 4.

The ratio of the matrix columns (polynomials in the factor base) and rows (valid relations) per time. The relation collections phase ends when the ratio is equal to one.

In Fig. 4, we show the progression of the ratio $\dfrac{\text {number of valid relations}}{\text {factor base size}}$ during the relations collection phase. Similarly to the genus-32, for bigger d values, the rate of the factor base growth stalled the progress of the relations collection algorithm. Again, one potential solution to this issue is to impose limits on the factor base size.

The challenge for obtaining an optimal relations collection phase is to find a balance between the average timing per relation and the factor base growth rate. The goal is to have a graph which, after the initial vertical rise, directs toward the ratio one as a linear function, such as the $d = 8, 10$ cases.