An Experiment of Number Field Sieve for Discrete Logarithm Problem over GF(p12)

  • Kenichiro Hayasaka
  • Kazumaro Aoki
  • Tetsutaro Kobayashi
  • Tsuyoshi Takagi
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8260)


The security of pairing-based cryptography is based on the hardness of the discrete logarithm problem (DLP) over finite field GF(p n ). For example, the security of the optimal Ate pairing using BN curves, which is one of the most efficient algorithms for computing paring, is based on the hardness of DLP over GF(p 12). Joux et al. proposed the number field sieve over GF(p n ) as an extension of the number field sieve that can efficiently solve the DLP over prime field GF(p). Two implementations of the number field sieve over GF(p 3) and GF(p 6) have been proposed, but there is no report on that over GF(p 12) of extension degree 12. In the sieving step of the number field sieve over GF(p) we perform the sieving of two dimensions, but we have to deal with more than two dimensions in the case of number field sieves over GF(p 12). In this paper we construct a lattice sieve of more than two dimensions, and discuss its parameter sizes such as the dimension of sieving and the size of sieving region from some experiments of the multi-dimensional sieving. Using the parameters suitable for efficient implementation of the number field sieve, we have solved the DLP over GF(p 12) of 203 bits in about 43 hours using a PC of 16 CPU cores.


pairing discrete logarithm problem number field sieve extension field lattice sieve 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Aoki, K.: Sieving region, and relationship between numbers of required relations and factor bases on the number field sieve, Technical Report of IEICE, ISEC 104(53), 23–28 (2004) (in Japanese)Google Scholar
  2. 2.
    Aoki, K., Kida, Y., Ueda, H.: A trial of GNFS implementation (Part VI): lattice sieve, Technical Report of IEICE, ISEC 104(315), 9–14 (2004) (in Japanese)Google Scholar
  3. 3.
    Aoki, K., Ueda, H., Uchiyama, S.: Evaluation report on integer factoring problems. In: Investigation Reports on Cryptographic Techniques in FY 2003, no.0202-1 (2004) (in Japanese),
  4. 4.
    Barreto, P.S.L.M., Naehrig, M.: Pairing-friendly elliptic curves of prime order. In: Preneel, B., Tavares, S. (eds.) SAC 2005. LNCS, vol. 3897, pp. 319–331. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  5. 5.
    Cohen, H.: A course in computational algebraic number theory. In: Graduate Texts in Math., vol. 138, Springer (1993)Google Scholar
  6. 6.
    Franke, J., Kleinjung, T.: Continued fractions and lattice sieve. In: Workshop Record of SHARCS (2005),
  7. 7.
    Joux, A., Lercier, R.: Improvements to the general number field sieve for discrete logarithms in prime fields. A comparison with the Gaussian integer method. Math. Comp. 72, 953–967 (2003)MathSciNetCrossRefzbMATHGoogle Scholar
  8. 8.
    Joux, A., Lercier, R., Smart, N.P., Vercauteren, F.: The number field sieve in the medium prime case. In: Dwork, C. (ed.) CRYPTO 2006. LNCS, vol. 4117, pp. 326–344. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  9. 9.
    Kleinjung, T., et al.: Discrete logarithms in GF(p) - 160 digits, email to the NMBRTHRY mailing list (2007),
  10. 10.
    Kleinjung, T., Aoki, K., Franke, J., Lenstra, A.K., Thomé, E., Bos, J.W., Gaudry, P., Kruppa, A., Montgomery, P.L., Osvik, D.A., te Riele, H., Timofeev, A., Zimmermann, P.: Factorization of a 768-bit RSA modulus. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 333–350. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  11. 11.
    LaMacchia, B.A., Odlyzko, A.M.: Solving large sparse linear systems over finite fields. In: Menezes, A., Vanstone, S.A. (eds.) CRYPTO 1990. LNCS, vol. 537, pp. 109–133. Springer, Heidelberg (1991)Google Scholar
  12. 12.
    Lanczos, C.: Solution of systems of linear equations by minimized iterations. J. Res. Nat. Bur. Stand. 49, 33–53 (1952)MathSciNetCrossRefGoogle Scholar
  13. 13.
    Lenstra, A.K., Lenstra, H.W.: The Development of the Number Field Sieve. Lecture Notes in Math., vol. 1554. Springer (1993)Google Scholar
  14. 14.
    Lenstra, A.K., Lenstra, H.W., Lovász, L.: Factoring polynomials with rational coefficients. Math. Ann. 261, 515–534 (1982)MathSciNetCrossRefzbMATHGoogle Scholar
  15. 15.
    Murphy, B.: Polynomial selection for the number field sieve integer factorisation algorithm, PhD thesis, The Australian National University (1999)Google Scholar
  16. 16.
    PARI/GP, version 2.5.3, Bordeaux (2012),
  17. 17.
    Pollard, J.M.: The lattice sieve. In: [13], pp. 43–49Google Scholar
  18. 18.
    Pomerance, C., Smith, J.: Reduction of huge, sparse matrices over finite fields via created catastrophes. Experiment. Math. 1, 89–94 (1992)MathSciNetCrossRefzbMATHGoogle Scholar
  19. 19.
    Schirokauer, O.: Discrete logarithms and local units. Philos. Trans. Roy. Soc. London Ser. A 345, 409–424 (1993)MathSciNetCrossRefzbMATHGoogle Scholar
  20. 20.
    Schirokauer, O.: Virtual logarithms. J. Algorithms 57, 140–147 (2005)MathSciNetCrossRefzbMATHGoogle Scholar
  21. 21.
    Vercauteren, F.: Optimal pairings. IEEE Transactions on Information Theory 56, 455–461 (2010)MathSciNetCrossRefGoogle Scholar
  22. 22.
    Zajac, P.: Discrete logarithm problem in degree six finite fields, PhD thesis, Slovak University of Technology (2008),
  23. 23.
    Zajac, P.: On the use of the lattice sieve in the 3D NFS. Tatra Mt. Math. Publ. 45, 161–172 (2010)MathSciNetzbMATHGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Kenichiro Hayasaka
    • 1
  • Kazumaro Aoki
    • 2
  • Tetsutaro Kobayashi
    • 2
  • Tsuyoshi Takagi
    • 3
  1. 1.Graduate School of MathematicsKyushu UniversityFukuokaJapan
  2. 2.NTT Secure Platform LaboratoriesTokyoJapan
  3. 3.Institute of Mathematics for IndustryKyushu UniversityFukuokaJapan

Personalised recommendations