Individual Discrete Logarithm in GF( p k ) (last step of the Number Field Sieve algorithm) Aurore Guillevic INRIA Saclay / GRACE Team ´ Ecole Polytechnique / LIX Asiacrypt 2015 Conference, Auckland, New Zealand, November 30 Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 1 / 25
Logjam attack (weakdh.org) Solving actual practical problem: Given a fixed finite field GF( q ), Huge massive precomputation (weeks, months, years) Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 2 / 25
Logjam attack (weakdh.org) Solving actual practical problem: Given a fixed finite field GF( q ), log tab Huge massive precomputation (weeks, months, years) p i < B 0 Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 2 / 25
Logjam attack (weakdh.org) Solving actual practical problem: Given a fixed finite field GF( q ), log tab Huge massive Thousands of precomputation individual log (weeks, months, computation years) < 1 min each p i < B 0 Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 2 / 25
Logjam attack (weakdh.org) Solving actual practical problem: Given a fixed finite field GF( q ), log tab Huge massive Thousands of precomputation individual log (weeks, months, computation years) < 1 min each p i < B 0 Logjam: GF( q ) = GF( p ) (standardized) prime field of 512 bits real-time man-in-the-middle attack on Diffie-Hellman key exchange compute a discrete log in GF( p ) in 70s in average Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 2 / 25
Logjam attack (weakdh.org) Solving actual practical problem: Given a fixed finite field GF( q ), log tab Huge massive Thousands of precomputation individual log (weeks, months, computation years) < 1 min each p i < B 0 Logjam: GF( q ) = GF( p ) (standardized) prime field of 512 bits real-time man-in-the-middle attack on Diffie-Hellman key exchange compute a discrete log in GF( p ) in 70s in average Pairing-based cryptography: GF( q ) = GF( p 2 ), GF( p 6 ), GF( p 12 ) Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 2 / 25
Logjam attack (weakdh.org) Solving actual practical problem: Given a fixed finite field GF( q ), log tab Huge massive Thousands of precomputation individual log (weeks, months, computation years) < 1 min each p i < B 0 Logjam: GF( q ) = GF( p ) (standardized) prime field of 512 bits real-time man-in-the-middle attack on Diffie-Hellman key exchange compute a discrete log in GF( p ) in 70s in average Pairing-based cryptography: GF( q ) = GF( p 2 ), GF( p 6 ), GF( p 12 ) Could we compute individual discrete logs in GF( p 2 ), GF( p 6 ), GF( p 12 ) in less than 1 min ? Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 2 / 25
DLP in the target group of pairing-friendly curves DLP in the target group of pairing-friendly curves Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 3 / 25
DLP in the target group of pairing-friendly curves Why DLP in finite fields F p 2 , F p 3 , . . . ? In a subgroup G = � g � of order ℓ , ( g , x ) �→ g x is easy (polynomial time) ( g , g x ) �→ x is (in well-chosen subgroup) hard: DLP. pairing: × → G 1 G 2 G T ∩ ∩ ∩ F ∗ E ( F p ) E ( F p k ) p k where E / F p is a pairing-friendly curve √ G 1 , G 2 , G T of large prime order ℓ (generic attacks in O ( ℓ ): take e.g. 256-bit ℓ ) 1 ≤ k ≤ 12 embedding degree: very specific property (specific attacks (NFS): take 3072-bit p k ) Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 4 / 25
DLP in the target group of pairing-friendly curves DL records in small characteristic ✗ Small characteristic: supersingular curves E / F 2 n : G T ⊂ F 2 4 n , E / F 3 m : G T ⊂ F 3 6 m Practical attacks (first one and most recent): Hayashi, Shimoyama, Shinohara, Takagi: GF(3 6 · 97 ) ( 923 bit field) (2012) Granger, Kleinjung, Zumbragel: GF(2 9234 ), GF(2 4404 ) (2014) ıquez: GF(3 822 ), GF(3 978 ) Adj, Menezes, Oliveira, Rodr´ ıguez-Henr´ (2014) Joux: GF(3 2395 ) (with Pierrot, 2014), GF(2 6168 ) (2013) Theoretical attacks: Quasi-Polynomial-time Algorithm (QPA) [Barbulescu Gaudry Joux Thom´ e 14] [Granger Kleinjung Zumbragel 14] Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 5 / 25
DLP in the target group of pairing-friendly curves Common used pairing-friendly curves ✓ Curves over prime fields E / F p where QPA does NOT apply (with log p ≥ log ℓ ≈ 256 bits, s.t. k log p ≥ 3072) supersingular: G T ⊂ F p 2 (log p = 1536) [Miyaji Nakabayashi Takano 01] (MNT): G T ⊂ F p 3 (log p = 1024), F p 4 (log p = 768), F p 6 (log p = 512) [Freeman 06] G T ⊂ F p 10 [Barreto Naehrig 05] (BN): G T ⊂ F p 12 (log p = 256, optimal) [Kachisa Schaefer Scott 08] (KSS): G T ⊂ F p 18 (used for 192-bit security level: 384-bit ℓ , log p = 512, k log p = 9216) Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 6 / 25
DLP in the target group of pairing-friendly curves Last DL records, with the NFS-DL algorithm GF( p ′ 2 ), p ′ 2 = q [BGGM15] GF( p ) Massive precomputation (d=core-day, y=core-year) [Logjam] 512-bit p : 10y 598-bit q : 0.75y + 18 GPU-d 175 × faster [BGIJT14] 596-bit p : 131y Individual Discrete Log 512-bit p : 70s median ✓ 596-bit p : 2d 600-bit q : few d slow [Logjam]: see weakdh.org [BGGM15]: Barbulescu, Gaudry, G., Morain [BGIJT14]: Bouvier, Gaudry, Imbert, Jeljeli, Thom´ e Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 7 / 25
DLP in the target group of pairing-friendly curves This work: Faster individual discrete logarithm in F p k , especially k = 2 , 3 , 4 , 6 Apply to pairing target group G T large characteristic F p 2 , F p 3 medium characteristic F p 4 , F p 6 , . . . source code: written in Magma + part of http://cado-nfs.gforge.inria.fr/ Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 8 / 25
DLP in the target group of pairing-friendly curves Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f ( x ) , g ( x ) with 1. ϕ = gcd( f , g ) (mod p ) and F p k = F p [ x ] / ( ϕ ( x )) Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 9 / 25
DLP in the target group of pairing-friendly curves Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f ( x ) , g ( x ) with 1. ϕ = gcd( f , g ) (mod p ) and F p k = F p [ x ] / ( ϕ ( x )) 2. Relation collection Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 9 / 25
DLP in the target group of pairing-friendly curves Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f ( x ) , g ( x ) with 1. ϕ = gcd( f , g ) (mod p ) and F p k = F p [ x ] / ( ϕ ( x )) 2. Relation collection 3. Linear algebra modulo ℓ | p k − 1 . ➙ here we know the discrete log of a subset of elements. log DB p i < B 0 Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 9 / 25
DLP in the target group of pairing-friendly curves Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f ( x ) , g ( x ) with 1. ϕ = gcd( f , g ) (mod p ) and massive precomputation F p k = F p [ x ] / ( ϕ ( x )) 2. Relation collection 3. Linear algebra modulo ℓ | p k − 1 ➙ here we know the discrete log of a subset of elements. log DB p i < B 0 Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 9 / 25
DLP in the target group of pairing-friendly curves Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f ( x ) , g ( x ) with 1. ϕ = gcd( f , g ) (mod p ) and massive precomputation F p k = F p [ x ] / ( ϕ ( x )) 2. Relation collection 3. Linear algebra modulo ℓ | p k − 1 ➙ here we know the discrete log of a subset of elements. log DB p i < B 0 1. Individual target discrete logarithm Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 9 / 25
DLP in the target group of pairing-friendly curves Number Field Sieve algorithm for DL in F p k Polynomial selection: compute f ( x ) , g ( x ) with 1. ϕ = gcd( f , g ) (mod p ) and massive precomputation F p k = F p [ x ] / ( ϕ ( x )) 2. Relation collection 3. Linear algebra modulo ℓ | p k − 1 ➙ here we know the discrete log of a subset of elements. log DB p i < B 0 1. Individual target discrete logarithm for each given DLP instance not so trivial this talk: practical improvements very efficient for small k or even k Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 9 / 25
DLP in the target group of pairing-friendly curves Polynomial Selection for DL in F p k , and norm f , g irreducible over Q , f � = g (define � = number fields) gcd( f mod p , g mod p ) = ϕ irreducible of degree k � f � ∞ , � g � ∞ , deg f , deg g small enough s.t. Norm f ( · ), Norm g ( · ) are as small as possible Norm of degree 1 element a − bx ∈ Z [ x ] / ( f ( x )): Norm f ( a − bx ) = � deg f i =0 a i b deg f − i f i More generally, when f is monic: Norm f ( T ) = Res( T , f ) ≤ A (deg f , deg T ) � T � deg f � f � d ∞ ∞ where � f � ∞ = max 0 ≤ i ≤ deg f | f i | Aurore Guillevic (INRIA/LIX) NFS-DL in F pk November 30, 2015 10 / 25
Recommend
More recommend
