On Using Torsion Points in the Elliptic Curve Index Calculus Gu - PowerPoint PPT Presentation

On Using Torsion Points in the Elliptic Curve Index Calculus Gu´ ena¨ el Renault Sorbonne Universit´ es UPMC, INRIA, CNRS LIP6 1/43

General Context Discrete Logarithm Problem (DLP) Given a finite cyclic group ( G = � g � , +) and h ∈ G , find k such that h = [ k ] g = g + · · · + g k times � √ # G � Generic algorithms O ◮ Baby Step Giant Step, Pollard’s rho, etc. ◮ For any black box group G , optimal complexity (Shoup) Index Calculus can be quasi-polynomial, sub-exponential ◮ sieving + linear algebra ◮ G = ( F × 2 k , × ) ◮ G = ( F × q , × ) , G = ( J C ( F q ) , +) with genus g > 2 ☞ G = E ( F q ) no sub-exponential index calculus algo. in general 2/43

Context ☞ Index calculus algo. adaptation for E ( F q n ) ( n small) Semaev/Gaudry/Diem ( ≈ 2005) (Point Decomposition Problem) Semaev Summation Polynomial Polynomial System Solving ☞ Increasing the efficiency by using the symmetries ☞ Using Symmetries in the Index Calculus for ECDLP (J. Crypto. 2014) (J.-C. Faug` ere, P. Gaudry, L. Huot, G. R.) ☞ Symmetrized Summation Polynomials (Eurocrypt’14) (J.-C. Faug` ere, L. Huot, A. Joux, G. R., V. Vitse) 3/43

Outline PDP in the Index Calculus 1 Polynomial System Solving 2 PoSSo With Symmetries 3 From Torsion Point to Symmetry 4 Characteristic 2 5 New Computational Record: 8th Summation Polynomial 6 Conclusion 7 4/43

Outline PDP in the Index Calculus 1 Polynomial System Solving 2 PoSSo With Symmetries 3 From Torsion Point to Symmetry 4 Characteristic 2 5 New Computational Record: 8th Summation Polynomial 6 Conclusion 7 5/43

Index Calculus for ECDLP Algorithm (Gaudry 2005) Input: P, Q ∈ E ( F q n ) Output: x such that Q = [ x ] P 1. Def. factor base: F = { ( x, y ) ∈ E ( F q n ) | x ∈ F q } 2. Sieving: [ a j ] P ⊕ [ b j ] Q = P 1 ⊕ · · · ⊕ P n , P i ∈ F until having # F + 1 such relations � 3. Linear algebra [ λ j · a j ] P ⊕ [ λ j · b j ] Q = 0 E ( F qn ) j Point Decomposition Problem Given R ∈ E F a factor base of points in E find P 1 , . . . , P n ∈ F such that R = P 1 ⊕ . . . ⊕ P n 6/43

Point Decomposition Problem PDP( n, R, F ) Given R ∈ E F a factor base of points in E find P 1 , . . . , P n ∈ F such that R = P 1 ⊕ . . . ⊕ P n ☞ Modeling the problem as a polynomial system { g 1 , . . . , g s } and solve this system: � ( x i , y i ) ∈ E ( x 1 , y 1 ) ⊕ ( x 2 , y 2 ) ⊕ · · · ⊕ ( x n , y n ) = ( R x , R y ) ☞ The solution has to be found in F 7/43

Algebraic modelling of PDP: Summation polynomials Semaev, 2004, Gaudry, 2005 ☞ Projection of the PDP( n, R = 0 , F = { ( x, y ) ∈ E ( F q n ) | x ∈ F q } ) PDP: g 1 ( , . . . , ) = · · · = g s ( , . . . , ) = 0 Projection π n Summation: f n ( , . . . , ) = 0 8/43

Algebraic modelling of PDP: Summation polynomials Semaev, 2004, Gaudry, 2005 ☞ Projection of the PDP( n, R = 0 , F = { ( x, y ) ∈ E ( F q n ) | x ∈ F q } ) PDP: � g 1 ( x 1 , . . . , x m , y 1 , . . . , y m ) , . . . , g s ( x 1 , . . . , x m , y 1 , . . . , y m ) � π : ( x, y ) → x Elimination (Resultant, Gr¨ obner basis) Summation: � f n ( x 1 , . . . , x n ) � = � g 1 , . . . , g s � ∩ F q n [ x 1 , . . . , x n ] deg x i ( f n ) � 2 n − 2 Characterization f n ( x 1 , ..., x n ) = 0 � n ∃ ( y 1 , ..., y n ) ∈ F q n s.t. ∀ i, P i = ( x i , y i ) ∈ E and P 1 ⊕ · · · ⊕ P n = 0 8/43

Algebraic modelling of PDP: Summation polynomials Semaev, 2004, Gaudry, 2005 ☞ Projection of the PDP( n, R = 0 , F = { ( x, y ) ∈ E ( F q n ) | x ∈ F q } ) PDP: � g 1 ( x 1 , . . . , x m , y 1 , . . . , y m ) , . . . , g s ( x 1 , . . . , x m , y 1 , . . . , y m ) � π : ( x, y ) → x Elimination (Resultant, Gr¨ obner basis) Summation: � f n ( x 1 , . . . , x n ) � = � g 1 , . . . , g s � ∩ F q n [ x 1 , . . . , x n ] deg x i ( f n ) � 2 n − 2 Application in Index Calculus: ( Gaudry 2005 ) Solving PDP( R, F ) with factor base F = { ( x, y ) ∈ E ( F q n ) | x ∈ F q } . � Finding ( x 1 , . . . , x n ) with x i ∈ F q s.t. f n +1 ( x 1 , ..., x n , ( − R ) x ) = 0 ☞ In Weierstrass model R x = ( − R ) x 8/43

From summation polynomials to PoSSo Problem We want to find P 1 , . . . , P n ∈ F = { ( x, y ) ∈ E | x ∈ F q } such that R = P 1 + · · · + P n ⇐ ⇒ P 1 + · · · + P n − R = 0 E � Finding ( x 1 , . . . , x n ) with x i ∈ F q s.t. f n +1 ( x 1 , ..., x n , R x ) = 0 Solving process: Restriction of scalar on sum. polynomial F q n ≃ F q ( ω ) : n dimensional F q -vector space n − 1 � ϕ i ( x 1 , . . . , x n ) · ω i f n +1 ( x 1 , . . . , x n , R x ) = 0 E = i =0 9/43

From summation polynomials to PoSSo Solving process: Restriction of scalar on sum. polynomial F q n ≃ F q ( ω ) : n dimensional F q -vector space n − 1 � ϕ i ( x 1 , . . . , x n ) · ω i f n +1 ( x 1 , . . . , x n , R x ) = 0 E = i =0  S = { ϕ 0 , . . . , ϕ n − 1 } ⊂ F q [ x 1 , . . . , x n ] -  ⇒ - n variables, n equations  solutions in F q - H 1 : The polynomial systems S are zero-dimensional 9/43

Outline PDP in the Index Calculus 1 Polynomial System Solving 2 PoSSo With Symmetries 3 From Torsion Point to Symmetry 4 Characteristic 2 5 New Computational Record: 8th Summation Polynomial 6 Conclusion 7 10/43

Solving 0 -dim polynomial systems Let S = { f 1 , . . . , f n } where f i ∈ K [ x 1 , . . . , x n ] and Deg( f i ) ≤ 2 n − 1 Solving S means here to compute V K ( �S� ) 11/43

Solving 0 -dim polynomial systems Let S = { f 1 , . . . , f n } where f i ∈ K [ x 1 , . . . , x n ] and Deg( f i ) ≤ 2 n − 1 Solving S means here to compute V K ( �S� ) Gr¨ obner basis Since |V K | < ∞ , the Gr¨ obner basis G of �S� w.r.t. lexicographical order with x 1 > . . . > x n then G has a triangular form  h 1 , 1 ( x 1 , . . . , x n ) , . . . , h 1 ,k 1 ( x 1 , . . . , x n )     . . .  h n − 1 , 1 ( x n − 1 , x n ) , . . . , h n − 1 ,k n − 1 ( x n − 1 , x n )    h n ( x n ) ☞ Factoring univariate polynomials over a finite field. 11/43

Solving 0 -dim polynomial systems Let S = { f 1 , . . . , f n } where f i ∈ K [ x 1 , . . . , x n ] and Deg( f i ) ≤ 2 n − 1 Solving S means here to compute V K ( �S� ) ☞ Compute a GB of �S� w.r.t. a lexicographical order. Zero-dim solve 1. Compute GB DRL from S ( F 4 /F 5 ) 2. Compute GB LEX from GB DRL (FGLM) 11/43

Solving 0 -dim polynomial systems Let S = { f 1 , . . . , f n } where f i ∈ K [ x 1 , . . . , x n ] and Deg( f i ) ≤ 2 n − 1 Compute GB DRL from S Compute GB LEX from GB DRL ☞ See K [ x 1 , . . . , x n ] / �S� as a K -ev ☞ Linear alg. on Macaulay mat. m 1 > m 2 > . . . GB DRL ⇒ K -ev B 1   . . . Change of basis  c 1 c 2  t i,j f i i,j . . . i,j B 1 → B 2 K -ev B 2 ⇒ GB LEX ere F 4 , F 5 Faug` ere, Gaudry, Huot, R. ISSAC’14 Faug` � ne nω 2 ( n − 1) nω + n · deg( � S � ) ω � � O ☞ deg( � S � ) = the number of solutions (with multiplicities) ☞ ω represents the linear algebra constant 11/43

On the complexity of computing GB DRL ☞ These results are usually obtain for homogeneous polynomial systems ☞ In order to avoid fall of degree issues, need to consider regular situation Regular sequences A sequence of homogeneous polynomials ( f 1 , . . . , f n ) ⊂ K [ x 1 , . . . , x n ] is said to be regular when f i +1 is a regular element in K [ x 1 , . . . , x n ] / � f 1 , . . . f i � Affine regular sequences A sequence of affine polynomials ( f 1 , . . . , f n ) ⊂ K [ x 1 , . . . , x n ] is said to be regular when the sequence f ( h ) , . . . , f ( h ) of corresponding homogeneous n 1 component of highest degree is regular. ☞ Complexity DRL(pol. sys. affine regular) < DRL(its homogenization) H 2 : The affine polynomial systems S are regular ( H 2 ⇒ H 1 ) 12/43

Outline PDP in the Index Calculus 1 Polynomial System Solving 2 PoSSo With Symmetries 3 From Torsion Point to Symmetry 4 Characteristic 2 5 New Computational Record: 8th Summation Polynomial 6 Conclusion 7 13/43

Invariant Polynomial/System Let be given a polynomial system  f 1 ( x 1 , . . . , x n )     . . . S :  f n − 1 ( x 1 , . . . , x n )    f n ( x 1 , . . . , x n ) σ ∈ G ⊂ GL ( K , n ) , σ · f i = f i ( σ · x ) ☞ Assume all f i are invariant under the action of G . How this assumption can help in solving the polynomial system? 14/43

Invariant ring Definition Let K [ x 1 , . . . , x n ] be a polynomial ring and G ⊂ GL ( K , n ) . K [ x 1 , . . . , x n ] G = { p ∈ K [ x 1 , . . . , x n ] | σ · p = p for all σ ∈ G } We want to efficiently solve  f 1 ( x 1 , . . . , x n )     . . . S :  f n − 1 ( x 1 , . . . , x n )    f n ( x 1 , . . . , x n ) under the assumption f 1 , . . . , f n ∈ K [ x 1 , . . . , x n ] G 15/43

Hironaka decomposition Hilbert’s finiteness theorem Let G ⊂ GL ( K , n ) . Its invariant ring K [ x 1 , . . . , x n ] G is finitely generated. t � K [ x 1 , . . . , x n ] G = η i K [ θ 1 , . . . , θ n ] . i =1 primary invariants θ 1 , . . . , θ n ∈ K [ x 1 , . . . , x n ] G secondary invariants η 1 , . . . , η t ∈ K [ x 1 , . . . , x n ] G ☞ primary invariants are algebraically independent 16/43