Page 1

arXiv:cs/0703032v1 [cs.CR] 7 Mar 2007

An L(1/3 + ε) Algorithm for the Discrete

Logarithm Problem for Low Degree Curves

Andreas Enge1and Pierrick Gaudry2

1INRIA Futurs & Laboratoire d’Informatique (CNRS/UMR 7161)

´Ecole polytechnique, 91128 Palaiseau Cedex, France

2LORIA (CNRS/UMR 7503), Campus Scientifique, BP 239

54506 Vandœuvre-l` es-Nancy Cedex, France

Abstract. The discrete logarithm problem in Jacobians of curves of

high genus g over finite fields Fq is known to be computable with subex-

ponential complexity Lqg(1/2,O(1)). We present an algorithm for a fam-

ily of plane curves whose degrees in X and Y are low with respect to the

curve genus, and suitably unbalanced. The finite base fields are arbitrary,

but their sizes should not grow too fast compared to the genus. For this

family, the group structure can be computed in subexponential time of

Lqg(1/3,O(1)), and a discrete logarithm computation takes subexponen-

tial time of Lqg(1/3 + ε,o(1)) for any positive ε. These runtime bounds

rely on heuristics similar to the ones used in the number field sieve or

the function field sieve algorithms.

1Introduction

The discrete logarithm problem in algebraic curves over finite fields has been

receiving particular attention since elliptic curves and subsequently Jacobian

groups of further algebraic curves have been proposed for discrete logarithm

based public key cryptosystems. Although it is now clear that high genus curves

are unsuitable for cryptographical use, it remains crucial to study algorithms for

solving the discrete logarithm problem in those curves for several reasons. The

first reason is that having a better understanding of the situation for high genus

curves might lead to algorithmic improvements also in the small genus case. The

second reason is that the Weil descent strategy of attacking the discrete loga-

rithm problem in elliptic curves defined over extension fields leads to a discrete

logarithm problem in the Jacobian of a high genus curve. Therefore a better al-

gorithm for high genus discrete logarithms becomes naturally a potential threat

for some elliptic curves.

It turned out very early that the discrete logarithm problem in high genus

hyperelliptic curves (for instance in the sense that the size q of the base field

is fixed, while the genus g tends to infinity) can be solved by a subexponential

algorithm of complexity Lqg(1/2,O(1)). The first such algorithm was proposed

in [1]. As other subexponential algorithms, it consists of fixing a factor base

of small prime elements (here, prime divisors) and of creating relations that

correspond to the zero element modulo an equivalence relation (here, equivalence

Page 2

2Andreas Enge and Pierrick Gaudry

of divisors modulo principal divisors). After collecting sufficiently many relations

and somehow introducing the base of the discrete logarithm and the element

whose logarithm is sought, linear algebra yields the desired result. Assuming

that smooth elements, that are elements decomposing over the factor base, have

the same density as for instance smooth integers or polynomials, such algorithms

usually end up with a complexity of Lqg(1/2,O(1)).

The algorithm in [1] creates relations by randomly taking low degree func-

tions (that are linear in Y for the curve Y2= f(X)), whose divisors are relations.

Its analysis is only heuristic. The first proven algorithms are given in [15] for

the infrastructure of real-quadratic hyperelliptic function fields and in [5] for

Jacobians of hyperelliptic curves. Relations are obtained in a process similar to

that of [11] by taking random linear combinations of factor base elements, re-

ducing modulo the equivalence relation and checking for smoothness. A rigorous

analysis is derived from the lower bound on the density of smooth divisors in

[7]. A generic description of a similar algorithm can be found in [6]; it applies to

all class groups in which a smoothness result is known. Heuristically, it obtains

a running time of Lqg(1/2,O(1)) for the discrete logarithm problem in arbitrary

high genus curves, the smoothness result needed for a proof of the complexity is

however only available for hyperelliptic curves.

A proven algorithm of complexity Lqg(1/2+ε,O(1)) for very general curves

over a fixed field Fqand with genus g tending to infinity (with the only restriction

that the curves contain a rational point and that the cardinality of the Jacobian

group is bounded by qg+O(√g)) is given in [3]. Unlike previous algorithms, it

appears to be specific to algebraic curves and relies on a double randomisation,

taking random combinations of factor base elements and a random function

in a Riemann–Roch space. A relation is obtained whenever the divisor of this

function is smooth. A more general algorithm is proposed in [13] that yields a

proven Lqg(1/2,O(1)) complexity without any restriction on the input curve.

Another line of research on the discrete logarithm problem for algebraic

curves, started in [8] and not pursued in this article, consists of fixing g and

having q tend to infinity. This leads to algorithms that are exponential, but

faster than generic algorithms of square root complexity as soon as g ≥ 3, see

[9, 4].

In the light of algorithms of complexity L(1/3) for the discrete logarithm

problem in finite fields as well as for factoring integers, it has been an open

problem to determine whether this complexity can be achieved also for algebraic

curves. In this article, we present the first probabilistic algorithm of heuris-

tic complexity Lqg(1/3,O(1)) to compute the group structure of certain curves

whose total degree is relatively small compared to their genus. When introducing

the two elements of the Jacobian for which the discrete logarithm problem is to

be solved, some sacrifice has to be made; we obtain an algorithm of complexity

bounded by Lqg(1/3 + ε,o(1)) for any positive constant ε.

The relation collection phase is the same as in [1] and consists of looking for

smooth divisors of functions linear in Y . By applying it to the curves of our spe-

cial family, one readily obtains a lower degree of the affine part of the intersection

Page 3

An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves3

divisor than in the general case, from which a complexity of Lqg(1/3,O(1)) is

derived. For smoothing the two divisors involved in the discrete logarithm prob-

lem, a process is employed that is similar to the one used in the number field

sieve or in the function field sieve. This is the general special-Q descent strategy

(also related to the so-called lattice sieving). Each divisor is partially smoothed

into prime divisors of degree less than the starting divisor. Then each such prime

divisor Q is smoothed again into smaller prime divisors, and we iterate until ev-

ery divisor is rewritten in terms of elements of the factor base. However, in our

case it is necessary to add an arbitrarily small constant ε to the 1/3 parameter

to obtain a proper descent phenomenon; otherwise, the process would get stuck

after one step.

Let us mention that subsequently to our algorithm, Diem has presented at

the 10th Workshop on Elliptic Curve Cryptography (ECC 2006) an algorithm

based on similar ideas, but with a quite different point of view. He manages to

obtain a complexity of L(1/3,O(1) for the discrete logarithm phase, for which

our algorithm takes L(1/3+ε,o(1)). We will show how to reach a complexity of

L(1/3,O(1)) for discrete logarithms in our setting in the long, journal version.

Acknowledgement. We thank Claus Diem for his careful reading of our article

and many useful remarks.

2Main idea

Before describing our algorithm with all its technical details on a general class

of curves, we sketch in this section the main idea yielding a complexity of

Lqg(1/3,O(1)) for the relation collection phase for a restricted class of curves.

We provide a simplified analysis by hand waving; Section 3 is devoted to a more

precise description of the heuristics used and of the smoothness properties needed

for the analysis.

Let Fqbe a fixed finite field. We consider a family of Cabcurves over Fq, that

is, curves of the form

C : Yn+ Xd+ f(X,Y )

without affine singularities such that gcd(n,d) = 1 and any monomial XiYj

occurring in f satisfies ni + dj < nd. Such a curve has genus g =

we assume that g tends to infinity, and that n ≈ g1/3and d ≈ g2/3(we use

the symbol ≈, meaning “about the same size” with no precise definition). The

non-singular model of a Cab curve has a unique point at infinity, and it is Fq-

rational; so there is a natural bijection between degree zero divisors and affine

divisors, and in the following, we shall only be concerned with effective affine

divisors. Choose as factor base F the Lqg(1/3,O(1)) prime divisors of smallest

degree (that is, the prime divisors up to a degree of B ≈ logqLqg(1/3,O(1))).

To obtain relations, consider functions linear in Y of the form

(n−1)(d−1)

2

;

ϕ = a(X) + b(X)Y

Page 4

4Andreas Enge and Pierrick Gaudry

with a, b ∈ Fq[X], gcd(a,b) = 1 and dega, degb = δ ≈ g1/3. Whenever the affine

part div(ϕ) of the divisor of ϕ is smooth with respect to the factor base, it yields

a relation, and we have to estimate the probability of this event.

Let N be the norm of the function field extension Fq(C) = Fq(X)[Y ]/(Yn+

Xd+ f(X,Y )) relative to Fq(X). The norm of ϕ is computed as

N(ϕ) = N(b)N

?

Y +a

b

?

= bn??

= (−a)n+ bnXd+ f∗(X),

−a

b

?n

+ Xd+ f

?

X,−a

b

??

where each monomial XiYjoccurring in f is transformed into a monomial

Xi(−a)jbn−jin f∗.

Since ϕ is linear in Y , all prime divisors it contains are totally split over

Fq(X), and ϕ is B-smooth if and only if its norm is. We have

degXN(ϕ) ≤ max(ndega,ndegb + d) = nδ + d ≈ g2/3.

Heuristically, we assume that the norm behaves like a random polynomial of

degree about g2/3. Then it is B-smooth with probability 1/Lqg(1/3,O(1)) (this

is the same theorem as the one stating that a random polynomial of degree

g is logqLqg(1/2,O(1))-smooth with probability 1/Lqg(1/2,O(1)), cf., for in-

stance, Theorem 2.1 of [2]). Equivalently, we may observe that deg(div(ϕ)) =

degX(N(ϕ)) and assume heuristically that div(ϕ) behaves like a random ef-

fective divisor of the same degree. Then the standard results on arithmetic

semigroups (cf. Section 3) yield again that div(ϕ) is smooth with probability

1/Lqg(1/3,O(1)).

Thus, the expected time for obtaining |F| = Lqg(1/3,O(1)) relations is

Lqg(1/3,O(1)), which is also the complexity of the linear algebra step for com-

puting the Smith normal form and thus the group structure of the Jacobian. The

complexity of the discrete logarithm problem is not considered here, an analysis

for the full algorithm is given in Section 5.

It remains to show that the search space is sufficiently large to yield the re-

quired Lqg(1/3,O(1)) relations, or otherwise said, that the number of candidates

for ϕ is at least Lqg(1/3,O(1)). The number of ϕ is about

q2δ= q2g1/3= exp(2logqg1/3)

< exp(2(g1/3(logq)1/3)(log(g logq))2/3) = Lqg(1/3,O(1)).

The previous inequality in the place of the desired equality shows that a

more rigorous analysis requires a more careful handling of the logq factors; in

particular, δ has to be slightly increased. Moreover, the constant exponent in

the subexponential function needs to be taken into account. This motivates the

following section, in which we examine in more detail the smoothness heuristics

and results that are needed for the algorithm.

Page 5

An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves5

3Smoothness

The algorithm presented in this article relies on finding relations as smooth

divisors of random polynomial functions of low degree. We suppose that all

curves are given by an absolutely irreducible plane affine model

C : F(X,Y )

with F ∈ Fq[X,Y ], where Fqis the exact constant field of the function field of C.

The factor base F consists essentially of the places of degree bounded by some

parameter µ, with a few technical modifications. Precisely, F is composed of the

following places:

– the places corresponding to the resolution of singularities, regardless of their

degrees, whose number is bounded by

cluding them in F, the algorithm can be described as if the curves were

non-singular.

– the infinite places corresponding to non-singularities, regardless of their de-

grees, whose number is bounded by d by B´ ezout’s theorem. By adding them,

it becomes sufficient to only examine the affine part of any divisor.

– places of degree bounded by some parameter µ and of inertia degree 1 with

respect to the function field extension Fq(X)[Y ]/(F) over Fq(X). Otherwise

said, places corresponding to prime ideals of the form (u,Y − v) with u ∈

Fq[X] irreducible of degree at most µ and v ∈ Fq[X] of degree less than

degu; the inertia degree is in fact the degree of the second generator in Y .

Due to the way relations are obtained in the algorithm, no places of higher

inertia degree may occur.

(d−1)(d−2)

2

with d = degF. By in-

A divisor is called F-smooth if it can be decomposed over the factor base;

thus only its affine part plays a role, and for polynomial functions, this is an

effective (i.e. non-negative) divisor. An effective divisor is called µ-smooth if it is

composed only of places of degree up to µ. To be able to analyse the smoothness

probability, we need the following reasonable assumption.

Heuristic 1. Let D be the divisor of a uniformly randomly chosen polynomial

of the form b(X)Y −a(X) and ν the degree of its affine part. Then the probability

of D to be F-smooth is the same as that of a random effective divisor of degree

ν to be µ-smooth.

Heuristic 1 covers the relation collection phase. For computing discrete log-

arithms, arbitrary non-principal divisors need to be smoothed, and another as-

sumption is needed.

Heuristic 2. The probability of a uniformly randomly chosen effective divisor

of degree ν to be F-smooth is essentially the same as that of being µ-smooth.

Heuristic 2 claims in fact that places of inertia degree larger than 1 do not

play a role for smoothness considerations. In the analogous case of number fields