Page 1

arXiv:cs/0703032v1 [cs.CR] 7 Mar 2007

An L(1/3 + ε) Algorithm for the Discrete

Logarithm Problem for Low Degree Curves

Andreas Enge1and Pierrick Gaudry2

1INRIA Futurs & Laboratoire d’Informatique (CNRS/UMR 7161)

´Ecole polytechnique, 91128 Palaiseau Cedex, France

2LORIA (CNRS/UMR 7503), Campus Scientifique, BP 239

54506 Vandœuvre-l` es-Nancy Cedex, France

Abstract. The discrete logarithm problem in Jacobians of curves of

high genus g over finite fields Fq is known to be computable with subex-

ponential complexity Lqg(1/2,O(1)). We present an algorithm for a fam-

ily of plane curves whose degrees in X and Y are low with respect to the

curve genus, and suitably unbalanced. The finite base fields are arbitrary,

but their sizes should not grow too fast compared to the genus. For this

family, the group structure can be computed in subexponential time of

Lqg(1/3,O(1)), and a discrete logarithm computation takes subexponen-

tial time of Lqg(1/3 + ε,o(1)) for any positive ε. These runtime bounds

rely on heuristics similar to the ones used in the number field sieve or

the function field sieve algorithms.

1Introduction

The discrete logarithm problem in algebraic curves over finite fields has been

receiving particular attention since elliptic curves and subsequently Jacobian

groups of further algebraic curves have been proposed for discrete logarithm

based public key cryptosystems. Although it is now clear that high genus curves

are unsuitable for cryptographical use, it remains crucial to study algorithms for

solving the discrete logarithm problem in those curves for several reasons. The

first reason is that having a better understanding of the situation for high genus

curves might lead to algorithmic improvements also in the small genus case. The

second reason is that the Weil descent strategy of attacking the discrete loga-

rithm problem in elliptic curves defined over extension fields leads to a discrete

logarithm problem in the Jacobian of a high genus curve. Therefore a better al-

gorithm for high genus discrete logarithms becomes naturally a potential threat

for some elliptic curves.

It turned out very early that the discrete logarithm problem in high genus

hyperelliptic curves (for instance in the sense that the size q of the base field

is fixed, while the genus g tends to infinity) can be solved by a subexponential

algorithm of complexity Lqg(1/2,O(1)). The first such algorithm was proposed

in [1]. As other subexponential algorithms, it consists of fixing a factor base

of small prime elements (here, prime divisors) and of creating relations that

correspond to the zero element modulo an equivalence relation (here, equivalence

Page 2

2 Andreas Enge and Pierrick Gaudry

of divisors modulo principal divisors). After collecting sufficiently many relations

and somehow introducing the base of the discrete logarithm and the element

whose logarithm is sought, linear algebra yields the desired result. Assuming

that smooth elements, that are elements decomposing over the factor base, have

the same density as for instance smooth integers or polynomials, such algorithms

usually end up with a complexity of Lqg(1/2,O(1)).

The algorithm in [1] creates relations by randomly taking low degree func-

tions (that are linear in Y for the curve Y2= f(X)), whose divisors are relations.

Its analysis is only heuristic. The first proven algorithms are given in [15] for

the infrastructure of real-quadratic hyperelliptic function fields and in [5] for

Jacobians of hyperelliptic curves. Relations are obtained in a process similar to

that of [11] by taking random linear combinations of factor base elements, re-

ducing modulo the equivalence relation and checking for smoothness. A rigorous

analysis is derived from the lower bound on the density of smooth divisors in

[7]. A generic description of a similar algorithm can be found in [6]; it applies to

all class groups in which a smoothness result is known. Heuristically, it obtains

a running time of Lqg(1/2,O(1)) for the discrete logarithm problem in arbitrary

high genus curves, the smoothness result needed for a proof of the complexity is

however only available for hyperelliptic curves.

A proven algorithm of complexity Lqg(1/2+ε,O(1)) for very general curves

over a fixed field Fqand with genus g tending to infinity (with the only restriction

that the curves contain a rational point and that the cardinality of the Jacobian

group is bounded by qg+O(√g)) is given in [3]. Unlike previous algorithms, it

appears to be specific to algebraic curves and relies on a double randomisation,

taking random combinations of factor base elements and a random function

in a Riemann–Roch space. A relation is obtained whenever the divisor of this

function is smooth. A more general algorithm is proposed in [13] that yields a

proven Lqg(1/2,O(1)) complexity without any restriction on the input curve.

Another line of research on the discrete logarithm problem for algebraic

curves, started in [8] and not pursued in this article, consists of fixing g and

having q tend to infinity. This leads to algorithms that are exponential, but

faster than generic algorithms of square root complexity as soon as g ≥ 3, see

[9, 4].

In the light of algorithms of complexity L(1/3) for the discrete logarithm

problem in finite fields as well as for factoring integers, it has been an open

problem to determine whether this complexity can be achieved also for algebraic

curves. In this article, we present the first probabilistic algorithm of heuris-

tic complexity Lqg(1/3,O(1)) to compute the group structure of certain curves

whose total degree is relatively small compared to their genus. When introducing

the two elements of the Jacobian for which the discrete logarithm problem is to

be solved, some sacrifice has to be made; we obtain an algorithm of complexity

bounded by Lqg(1/3 + ε,o(1)) for any positive constant ε.

The relation collection phase is the same as in [1] and consists of looking for

smooth divisors of functions linear in Y . By applying it to the curves of our spe-

cial family, one readily obtains a lower degree of the affine part of the intersection

Page 3

An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves3

divisor than in the general case, from which a complexity of Lqg(1/3,O(1)) is

derived. For smoothing the two divisors involved in the discrete logarithm prob-

lem, a process is employed that is similar to the one used in the number field

sieve or in the function field sieve. This is the general special-Q descent strategy

(also related to the so-called lattice sieving). Each divisor is partially smoothed

into prime divisors of degree less than the starting divisor. Then each such prime

divisor Q is smoothed again into smaller prime divisors, and we iterate until ev-

ery divisor is rewritten in terms of elements of the factor base. However, in our

case it is necessary to add an arbitrarily small constant ε to the 1/3 parameter

to obtain a proper descent phenomenon; otherwise, the process would get stuck

after one step.

Let us mention that subsequently to our algorithm, Diem has presented at

the 10th Workshop on Elliptic Curve Cryptography (ECC 2006) an algorithm

based on similar ideas, but with a quite different point of view. He manages to

obtain a complexity of L(1/3,O(1) for the discrete logarithm phase, for which

our algorithm takes L(1/3+ε,o(1)). We will show how to reach a complexity of

L(1/3,O(1)) for discrete logarithms in our setting in the long, journal version.

Acknowledgement. We thank Claus Diem for his careful reading of our article

and many useful remarks.

2 Main idea

Before describing our algorithm with all its technical details on a general class

of curves, we sketch in this section the main idea yielding a complexity of

Lqg(1/3,O(1)) for the relation collection phase for a restricted class of curves.

We provide a simplified analysis by hand waving; Section 3 is devoted to a more

precise description of the heuristics used and of the smoothness properties needed

for the analysis.

Let Fqbe a fixed finite field. We consider a family of Cabcurves over Fq, that

is, curves of the form

C : Yn+ Xd+ f(X,Y )

without affine singularities such that gcd(n,d) = 1 and any monomial XiYj

occurring in f satisfies ni + dj < nd. Such a curve has genus g =

we assume that g tends to infinity, and that n ≈ g1/3and d ≈ g2/3(we use

the symbol ≈, meaning “about the same size” with no precise definition). The

non-singular model of a Cab curve has a unique point at infinity, and it is Fq-

rational; so there is a natural bijection between degree zero divisors and affine

divisors, and in the following, we shall only be concerned with effective affine

divisors. Choose as factor base F the Lqg(1/3,O(1)) prime divisors of smallest

degree (that is, the prime divisors up to a degree of B ≈ logqLqg(1/3,O(1))).

To obtain relations, consider functions linear in Y of the form

(n−1)(d−1)

2

;

ϕ = a(X) + b(X)Y

Page 4

4Andreas Enge and Pierrick Gaudry

with a, b ∈ Fq[X], gcd(a,b) = 1 and dega, degb = δ ≈ g1/3. Whenever the affine

part div(ϕ) of the divisor of ϕ is smooth with respect to the factor base, it yields

a relation, and we have to estimate the probability of this event.

Let N be the norm of the function field extension Fq(C) = Fq(X)[Y ]/(Yn+

Xd+ f(X,Y )) relative to Fq(X). The norm of ϕ is computed as

N(ϕ) = N(b)N

?

Y +a

b

?

= bn??

= (−a)n+ bnXd+ f∗(X),

−a

b

?n

+ Xd+ f

?

X,−a

b

??

where each monomial XiYjoccurring in f is transformed into a monomial

Xi(−a)jbn−jin f∗.

Since ϕ is linear in Y , all prime divisors it contains are totally split over

Fq(X), and ϕ is B-smooth if and only if its norm is. We have

degXN(ϕ) ≤ max(ndega,ndegb + d) = nδ + d ≈ g2/3.

Heuristically, we assume that the norm behaves like a random polynomial of

degree about g2/3. Then it is B-smooth with probability 1/Lqg(1/3,O(1)) (this

is the same theorem as the one stating that a random polynomial of degree

g is logqLqg(1/2,O(1))-smooth with probability 1/Lqg(1/2,O(1)), cf., for in-

stance, Theorem 2.1 of [2]). Equivalently, we may observe that deg(div(ϕ)) =

degX(N(ϕ)) and assume heuristically that div(ϕ) behaves like a random ef-

fective divisor of the same degree. Then the standard results on arithmetic

semigroups (cf. Section 3) yield again that div(ϕ) is smooth with probability

1/Lqg(1/3,O(1)).

Thus, the expected time for obtaining |F| = Lqg(1/3,O(1)) relations is

Lqg(1/3,O(1)), which is also the complexity of the linear algebra step for com-

puting the Smith normal form and thus the group structure of the Jacobian. The

complexity of the discrete logarithm problem is not considered here, an analysis

for the full algorithm is given in Section 5.

It remains to show that the search space is sufficiently large to yield the re-

quired Lqg(1/3,O(1)) relations, or otherwise said, that the number of candidates

for ϕ is at least Lqg(1/3,O(1)). The number of ϕ is about

q2δ= q2g1/3= exp(2logqg1/3)

< exp(2(g1/3(logq)1/3)(log(g logq))2/3) = Lqg(1/3,O(1)).

The previous inequality in the place of the desired equality shows that a

more rigorous analysis requires a more careful handling of the logq factors; in

particular, δ has to be slightly increased. Moreover, the constant exponent in

the subexponential function needs to be taken into account. This motivates the

following section, in which we examine in more detail the smoothness heuristics

and results that are needed for the algorithm.

Page 5

An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves5

3 Smoothness

The algorithm presented in this article relies on finding relations as smooth

divisors of random polynomial functions of low degree. We suppose that all

curves are given by an absolutely irreducible plane affine model

C : F(X,Y )

with F ∈ Fq[X,Y ], where Fqis the exact constant field of the function field of C.

The factor base F consists essentially of the places of degree bounded by some

parameter µ, with a few technical modifications. Precisely, F is composed of the

following places:

– the places corresponding to the resolution of singularities, regardless of their

degrees, whose number is bounded by

cluding them in F, the algorithm can be described as if the curves were

non-singular.

– the infinite places corresponding to non-singularities, regardless of their de-

grees, whose number is bounded by d by B´ ezout’s theorem. By adding them,

it becomes sufficient to only examine the affine part of any divisor.

– places of degree bounded by some parameter µ and of inertia degree 1 with

respect to the function field extension Fq(X)[Y ]/(F) over Fq(X). Otherwise

said, places corresponding to prime ideals of the form (u,Y − v) with u ∈

Fq[X] irreducible of degree at most µ and v ∈ Fq[X] of degree less than

degu; the inertia degree is in fact the degree of the second generator in Y .

Due to the way relations are obtained in the algorithm, no places of higher

inertia degree may occur.

(d−1)(d−2)

2

with d = degF. By in-

A divisor is called F-smooth if it can be decomposed over the factor base;

thus only its affine part plays a role, and for polynomial functions, this is an

effective (i.e. non-negative) divisor. An effective divisor is called µ-smooth if it is

composed only of places of degree up to µ. To be able to analyse the smoothness

probability, we need the following reasonable assumption.

Heuristic 1. Let D be the divisor of a uniformly randomly chosen polynomial

of the form b(X)Y −a(X) and ν the degree of its affine part. Then the probability

of D to be F-smooth is the same as that of a random effective divisor of degree

ν to be µ-smooth.

Heuristic 1 covers the relation collection phase. For computing discrete log-

arithms, arbitrary non-principal divisors need to be smoothed, and another as-

sumption is needed.

Heuristic 2. The probability of a uniformly randomly chosen effective divisor

of degree ν to be F-smooth is essentially the same as that of being µ-smooth.

Heuristic 2 claims in fact that places of inertia degree larger than 1 do not

play a role for smoothness considerations. In the analogous case of number fields

Page 6

6Andreas Enge and Pierrick Gaudry

this is justified by the observation that these places have a Dirichlet density of 0,

and the situation is completely analogous for function fields: A place of degree

µ and inertia degree f dividing µ corresponds to a closed point on C with X-

coordinate in Fqµ/f and Y -coordinate in Fqµ, of which there are on the order of

qµ/f. Clearly, places with f ≥ 2 are completely negligible.

The probability of µ-smoothness is ruled by the usual results on smoothness

probabilities in arithmetic semigroups such as the integers or polynomials over

a finite field, cf. [14].

Unfortunately, most results in the literature assume a fixed semigroup and

give asymptotics for µ and ν tending to infinity, whereas we need information

that is uniform over an infinite family of curves. Theorem 13 of [13] provides

such a result:

Theorem 3 (Heß). Let 0 < ε < 1, γ =

3logq(14g + 4) ≤ µ ≤ νεand u ≥ 2log(g + 1). Denote by ψ(ν,µ) the number of

µ-smooth effective divisors of degree ν. Then for µ and ν sufficiently large (with

an explicit bound depending only on ε, but not on q or g),

3

1−εand ν, µ and u =

ν

µsuch that

ψ(ν,µ)

qν

≥ e−ulog u(1+log log u+γ

log u

)= e−ulog u(1+o(1)).

Notice that the proof of Theorem 3, similar in spirit to that for hyperellip-

tic curves in [7], is entirely combinatorial and relies on the fact that there are

essentially qµ/µ places of degree µ. So we expect the result to hold even if one

restricts to places of inertia degree 1.

Denote by

L(α,c) = Lqg(α,c) = ec(g log q)α(log(g log q))1−α

for 0 ≤ α ≤ 1 and c > 0 the subexponential function with respect to g logq, and

let

M = Mqg = logq(g logq) =log(g logq)

logq

.

The parameter glogq will be the input size for the class of curves we consider;

more intrinsically, this is the logarithmic size of the group in which the discrete

logarithm problem is defined.

Proposition 4. Let ν = ⌊logqL(α,c)⌋ = ⌊cgαM1−α⌋ and µ = ⌈logqL(β,d)⌉ =

⌈dgβM1−β⌉ with 0 < β < α ≤ 1 and c, d > 0. Assume that there is a constant

δ >1−α

α−βsuch that g ≥ (logq)δ. Then for g sufficiently large,

ψ(ν,µ)

qν

≥ L

?

α − β,−c

d(α − β) + o(1)

?

,

where o(1) is a function that is bounded in absolute value by a constant (depend-

ing on α, β, c, d and δ) times

log(g log q).

log log(g log q)

Page 7

An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves7

Proof. One computes

u =ν

µ≤c

d

?

g logq

log(glogq)

?α−β

(the inequality being due only to the rounding of ν and µ),

logu = (α − β)log(glogq)(1 + o(1))

and

loglogu

logu

= o(1),

with both o(1) terms being of the form stipulated in the proposition. Applying

Theorem 3 yields the desired result. Its prerequisites are satisfied since

limg→∞logµ

logν= limg→∞β logg − (1 − β)loglogq

αlogg − (1 − α)loglogq

≤ limg→∞

αlogg −1−α

=

α −1−α

β logg

δ

logg

β

δ

=: ε < 1

because of the definition of δ. Notice further that g → ∞ is equivalent to

glogq → ∞, and that also µ and ν tend to infinity when g does.⊓ ⊔

The choice of µ shall insure that the factor base size, that is about qµ, becomes

subexponential. But the necessary rounding of µ, which may increase qµby a

factor of almost q, may result in more than subexponentially many elements in

the factor base when q grows too fast compared to g.

Proposition 5. Let 0 < β < 1 and δ >1−β

β. If g ≥ (logq)δ, then q = L(β,o(1))

1−α

β

in Proposition 4 implies that

for g → ∞. In particular, δ > max

qµ= L(β,d + o(1)).

?

α−β,1−β

?

Proof. To verify the first assertion, one computes

q = elog q= e(log q)1−β(log q)β

≤ eg(1−β)/δ(log q)β(log(g log q))1−β

= e(g log q)β(log(g log q)1−β)g

1−β

δ

−β,

and g

1−β

δ

−β→ 0 since

1−β

δ

− β < 0. The second assertion is obvious.⊓ ⊔

Page 8

8Andreas Enge and Pierrick Gaudry

4Computing the group structure

This section is concerned with the relation collection phase of the discrete loga-

rithm algorithm; an immediate application is the computation of the cardinality

and the group structure of the Jacobian of the curve. Relation collection is virtu-

ally identical to the process described for hyperelliptic curves in [1]; the running

time of L(1/3,O(1)) is obtained by applying it to a particular class of curves

that are of relatively low degree with respect to their genus and for which the

degrees in X and Y of a plane model are balanced in a certain way.

We consider absolutely irreducible curves over finite fields Fqof characteristic

p of the form

C : Yn+ F(X,Y )

with F(X,Y ) ∈ Fq[X] of degree d in X and at most n − 1 in Y . The function

field extension Fq(C) = Fq(X)[Y ]/(Yn+F(X,Y )) over Fq(X) is supposed to be

separable (which is for instance the case if p ∤ n).

Most importantly, the degrees n and d are related to the genus g by

n ≤ n0g1/3M−1/3and d ≤ d0g2/3M1/3

where M =log(g log q)

For instance, C may be a Cab curve of degree n ∼ g1/3M−1/3in Y and

d ∼ 2g2/3M1/3in X.

For the running time analysis, we will want to apply Propositions 4 and 5

with α = 2/3 and β = 1/3; so we have to assume that the curves belong to a

family satisfying g ≥ (logq)δfor some δ > 2.

Algorithm 6 (Group structure).

Input: a curve C as above

Output: h = |JC(Fq)| and divisors D1,...,Dr with their orders h1,...,hr s.t.

JC(Fq) = ?D1? × ··· × ?Dr?

log q

and n0, d0are some positive constants.

1. Compute an approximation of h within a factor of 2, that is, h−and h+s.t.

h−< h < h+and h+≤ 2h−.

2. Fix a smoothness bound B = ⌈logqL(1/3,ρ)⌉ (with a parameter ρ to be

determined later) and compute the factor base F consisting of all affine prime

divisors of C of degree at most B as well as all infinite prime divisors and

prime divisors corresponding to singularities regardless of their degrees. Let

t = |F| and F = {P1,...,Pt}.

3. Start with an empty matrix of relations R and repeat the following step until

s ≥ 2t relations are obtained (in practice, s slightly larger than t should

suffice):

Draw uniformly at random a function

ϕ = b(X)Y − a(X) ∈ Fq(C)

Page 9

An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves9

with a, b ∈ Fq[X] of degree at most

m = ⌊σg1/3M2/3⌋

(with a parameter σ to be determined later). If its divisor is F-smooth, that

is,

divϕ =

t

?

i=1

eiPi,

add a column (e1,...,et)Tto the matrix R.

4. Compute the rank of R; if it is less than t, declare failure and stop.

5. Compute the Smith normal form S = diag(hr,...,h1,1,...,1) of R, where

1 ?= h1|h2|···|hr, and unimodular transformation matrices T ∈ Zt×tand

U ∈ Zs×ss.t. TRU = (S|0).

Let h = h1···hr. If h ≥ h+, declare failure and stop.

Otherwise return h, D1,...,Drs.t.

(D1,...,Dr,0,...,0) = (P1,...,Pt)T−1

and h1,...,hr.

That the algorithm is correct follows from standard arguments such as given

in [1, 5, 6]. It remains to prove its failure probability and running time. We also

have to show that there actually are subalgorithms to carry out the different

steps; these are given together with the following running time analysis.

1. An approximation˜h of h can be obtained by appropriately truncating the

L-series of the curve as in [13, Section 6]. The necessary counting of the

number of points on the curve over a small number of extension fields is

shown in [13] to be polynomial in g and logq for curves of degree in O(g).

The bounds on h are then given by h−=˜h/√2 and h+=√2˜h.

2. The affine prime divisors of degree up to B are obtained by enumerating all

irreducible monic polynomials f ∈ Fq[X] of degree up to B and factoring

Yn+ F(X,Y ) over Fq[X]/(f)[Y ]. Each factor of degree w yields a prime

divisor of degree wdegf. Altogether, these factorisations can be carried out

by O(qB) repetitions of a randomised algorithm with an expected running

time that is polynomial in n, B and logq, and thus ultimately in g logq.

Since polynomial terms are in L(1/3,o(1)), they can be neglected, and we

retain only the term O(qB) for the remainder of the analysis.

The number of singular places is bounded by O((nd)2) = O(g2) using the

genus formula for a plane curve. They can be fully described in polynomial

time, by computing the desingularisation trees of the singular points (see for

instance [10]).

The non-singular places at infinity are included in the intersection of the

projective curve with the line Z = 0, which has at most O(nd) = O(g)

elements by B´ ezout’s theorem, and these are also computable in polynomial

time.

Page 10

10Andreas Enge and Pierrick Gaudry

So this step terminates with a factor base of size

t = O?nqB?= L(1/3,ρ + o(1))

that is computed in time L(1/3,ρ + o(1)).

3. To estimate the smoothness probability of divϕ under Heuristic 1, we need

to compute the degree of its affine part. Denote the affine degree of a divisor

by degaff. Let σ1,...,σnbe the different embeddings of Fq(C) into its Galois

closure (that exists because the function field extension is assumed to be

separable). The σi fixing Fq(X), they send affine to affine and infinite to

infinite prime divisors. Hence, all the degaff(ϕσi) are the same and given by

degaffϕ =1

ndegaffNFq(C)/Fq(X)(ϕ) = degXN(ϕ).

The norm of ϕ is computed as N(ϕ) = ResY(ϕ,Yn+F(X,Y )), and its degree

in X is bounded from above by

degXϕ · degYC + degYϕ · degXC = nm + d.

The divisor of ϕ is B-smooth if and only if its norm is; this test as well

as the decomposition of a smooth divϕ into prime divisors boils down to a

factorisation of the norm in Fq[X] and takes random polynomial time.

Let τ = (n0σ+d0)/3. Applying Propositions 4 and 5 under Heuristic 1 with

nm + d ≤ 3τg2/3M1/3in the place of ν and B = ⌈ρg1/3M2/3⌉ in the place

of µ shows that a relation is obtained on average in time L

so that this step takes overall

?

1/3,τ

ρ+ o(1)

?

,

L

?

1/3,τ

ρ+ ρ + o(1)

?

.

4. and 5. Since all entries of the matrix are of bit size polynomial in glogq, its

rank and Smith normal form can be computed in quartic time according to

[16, Proposition 8.10], that is in

L(1/3,4ρ+ o(1)).

The total running time of the algorithm thus becomes

L

?

1/3,max

?τ

ρ+ ρ,4ρ

?

+ o(1)

?

with τ = (n0σ + d0)/3.

For any fixed σ (and thus τ), the value of ρ that minimises the running time

is ρ =?τ/3 and we get a complexity of L

Now τ is not a completely free parameter; it is connected to the success

probability of the algorithm. It is in fact not clear whether the algorithm has

a non-zero success probability at all; as in [1], it is already unknown whether

?

1/3,4√τ

√3+ o(1)

?

.

Page 11

An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves11

the principal divisors of the special form considered in Step 3. generate the full

relation lattice. The analysis of the proven subexponential algorithm in [5], for

instance, exploits the fact that the created relations are essentially uniformly

distributed among all possible relations in a hypercube of side length about

|JC(Fq)|. Since all our relations are sparse, this line of argumentation definitely

cannot be applied; as in [1], the non-negligible success probability of the algo-

rithm can only be conjectured (and notice also that it does not follow from a

smoothness assumption such as Heuristic 1).

A necessary condition for the success of the algorithm is nonetheless that the

number of potential functions ϕ tested for smoothness in Step 3. must be at least

as large as the number of tests, since otherwise the matrix is filled with redundant

multiple relations. Thus we need q2m≥ L

?

1/3,4√τ

√3

?

or, taking logarithms,

2σ ≥

4

√3

√τ =4

3

?

n0σ + d0,

which holds asymptotically for σ → ∞. Precisely, the optimal value of σ is the

positive solution of the quadratic equation σ2−4

9n0σ −4

9d0= 0.

5Computing discrete logarithms

In order to smooth the basis of the discrete logarithm and the element whose

logarithm is sought, we are going to perform a special-Q descent with a slightly

larger subexponentiality parameter 1/3 + ε. Let us first describe an algorithm

that does one step of the special-Q descent and that will be used as a building

block by the final algorithm.

Heuristic Result 7. Let Q be an affine prime divisor of the curve C of the

form div(u(X),Y −v(X)), with degu(X) ≤ logqL(1/3+t,c) for some constants

c > 0 and ε < t ≤ 1/3 − ε. There is an algorithm that finds a divisor R

equivalent to Q such that all prime divisors of R are either in F or have a

degree bounded by logqL(1/3 + t − ε,c′), and such that all these prime divisors

are of the form div(ui(X),Y − vi(X)). The heuristic expected running time is

bounded by L(1/3 + ε,cn0

c′ (1/3 + ε + o(1))).

Justification. Let us consider the set LQof functions of the form a(X)+b(X)Y

whose divisors contain Q in their support. In other words, this is the Fq[X]-lattice

LQ= {a(X) + b(X)Y : u(X)|a(X) + v(X)b(X)}.

A basis of this lattice is given by the two vectors b1= u(X) and b2= −v(X)+Y .

Hence,

LQ= {λ(X)b1+ µ(X)b2 : λ,µ ∈ Fq[X]}.

When λ and µ are taken of degree at most δ = logqL(1/3 + t,c), the function

ϕ corresponding to λ(X)b1+ µ(X)b2has the form a(X) + b(X)Y with a and b

Page 12

12Andreas Enge and Pierrick Gaudry

of degree ∆ ≤ 2logqL(1/3 + t,c). The degree of the norm of ϕ is then ∆n + d,

which is dominated by logqL(2/3+ t,cn0).

We rely now on Heuristic 1 that says that the zero divisor of the function has

the same smoothness properties as a random effective divisor of the same degree,

and apply Proposition 4. Therefore the expected number of functions one has to

try before having found one whose divisor is logqL(1/3 + t − ε,c′)-smooth is

?

The fact that the prime divisors that we obtain are of the same form as Q

comes from the shape of the function we have chosen.

It remains to check that the number of functions we can test in the lattice is

large enough compared to this expected number of tests. With our choice of δ,

the size of the sieving space is L(1/3+t,2c), which is larger than any L(1/3+ǫ)

since t is greater than ε.

L1/3 + ε,cn0

c′(1/3 + ε + o(1))

?

.

⊓ ⊔

This result suffices to carry out a full descent if one can initialise the process

and finish it once smoothness is reached up to a t < ε. The next two heuristic

results explain these steps.

Heuristic Result 8. Assume that ρ > (1

divisor of C of the form div(u(X),Y − v(X)), with degu(X) ≤ logqL(1/3 +

t,c), for some constants c > 0 and 0 < t ≤ ε. There is an algorithm that

finds a divisor R equivalent to Q such that all prime divisors of R are in F

(defined with this value of ρ), and such that all these prime divisors are of the

form div(ui(X),Y − vi(X)). The heuristic expected running time is bounded by

L

?

Justification. Let us consider the same lattice LQas in the proof of Proposition 7.

Assume that λ and µ are taken of degree at most δ = logqL(1/3 + t,c), then,

as before, the norm of the corresponding functions are of degree bounded by

logqL(2/3 + t,cn0). Using again Heuristic 1, one gets by Proposition 4 that a

logqL(1/3,ρ)-smooth divisor can be obtained in heuristic expected time

3+ ε)n0

2. Let Q be an affine prime

1/3 + t,(1/3 + t)cn0

ρ+ o(1)

?

.

L

?

1/3 + t,(1/3 + t)cn0

ρ

+ o(1)

?

.

One has to check that we have enough possibilities for λ and µ to cover this

search. The sieving space is q2δ= L(1/3 + t,2c). Therefore it is large enough if

2c > (1/3 + t)cn0

our hypothesis on ρ.

ρ, that is if ρ > (1/3 + t)n0

2. Since ε > t, this is guaranteed by

⊓ ⊔

Heuristic Result 9. Let D be a degree 0 divisor and?

into prime divisors such that?

finds a divisor R equivalent to D such that all prime divisors of R are of the

form div(ui(X),Y − vi(X)) with degui(X) ≤ logqL(2/3 − ε,c). The heuristic

expected running time is bounded by L(1/3 + ε,(1/3 + ε)1

PePP its decomposition

P|mP| ∈ O(g). Then there is an algorithm that

c+ o(1)).

Page 13

An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves 13

Justification. In order to smooth D, we apply the classical Hafner-McCurley

strategy: a random linear combination of elements of the factor base is added to

D, and the obtained divisor is tested for smoothness. Each test takes polynomial

time since the effective group law in the Jacobian reduces to computing Riemann-

Roch spaces as in [12].

Following Heuristic 2, the additional restriction on the form of the prime

divisors has no influence on the running time, and the desired result follows

from Proposition 4.⊓ ⊔

Armed with these heuristic partial smoothing results, we can now derive a

full special-Q descent algorithm. Let us fix a constant ε > 0, a parameter of

the algorithm. This ε is to be thought of as small (and of course ε < 1/6). The

algorithm assumes that Algorithm 6 has been run as a precomputation, with a

value of ρ that is larger than a bound given below. Similarly, the constants c0

and cKare made explicit below.

Algorithm 10 (Discrete logarithm).

1. Use Heuristic Result 9 to build a list L of prime divisors of degree at most

logqL(2/3−ε,c0), such that if we know their discrete logarithms, the discrete

logarithm of D is implied.

2. While there is a Q in L of degree more than logqL(1/3+ε,cK), use Heuristic

Result 7 to replace Q in L by a list of prime divisors of degree bounded by a

subexponential function with parameter reduced by ε.

3. For each Q in L that is not in F, use Heuristic Result 8 to decompose Q

in F.

In order to analyse the algorithm, let us model it by a tree: the root is the

divisor D, its sons are the prime divisors coming from its decomposition using

Heuristic Result 9, then each internal node corresponds to a prime divisor and

its sons are the prime divisors obtained using Heuristic Result 7 or Heuristic

Result 8. The depth of the tree is bounded by 1/(3ε) since at each intermedi-

ate step the subexponential parameter is reduced by at least ε and one has to

cover a range of 1/3. The number of sons of each node is bounded by g. Hence

the total number of nodes is bounded by g1/(3ε). Since ε is a fixed constant,

this is a polynomial in g logq and therefore contributes only for a o(1) in the

subexponential complexity.

Let us allow a computation time of L(1/3 + ε,ν + o(1)), for fixed positive

constants ε and ν. Then the first step that uses Heuristic Result 9 can decompose

D in prime divisors of degree at most logqL(2/3−ε,c0) in time L(1/3+ε,ν+o(1))

for c0= (1/3 + ε)/ν. Going one step down the tree, one can decompose these

primes using Heuristic Result 7 in primes of degrees at most logqL(2/3−2ε,c1)

in the same time, for c1= c0n0(1/3 + ε)/ν. Going from level k to level k + 1 in

the tree will decompose in primes of degree at most logqL(2/3−(k +2)ε,ck+1)

in the same time, for ck+1 = ckn0(1/3 + ε)/ν. Finally, each last step will be

feasible in the same running time if ρ > cKn0(1/3+ε)/ν, where K is the depth

of the tree.

Page 14

14Andreas Enge and Pierrick Gaudry

This value of ρ is feasible and does not affect the overall complexity. It only

changes the exponent in the L(1/3) runtime of the group structure algorithm,

whose complexity remains negligible compared to the L(1/3 + ε) of the present

algorithm. Therefore, a suitable choice of ρ, c0and cK in Algorithm 10 results

in a running time of L(1/3 + ε,ν + o(1)) for any given ε and ν.

Choosing ε/2 in the place of ε (and an arbitrary ν) shows that even a com-

plexity of L(1/3 + ε,o(1)) is achievable.

Remark. In the analysis, we have remained silent about the exact nature of the

o(1) terms. As long as a fixed number of them is involved, this does not pose

any problem. But at first sight, since Heuristic Result 7 is used a non-constant

number of times, one apparently needs to make the o(1) terms explicit to check

that they do not sum up to something that is not tending to zero. However,

although the number of nodes in the tree of Algorithm 10 is in g1/(3ε), the o(1)

term is the same for any given level in the tree, so that actually only the depth

of the tree is important for these o(1)-terms considerations. The depth of the

tree is in 1/(3ε), which is a constant, so that we actually consider a constant

number of o(1) terms and need not make them explicit.

6 Extensions to wider families of curves

6.1Highly singular curves

Consider the case where the curve has an equation of the appropriate form,

but with a genus that is much smaller than nd. Then letting g′= nd, one may

apply the exact same algorithms yielding an L(1/3+ε) complexity. However, the

subexponential function is now taken with respect to qg′. This may still result

in a subexponential complexity in qg, depending on the relation between q, g

and g′.

6.2 Different balancing between n and d

Here we consider the case where n ≈ gαand d ≈ g1−αfor α ∈

shall just give an informal description of an algorithm that yields an L(1/3)

complexity for the group structure. Note that to obtain the claimed complexity

without ε, the bounds on n and d should resemble the ones we have in Section 4.

For instance, bounds of the form n ≤ n0gαM−αand d ≤ d0g1−αMαwould

suffice. For the sake of better readability, we content ourselves with approximate

bounds.

Let us restrict to Cab curves for simplicity, and let us call P∞ the unique

place at infinity. We proceed as in Algorithm 6, but the functions we consider

are of the more general form:

?1

3,1

2

?. We

ϕ = a0(X) + a1(X)Y + ··· + ak(X)Yk,

where the ai(X) have a degree bounded by gβand k is taken of the form gγ,

for some β and γ to be determined. Then the divisor of ϕ is of the form E −

(degE)P∞, with E effective of degree bounded by gγ+1−α+ gβ+α.

Page 15

An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves 15

Fix a smoothness bound of gβ+γ; with the usual heuristic, one can find E

that is smooth in time about gmax(α−γ,(1−α)−β). The consistency check that the

sieving space must be larger than the factor base yields the condition

β + γ ≥ max(α − γ,(1 − α) − β),

which gives β + 2γ ≥ α and γ + 2β ≥ 1 − α. This in turn imposes that β + γ ≥

1/3. Therefore, in this setting we can not hope to get something better than

an L(1/3) complexity. We now show that this complexity is achievable: taking

β = 2/3−α and γ = α−1/3, all the conditions are verified, and the complexity

is as announced.

In the particular case of α = 1/3, we recover β = 1/3 and γ = 0, which

corresponds to Algorithm 6. In the other extremal case α = 1/2, we get β = γ =

1/6.

If α gets smaller than 1/3, then the L(1/3) complexity is not achievable with

this algorithm. In fact, for each value of α ∈ [0,1/3], there is an L(x) complexity

with x ∈ [1/3,1/2], and finally, for hyperelliptic curves one essentially recovers

Adleman-Demarrais-Huang’s L(1/2) algorithm.

All of this concerns only the group structure. For the special-Q descent how-

ever, things get more complicated and the L(1/3 + ε) complexity is lost when

α is bigger than 1/3. More precisely, the same kind of computations as above

yields a complexity of L(α + ε) for α ∈ [1/3,1/2].

References

[1] L. M. Adleman, J. DeMarrais, and M.-D. Huang. A subexponential algorithm

for discrete logarithms over the rational subgroup of the jacobians of large genus

hyperelliptic curves over finite fields. In L. Adleman and M.-D. Huang, editors,

ANTS-I, volume 877 of Lecture Notes in Comput. Sci., pages 28–40. Springer–

Verlag, 1994.

[2] R. L. Bender and C. Pomerance. Rigorous discrete logarithm computations in

finite fields via smooth polynomials. In D. A. Buell and J. T. Teitelbaum, editors,

Computational Perspectives on Number Theory: Proceedings of a Conference in

Honor of A.O.L. Atkin, volume 7 of Studies in Advanced Mathematics, pages

221–232. American Mathematical Society, 1998.

[3] J.-M. Couveignes. Algebraic groups and discrete logarithm. In Public-key cryp-

tography and computational number theory, pages 17–27. de Gruyter, 2001.

[4] C. Diem. An index calculus algorithm for plane curves of small degree. In F. Heß,

S. Pauli, and M. Pohst, editors, ANTS-VII, volume 4076 of Lecture Notes in

Comput. Sci., pages 543–557. Springer–Verlag, 2006.

[5] A. Enge. Computing discrete logarithms in high-genus hyperelliptic Jacobians in

provably subexponential time. Math. Comp., 71:729–742, 2002.

[6] A. Enge and P. Gaudry. A general framework for subexponential discrete loga-

rithm algorithms. Acta Arith., 102:83–103, 2002.

[7] A. Enge and A. Stein. Smooth ideals in hyperelliptic function fields. Math. Comp.,

71:1219–1230, 2002.

Page 16

16Andreas Enge and Pierrick Gaudry

[8] P. Gaudry. An algorithm for solving the discrete log problem on hyperelliptic

curves.In B. Preneel, editor, Advances in Cryptology – EUROCRYPT 2000,

volume 1807 of Lecture Notes in Comput. Sci., pages 19–34. Springer–Verlag,

2000.

[9] P. Gaudry, E. Thom´ e, N. Th´ eriault, and C. Diem. A double large prime variation

for small genus hyperelliptic index calculus. Math. Comp., 76:475–492, 2007.

[10] G. Hach´ e. Construction effective de codes g´ eom´ etriques. PhD thesis, Universit´ e

de Paris VI, 1996.

[11] J. L. Haffner and K. S. McCurley. A rigorous subexponential algorithm for com-

putation of class groups. J. Amer. Math. Soc., 2(4):837–850, 1989.

[12] F. Heß. Computing Riemann-Roch spaces in algebraic function fields and related

topics. J. Symbolic Comput., 33:425–445, 2002.

[13] F. Heß. Computing relations in divisor class groups of algebraic curves over finite

fields. Preprint, 2004.

[14] E. Manstaviˇ cius. Semigroup elements free of large prime factors. In F. Schweiger

and E. Manstaviˇ cius, editors, New Trends in Probability and Statistic, pages 135–

153, 1992.

[15] V. M¨ uller, A. Stein, and C. Thiel. Computing discrete logarithms in real quadratic

congruence function fields of large genus. Math. Comp., 68(226):807–822, 1999.

[16] A. Storjohann.

Algorithms for Matrix Canonical Forms.

gen¨ ossische Technische Hochschule Z¨ urich, 2000.

PhD thesis, Eid-