arXiv:cs/0703032v1 [cs.CR] 7 Mar 2007
An L(1/3 + ε) Algorithm for the Discrete
Logarithm Problem for Low Degree Curves
Andreas Enge1and Pierrick Gaudry2
1INRIA Futurs & Laboratoire d’Informatique (CNRS/UMR 7161)
´Ecole polytechnique, 91128 Palaiseau Cedex, France
2LORIA (CNRS/UMR 7503), Campus Scientifique, BP 239
54506 Vandœuvre-l` es-Nancy Cedex, France
Abstract. The discrete logarithm problem in Jacobians of curves of
high genus g over finite fields Fq is known to be computable with subex-
ponential complexity Lqg(1/2,O(1)). We present an algorithm for a fam-
ily of plane curves whose degrees in X and Y are low with respect to the
curve genus, and suitably unbalanced. The finite base fields are arbitrary,
but their sizes should not grow too fast compared to the genus. For this
family, the group structure can be computed in subexponential time of
Lqg(1/3,O(1)), and a discrete logarithm computation takes subexponen-
tial time of Lqg(1/3 + ε,o(1)) for any positive ε. These runtime bounds
rely on heuristics similar to the ones used in the number field sieve or
the function field sieve algorithms.
The discrete logarithm problem in algebraic curves over finite fields has been
receiving particular attention since elliptic curves and subsequently Jacobian
groups of further algebraic curves have been proposed for discrete logarithm
based public key cryptosystems. Although it is now clear that high genus curves
are unsuitable for cryptographical use, it remains crucial to study algorithms for
solving the discrete logarithm problem in those curves for several reasons. The
first reason is that having a better understanding of the situation for high genus
curves might lead to algorithmic improvements also in the small genus case. The
second reason is that the Weil descent strategy of attacking the discrete loga-
rithm problem in elliptic curves defined over extension fields leads to a discrete
logarithm problem in the Jacobian of a high genus curve. Therefore a better al-
gorithm for high genus discrete logarithms becomes naturally a potential threat
for some elliptic curves.
It turned out very early that the discrete logarithm problem in high genus
hyperelliptic curves (for instance in the sense that the size q of the base field
is fixed, while the genus g tends to infinity) can be solved by a subexponential
algorithm of complexity Lqg(1/2,O(1)). The first such algorithm was proposed
in . As other subexponential algorithms, it consists of fixing a factor base
of small prime elements (here, prime divisors) and of creating relations that
correspond to the zero element modulo an equivalence relation (here, equivalence
2Andreas Enge and Pierrick Gaudry
of divisors modulo principal divisors). After collecting sufficiently many relations
and somehow introducing the base of the discrete logarithm and the element
whose logarithm is sought, linear algebra yields the desired result. Assuming
that smooth elements, that are elements decomposing over the factor base, have
the same density as for instance smooth integers or polynomials, such algorithms
usually end up with a complexity of Lqg(1/2,O(1)).
The algorithm in  creates relations by randomly taking low degree func-
tions (that are linear in Y for the curve Y2= f(X)), whose divisors are relations.
Its analysis is only heuristic. The first proven algorithms are given in  for
the infrastructure of real-quadratic hyperelliptic function fields and in  for
Jacobians of hyperelliptic curves. Relations are obtained in a process similar to
that of  by taking random linear combinations of factor base elements, re-
ducing modulo the equivalence relation and checking for smoothness. A rigorous
analysis is derived from the lower bound on the density of smooth divisors in
. A generic description of a similar algorithm can be found in ; it applies to
all class groups in which a smoothness result is known. Heuristically, it obtains
a running time of Lqg(1/2,O(1)) for the discrete logarithm problem in arbitrary
high genus curves, the smoothness result needed for a proof of the complexity is
however only available for hyperelliptic curves.
A proven algorithm of complexity Lqg(1/2+ε,O(1)) for very general curves
over a fixed field Fqand with genus g tending to infinity (with the only restriction
that the curves contain a rational point and that the cardinality of the Jacobian
group is bounded by qg+O(√g)) is given in . Unlike previous algorithms, it
appears to be specific to algebraic curves and relies on a double randomisation,
taking random combinations of factor base elements and a random function
in a Riemann–Roch space. A relation is obtained whenever the divisor of this
function is smooth. A more general algorithm is proposed in  that yields a
proven Lqg(1/2,O(1)) complexity without any restriction on the input curve.
Another line of research on the discrete logarithm problem for algebraic
curves, started in  and not pursued in this article, consists of fixing g and
having q tend to infinity. This leads to algorithms that are exponential, but
faster than generic algorithms of square root complexity as soon as g ≥ 3, see
In the light of algorithms of complexity L(1/3) for the discrete logarithm
problem in finite fields as well as for factoring integers, it has been an open
problem to determine whether this complexity can be achieved also for algebraic
curves. In this article, we present the first probabilistic algorithm of heuris-
tic complexity Lqg(1/3,O(1)) to compute the group structure of certain curves
whose total degree is relatively small compared to their genus. When introducing
the two elements of the Jacobian for which the discrete logarithm problem is to
be solved, some sacrifice has to be made; we obtain an algorithm of complexity
bounded by Lqg(1/3 + ε,o(1)) for any positive constant ε.
The relation collection phase is the same as in  and consists of looking for
smooth divisors of functions linear in Y . By applying it to the curves of our spe-
cial family, one readily obtains a lower degree of the affine part of the intersection
An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves3
divisor than in the general case, from which a complexity of Lqg(1/3,O(1)) is
derived. For smoothing the two divisors involved in the discrete logarithm prob-
lem, a process is employed that is similar to the one used in the number field
sieve or in the function field sieve. This is the general special-Q descent strategy
(also related to the so-called lattice sieving). Each divisor is partially smoothed
into prime divisors of degree less than the starting divisor. Then each such prime
divisor Q is smoothed again into smaller prime divisors, and we iterate until ev-
ery divisor is rewritten in terms of elements of the factor base. However, in our
case it is necessary to add an arbitrarily small constant ε to the 1/3 parameter
to obtain a proper descent phenomenon; otherwise, the process would get stuck
after one step.
Let us mention that subsequently to our algorithm, Diem has presented at
the 10th Workshop on Elliptic Curve Cryptography (ECC 2006) an algorithm
based on similar ideas, but with a quite different point of view. He manages to
obtain a complexity of L(1/3,O(1) for the discrete logarithm phase, for which
our algorithm takes L(1/3+ε,o(1)). We will show how to reach a complexity of
L(1/3,O(1)) for discrete logarithms in our setting in the long, journal version.
Acknowledgement. We thank Claus Diem for his careful reading of our article
and many useful remarks.
Before describing our algorithm with all its technical details on a general class
of curves, we sketch in this section the main idea yielding a complexity of
Lqg(1/3,O(1)) for the relation collection phase for a restricted class of curves.
We provide a simplified analysis by hand waving; Section 3 is devoted to a more
precise description of the heuristics used and of the smoothness properties needed
for the analysis.
Let Fqbe a fixed finite field. We consider a family of Cabcurves over Fq, that
is, curves of the form
C : Yn+ Xd+ f(X,Y )
without affine singularities such that gcd(n,d) = 1 and any monomial XiYj
occurring in f satisfies ni + dj < nd. Such a curve has genus g =
we assume that g tends to infinity, and that n ≈ g1/3and d ≈ g2/3(we use
the symbol ≈, meaning “about the same size” with no precise definition). The
non-singular model of a Cab curve has a unique point at infinity, and it is Fq-
rational; so there is a natural bijection between degree zero divisors and affine
divisors, and in the following, we shall only be concerned with effective affine
divisors. Choose as factor base F the Lqg(1/3,O(1)) prime divisors of smallest
degree (that is, the prime divisors up to a degree of B ≈ logqLqg(1/3,O(1))).
To obtain relations, consider functions linear in Y of the form
ϕ = a(X) + b(X)Y
4Andreas Enge and Pierrick Gaudry
with a, b ∈ Fq[X], gcd(a,b) = 1 and dega, degb = δ ≈ g1/3. Whenever the affine
part div(ϕ) of the divisor of ϕ is smooth with respect to the factor base, it yields
a relation, and we have to estimate the probability of this event.
Let N be the norm of the function field extension Fq(C) = Fq(X)[Y ]/(Yn+
Xd+ f(X,Y )) relative to Fq(X). The norm of ϕ is computed as
N(ϕ) = N(b)N
= (−a)n+ bnXd+ f∗(X),
+ Xd+ f
where each monomial XiYjoccurring in f is transformed into a monomial
Since ϕ is linear in Y , all prime divisors it contains are totally split over
Fq(X), and ϕ is B-smooth if and only if its norm is. We have
degXN(ϕ) ≤ max(ndega,ndegb + d) = nδ + d ≈ g2/3.
Heuristically, we assume that the norm behaves like a random polynomial of
degree about g2/3. Then it is B-smooth with probability 1/Lqg(1/3,O(1)) (this
is the same theorem as the one stating that a random polynomial of degree
g is logqLqg(1/2,O(1))-smooth with probability 1/Lqg(1/2,O(1)), cf., for in-
stance, Theorem 2.1 of ). Equivalently, we may observe that deg(div(ϕ)) =
degX(N(ϕ)) and assume heuristically that div(ϕ) behaves like a random ef-
fective divisor of the same degree. Then the standard results on arithmetic
semigroups (cf. Section 3) yield again that div(ϕ) is smooth with probability
Thus, the expected time for obtaining |F| = Lqg(1/3,O(1)) relations is
Lqg(1/3,O(1)), which is also the complexity of the linear algebra step for com-
puting the Smith normal form and thus the group structure of the Jacobian. The
complexity of the discrete logarithm problem is not considered here, an analysis
for the full algorithm is given in Section 5.
It remains to show that the search space is sufficiently large to yield the re-
quired Lqg(1/3,O(1)) relations, or otherwise said, that the number of candidates
for ϕ is at least Lqg(1/3,O(1)). The number of ϕ is about
q2δ= q2g1/3= exp(2logqg1/3)
< exp(2(g1/3(logq)1/3)(log(g logq))2/3) = Lqg(1/3,O(1)).
The previous inequality in the place of the desired equality shows that a
more rigorous analysis requires a more careful handling of the logq factors; in
particular, δ has to be slightly increased. Moreover, the constant exponent in
the subexponential function needs to be taken into account. This motivates the
following section, in which we examine in more detail the smoothness heuristics
and results that are needed for the algorithm.
An L(1/3 + ε) Algorithm for Discrete Logarithm for Low Degree Curves5
The algorithm presented in this article relies on finding relations as smooth
divisors of random polynomial functions of low degree. We suppose that all
curves are given by an absolutely irreducible plane affine model
C : F(X,Y )
with F ∈ Fq[X,Y ], where Fqis the exact constant field of the function field of C.
The factor base F consists essentially of the places of degree bounded by some
parameter µ, with a few technical modifications. Precisely, F is composed of the
– the places corresponding to the resolution of singularities, regardless of their
degrees, whose number is bounded by
cluding them in F, the algorithm can be described as if the curves were
– the infinite places corresponding to non-singularities, regardless of their de-
grees, whose number is bounded by d by B´ ezout’s theorem. By adding them,
it becomes sufficient to only examine the affine part of any divisor.
– places of degree bounded by some parameter µ and of inertia degree 1 with
respect to the function field extension Fq(X)[Y ]/(F) over Fq(X). Otherwise
said, places corresponding to prime ideals of the form (u,Y − v) with u ∈
Fq[X] irreducible of degree at most µ and v ∈ Fq[X] of degree less than
degu; the inertia degree is in fact the degree of the second generator in Y .
Due to the way relations are obtained in the algorithm, no places of higher
inertia degree may occur.
with d = degF. By in-
A divisor is called F-smooth if it can be decomposed over the factor base;
thus only its affine part plays a role, and for polynomial functions, this is an
effective (i.e. non-negative) divisor. An effective divisor is called µ-smooth if it is
composed only of places of degree up to µ. To be able to analyse the smoothness
probability, we need the following reasonable assumption.
Heuristic 1. Let D be the divisor of a uniformly randomly chosen polynomial
of the form b(X)Y −a(X) and ν the degree of its affine part. Then the probability
of D to be F-smooth is the same as that of a random effective divisor of degree
ν to be µ-smooth.
Heuristic 1 covers the relation collection phase. For computing discrete log-
arithms, arbitrary non-principal divisors need to be smoothed, and another as-
sumption is needed.
Heuristic 2. The probability of a uniformly randomly chosen effective divisor
of degree ν to be F-smooth is essentially the same as that of being µ-smooth.
Heuristic 2 claims in fact that places of inertia degree larger than 1 do not
play a role for smoothness considerations. In the analogous case of number fields