Implementation of Index Calculus Attack for Hyperelliptic Curves of High Genera

Transcript

1 ,,, HCDLP),, F 3 H : y 2 = x 2g+1 + 1, HCDLP,, g = 74 J H F 3 ) HCDLP J H F 3 ) ) Implementation of Index Calculus Attack for Hyperelliptic Curves of High Genera Yasunori Kobayashi Tsuyoshi Takagi Graduate School of Systems Information Science, Future University Hakodate, 116-2, Kamedanakano-cho, Hakodate, Hokkaido, , Japan. Abstract Recently, pairngs over hyperelliptic curves have been getting more attentions due to novel protocols and their rich algebraic structures. The security of these pairings depends on both the discrete logarithm problem over hyperelliptic curves HCDLP) and that over finite fields. However, there are a few previous works which evaluate the security of the HCDLP with high genus by implementing them on computers. In this paper, we implement an efficient algorithm called index calculus method for solving the HCDLP of high genus hyperelliptic curve H : y 2 = x 2g over F 3. Then we solved the HCDLP over J H F 3 ) of g = 74, J H F 3 ) 2 120, in 2.3 days using Core 2 Quad2.66GHz), Core 2 Quad2.40GHz), and Core 2 Duo3.00GHz). 1 ID [6], [5],,, [19],,,., HCDLP), DLP) F p n DLP [12, 14], [1, 3] HCLDP, HCDLP,, HCDLP, p, q, g, 1994, Adleman [2]. Adleman, L p 2g+1[1/2, c], c 2.181, L N α, c) = exp clog N) α log log N) 1 α ) Flassenberg 1997,, [8]., Flassenberg, 40 Enge 2002,, L q g1/2, 6/ 5) [9]. 2002, Enge Gaudry L q g1/2, 2) [10]., F 3 H :

2 y 2 = x 2g Enge Gaudry [10],. C, gcc gnu mphttp://gmplib.org/) D 1, D 2 J H F p ), J H F p ) = p g + 1, smooth bound B N, D 2 = nd 1 n [0, J H F p ) 1] Z,,, 3, smooth, Cantor-Zassenhaus Lanczos [16], F B) F B) = O3 B ) smooth, exp g log logqg ) 2B )., Core 2 Quad 2.40GHz) 1, Core 2 Quad 2.66GHz) 1, Core 2 Duo 3.00GHz) 1, 3 10 ) g = 74, B = 13, 1.3 F B) = 96, 124,, Core 2 Quad 2.66GHz) J H F 3 ) ) HCDLP, 2, 3 [10] 4, 5, HCDLP 2, p, q = p m, m N, C F q g N C : y 2 = fx), 1), fx) F q [x] F, degf) = 2g + 1, C, m i P m i O, m i N, m i g 2) P i C P i C P i C, O, 2) F q C, J C F q ) Hasse, J C F q ) q 1) 2g J C F q ) q + 1) 2g 3) 2.1 Mumford, Mumford [18], 2) D J C F q ), P i = α i, β i ) F, Ux), V x) F q [x] Uα i ) = 0, V α i ) = β i, Ux) fx) V x) 2, degv ) degu) g, Ux) : monic 4) D 4) [Ux), V x)] F q [x] 2, Mumford D = [Ux), V x)] wtd) = degu), Ux) F q D prime) Mumford D = [Ux), V x)] D = [Ux), V x)] Mumford, Cantor [7] 2.2, r r J C F q ), k r q k 1 k k G 1 = J C F q )[r], G 2 = J C F q k)/rj C F q k), G 3 = F /F ) r q k q k, C Tate 2 1, : G 1 G 2 G 3 Tate η T [4], Ate [13] 2.3 D 1 J C F q ), D 2 D 1, D 2 = αd 1 α {0, 1, 2,, D 1 1}, Hyperelliptic Curves Discrete Logarithm Problem, HCDLP), α α = log D1 D 2 ) 3 Enge Gaudry [10] C F q g D 1 J C F q ), D 2 D 1, D 1, smooth-bound B N, log D1 D 2 ) 1), 2), 3) 3

3 3.1,, smooth-bound B N F B) = {D J C F q ) D : prime, wtd) B} 5), F B) F q [x] n νn), νn) = n 1 k n µk)q n/k [17]., µk) degu) < g Ux) F q [x], 4) V x) F q [x], X 2 fx) mod Ux)), degx) < degu) X F q [x], Ux), F q degu) X 2 = fx) mod Ux)), F q {a F q dega) < degu)},, 1/2, F B) 1 2 B νn) n=1, k 2 q n/k q n/2, q n µk)q n/k = q n + µk)q n/k k n q n k n,k 2, F B) B q n n=1 2n, 3.2 B-smooth F B) = Oq B ) 6) B-smooth, J C F q ) D B- smooth D = [Ux), V x)], Ux) Ux) = ΠU i x) ci, 4) D D[Ux), V x)] = c i P i, P i = [U i x), V i x)] 7) 7), P i smooth bound B wtp i ) B, D B-smooth, J C F q ) D B- smooth, J C F q ) B-smooth SB) J C F q ) B-smooth Enge Stein ρ > 0, smooth bound B, B = log q L q g1/2, ρ) 8) SB) q g L q g 1/2, 1 ) 2ρ + o1) 9) [11]. L N c, α), N > 0, c [0, 1], α > 0 L N c, α) = expclog N) α log log N) 1 α ), 9) o1), N o1) 0, 8) smooth bound B, J C F q ) D B-smooth, 3), 9) SB)/ J C F q ) L q g 1/2, 1 ) 10) 2ρ 8), 10) B exp g log ) logqg ) 11) 2B 3.3,,. F B) P 1, P 2,, P F B), F B) = {P 1, P 2,, P F B) }, B-smooth D = c i P i SB), v v = c 1, c 2,, c F B)) T, F B) + 1) 1. α, β [0, J C F q ) 1] Z, D = αd 1 + βd 2 2. D B-smooth smooth

4 3. D B-smooth, α, β,v) smooth, D = [Ux), V x)] Ux), B, 10), F B)+1), smooth F B) + 1)/L q g1/2, 1 2ρ )) 1,, L q g 1/2, ρ + 1 ) 2ρ + o1) 12) 3.4,,, F B)+ 1 v 1, v 2,, v F B)+1, v i = c i,1, c i,2,, c i, F B) ) T, F B)) F B) + 1) A A = v 1,, v F B)+1 ) c 1,1 c F B)+1,1 c 1,2 c F B)+1,2 =..... c 1, F B) c F B)+1, F B) v i g A, g, AX = 0 mod J C F q ) 13) F B) + 1) X, ranka) F B) < X ), 13) Z/J C F q ), 13) X Z/J C F q )Z) F B)+1, J C F q ) 1) A, 13) Lanczos [16], Wiedemann [21] Lanczos, )) 1 O F B) 2 ) = O L q g 2, 2ρ 14) 13) X = x 1, x 2,, x F B)+1 ), F B)+1 i=0 x i α i D 1 + βd 2 ) = 0, x i β i )D 2 = x i α i )D 1, log D1 D 2 ) F B)+1 i=0 x i α i log D1 D 2 ) = F B)+1 mod J C F q ) i=0 x i β i 3.5 smooth-bound B 8), 12), 14), 1 L q g 2, ρ + 1 ) ) 1 + L q g 2ρ 2, 2ρ { 1 L q g 2, max ρ + 1 }) 2ρ, 2ρ { } max ρ + 1 2ρ, 2ρ ρ = 1/ 2 2, 4 L q g1/2, 2) 15), [10] 2, F p g H : y 2 = x 2g g + 1, p mod 2g + 1 F 2g+1 p, g, distortion [20], 2. p, g, J H F p ) = p g + 1,, 2, p = 3 1) F p [x], CSS2008 J H F 3 ) Tate [22] 2), g 4.1 C, gcc, gnu mphttp://gmplib.org/)

5 Core 2 Quad Q GHz), 3.25 GB RAM, Windows XP 1, Core 2 Quad2.66 GHz), 4.00 GB RAM, Windows Vista 1, Core 2 Duo3.00 GHz), 4.00 GB RAM, Windows XP , p 3, g, smooth-bound B 2 g, g = 74 J H F 3 ) 2 120, g, g = 26, 56, 74, J H F 3 ) = 3 g , 80, 120 smooth-bound B, 8), 15) B = L p g1/2, 1/ 2), g = 26, 56, 74 B 7,11,13, B, smooth, B = 10, 11, 12, 13, 14, 15, 16, [Ux), V x)] = [Ux), V x)], [Ux), V x)] F B), [Ux), V x)] F B), F B) 1, B, F B) 1 F B) = O3 B ), 6) 1 B F B) 10 4, , , , , , ,090, ,888,320 [Ux), V x)], 4) V x) Ux), F B) [Ux), V x)] Ux), F B) l N, D 1, D 2 J H F 3 ) {D 1, 2D 1, ld 1, D 2, 2D 2, ld 2 } l = 1000 S i, T i J H F 3 ), i = 0, 1, 2, ), D 1, D 2 s, t [0, J H F 3 ) 1] Z, S 0 = sd 1, T 0 = td 2, α i, β i {1, 2,, l}, S i+1 = S i + α i D 1, T i+1 = T i + β i D 2 S i, T i, S i, T i D = S i + T i, smooth D B-smooth D = [Ux), V x)], smooth Cantor-Zassenhaus Ux), distinct degree factorizationddf) B smooth Ux) = ΠU i x) mi, U i F B), m i 0 m i F B), g m i = 0, m i m i = 1 B-smooth D = [Ux), V x)], v = c 1, c 2,, c F B) ) T, m i = 0 i, c i = 0 m i 0 i ax) = V x) mod U i x), ax) 1 0 c i = m i, ax) 1 c i = m i Lanczos., Structured Gaussian EliminationSGE)[15] 13) X, SGE 4.4, 4.2 g, B, 1 10, g = 26, 3 g = 56, 3 g = 74, P rb) smooth,, P rb) = 10,000/10,000 smooth ) ave 1,, ave = 10,000 )/10,000 total,, total = F B) + 1)ave smooth, 11),, 12), DDF B smooth

6 2 g = 26 case J H F 3 ) 2 40 ) B P rb) aveµsec) totalsec) g = 56 case J H F 3 ) 2 80 ) B P rb) avesec) totalhour) g = 74 case J H F 3 ) ) B P rb) avesec) totalday) g = 74, B = 13, g = 74 smooth bound B B = L 3 741/2, 1/ 2) = 13, ) 1.3, ) 2.3 g = 74, B = 13 J H F 3 ) HCDLP 5, F 3 H : y 2 = x 2g+1 + 1, smooth, Cantor-Zassenhaus Lanczos, smooth bound B smooth, exp g log logqg ) 2B, g = 7, B = 13, 120 HCDLP [1] L. M. Adleman, The Function Field Sieve, ANTS-I, LNCS 877, pp , [2] L. M. Adleman, J. DeMarrais and M. D. A. Huang, A Subexponential Algorithm for Discrete Logarithms over the Rational Subgroup of the Jacobians of Large Genus Hyperelliptic Curves over Finite Fields, ANTS- I, LNCS 877, pp.28-40, [3] L. M. Adleman and M. D. A. Huang. Function Field Sieve Method for Discrete Logarithms over Finite Fields, Inform. and Comput., 151, 12, pp.5-16, [4] P. S. L. M. Barreto, S. Galbraith, C. heingeartaigh and M. Scott, Efficient Pairing Computation on Supersingular Abelian Varieties, Designs, Codes and Cryptography, 42, 3, pp , ) [5] D. Boneh, G.D. Crescenzo, R. Ostrovsky and G. Persiano, Public Key Encryption with Keyword Search, EUROCRYPT 2004, LNCS 3027, pp , [6] D. Boneh and M. Franklin, Identity Based Encryption from the Weil Pairing, CRYPTO 2001, LNCS 2139, pp , [7] D.G. Cantor, Computing in the Jacobian of a Hyperelliptic Curve, Math. Comp., 48, 177, pp , [8] R. Flassenberg and S. Paulus, Sieving in Function Fields, Experiment. Math., 8, pp , Preliminary Version: Technical Report, TI-97-13, Darmstadt University of Technology, 1997.) [9] A. Enge, Computing Discrete Logarithm in High- Genus Hyperelliptic Jacobians in Provably Subexponential Time, Math. Comp., 71, pp , [10] A. Enge and P. Gaudry, A General Framework for Subexponential Discrete Logarithm Algorithm, Acta Arith, 102, pp , [11] A. Enge and A. Stein, Smooth Ideals in Hyperelliptic Function Fields, Math. Comp., 71, pp , [12] D. M. Gordon, Discrete Logarithms in GFp) Using the Number Field Sieve, SIAM Journal on Discrete Mathmatics 6, 1, pp , [13] R. Granger, F. Hess, R. Oyono, N. Thériault, and F. Vercauteren, Ate Pairing on Hyperelliptic Curves, EUROCRYPT 2007, LNCS 4515, pp , [14] A. Joux, R. Lercier, N. Smart and F. Vercauteren, The Number Field Sieve in the Medium Prime Case, CRYPTO 2006, LNCS 4117, pp , [15] B. A. LaMacchia and A. M. Odlyzko, Solving Large Sparse Linear Systems over Finite Fields, CRYPTO 90, LNCS 537, pp , [16] C. Lanczos, Solution of Systems of Linear Equations by Minimized Iterations, J. Res. Nat. Bur. Stand, 49, pp.33-53, [17] R. Lidl and H. Niederreiter, Introduction to Finite Field and Their Applications, Cambridge University Press, pp.85-86, [18] D. Mumford, Tata Lectures on Theta II, Birkhaeuser, [19] T. Okamoto and K. Takashima Homomorphic Encryption and Signatures from Vector Decomposition, Pairing 2008, LNCS 5209, pp.57-74, [20] K. Takashima, Efficiently Computable Distortion Maps for Supersingular Curves, ANTS VIII, LNCS 5011, pp , [21] D. H. Wiedemann, Solving Sparse Linear Equations over Finite Fields, IEEE Trans. Information Theory, IT-32, pp.54-62, [22],, Tate, CSS 2008,, pp , HCDLP D 1 = [U 1 x), V 1 x)], D 2 = [U 2 x), V 2 x)], α = log D1 D 2 ), n ax) = n i=0 c ix i, a = c n c n 1 c 1 c 0 U 1 = V 1 = U 2 = V 2 = α =