[Paper Review] Discrete logarithm computations over finite fields using Reed-Solomon codes

Daniel Augot, François Morain|arXiv (Cornell University)|Feb 20, 2012

Coding theory and cryptography31 references3 citations

TL;DR

This paper proposes a novel algorithm, RSDL, for computing discrete logarithms over finite fields using Reed-Solomon code decoding instead of traditional polynomial factorization. By framing the relation collection phase as a unique decoding problem over $\mathbb{F}_q$, the method achieves a complexity of $\tilde{O}(h! \cdot q^2)$ operations over $\u005cmathbb{F}_q$ for fixed $h$ and growing $q$, with practical improvements via helper fields and incremental decoding.

ABSTRACT

Cheng and Wan have related the decoding of Reed-Solomon codes to the computation of discrete logarithms over finite fields, with the aim of proving the hardness of their decoding. In this work, we experiment with solving the discrete logarithm over GF(q^h) using Reed-Solomon decoding. For fixed h and q going to infinity, we introduce an algorithm (RSDL) needing O (h! q^2) operations over GF(q), operating on a q x q matrix with (h+2) q non-zero coefficients. We give faster variants including an incremental version and another one that uses auxiliary finite fields that need not be subfields of GF(q^h); this variant is very practical for moderate values of q and h. We include some numerical results of our first implementations.

Motivation & Objective

• To explore the use of Reed-Solomon decoding as an alternative to polynomial factorization in the index calculus method for discrete logarithm computation.
• To reduce the complexity of the relation collection phase in discrete logarithm algorithms by leveraging coding-theoretic techniques.
• To investigate whether decoding Reed-Solomon codes can yield efficient relations in the discrete logarithm problem over finite fields.
• To improve practical performance through the use of auxiliary helper fields and incremental decoding strategies.

Proposed method

• The method replaces traditional polynomial factorization with unique decoding of Reed-Solomon codes to find relations of the form $X^u \equiv \prod_{a \in A}(X - a) \mod Q(X)$, where $A$ is a subset of $\mathbb{F}_q$.
• Relations are collected by decoding $X^u \bmod Q(X)$ as a codeword in a Reed-Solomon code over $\mathbb{F}_q$ with support $S = \mathbb{F}_q$, using unique decoding for $\tau \leq \lfloor (q - k)/2 \rfloor$.
• An incremental variant is introduced to speed up the relation collection phase by reusing intermediate computations across multiple $u$ values.
• A helper field approach uses an auxiliary finite field $\mathbb{F}_{q^e}$ with $e$ dividing $h$ to reduce the size of the decoding matrix, improving efficiency by exploiting Galois structure.
• The algorithm constructs a linear system over $\mathbb{Z}/(q^h - 1)\mathbb{Z}$ from the decoded relations, which is then solved using standard linear algebra techniques.
• The complexity is analyzed as $\tilde{O}(h! \cdot q^2)$ operations over $\mathbb{F}_q$, with a faster variant using helper fields reducing the effective constant factor.

Experimental results

Research questions

• RQ1 Can Reed-Solomon decoding be effectively used to replace polynomial factorization in the relation collection phase of index calculus algorithms for discrete logarithms?
• RQ2 What is the asymptotic complexity of using Reed-Solomon decoding for discrete logarithm computation in $\mathbb{F}_{q^h}$ for fixed $h$ and growing $q$?
• RQ3 How do helper fields—especially those not necessarily subfields of $\mathbb{F}_{q^h}$—improve the practical efficiency of the decoding-based approach?
• RQ4 Can incremental decoding techniques significantly reduce the time required to collect sufficient relations in the discrete logarithm computation?
• RQ5 What is the impact of code parameters such as $q$, $h$, and $e$ on the success probability and overall performance of the algorithm?

Key findings

• The RSDL algorithm achieves a complexity of $\tilde{O}(h! \cdot q^2)$ operations over $\mathbb{F}_q$ for fixed $h$ and growing $q$, which is competitive with known methods in the asymptotic regime.
• The use of helper fields, particularly $\mathbb{F}_{q^e}$ with $e$ dividing $h$, reduces the number of columns in the decoding matrix from $q^e$ to approximately $q^e/e$, significantly improving practical performance.
• For $\mathbb{F}_{7^5}$ with a helper field $\mathbb{F}_{7^2}$, the success probability of decoding a relation is approximately 0.217, as confirmed by numerical experiments.
• The incremental version of RSDL reduces the time for relation collection, with benchmarks showing a 10x speedup over non-incremental versions in some cases.
• In experiments with $p=65537$, $h=7$, the linear algebra phase took 124,095 seconds, dominated by the size of the largest prime factor $P$ of $p^h - 1$, which was $\log_2 P \approx 97$. $\tilde{O}(h! \cdot q^2)$
• For $\mathbb{F}_2^{31}$ with helper field $\mathbb{F}_{2^8}$, the linear algebra phase took only 0 seconds, indicating that the system was small or easily solvable due to favorable structure.