[Paper Review] On the discrete logarithm problem in finite fields of fixed characteristic

Robert Granger, Thorsten Kleinjung+1 more|IACR Cryptology ePrint Archive|Jul 6, 2015

Coding theory and cryptography4 citations

TL;DR

This paper presents a randomized algorithm that solves the discrete logarithm problem (DLP) in finite fields of fixed characteristic in expected quasi-polynomial time. By exploiting algebraic structures in extension fields ${\mathbb{F}}_{p^n}$, the method achieves time complexity $\exp\big{(}(1/\log 2+o(1))( \log n)^2\big{)}$, proving that for every prime $p$, there are infinitely many explicit extensions where DLP is solvable in quasi-polynomial time.

ABSTRACT

For $q$ a prime power, the discrete logarithm problem (DLP) in $\mathbb{F}_{q}$ consists in finding, for any $g \in \mathbb{F}_{q}^{ imes}$ and $h \in \langle g angle$, an integer $x$ such that $g^x = h$. We present an algorithm for computing discrete logarithms with which we prove that for each prime $p$ there exist infinitely many explicit extension fields $\mathbb{F}_{p^n}$ in which the DLP can be solved in expected quasi-polynomial time. Furthermore, subject to a conjecture on the existence of irreducible polynomials of a certain form, the algorithm solves the DLP in all extensions $\mathbb{F}_{p^n}$ in expected quasi-polynomial time.

Motivation & Objective

• To develop a deterministic, algebraically-structured algorithm for solving the discrete logarithm problem (DLP) in finite fields of fixed characteristic.
• To eliminate reliance on heuristic smoothness assumptions, unlike prior quasi-polynomial algorithms.
• To prove that for every prime $p$, there exist infinitely many explicit extension fields ${\mathbb{F}}_{p^n}$ where the DLP can be solved in expected quasi-polynomial time.
• To establish a rigorous complexity bound for DLP in such fields, independent of group order factorization.

Proposed method

• The algorithm uses a descent method based on constructing irreducible polynomials $I$ dividing $h_1X^q - h_0$ in $\mathbb{F}_{q^k}[X]$.
• It relies on a key building block from Göloğlu et al., leveraging algebraic structures in function fields to enable descent steps.
• The method applies repeated descent to reduce the DLP in $\mathbb{F}_{q^{kl}}$ to smaller subproblems, using polynomial factorization and invariant theory.
• It exploits Kummer theory to ensure existence of suitable $h_0, h_1$ when $l = q-1$, enabling construction of explicit fields.
• The analysis uses group actions of $\mathrm{PGL}_2(\mathbb{F}_q)$ and $\mathrm{PSL}_2(\mathbb{F}_q)$ on roots to prove irreducibility and invariance properties.
• The algorithm avoids smoothness heuristics by relying on algebraic geometry and field isomorphisms, enabling rigorous complexity analysis.

Experimental results

Research questions

• RQ1 Can the discrete logarithm problem in finite fields of fixed characteristic be solved in quasi-polynomial time without relying on heuristic smoothness assumptions?
• RQ2 For a fixed prime $p$, do there exist infinitely many explicit extension fields ${\mathbb{F}}_{p^n}$ where the DLP is solvable in expected quasi-polynomial time?
• RQ3 Can the descent method be rigorously analyzed and proven to succeed under algebraic conditions on $h_0, h_1, I$?
• RQ4 Is it possible to construct such fields and algorithms with deterministic, algebraic structure rather than probabilistic heuristics?

Key findings

• For every prime $p$, there exist infinitely many explicit extension fields ${\mathbb{F}}_{p^n}$ in which the discrete logarithm problem can be solved in expected time $\exp\big{(}(1/\log 2+o(1))( \log n)^2\big{)}$.
• The algorithm solves the DLP in $\mathbb{F}_{q^{kl}}$ in expected time $q^{\log_2 l + O(k)}$, which matches the quasi-polynomial bound when $l = q-1$ and $k = 18$.
• The method is fully deterministic and does not rely on unproven smoothness assumptions, unlike prior quasi-polynomial algorithms such as those by Barbulescu et al.
• The existence of suitable $h_0, h_1$ is guaranteed via Kummer theory when $l = q-1$, enabling explicit construction of the fields.
• The algorithm's success is proven via rigorous descent arguments using group actions and invariant theory, ensuring correctness under the stated conditions.
• The result implies that the DLP in such fields is not as hard as previously assumed, challenging the security assumptions of certain cryptographic systems based on finite field discrete logs.