The number field sieve for integers of low weight

We define the weight of an integer N to be the smallest w such that N can be represented as w i=1 i2ci , with 1,..., w{1,-1}. Since arithmetic modulo a prime of low weight is particularly efficient, it is tempting to use such primes in cryptographic protocols. In this paper we consider the difficulty of the discrete logarithm problem modulo a prime N of low weight, as well as the difficulty of factoring an integer N of low weight. We describe a version of the number field sieve which handles both problems. Our analysis leads to the conjecture that, for N with w fixed, the worst-case running time of the method is bounded above by exp((c+o(1))(log N)1/3 (log log N)2/3 ) with c<((32/9)(2w-3)/(w-1))1/3 and below by the same expression with c=(32/9)1/3 (( 2w-2 2+1)/(w-1))2/3 . It also reveals that on average the method performs significantly better than it does in the worst case. We consider all the examples given in a recent paper of Koblitz and Menezes and demonstrate that in every c...

• Type: Journal
• Year: 2010
• Where: MOC
• Authors: Oliver Schirokauer
• Keywords: Discrete Logarithm Problem, Low Weight, MOC 2010, Number Field, Security Privacy