"Normal" discrete logarithm based cryptosystems (DSA, Diffie-Hellman, ElGamal) work in the finite field of integers modulo a big prime $p$. However, there exist other finite fields out there, in particular binary fields $GF(2^n)$. There is a specific attack described by Coppersmith for discrete logarithm in a binary field, and it was later on refined into the more general Function Field Sieve by Adleman and Huang. The FFS was used by Joux and Lercier to obtain the current record in $GF(2^n)$ discrete logarithm, where $n = 613$.
What I would like to know is:
- How does discrete logarithm in $GF(2^n)$ compares to discrete logarithm modulo a prime $p$ of $n$ bits ? At the time when Coppersmith published his algorithm, it made discrete logarithm in binary fields look easier than its prime $p$ counterpart, but the latter also got improved later on.
- Is it important, for discrete logarithm in $GF(2^n)$, whether $n$ is itself prime or not ? The current record is for $GF(2^{613})$, beating the previous record of $GF(2^{607})$, and both 607 and 613 are prime numbers. Would discrete logarithm in $GF(2^{1024})$ be easier than in $GF(2^{1021})$ ?