"Normal" discrete logarithm based cryptosystems (DSA, Diffie-Hellman, ElGamal) work in the finite field of integers modulo a big prime p. However, there exist other finite fields out there, in particular binary fields GF(2n). There is a specific attack described by Coppersmith for discrete logarithm in a binary field, and it was later on refined into the more general Function Field Sieve by Adleman and Huang. The FFS was used by Joux and Lercier to obtain the current record in GF(2n) discrete logarithm, where n = 613.
What I would like to know is:
- How does discrete logarithm in GF(2n) compares to discrete logarithm modulo a prime p of n bits ? At the time when Coppersmith published his algorithm, it made discrete logarithm in binary fields look easier than its prime p counterpart, but the latter also got improved later on.
- Is it important, for discrete logarithm in GF(2n), whether n is itself prime or not ? The current record is for GF(2613), beating the previous record of GF(2607), and both 607 and 613 are prime numbers. Would discrete logarithm in GF(21024) be easier than in GF(21021) ?