3

I'm not sure if I understand the question correctly, but let's try anyway. By assumption we have some integer $m$ such that $\varphi(m)=2pq^5r^2$ for primes $p,q,r$. The goal is to solve a discrete logarithm problem in $\mathbb{Z}_m^*$, say we have $g,h\in\mathbb{Z}_m^*$ such that $h=g^\ell$ for some integer $\ell$. We note that $\mathbb{Z}_m^*$ is a ...


2

If $L[\alpha, c] = e^{(c + o(1)) \cdot (\log p^n)^\alpha \cdot (\log \log p^n)^{1 - \alpha}}$ then $$\log_2 L[\alpha, c] = (c + o(1)) \cdot (\log p^n)^\alpha \cdot (\log \log p^n)^{1 - \alpha}/\log 2.$$ Let $p \approx 2^{256}$ and $n = 12$ so that $\log p^n \approx 12\cdot256\cdot \log 2 \approx 2130$; and let $\alpha = 1/3$, $c \approx 1.54$. Then, if we ...


2

But in many places I saw that BN256 curve provided 128 bit security. Where I am doing wrong? There are two potential attacks against the DLog problem in BN256 The first is to attack the DLog problem in the finite field; that is, given the points $G$ and $H$, we compute $e(G, G)$ and $e(G, H)$, and then find the value $x$ with $e(G, G)^x = e(G, H)$. The ...


2

To my knowledge, there are two reports that deal with the crossover point between the Gaussian integer sieve—which is the rough analogous of the quadratic sieve for discrete logarithms—and the number field sieve over prime fields: Weber (1998) computed discrete logarithms over a 85-digit (~283 bits) prime, and concluded that at that size point the Gaussian ...


2

We summarize the discussion of parameters to express numbers suitable to be factored:: $$ N = C_1 r^t + C_2 s^u $$ by the Special Number Field Sieve (SNFS) from the paper "An Implementation of the Number Field Sieve" by Marije Elkenbracht-Huizing (1996). She describes the Number Field Sieve this way: Let $n$ be the odd number to be factored. It is ...


Only top voted, non community-wiki answers of a minimum length are eligible