8

Suppose, for some security parameter $n$ you choose a prime $p$ such that $p = 2^n+c$ for some relatively small $|c| < 2^m << 2^n$. I have seen such primes being called Pseudo-Mersenne Primes (if $c < 0$), Barrett Primes or Crandall Primes.

Does choosing such special primes $p$ as the group modulus for Discrete Logarithm Problem based Finite Field schemes in $Z_p^{*}$ in any way weaken the hardness of any known Discrete Logarithm based problems? I have seen the answers to this related question, which imply that if $|c|$ is small enough, the magnitude $n$ has to be doubled to counter the improved efficiency of the Special Number Field Sieve, but how small does $|c|$ have to be for that to apply?

For instance, suppose $n = 2048$ and $m = 512$, and the Hamming Weight of $c$ is approximately $256$. Is this sufficient to counter the SNFS, while still retaining the possibility of Barrett Reduction implementation optimizations?

Community
  • 1
Henrick Hellström
  • 10,406
  • 1
  • 30
  • 58

1 Answers1

3

The complexity of the number field sieve can be obtained from the expected size of the coefficients of the polynomial $f(x) = x^d + c_{d-1} x^{d-1} + \ldots + c_0$: if $c_i \le N^{\epsilon/d}$, then the expected runtime is

$$ \exp\left(\left(\left(\frac{32(1 + \epsilon)}{9}\right)^{1/3} + o(1)\right) (\log N )^{1/3} (\log \log N)^{2/3}\right),$$

or simply $L[1/3, (32(1 + \epsilon)/9)^{1/3}]$. When $\epsilon = 1$, we get $L[1/3, (64/9)^{1/3}]$ aka the GNFS, and when $\epsilon = 0$ (more accurately $o(1)$) we get the SNFS. Where does that put your example?

This requires analyzing the probability of smoothness of the numbers tested in the sieving phase, which, among other factors, depend on the size of the evaluated polynomial. The sieving process tests integers of the form

$$ F(a,b) = (a - bm) b^d f(a/b) = (a - bm)(a^d + a^{d-1}b c_{d-1} + \ldots + b^d c_0). $$

If we bound $a$ and $b$ to $M$, and $m, c_i$ to $N^{1/d}$, the size of $F(a,b)$ is bounded by $2(d + 1) M^{d+1} N^{2/d}$. In the SNFS, since both $m$ and $c_i$ are $o(1)$, the bound is much smaller, since it does not carry a $N^{1/d}$ factor anymore.

In your case, we have a mixed bag: the upper coefficients of the polynomial will be very small or 0, while the lower ones will be larger. For example, with degree $8$ and base $2^{256}$, your example results in the polynomial

$$ x^8 + c_1 x + c_0. $$

This polynomial is sparse, yes, but its expected $F(a, b)$ value size bound is not very far out from the general case: $2h M^{d+1} N^{2/d}$, where $h$ is the amount of nonzero coefficients in the polynomial. This is a constant improvement, but does not asymptotically alter the smoothness probability. So I expect your suggestion to be somewhat easier that a random prime, but not significantly so.

Since finding good polynomials seems to be an art in itself, it is hard to say when exactly the $c$ in $2^n + c$ becomes large enough to thwart the SNFS. A good rule of thumb would perhaps be to ensure that at least $c_0$ is $N^{1/d}$, by setting $c>2^{n/d}$. Since $d$ is an exponent in the size expression stated above, it will tend to be small: 1024-bit numbers are expected to have a $d$ of $6$ or $7$; 2048-bit will probably use degree $8$; and the optimal asymptotic expression for $d$ is $((3\log N)/(\log \log N))^{1/3}$, so it is very slow growing.

On a related note, the Schirokauer method for low-weight primes would not work here: it bounds the $c$ in $L[1/3, c]$ complexity of the NFS for an integer of (signed) weight $w$ as

$$ (32/9)^{1/3}((\sqrt{2}w - 2\sqrt{2} + 1)/(w - 1))^{2/3} < c < ((32/9)(2w-3)/(w-1))^{1/3}. $$

Replacing $w$ with $256$ results in the bound $1.9215 < c < 1.9217$, barely distinguishable from the GNFS.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
Samuel Neves
  • 12,460
  • 43
  • 52
  • @fgrieu: I suspect you interpreted $n$ as the magnitude of the modulus. $n$ is the actual modulus, so for a 1024 bit modulus, $\log n = 1024 \log 2$ etc. – Henrick Hellström Mar 26 '13 at 14:28
  • Edited the answer. Changed $n$ to $N$ as approriate (implicitly $N\approx2^n$), except $2^n$ remains unchanged and $c\ge n^{1/d}$ became $c>2^{n/d}$; feel free to revert. – fgrieu Mar 26 '13 at 15:29
  • @Samuel Neves: the rule of thumb you conjecture (I noted the use of perhaps) also applies to composite $N$, and would allow use of $N=2^n-c$ with $c\approx2^{n/5}$ for $n\ge1024$ with no significant security loss in RSA. That has practical applications: appreciably faster implementation of $x\mapsto x^e\bmod N$ (and as an aside more compact public key without use of an arbitrary value). Can you quote other sources of that rule of thumb? – fgrieu Mar 28 '13 at 11:11
  • I cannot. It is possible that with clever methods (tuning the regular polynomial selection methods) we can can come up with better bounded polynomials easily, but I have found no existing work on this. – Samuel Neves Mar 28 '13 at 12:14