Acceleration of Index Calculus for Solving ECDLP over Prime Fields and Its Limitation

  • Momonari Kudo
  • Yuki Yokota
  • Yasushi Takahashi
  • Masaya YasudaEmail author
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11124)


In 2018, Amadori et al. proposed a new variant of index calculus to solve the elliptic curve discrete logarithm problem (ECDLP), using Semaev’s summation polynomials. The variant drastically decreases the number of required Gröbner basis computations, and it outperforms other index calculus algorithms for the ECDLP over prime fields. In this paper, we provide several improvements to accelerate to solve systems of multivariate equations arising in the variant. A main improvement is to apply the hybrid method, which mixes exhaustive search and Gröbner bases techniques to solve multivariate systems over finite fields. We also make use of symmetries of summation polynomials. We show experimental results of our improvements, and give their complexity analysis to discuss a limitation of our acceleration in both theory and practice.


ECDLP Index calculus Summation polynomials Gröbner basis algorithms 



This work was supported by JST CREST Grant Number JPMJCR14D6, Japan.


  1. 1.
    Amadori, A., Pintore, F., Sala, M.: On the discrete logarithm problem for prime-field elliptic curves. Finite Fields Appl. 51, 168–182 (2018)MathSciNetCrossRefGoogle Scholar
  2. 2.
    Bernstein, D.J., et al.: Faster elliptic-curve discrete logarithms on FPGAs. IACR Cryptology ePrint Archive 2016/382 (2016)Google Scholar
  3. 3.
    Bettale, L., Faugère, J.C., Perret, L.: Hybrid approach for solving multivariate systems over finite fields. J. Math. Cryptol. 3(3), 177–197 (2009)MathSciNetCrossRefGoogle Scholar
  4. 4.
    Blake, I.F., Seroussi, G., Smart, N.: Elliptic Curves in Cryptography, vol. 265. Cambridge University Press, Cambridge (1999)CrossRefGoogle Scholar
  5. 5.
    Bos, J.W., Kaihara, M.E., Kleinjung, T., Lenstra, A.K., Montgomery, P.L.: Solving a 112-bit prime elliptic curve discrete logarithm problem on game consoles using sloppy reduction. Int. J. Appl. Cryptogr. 2(3), 212–228 (2012)MathSciNetCrossRefGoogle Scholar
  6. 6.
    Caminata, A., Gorla, E.: Solving multivariate polynomial systems and an invariant from commutative algebra. arXiv preprint arXiv:1706.06319 (2017)
  7. 7.
    Caviglia, G., Sbarra, E.: Characteristic-free bounds for the castelnuovo-mumford regularity. Compos. Math. 141(6), 1365–1373 (2005)MathSciNetCrossRefGoogle Scholar
  8. 8.
    Cohen, H., et al.: Handbook of Elliptic and Hyperelliptic Curve Cryptography. CRC Press, Boca Raton (2005)CrossRefGoogle Scholar
  9. 9.
    Diem, C.: On the discrete logarithm problem in elliptic curves. Compos. Math. 147(01), 75–104 (2011)MathSciNetCrossRefGoogle Scholar
  10. 10.
    Eisenbud, D.: The Geometry of Syzygies: A Second Course in Algebraic Geometry and Commutative Algebra. Graduate Texts in Mathematics, vol. 229. Springer, New York (2005). Scholar
  11. 11.
    Faugère, J.C.: A new efficient algorithm for computing Gröbner bases (F4). J. Pure Appl. Algebra 139(1–3), 61–88 (1999)MathSciNetCrossRefGoogle Scholar
  12. 12.
    Faugère, J.C.: A new efficient algorithm for computing Gröbner bases without reduction to zero (F5). In: International Symposium on Symbolic and Algebraic Computation-ISSAC 2002, pp. 75–83. ACM (2002)Google Scholar
  13. 13.
    Faugère, J.-C., Perret, L., Petit, C., Renault, G.: Improving the complexity of index calculus algorithms in elliptic curves over binary fields. In: Pointcheval, D., Johansson, T. (eds.) EUROCRYPT 2012. LNCS, vol. 7237, pp. 27–44. Springer, Heidelberg (2012). Scholar
  14. 14.
    Galbraith, S.D., Gaudry, P.: Recent progress on the elliptic curve discrete logarithm problem. Des. Codes Cryptogr. 78(1), 51–72 (2016)MathSciNetCrossRefGoogle Scholar
  15. 15.
    Galbraith, S.D., Gebregiyorgis, S.W.: Summation polynomial algorithms for elliptic curves in characteristic two. In: Meier, W., Mukhopadhyay, D. (eds.) INDOCRYPT 2014. LNCS, vol. 8885, pp. 409–427. Springer, Cham (2014). Scholar
  16. 16.
    Gary, M., Daniela, M.: A few more index calculus algorithms for the elliptic curve discrete logarithm problem. Cryptology ePrint Archive: Report 2017/1262 (2017).
  17. 17.
    Gaudry, P.: Index calculus for abelian varieties of small dimension and the elliptic curve discrete logarithm problem. J. Symb. Comput. 44(12), 1690–1702 (2009)MathSciNetCrossRefGoogle Scholar
  18. 18.
    Hankerson, D., Menezes, A.J., Vanstone, S.: Guide to Elliptic Curve Cryptography. Springer, New York (2006). Scholar
  19. 19.
    Hashemi, A., Seiler, W.M.: Dimension-dependent upper bounds for grobner bases. arXiv preprint arXiv:1705.02776 (2017).
  20. 20.
    Kleinjung, T., et al.: Factorization of a 768-bit RSA modulus. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223, pp. 333–350. Springer, Heidelberg (2010). Scholar
  21. 21.
    Koblitz, N.: Elliptic curve cryptosystems. Math. Comput. 48(177), 203–209 (1987)MathSciNetCrossRefGoogle Scholar
  22. 22.
    Kusaka, T., et al.: Solving 114-bit ECDLP for a barreto-naehrig curve. In: Kim, H., Kim, D.-C. (eds.) ICISC 2017. LNCS, vol. 10779, pp. 231–244. Springer, Cham (2018). Scholar
  23. 23.
    Menezes, A.J., Okamoto, T., Vanstone, S.A.: Reducing elliptic curve logarithms to logarithms in a finite field. IEEE Trans. Inf. Theory 39(5), 1639–1646 (1993)MathSciNetCrossRefGoogle Scholar
  24. 24.
    Miller, V.S.: Use of elliptic curves in cryptography. In: Williams, H.C. (ed.) CRYPTO 1985. LNCS, vol. 218, pp. 417–426. Springer, Heidelberg (1986). Scholar
  25. 25.
    Petit, C., Kosters, M., Messeng, A.: Algebraic approaches for the elliptic curve discrete logarithm problem over prime fields. In: Cheng, C.-M., Chung, K.-M., Persiano, G., Yang, B.-Y. (eds.) PKC 2016. LNCS, vol. 9615, pp. 3–18. Springer, Heidelberg (2016). Scholar
  26. 26.
    Pollard, J.M.: Monte Carlo methods for index computation (mod \(p\)). Math. Comput. 32(143), 918–924 (1978)Google Scholar
  27. 27.
    Rivest, R.L., Shamir, A., Adleman, L.: A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21(2), 120–126 (1978)MathSciNetCrossRefGoogle Scholar
  28. 28.
    Satoh, T., Araki, K.: Fermat quotients and the polynomial time discrete log algorithm for anomalous elliptic curves. Comment. Math. Univ. Sancti Pauli 47(1), 81–92 (1998)MathSciNetzbMATHGoogle Scholar
  29. 29.
    Semaev, I.A.: Evaluation of discrete logarithms in a group of \(p\)-torsion points of an elliptic curve in characteristic \(p\). Math. Comput. 67(221), 353–356 (1998)Google Scholar
  30. 30.
    Semaev, I.A.: Summation polynomials and the discrete logarithm problem on elliptic curves. IACR Cryptology ePrint Archive 2004/031 (2004)Google Scholar
  31. 31.
    Semaev, I.A.: New algorithm for the discrete logarithm problem on elliptic curves. IACR Cryptology eprint Archive 2015/310 (2015)Google Scholar
  32. 32.
    Shanks, D.: Class number, a theory of factorization, and genera. In: Proceedings of Symposium of Pure Mathematics, vol. 20, pp. 41–440 (1971)Google Scholar
  33. 33.
    Silverman, J.H.: The Arithmetic of Elliptic Curves. Graduate Texts in Mathematics, vol. 106, 2nd edn. Springer, New York (2009). Scholar
  34. 34.
    Smart, N.P.: The discrete logarithm problem on elliptic curves of trace one. J. Cryptol. 12(3), 193–196 (1999)MathSciNetCrossRefGoogle Scholar
  35. 35.
    Wenger, E., Wolfger, P.: Solving the discrete logarithm of a 113-bit Koblitz curve with an FPGA cluster. In: Joux, A., Youssef, A. (eds.) SAC 2014. LNCS, vol. 8781, pp. 363–379. Springer, Cham (2014). Scholar
  36. 36.
    Yasuda, M., Shimoyama, T., Kogure, J., Izu, T.: Computational hardness of IFP and ECDLP. Appl. Algebra Eng. Commun. Comput. 27(6), 493–521 (2016)MathSciNetCrossRefGoogle Scholar
  37. 37.
    Yokota, Y., Kudo, M., Yasuda, M.: Practical limit of index calculus algorithms for ECDLP over prime fields. In: International Workshop on Coding and Cryptography-WCC 2017 (2017).

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  • Momonari Kudo
    • 1
  • Yuki Yokota
    • 2
  • Yasushi Takahashi
    • 2
  • Masaya Yasuda
    • 3
    Email author
  1. 1.Kobe City College of TechnologyNishi-kuJapan
  2. 2.Graduate School of MathematicsKyushu UniversityNishi-kuJapan
  3. 3.Institute of Mathematics for IndustryKyushu UniversityNishi-kuJapan

Personalised recommendations