Extended tower number field sieve: A new complexity for the medium prime case

Abstract

We introduce a new variant of the number field sieve algorithm for discrete logarithms in Fpn called exTNFS. The most important modification is done in the polynomial selection step, which determines the cost of the whole algorithm: if one knows how to select good polynomials to tackle discrete logarithms in Fpκ, exTNFS allows to use this method when tackling Fpηκ whenever gcd(η, κ) = 1. This simple fact has consequences on the asymptotic complexity of NFS in the medium prime case, where the complexity is reduced from (formula presented), respectively from (formula presented) if multiple number fields are used. On the practical side, exTNFS can be used when n = 6 and n = 12 and this requires to updating the keysizes used for the associated pairing-based cryptosystems.