Computing discrete logarithms in cryptographically-interesting characteristic-three finite fields

Abstract

Since 2013 there have been several developments in algorithms for computing discrete logarithms in small-characteristic finite fields, culminating in a quasi-polynomial algorithm. In this paper, we report on our successful computation of discrete logarithms in the cryptographically-interesting characteristic-three finite field F 36·509 using these new algorithms; prior to 2013, it was believed that this field enjoyed a security level of 128 bits. We also show that a recent idea of Guillevic can be used to compute discrete logarithms in the cryptographically-interesting finite field F 36·709 using essentially the same resources as we expended on the F 36·509 computation. Finally, we argue that discrete logarithms in the finite field F 36·1429 can feasibly be computed today; this is significant because this cryptographically-interesting field was previously believed to enjoy a security level of 192 bits.