Computation of a 30750-bit binary field discrete logarithm

This paper reports on the computation of a discrete logarithm in the finite field <inline-formula content-type="math/mathml"> <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" alttext="double-struck upper F Subscript 2 Sub Superscript 30750"> <mml:semantics> <mml:msub> <mml:mrow class="MJX-TeXAtom-ORD"> <mml:mi mathvariant="double-struck">F</mml:mi> </mml:mrow> <mml:mrow class="MJX-TeXAtom-ORD"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow class="MJX-TeXAtom-ORD"> <mml:mn>30750</mml:mn> </mml:mrow> </mml:msup> </mml:mrow> </mml:msub> <mml:annotation encoding="application/x-tex">\mathbb {F}_{2^{30750}}</mml:annotation> </mml:semantics> </mml:math> </inline-formula>, breaking by a large margin the previous record, which was set in January 2014 by a computation in <inline-formula content-type="math/mathml"> <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" alttext="double-struck upper F Subscript 2 Sub Superscript 9234"> <mml:semantics> <mml:msub> <mml:mrow class="MJX-TeXAtom-ORD"> <mml:mi mathvariant="double-struck">F</mml:mi> </mml:mrow> <mml:mrow class="MJX-TeXAtom-ORD"> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow class="MJX-TeXAtom-ORD"> <mml:mn>9234</mml:mn> </mml:mrow> </mml:msup> </mml:mrow> </mml:msub> <mml:annotation encoding="application/x-tex">\mathbb {F}_{2^{9234}}</mml:annotation> </mml:semantics> </mml:math> </inline-formula>. The present computation made essential use of the elimination step of the quasi-polynomial algorithm due to Granger, Kleinjung and Zumbrägel, and is the first large-scale experiment to truly test and successfully demonstrate its potential when applied recursively, which is when it leads to the stated complexity. It required the equivalent of about <inline-formula content-type="math/mathml"> <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" alttext="2900"> <mml:semantics> <mml:mn>2900</mml:mn> <mml:annotation encoding="application/x-tex">2900</mml:annotation> </mml:semantics> </mml:math> </inline-formula> core years on a single core of an Intel Xeon Ivy Bridge processor running at 2.6 GHz, which is comparable to the approximately <inline-formula content-type="math/mathml"> <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" alttext="3100"> <mml:semantics> <mml:mn>3100</mml:mn> <mml:annotation encoding="application/x-tex">3100</mml:annotation> </mml:semantics> </mml:math> </inline-formula> core years expended for the discrete logarithm record for prime fields, set in a field of bit-length <inline-formula content-type="math/mathml"> <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" alttext="795"> <mml:semantics> <mml:mn>795</mml:mn> <mml:annotation encoding="application/x-tex">795</mml:annotation> </mml:semantics> </mml:math> </inline-formula>, and demonstrates just how much easier the problem is for this level of computational effort. In order to make the computation feasible we introduced several innovative techniques for the elimination of small degree irreducible elements, which meant that we avoided performing any costly Gröbner basis computations, in contrast to all previous records since early 2013. While such computations are crucial to the <inline-formula content-type="math/mathml"> <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML" alttext="upper L left-parenthesis one fourth plus o left-parenthesis 1 right-parenthesis right-parenthesis"> <mml:semantics> <mml:mrow> <mml:mi>L</mml:mi> <mml:mo stretchy="false">(</mml:mo> <mml:mfrac> <mml:mn>1</mml:mn> <mml:mn>4</mml:mn> </mml:mfrac> <mml:mo>+</mml:mo> <mml:mi>o</mml:mi> <mml:mo stretchy="false">(</mml:mo> <mml:mn>1</mml:mn> <mml:mo stretchy="false">)</mml:mo> <mml:mo stretchy="false">)</mml:mo> </mml:mrow> <mml:annotation encoding="application/x-tex">L(\frac 1 4 + o(1))</mml:annotation> </mml:semantics> </mml:math> </inline-formula> complexity algorithms, they were simply too slow for our purposes. Finally, this computation should serve as a serious deterrent to cryptographers who are still proposing to rely on the discrete logarithm security of such finite fields in applications, despite the existence of two quasi-polynomial algorithms and the prospect of even faster algorithms being developed.