Gabrielle De Micheli

Pierrick Gaudry

Cécile Pierrot

Lattice Enumeration and Automorphisms for Tower NFS: a 521-bit Discrete Logarithm Computation

The Tower variant of the Number Field Sieve (TNFS) is known to be asymptotically the most efficient algorithm to solve the discrete logarithm problem in finite fields of medium characteristics, when the extension degree is composite. A major obstacle to an efficient implementation of TNFS is the collection of algebraic relations, as it happens in dimension greater than 2. This requires the construction of new sieving algorithms which remain efficient as the dimension grows. In this article, we overcome this difficulty by considering a lattice enumeration algorithm which we adapt to this specific context. We also consider a new sieving area, a high-dimensional sphere, whereas previous sieving algorithms for the classical NFS considered an orthotope. Our new sieving technique leads to a much smaller running time, despite the larger dimension of the search space, and even when considering a larger target, as demonstrated by a record computation we performed in a 521-bit finite field F p 6 . The target finite field is of the same form as finite fields used in recent zero-knowledge proofs in some blockchains. This is the first reported implementation of TNFS.

Introduction

Context. While the post-quantum competition is ongoing, the discrete logarithm problem is still at the basis of the security of many currently-deployed public key protocols. Given a cyclic group G, a generator g ∈ G and a target h ∈ G, solving the discrete logarithm problem in G means finding an integer x mod |G| such that g x = h. The hardness of this problem depends on the group G and the two usual choices are the group of the invertible elements in a finite field and the group of points of an elliptic curve. This article deals with discrete logarithms in finite fields. In particular, as small characteristics finite fields are no longer considered because of the advent of quasipolynomial time algorithms [START_REF] Barbulescu | A heuristic quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic[END_REF][START_REF] Granger | On the discrete logarithm problem in finite fields of fixed characteristic[END_REF][START_REF] Kleinjung | Discrete logarithms in quasi-polynomial time in finite fields of fixed characteristic[END_REF], we focus on medium and large characteristics. For a finite field F p n we recall that the characteristic p is of medium size if L p n (1/3) < p < L p n (2/3) and of large size if p > L p n (2/3). 1 Equivalently, it means that the extension degree n is of bounded size with respect to the finite field order.

NFS and TNFS. The Number Field Sieve (NFS) algorithm and its variants are the fastest known algorithms to solve the discrete logarithm problem in finite fields of medium and large characteristics. One of these variants is the Tower Number Field Sieve (TNFS), known to be asymptotically more efficient than a classical NFS for some fields when the extension degree is composite. TNFS exploits the algebraic structure of towers of number fields: the main difference with NFS comes from the representation of the target field F p n . Whereas in the classical NFS setup, the finite field F p n is represented as the quotient field F p [x]/(f ) where f is a polynomial of degree n over F p , in the TNFS setup, we have F p n ∼ = R/pR where R is a ring defined as the quotient Z[ι]/h(ι), and h ∈ Z[ι] is a degree n polynomial that remains irreducible modulo p.

Originally proposed by Schirokauer [START_REF] Schirokauer | Using Number Fields to Compute Logarithms in Finite Fields[END_REF], TNFS was reinvestigated by Barbulescu, Gaudry, and Kleinjung [START_REF] Barbulescu | The tower number field sieve[END_REF] in 2015. They showed that the asymptotic complexity of TNFS in large characteristics is L p n (1/3, 3 64/9), the same as for NFS. In medium characteristics, the complexity of TNFS is greater than L p n (1/3) and thus this algorithm is only considered in the large case.

This algorithm was then modified by Kim and Barbulescu [START_REF] Kim | Extended tower number field sieve: A new complexity for the medium prime case[END_REF], and Kim and Jeong [START_REF] Kim | Extended tower number field sieve with application to finite fields of arbitrary composite extension degree[END_REF] to form the extended Tower Number Field Sieve (exTNFS), the variant being dedicated to composite extension degrees, i.e., when n = ηκ. This extended variant has an L p n (1/3) complexity also in medium characteristics. In this case, the overall complexity of exTNFS can be as low as L p n (1/3, 3 48/9) if there is a factor of n of the appropriate size (see Table 1). Both TNFS and exTNFS can be coupled with a multiple field variant -for any finite field -and a special variant -for some sparse characteristics only -giving each time a lower asymptotic complexity. We do not address these variants in this article. Towards an implementation of exTNFS. One can see from the complexities given in Table 1 that for NFS, medium characteristics are harder than large characteristics. This remains true for the multiple and special variants. However, a noticeable exception to this observation lies in the exTNFS algorithm. Indeed, when the degree n is composite, i.e., n = ηκ, the target finite field F p n = F p ηκ can be viewed as F P κ where P is a prime power of the same bitsize as p η . Thus, the complexity of exTNFS in medium characteristics can be viewed similarly as the complexity of NFS at the boundary case between medium and large characteristics, leading to a smaller c constant in the L p n -notation. Hence we find a lower complexity in medium characteristics than in large ones with exTNFS, which makes it a promising candidate for computational records in this area.

Let us assume we want to evaluate the security of a family of finite fields with fixed composite extension degree (for instance n = 6). These families often arise in pairing-based protocols. Evaluating the security of a concrete finite field in such a family is not an easy task, as we are not even able to tell beforehand whether NFS or exTNFS would be the fastest algorithm. Indeed, using a fixed extension degree asymptotically defines the characteristic as large, an area where the best discrete logarithm algorithm is NFS (not exTNFS). However, let us keep in mind that medium and large characteristics are notions defined for asymptotic sizes; as soon as we set a concrete target finite field it is not well understood how we should qualify its characteristic. In this work we underline that exTNFS shows real improvements with regards to current NFS computations for this family. Current record computations (e.g. for 400 or 500-bit finite fields) deal with areas where asymptotic analysis are not yet the relevant ones. We cannot easily extrapolate on current and deployed sizes (e.g. for more than 2000-bit finite fields) but our implementation of exTNFS provides practical insight on security parameters by showing its incredibly good behavior at lower sizes.

In the rest of this article, to simplify notations and to be coherent with the recent literature, we use TNFS as a short hand for ex-TNFS 2 . We do however assume the degree n of our target finite field is composite, thus considering specifically the extended variant.

Lattice enumeration for TNFS. Despite the fact that TNFS is promising, no implementation was done using this variant of NFS, up to this work. Indeed, so far, excluding the very small characteristics 2 and 3, all discrete logarithm record computations were performed using NFS, the special variant of NFS, or the Function Field Sieve -a method for small characteristics only.

A major obstacle to an efficient implementation of TNFS is the collection of algebraic relations where equations between small elements of number fields must be found. Indeed, whereas NFS requires sieving through (a, b) ∈ Z 2 pairs, the tower setup sieves through (a(ι), b(ι))-pairs, i.e., degree η -1 polynomials with bounded coefficients. This requires the construction of sieving algorithms in a space of dimension 2η ≥ 4, which remain efficient as the dimension grows.

In dimension 2, Franke and Kleinjung [START_REF] Franke | Continued Fractions and Lattice Sieving. Special-Purpose Hardware for Attacking Cryptographic Systems-SHARCS[END_REF] proposed in 2005 an efficient algorithm used in all previous records. For higher dimensions, after the pioneer work in F p 12 by Hayasaka et al. [START_REF] Hayasaka | An experiment of number field sieve for discrete logarithm problem over GF(p n )[END_REF], the transition vectors method from Grémy [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF] and a recursive plane method proposed by McGuire and Robinson [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF][START_REF] Robinson | An implementation of the Extended Tower Number Field Sieve using 4d sieving in a box and a record computation in F p 4[END_REF] were tested in dimensions 3 and 4 and used for record computations using NFS. However, the efficiency of their algorithms for even higher dimensions is questionable.

Our work. In this article, we introduce an efficient sieving algorithm for higher dimensions which allows us to implement TNFS and perform the first record computation with it. More specifically, we propose the following contributions.

1. Sieving in a high dimensional sphere instead of an orthotope. All sieving algorithms so far considered a product of intervals as search space S. Indeed, whether a candidate relation is characterized by an (a, b)-pair or an (a(ι), b(ι))-pair with more than two coefficients, every coefficient is bounded separately in an interval [-H i 1 , H i 2 ] for i = 1, 2, • • • , d where d is the total number of coefficients. Hence, the search space considered is a d-orthotope of the form S = [-H 1 1 , H

1 2 ] × • • • × [-H d 1 , H d 2 ]
. We choose to use a d-sphere instead, since this is more suitable for the lattice enumeration algorithm we want to apply.

2. Adapting a lattice enumeration algorithm to the context of TNFS. In order to fully exploit the new search space, we adapt a known lattice algorithm to the context of TNFS: Schnorr-Euchner's enumeration algorithm [START_REF] Schnorr | Lattice Basis Reduction: Improved Practical Algorithms and Solving Subset Sum Problems[END_REF], that outputs the shortest vector of a lattice. We modify this algorithm in order to list all the vectors of a lattice L within a d-dimensional sphere S d . Furthermore, a part of the common coefficients of the enumerated vectors are kept in memory during the algorithm, leading to a 10% reduction in the execution time. This algorithm remains competitive when the dimension grows and also provides an exhaustive search of all the vectors in L ∩ S d , contrary to previous approaches.

3. Analysis of the relation collection step in TNFS and duplicate relations. We place this sieving algorithm in the context of the entire relation collection step. Sieving algorithms are usually combined with batch algorithms and ECM to provide the most efficient relation collection. We give details on this relation collection step, and give new insight on how to define and remove duplicate relations that arise in the context of TNFS.

4.

A 521-bit finite field record. Our new lattice enumeration for the sieving step led to the first record computation of a discrete logarithm with TNFS, reaching a 521-bit finite field F p 6 . Previous record on a finite field of the same shape reached a 423-bit finite field in January 2020. The choice of the extension degree was motivated by the use of such finite fields in pairing-based protocols, in particular in recent zero-knowledge proofs in some blockchains [START_REF] Ben-Sasson | Scalable zero knowledge via cycles of elliptic curves[END_REF][START_REF]CODA: MNT-6 curve with parameter 753 for Snark prover[END_REF]. Ultimately, as shown in Table 2, our algorithm is much faster than existing high-dimensional sieving algorithms, despite the larger dimension of the search space and the larger finite field. [START_REF] Grémy | Computing discrete logarithms in F p 6[END_REF] and [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF] for finite fields of the form F p 6 .

Outline. In Section 2, we recall the general setup of TNFS and in particular we focus on the steps that differ the most from the classical NFS setup. In Section 3, we focus on the relation collection step with the special-q method, and explain how to deal with duplicate relations. In Section 4, we describe our adaptation of Schnorr-Euchner's enumeration algorithm to the context of TNFS. We justify why we choose a d-sphere as sieving area and introduce an efficient way to compute the desired vectors of coefficients for the relations. Section 5 analyses the complexity of our sieving algorithm and compares the latter with pre-existing algorithms. In Section 6 we detail our complete discrete logarithm computation in a 521-bit finite field with extension degree 6. Finally, in Section 7 we study the potential savings brought by explicit automorphisms, and introduce the notion of Galois-compatible Schirokauer maps, relevant in this context. This article is an extended version of our paper accepted at Asiacrypt 2021 [START_REF] De Micheli | Lattice enumeration for tower NFS: a 521-bit discrete logarithm computation[END_REF] (Section 7 in particular is novel and does not appear in the conference version).

2 The Tower Number Field Sieve

Mathematical setup

The classical tower of number fields that illustrates the TNFS setup considers the intermediate number field

K h = Q[ι]/h(ι)
, where ι is a root of h, a polynomial over Z that remains irreducible modulo p. Above this number field are set the two number fields

K 1 = K h [x]/f 1 (x) and K 2 = K h [x]/f 2 (x) where f 1 , f 2 are irreducible polynomials over R = Z[ι]
that share an irreducible factor φ modulo the unique ideal p over p in K h . We write O i the ring of integers of K i and α i a root of f i in K i for i = 1, 2. This construction is illustrated in Figure 1.

Because of the conditions on the polynomials h, f 1 and f 2 , there exist two ring

K1 K2 R ⊂ K h Q f1 f2 h Fig. 1: Tower of Number Fields used in TNFS. homomorphisms from R[x] = Z[ι][x]
to the target finite field F p n through the number fields K 1 and K 2 . This allows to build a commutative diagram as shown in Figure 2. The extension degree n is assumed to be composite, and we write n = ηκ. In this setting, h is of degree η, and f 1 and f 2 have degree at least κ, so that the degree of their common factor φ is exactly κ. For simplicity, we will assume that f 1 and f 2 are defined over Z, since it is the case in our record computation; this is only possible when κ and η are coprime.

R [X] K1 ⊃ R [X] /(f1(X)) K2 ⊃ R [X] /(f2(X)) R/p[X]/(φ(X)) ∼ = Fpn mod φ, mod p mod φ, mod p

A step by step walk through TNFS

The TNFS algorithm follows similar steps as any index calculus algorithm. The main differences with the Number Field Sieve algorithm take place in the polynomial selection step and the collection of relations.

Polynomial selection. Unlike NFS which uses only two polynomials f 1 and f 2 to define the number fields, three polynomials must be selected for this algorithm, namely h, f 1 and f 2 . The polynomial h must be of degree η and irreducible modulo p to ensure the uniqueness of the ideal p over p in R. Ideally one would choose a unitary h with small coefficients and such that the inverse of the Dedekind zeta function evaluated at 2 (implemented in Sage for example) is close to 1. Indeed, as we will see in Section 3.4, this is related to non-coprime ideals that produce equivalent relations which are useless for the linear algebra step. Moreover, the proportion of coprime ideals is given by

q prime ideal in Q(ι) 1 - 1 N (q) 2 = 1 ζ K h (2)
,

where ζ K h is the Dedekind zeta function. Hence, in order to reduce the amount of duplicate relations produced because of these non-coprime ideals, one can choose an h with ζ K h (2) as close to 1 as possible.

The polynomials f 1 and f 2 are selected to fit the mathematical setting of Section 2.1. One can use NFS polynomial selections such as the Conjugation, JLSV or Sarkar-Singh's methods [START_REF] Barbulescu | Improving NFS for the discrete logarithm problem in non-prime finite fields[END_REF][START_REF] Joux | The number field sieve in the medium prime case[END_REF][START_REF] Sarkar | New complexity trade-offs for the (multiple) number field sieve algorithm in non-prime fields[END_REF], not recalled here. The polynomials we use for our 521-bit computation come from the Conjugation method. The choice of the polynomial selection can be made as follows. We know that JLSV produces polynomials f 1 and f 2 of same degree, say d, and with coefficients of size O( √ p) for both polynomials. On the other hand, the Conjugation method has more unbalanced parameters. The polynomial f 1 has a larger degree 2d and small coefficient in O(1) and f 2 has degree d (the same as for JLSV) and coefficients of size O( √ p). Thus in order to decide which method to use, one should compare the size of the norms in K 1 , written as N 1 (ϕ), and in K 2 , written as

N 2 (ϕ), for elements ϕ ∈ R[x]. If N 1 (ϕ) < N 2 (ϕ)
, then one should choose the Conjugation method. However, if N 2 (ϕ) < N 1 (ϕ), then one should choose the JLSV method since the polynomial f 2 , which shares the same properties as polynomials outputted from JLSV, has the smaller norm.

In NFS, the quality of the polynomials can be refined with a quantity known as the Murphy-α value. See [START_REF] Guillevic | On the alpha value of polynomials in the Tower Number Field Sieve Algorithm[END_REF] for details about Murphy-α adapted to TNFS.

Relation collection. The goal of the relation collection step is to select among the set of linear polynomials ϕ(x, ι) = a(ι) -b(ι)x ∈ R[x] at the top of the diagram the candidates which produce a relation. A relation is found if the polynomial ϕ(x, ι) mapped to K 1 and K 2 factors into products of ideals of small norms in both number fields. The ideals of small norms that occur in these factorizations constitute the factor basis F. More precisely, we define it as

F = F 1 ∪ F 2 with F i (B) = {prime ideals of O i of norm ≤ B, whose inertia degree over K h is 1}, for i = 1, 2.
Remark 1. The prime ideals in the factorization of (a(ι) -b(ι)α i )O i can have degree at most deg ϕ. Thus the ideals in the factor basis have degree at most 1 in the variable x. However, in the specific context of TNFS, the polynomial ϕ is a polynomial in two variables: x and ι. Thus, these ideals can have degree in ι up to degree of h. We will however only consider ideals of degree 1 in ι. Indeed, in theory, we only lose a constant factor in the smoothness probabilities when excluding the ideals of degree greater than 1. In practice, if we encounter a prime ideal that has a degree greater than 1 in the variable ι, we keep the relation. Otherwise, we would throw away too many relations. The same holds for ideals dividing the index ideal [O i : O K h [α i ]] but there are only finitely many and they can be handled separately.

The representation of these ideals of degree 1 in the context of TNFS is summarized in [4, Proposition 1], which we recall below.

Proposition 1 (From [START_REF] Barbulescu | The tower number field sieve[END_REF], Proposition 1). Let K h = Q(ι) be a number field generated by a root ι of a polynomial h, and let O K h be its ring of integers. Let f be a monic irreducible polynomial in K h [x], and denote by α one of its roots. We denote by K = Q(α, ι) the corresponding extension field, and O f its ring of integers.

If q is a prime ideal of

O K h not dividing the index-ideal [O f : O K h [α]]
, then the following statement holds.

1. The prime ideals of O f above q are all the ideals of the form

Q = (q, T (α)),
where T (x) are the lifts to O

K h [x] of the irreducible factors of f in O K h /q[x]. Moreover, deg Q = deg T . 2. If a(t), b(t) ∈ Z[t] are such that q divides N K/K h (a(ι)-b(ι)α) and a(ι)O K h + b(ι)O K h = O K h , then the unique ideal of O f above q which divides a(ι) - b(ι)α is Q = (q, α -r(ι)) with r ≡ a(ι)/b(ι) (mod q).
To verify the B-smoothness on each side, one needs to evaluate the norms N i (a(ι) -b(ι)α i ) for i = 1, 2. To do so we recall that when the polynomials f i are monic, these norms are integers that can be computed thanks to resultants as

N i (a(ι) -b(ι)α i ) = Res t (Res x (a(t) -b(t)x, f i (x)), h(t)).
This allows to verify the B-smoothness over integer values. These formulas must be adapted when the polynomials f i are not monic by including the leading coefficient raised to the degree of the polynomial. The relation collection step stops when we have enough relations to construct a system of linear equations that may be full rank. The unknowns of these equations are the virtual logarithms of the ideals of the factor basis.

Linear algebra. A good feature of the linear system created is that the number of non-zero coefficients per line is very low. This allows to use sparse linear algebra algorithms such as the block variant of Wiedemann's algorithm [START_REF] Wiedemann | Solving Sparse Linear Equations over Finite Fields[END_REF], for which parallelization is partly possible. The output of this step is a kernel vector corresponding to the virtual logarithms of the ideals in the factor basis. There is no difference for this step between TNFS and NFS.

Individual discrete logarithm. The final step of TNFS consists in finding the discrete logarithm of the target element. This step is subdivided into two substeps: a smoothing step and a descent step. The smoothing step is an iterative process where the target element t is randomized by considering s = g e t ∈ F * p n for an exponent e chosen uniformly at random. Values for e are tested until s lifted back to one of the number fields K i is B i -smooth for a smoothness bound

B i > B.
The second step consists in decomposing every factor of the lifted value of s, in our case prime ideals with norms less than a smoothness bound B i (but usually greater than B) into elements of the factor basis for which we now know the virtual logarithms. This process creates descent trees where the root is an ideal coming from the smoothing step and the nodes are ideals that get smaller and smaller as they go deeper. The leaves are ultimately elements of the factor basis. The edges of the tree are defined as follows: for every node, there exists an equation between the ideal of the node and all the ideals of its children.

In this work, we consider an improvement given by Guillevic in [23, Algorithm 5] for the smoothing step, that is useful in the context of TNFS only. The goal is to improve the smoothness probability of the lift of s ∈ F * p n to K i by constructing an adequate lattice whose reduced vectors define elements of K i with potentially small norms which is precisely the potential lifts of s we are looking for.

Focus on the relation collection

In TNFS the relation collection step requires sieving in dimension 2η ≥ 4, which is the number of coefficients involved in ϕ. We start by dividing the set of polynomials ϕ into multiple subsets and then we present different algorithms to successively select the candidates in each of these subsets.

The special-q setup

The relation collection phase looks at a set of linear polynomials ϕ

(x, ι) = a(ι) - b(ι)x ∈ R[x]
where a, b are polynomials of degree deg h -1 with deg h = η and bounded coefficients, and tries to identify which are going to produce doublysmooth norms, i.e., for which pair (a(ι), b(ι)) the norms N 1 (a(ι) -b(ι)α 1 ) and N 2 (a(ι) -b(ι)α 2 ) factor into small primes. To reduce the time of the sieving stage, Pollard [START_REF] Pollard | The Lattice Sieve[END_REF] suggested to divide the set of all polynomials ϕ, commonly called the search space, into multiple subsets. This task also requires a large amount of memory and Pollard's idea allows to parallelize the process, thus improving practical computation time. This corresponds to the so-called specialq method. This method regroups polynomials into groups such that ϕ(α 1 , ι) (or ϕ(α 2 , ι) depending on whether we put the special-q on the f 1 -side or the f 2 -side) share a common factor: the ideal Q, above a prime q, hence the name. Thus, when talking about a sieving algorithm, we usually consider a fixed special-q ideal Q, and select good polynomials ϕ in the corresponding subset. This idea of using special-q's increases the smoothness probability on the side where divisibility by Q is forced, since the norm is already divisible by q. Furthermore this provides a natural parallelization where each work-unit corresponds to a special-q.

Let ϕ denote the (row-) vector of coefficients of the polynomial ϕ(x, ι), i.e. the vector ϕ = (a 0 ,

• • • , a η-1 , b 0 , • • • , b η-1 ) ∈ Z 2η .
Let us consider a special-q ideal Q of degree 1 in K i of the form Q = ⟨q, ι -ρ ι , x -ρ x ⟩, where q is a prime number, ρ ι is a root of h modulo q, and ρ x is a root of f i modulo q. One could also consider ideals of degree greater than 1, but special-q of degree 1 are the most common among ideals of bounded norms and thus we restrict to this case. Proposition 2. The set of polynomials ϕ such that the corresponding principal ideal in K i is divisible by Q form a lattice that we call the Q-lattice L Q .

The latter can be made explicit as follows.

L Q = {(a 0 , • • • , a η-1 , b 0 , • • • , b η-1 ) ∈ Z 2η : η-1 k=0 a k ι k -b k ι k α i ≡ 0 (mod Q)}
where i = 1, 2 depending on the side we consider. A basis B Q of this lattice can be expressed as seen in Figure 3.

The determinant of this lattice is q deg ϕ h , where ϕ h is an irreducible factor of h (mod p). In our case ϕ h = ι -ρ ι because we only consider special-q ideals of degree 1 and so the determinant is simply q. The lattice dimension is 2η.

(a, b) a0 a1 • • • aη-2 aη-1 b0 b1 • • • bη-1                                 (q, 0) q 0 0 (ι -ρι, 0) -ρι 1 0 (ι(ι -ρι), 0) 0 -ρι 1 0 . . . . . . . . . (ι η-2 (ι -ρι), 0) -ρι 1 (ρx, 1) ρx 0 1 (ιρx, ι) 0 ρx 0 1 . . . . . . . . . (ι η-1 ρx, ι η-1 ) ρx 1 = B Q . Fig. 3: A basis B Q of the lattice L Q . B Q =         q 0 0 0 0 0 -ρι 1 0 0 0 0 0 -ρι 1 0 0 0 -ρx 0 0 1 0 0 0 -ρx 0 0 1 0 0 0 -ρx 0 0 1        
, Fig. 4: Example with η = 3.

For example, with η = 3, it is generated by the rows of the matrix given in Figure 4. where the first 3 columns correspond to the coefficients of a(ι) = a 0 + a 1 ι + a 2 ι 2 , and the last 3 columns to the coefficients of b(ι) = b 0 + b 1 ι + b 2 ι 2 . For example, the 5 th row corresponds to the polynomial ϕ 5 (x, ι) = -ρ x ι+ιx, and ϕ 5 = (0, ρ x , 0, 0, 1, 0) is indeed in L Q . The lattice L Q has dimension d = 2η = 6 and determinant q in this example.

Each unit of computation targets one special-q ideal Q and searches for polynomials ϕ(x, ι) with ϕ ∈ L Q leading to relations, i.e., for which both sides are smooth. In order to explore the lattice L Q , we first LLL-reduce the basis B Q , and then consider linear combinations with small coefficients of these new basis elements. This allows us to focus on polynomials where one of the norms on one side is known to be divisible by q, thus increasing the probability of it being smooth. More precisely, let M Q be an LLL-reduced basis of L Q . We study the (row-) vectors c of coefficients such that ϕ = c • M Q , potentially leads to a relation. This is done using sieving algorithms.

Constructing the double-divisibility lattice L Q,p

We concentrate on vectors c that belong to a sieving region S. Traditionally, S is an ℓ ∞ -ball, however in this work we consider the ℓ 2 -norm, which is more suited to our relation collection strategy. In order to efficiently detect the vectors c giving elements of smooth norms, one can perform an Eratosthenes-like sieving, quickly marking all vectors c in S leading to a norm on the f 1 -side (or the f 2side) that is divisible by a small prime p. Repeating this sieve for many primes p allows to detect the most promising vectors ϕ, those for which the norm is divisible by many small primes. To do so, we proceed as for the divisibility by Q.

Let p be a prime ideal of norm p in K i of the form p = ⟨p, ι -r ι , x -r x ⟩, where r ι is a root of h modulo p and r x is a root of f i modulo p. The second statement of [4, Proposition 1] can be reformulated for this specific context. Proposition 3. The principal ideal generated by ϕ(x, ι) in K i is divisible by p if and only if ϕ(r x , r ι ) ≡ 0 mod p.

Let U p be the (row-) vector of size 2η defined by

U p = 1, r ι mod p, • • • , r η-1 ι mod p, r x , r x r ι mod p, • • • , r x r η-1 ι mod p .
Then similarly as before, we can translate the divisibility property of the ideal of Proposition 3: the divisibility by p is equivalent to the condition ϕ • U ⊺ p ≡ 0 mod p. Recall that ϕ is taken in a subset of the search space so that the ideal generated by ϕ is divisible by Q, namely its coefficients are written as ϕ = c•M Q . Taking into account the divisibility by Q and by p yields the condition on c:

c • M Q U ⊺ p ≡ 0 mod p. (1)
The product M Q U ⊺ p , reduced modulo p and normalized so that its first coordinate is 1, is expressed as

M Q U ⊺ p ≡ λ (1, α 1 , α 2 , . . . , α 2η-1 )
⊺ mod p, with λ > 0. Since M Q and U p are known, we explicitly compute the values α i . This assumes the first coordinate is non-zero. Otherwise, one must either adapt the construction of M Q,p below or skip the ideal p during sieving. Finally, the set of vectors c verifying Equation (1) is the lattice L Q,p generated by the rows of the matrix

M Q,p =         p 0 0 0 • • • 0 -α 1 1 0 0 • • • 0 -α 2 0 . . . 0 • • • 0 . . . 0 0 . . . 0 -α η-1 0 0 0 • • • 1         .
In the end, since M Q,p is explicitly known, we can compute the coefficients ϕ = c • M Q of the polynomials ϕ. This is possible as soon as we are able to enumerate the short vectors c in this lattice which is the aim of Section 4. This procedure, which is called enumeration, is done for all prime p from 2 up to a predefined bound p max , forming a so called sieving algorithm. Sieving allows to detect quickly vectors c that belong to several M Q,p for various p. The corresponding polynomials ϕ are good candidates that potentially give relations as they provide by construction ideals that are already divisible by Q and several ideals p. Hence we keep them for the next selection phase.

Combining three algorithms

Other algorithms are used, some directly detect polynomials leading to doublysmooth norms. Some others work as complementary algorithms one after another as a sequence of filters to determine and only keep the promising candidates at each step, as done with the enumeration above. These algorithms either find and extract smooth parts of the norms, or completely factor them. The family of sieving algorithms [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF][START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF], batch algorithms [7, Algorithm 2.1] and ECM [START_REF] Bouvier | Faster cofactorization with ECM using mixed representations[END_REF][START_REF] Lenstra | Factoring Integers with Elliptic Curves[END_REF] are examples of such methods used in factorization and DLP computations.

Batch. Batch algorithms are quasi-linear time algorithms that test the smoothness of a list of integers. Multiple variants exist depending on the required output.

The first two variants take as input the list of integers and a list of primes up to some bound: batch trial division outputs the list of primes p that divide the integers and batch smooth part extraction only returns the smooth part of the integers, i.e., the product of the primes that divide the integers. Finally batch coprime factorization only takes as input the list of integers and returns the factors of each integer using repeated gcd operations.

In the context of DLP computations, the batch smooth part extraction algorithm is favored since it has the lowest complexity and is enough to test for potential smooth candidates. More precisely, the algorithm takes as input a list of prime numbers

P = {p 1 , • • • , p batch } and a list of integers N = {n 1 , • • • , n m }
and outputs for each n i ∈ N its smooth part, i.e., the product of its prime factors in P . The algorithm uses product trees and remainder trees to efficiently compute the gcd(n i , j p j ) for all i. We refer to [7, Algorithm 2.1] for the complete algorithm.

The batch smooth part extraction has complexity O(M (B) log B) where M (n) is the cost of multiplication of integers of size n bits and B is the number of bits of max ( p j , n i ).

Elliptic Curve Factorization Method. The elliptic curve factorization method [START_REF] Lenstra | Factoring Integers with Elliptic Curves[END_REF], commonly known as ECM is an elliptic curve-based integer factorization algorithm that runs in sub-exponential time. The algorithm takes as input a composite integer n and outputs small factors of n. The algorithm relies on Hasse's theorem that states that if p is a prime, then the group order of an elliptic curve over Z/pZ is p + 1 -t where |t| ≤ 2 √ p. The algorithm picks a random elliptic curve E(Z/nZ) and a point P on it and computes the scalar multiplication Q = kP where k = p i for primes p i up to some bound. Let p be one of the factors of n which we want to find. If the order of the curve E over Z/pZ divides k, then the z-coordinate of the point Q taken mod p is equal to zero and can thus be recovered by computing gcd(z

, n) = p. The running-time of ECM is O(L p (1/2, √ 2+o(1))M (log n))
, where p is the smallest prime factor of n.

These algorithms all have different complexities and properties and thus cannot be used on the same amount of input norms N i . ECM is for example much costlier than sieving. Hence, applying it to all norms N i is far from optimal. On the other hand, sieving is a much cheaper algorithm per candidate, and thus can be used to find the small factors (up to p max ) of a large number of norms of structured candidates. This is why the relation collection step usually starts with a sieving algorithm with input all candidates (a(ι), b(ι)) pairs. ECM is then used to guarantee that the norms of promising candidates are indeed B-smooth by checking the larger prime factors. Batch smoothness can be added in between sieving and ECM or as a substitution of one of them to further optimize the overall cost. It is cheaper than ECM and thus can be used to pre-select promising candidates but costlier than sieving and thus cannot be run on the entire set of candidates. It extracts prime factors up to a bound p batch such that p max < p batch < B. Table 3 The relation collection is thus seen as a sequence of filters, each taking a certain amount of candidates as input, and selecting survivors based on a criterion. These survivors are then the input to the next filter. The selection of survivors is usually based on a threshold on the size of the cofactor, for which we fix a notation.

Notation Let N be a positive integer and consider P = i p i where the p i are the prime factors of N extracted by Algorithm A. Then the A-cofactor of N is denoted by C A (N ) = N/P . We also denote by T A the A-cofactor threshold, that is such that a candidate is a survivor when its norm N satisfies C A (N ) ≤ T A . Remark 2. When A is sieving or ECM, the algorithm returns the primes p i and when A is batch smoothness, the algorithm directly returns the product P .

The entire procedure is summarized in Figure 5.

Remark 3. Note that the bounds T A are not smoothness bounds. However, they allow to select promising candidates. Indeed, if the cofactor of a norm is small, the probability of the norm being smooth is higher.

Finally, the complete relation collection is given in Algorithm 1. Note that on line 7, we remove duplicate relations, as explained in the next Section.

Filtering through equivalent relations

When sieving through all the pairs of candidates it is sometimes the case that two pairs (a(ι), b(ι)) and (a ′ Enumerate all vectors c in L Q,p ∩ S.

5:

For each c, keep track of the size of the factor p with a sieving table. 6: For promising c, for which the product of the factors p is large, compute approximations of the norms N1, N2 and identify vectors with sieve-cofactor smaller than Tsiev. They are called sieve-survivors. 7: Remove duplicates. 8: Run batch algorithm with input the (exact) norms N1 and N2 of the sieve-survivors and primes up to p batch . Keep batch-survivors whose batch-cofactor is smaller than T batch < Tsiev. 9: Run ECM on the batch-survivors to identify all the doubly-B-smooth norms. 10: return Vectors with doubly-B-smooth norms spond to two linear equations that provide the same information on the virtual logarithms of the elements of the factor basis involved.

Removing duplicates is common in factoring and DLP computations. Let us start by identifying three different types of duplicates. Because these definitions apply in both NFS and TNFS, we use the terminology (a, b)

to either define a classical (a, b) ∈ Z 2 pair in NFS or (a(ι), b(ι)) ∈ R[ι] 2 in TNFS.

Definition 1 (Duplicates).

A duplicate relation refers to a pair (a, b) such that there exists another pair (a ′ , b ′ ) that leads to the same relation. We distinguish three types of duplicates:

-We refer to special-q-duplicates when a relation with ideal factorization (a -bα i )O i = j Q ej j involves several prime ideals Q j that occur in the set of special-q's considered. In other words, more than one special-q units of computation provide the same relation.

-If (a, b) generates a relation for a fixed special-q, then a K h -unit-duplicate refers to the pair (ua, ub), for u ∈ O * K h , where u is a small enough3 unit of K h .

-If (a, b) generates a relation for a fixed special-q, then a ζ 2 -duplicate refers to the pair (λa, λb),

for λ ∈ O K h \ O * K h
, where λ is small enough.

Remark 4. The special-q-duplicates are considered over the entire set of relations, meaning for all special-q considered, whereas the other two types of duplicates concern a fixed special-q. The methods to remove them thus differ.

The name ζ 2 -duplicate was chosen to recall that given a random (a, b) pair, the probability that a and b (seen as ideals) are coprime is 1/ζ K h [START_REF] Barbulescu | Improving NFS for the discrete logarithm problem in non-prime finite fields[END_REF]. A lower value of ζ K h (2) therefore translates into a larger proportion of ζ 2 -duplicates in the sieving space.

Duplicate relations generate identical or nearly identical lines in the linear system of equations. As the cost of solving the system grows with its dimension, we want to get rid of all the unnecessary lines. The related matrix is encoded as a list of prime ideal factors for each relation. So in theory, a simple solution would be to remove identical lines in this file before the linear algebra step.

However, in practice generating duplicate relations is costly. Indeed, they generate more hits during the enumeration of the vectors in L Q,p ∩ S (line 4 in Algorithm 1), they imply more sieve-survivors for which we must compute exact norms (line 8), and this finally results in more batch-survivors and hence a costlier ECM algorithm (line 9). To minimize these extra computations, it is thus convenient to get rid of the duplicates that can be identified as fast as possible. However, the same strategy cannot be applied for each type of duplicates.

Indeed, the special-q duplicates can only be detected once we know the entire factorization of the norms, meaning after running ECM. Moreover, special-q computation units are often run in parallel and thus there is little hope to be able to detect any special-q duplicates before the end of the relation collection phase. These duplicates are thus removed just before the linear algebra step.

On the other hand, K h -unit-duplicates and ζ 2 -duplicates are local to a specialq and can be detected at an earlier stage. Yet there is a trade-off between the extra cost of having duplicates and the cost of analyzing whether a pair (a, b) yields a duplicate relation. In our Algorithm 1, we chose to remove duplicates before running the batch algorithm. Let us now explain how to remove them.

Classical strategy for removing duplicates. A classical trick used in NFS is to reduce the search space by enforcing a positive sign to the first coordinate a. Indeed, when looking at K h -unit-duplicates, we are concerned with elements

u ∈ O * K h and in the classical NFS setup, O * K h = Z * = {-1, 1}.
Enforcing a > 0 reduces the search space by a factor 2 and avoids all unit-duplicates.

The situation is more complicated in TNFS as the number of units to consider is greater than 2. It is still possible to restrict to positive coefficients in order to avoid duplicates resulting from the units {±1} and we see in Section 4 that the enumeration algorithm indeed only considers half of the vectors in L Q,p ∩ S. However, we are left with the following open question. Is there a systematic way to identify and thus remove duplicates generated from units other than ±1? The difficulty of answering this question comes not only from the large number of units but also from the fact that the units must be small enough in order to produce a relation. Indeed, if u is too large, then (ua, ub) will be outside the sieving region and we do not have to worry about it.

Before giving more details on how we deal with these problematic K h -unitduplicates and the ζ 2 -duplicates, we give our methodology to identify them. We remind the reader that removing duplicates happens before the batch smoothness and thus we are looking at the set of sieve-survivors.

Our strategy to identify K h -unit-duplicates and ζ 2 -duplicates. For each pair (a, b) that is a sieve-survivor, we compute the value k := a/b (mod h) ∈ K h , and store it in a hash table. If (a, b) and (a ′ , b ′ ) are either K h -unit-duplicates or ζ 2duplicates, then they have the same index k. The hash table allows us to quickly identify if a given pair (a ′ , b ′ ) is a duplicate of a previously seen (a, b) pair.

Remark 5. This method is done "locally" for every special-q. Indeed, one could think of adapting the idea of a general hash table regrouping relations from every special-q considered but the memory cost would be exceedingly high. This method also justifies the choice of where in Algorithm 1 we test for duplicates. Indeed, computing k is not cost-free thus we want to avoid this computation for every pair (a, b) outputted by the enumeration algorithm. It is however cheaper than computing an exact norm, so we compute it before.

However, the method brings forth the following issue. Duplicates can be seen as an equivalence class from which we want to select a unique representative. This representative of the class should be the "smallest" pair (a, b), meaning the (a, b)-pair which leads to the smallest norms. Indeed, a larger (a, b)-pair adds non-zero coefficients in the matrix of the linear system of relations and thus slows down the linear algebra step. For example, considering the (λa, λb)-pair, we have N i (λa, λb) = N i (a, b)N K h (λ) for i = 1, 2 with the additional term N K h (λ) with respect to the (a, b)-pair. This additional term yields extra ideals in the prime ideal decomposition, thus non-zero coefficients in the matrix. Our method does not necessarily keep the smallest pair. Indeed, if (λa, λb) for λ ∈ O K h is already in the hash table, and if the algorithm sees the pair (a, b) afterwards, it will discard it and keep (λa, λb).

The removal of special-q duplicates is easier when the representative of a duplicate class is in its canonical form. Indeed, special-q duplicates are removed by simply comparing the lines in the file that encodes the relations. Thus if different special-q's produce the same relation but each keep a different representative, say (a, b) for one and (λa, λb) for the other, then their prime ideal decomposition will differ by some factors corresponding to N K h (λ) and thus the duplicate will be kept. To identify the "smallest" (a, b)-pair in a ζ 2 -duplicates class of equivalence, the most intuitive idea is to consider the notion of a primitive pair.

Definition 2. A pair (a, b) is primitive if there exists no λ ∈ O K h \ O * K h such that a = λa ′ and b = λb ′ with a ′ , b ′ ∈ O K h .
In NFS, we simply keep the (a, b)-pairs such that gcd(a, b) = 1. The situation is more problematic in TNFS as the notion of gcd exists at the level of ideals, but not for a(ι) and b(ι). Consequently we propose to detect non-primitive pairs by computing the gcd of their norms: if gcd(N 1 (a, b), N 2 (a, b)) = 1, then the (a, b)pair is primitive. Indeed if one considers (λa, λb) which is clearly non-primitive, we have

gcd (N 1 (λa, λb), N 2 (λa, λb)) ≥ N K h (λ) min(deg f1,deg f2) ̸ = 1.
Because we store and compare pairs in our hash table, we are left with a unique representative per class but we cannot be certain that this pair is primitive. Indeed, the method that computes the indices k keeps the first pair it encounters with that index and ignores all the following regardless of their primitiveness. Hence, on line 7 of Algorithm 1, if an (a, b)-pair survives the K h -unit duplicates and ζ 2 -duplicates elimination, we check whether our representative is primitive and if not, try to make it so, using Algorithm 2. Return Fail Remark 6. A few comments can be made on the above algorithm.

Algorithm 2 Primitive representative for each class of duplicates

-In Algorithm 2 we use the fact that if gcd(N 1 (a, b), N 2 (a, b)) = 1, then the (a, b)-pair is primitive. We actually have an equivalence if the number field K h is principal. In particular, in our computation, the field K h is principal which ensures we do not throw away too many relations by using Algorithm 2.

-The elements of K h of norm ℓ are hardcoded in our code for our specific computation for primes ℓ up to 43.

-If for a given (a, b)-pair, once we have reached ℓ = 43 and the gcd is still not 1, we simply remove the relation. Therefore the algorithm may still fail, even though K h is principal. -Finding the corresponding primitive pair can be done in an easier way with PARI [START_REF] Batut | User's Guide to PARI-GP[END_REF] or Sage [START_REF]The Sage Developers: SageMath, the Sage Mathematics Software System (Version 9[END_REF] We have presented how to detect ζ 2 -duplicates and K h -unit duplicates. For ζ 2 -duplicates we can keep a unique representative and make sure that representative is in a primitive form. Unfortunately, Algorithm 2 does not work for finding a unique representative with respect to K h -unit duplicates. Indeed, if γ is a unit, then N K h (γ) = 1. In this case, we simply rely on the prime ideal decomposition which is unique in an equivalence class of K h -unit duplicates.

Relation collection with lattice enumeration

Recall we can select polynomials ϕ that are good candidates that lead to potential relations as soon as we enumerate all vectors c in L Q,p ∩ S. Different enumeration techniques exist in the literature which depend on the shape of the sieving region S and the dimension d of the lattice L Q,p . For NFS, usually d = 2 since (a, b) ∈ Z 2 are not polynomials. Higher dimensions can also be considered in theory to target medium characteristics finite fields. When d = 2, thus for previous records using NFS, the sieving method of Franke and Kleinjung [START_REF] Franke | Continued Fractions and Lattice Sieving. Special-Purpose Hardware for Attacking Cryptographic Systems-SHARCS[END_REF] is very efficient. However, in this article, we focus on methods that can be used in higher dimensions. Indeed, as shown above, for TNFS we have d = dim M Q,p . Taking the polynomials a(ι) and b(ι) of degree deg h -1 leads to d = 2 × deg h hence d ≥ 4. There exist two competitive algorithms that can be used when d ≥ 3: the transition vectors method [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF] and the recursive hyperplane one [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF], see Section 4.1 for these algorithms. They both use as a sieving space a d-orthotope whereas in this work we consider a d-sphere. We use the notation S = S d (R) to indicate we are working in a d-sphere of radius R or simply S d to lighten the notation when possible. Section 4.2 describes our new algorithm adapted for TNFS.

Existing algorithms to enumerate vectors in

L Q,p ∩ S
We start by giving a short refresher of two other recent competitive methods that can be used when d ≥ 3: the transition vectors method [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF] and the recursive hyperplane one [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF].

Transition vectors for lattice sieving in [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF]. In 2018, Grémy suggested a sieving algorithm inspired by Franke-Kleinjung's algorithm in dimension 2 but extended to higher dimensions. Let S be the sieving space considered, in this case, a dorthotope defined as the product of intervals

S = [H m 0 , H M 0 [× • • • × [H m d-1 , H M d-1 [ for fixed bounds H m k , H M k .
The key notion used by Grémy to enumerate vectors of a lattice L is the notion of transition-vectors, allowing to jump from vector to vector in order to reach all elements in L Q,p ∩ S. More precisely, a k-transition vector t is a non-zero vector of the lattice L such that there exists vectors v and v ′ in L ∩ S satisfying v ′ = v + t with the following two conditions: the last d -k coordinates of v and v ′ are the same, and the coordinate v ′ k is the smallest possible value greater than v k . The addition (similarly subtraction) of k transition-vectors is illustrated below.

v + t = (v 1 , v 2 , • • • , v k , v k+1 , • • • , v d ) + ( * , * , • • • , * , 0, • • • , 0) = v ′ = (v ′ 1 , v ′ 2 , • • • , v ′ k , v k+1 , • • • , v d )
The enumeration algorithm reaches all vectors in the intersection by adding and subtracting k-transition vectors for k = 1, 2, • • • , d. The algorithm starts with the null vector (which trivially belongs to L) and adds (and subtracts) k-transition vectors until the edges of the intervals [H m k , H M k [ are reached. In most cases, producing the entire set T is not possible, and thus the notion of transition-vectors is relaxed into nearly-transition-vectors. This variant is effective, but no longer reaches all vectors. A fall-back strategy is then considered when the algorithm fails to find an appropriate nearly-transition vector.

In dimension 4, this method seems to have sufficient prospects of success. However, even with the relaxed variant, experiments ran in dimension 6 in [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF] point to the limits of this method due to the poor quality of the nearly-transitionvectors and the number of calls required to the dedicated fall-back strategy. [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF] concluded that "using cuboid search is probably a too hard constraint that implies the hardness or even an impossibility for the sieving process".

Recursive lattice sieving through hyperplanes in [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF]. In 2020, McGuire and Robinson also proposed an enumeration algorithm in dimension 3 or higher. The sieving area is again a

d-orthotope S = [0, H[×[-H, H] • • • × [-H, H[ for a fixed bound H.
To enumerate all the vectors in L Q,p ∩ S the main idea consists in dividing the search space into hyperplanes, and enumerating in each of them. Minimizing the number of hyperplanes to visit is done by adequately choosing a "ground" hyperplane and then considering translations of it.

More precisely, in dimension 3 the "ground" plane G 0 is defined as a plane spanned by the two shortest vectors c 1 , c 2 of L Q,p through the origin. Because of the small dimension of L Q,p , these shortest vectors are easily found with LLL. One then enumerates every point in G 0 ∩ S before moving to the next translated plane:

G 1 = G 0 + c 3 , G 2 = G 0 + 2c 3 , • • • , G k = G 0 + kc 3 until a k is reached such that G k ∩ S = ∅. For each translated plane, one enumerates points in G k ∩ S.
As we understand it, these short vectors serve a similar purpose as Grémy's transition-vectors: the aim is to choose relevant vectors to add (or subtract) to others while being as exhaustive as possible. Similarly to [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF], the enumeration here is not completely exhaustive. Indeed, in [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF], the authors report consistently missing around 1.8 % of the lattice points per special-q due to corner cases.

The main speed gain of this algorithm compared to Grémy's algorithm is not so much in the enumeration done in each translated hyperplane, but in the number of hyperplanes that are being considered. Indeed, taking the largest vectors of the basis for the direction of the hyperplane translations allows to minimize the number of hyperplanes required to cover S.

Algorithm 3 Recursive version of enumeration algorithm from [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF] Input: the basis of a lattice L of dimension d, a sieving region S.

Output: list L of vectors in L ∩ S def enum(d, S, [b1, b2, • • • , b d ]) 1: L = {} 2: if d ̸ = 1 then 3: k = 0 4: P = plane(0, b1, b2, • • • , b d-1 ) 5: emax = max{e ∈ N : S ∩ (P -e • b d ) ̸ = ∅} 6: G0 = P -emax • b d 7:
while

G k ∩ S ̸ = ∅ do 8: L ′ ← enum(d -1, G k ∩ S, [b1, b2, • • • , b d-1 ]) 9:
Append L ′ to L 10:

k = k + 1 11: G k+1 = G k + b d 12: if d = 1 then 13:
Find p0 ∈ plane(0, b1) ∩ S with linear programming 14:

Add p0 to L 15:

emax = max{e ∈ N : S ∩ (p0 -e • b1) ̸ = ∅} 16: Define P0 = p0 -emax • b1 17: while P0 ∩ S ̸ = ∅ do 18: P0 = P0 + b1 19:
Add P0 to L 20: return L.

Pseudo-codes for dimensions 3 and 4 (only) are given in [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF][START_REF] Robinson | An implementation of the Extended Tower Number Field Sieve using 4d sieving in a box and a record computation in F p 4[END_REF]. Although the authors state their algorithm can be extended to higher dimension, we wonder whether it remains efficient when d > 4. We write in Algorithm 3 a pseudo-code of our understanding of how their method can be adapted for any dimension d. One difficulty we see is finding e max when enumerating in G k ∩S, which increases with d and the task can become too expensive very quickly. Indeed, finding e max can be done using integer linear programming, which is doable in low dimension but should be very hard (or at least costlier than desired) as d grows.

Remark 7. Those two approaches use a sieving space that is an orthotope, while we prefer to use a sphere. In the end, what is involved in the computation is the algebraic norms of the elements of the sieving space, and taking an orthotope or a sphere amounts to choosing to approximate the algebraic norms by either the ℓ ∞ or the ℓ 2 norms. Giving a definitive answer about what is the best approximation seems to be hard, since, for instance, the shape of an ideal sieving space based on algebraic norms depends on the number of real roots of the defining polynomials. Illustrations in dimension 3 are given in the Appendix A of [START_REF] Gaudry | Collecting relations for the number field sieve in GF (p 6 )[END_REF]. The method we use for enumeration in the next section is very ℓ 2 -friendly, so using a sphere instead of an orthotope is the natural choice.

Schnorr-Euchner's enumeration algorithm for TNFS

In order to find potential relations, recall that we enumerate all the vectors of bounded norms in the lattice L Q,p , where L Q,p translates the notion of divisibility by an ideal p and a special-q ideal Q. By enumerating vectors in L Q,p ∩S d (R) for many different p (each generating a different L Q,p ) one can identify vectors divisible by many p's and thus more likely to correspond to B-smooth norms.

Let us fix p and a special-q ideal Q. Given an LLL-reduced basis

{b 1 , • • • , b d } of L Q,p
and the radius R of a d-sphere S d which corresponds to the sieving area, we propose to find these vectors thanks to an adaptation of Schnorr-Euchner's enumeration algorithm [START_REF] Schnorr | Lattice Basis Reduction: Improved Practical Algorithms and Solving Subset Sum Problems[END_REF]. We choose to follow [START_REF] Schnorr | Lattice Basis Reduction: Improved Practical Algorithms and Solving Subset Sum Problems[END_REF] instead of Fincke-Pohst-Kannan's algorithm [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF][START_REF] Kannan | Improved Algorithms for Integer Programming and Related Lattice Problems[END_REF] as it appears more efficient operation-wise.

Description of the algorithm. Schnorr-Euchner's algorithm constructs an enumeration tree of depth d where the leaves correspond to our vectors in L Q,p ∩ S d , i.e., the vectors c = d i=1 v i b i that satisfy ||c|| ≤ R. To construct the tree, the algorithm considers projections of the lattice L Q,p . Since the norm of vectors cannot increase under orthogonal projections, the enumeration algorithm proceeds recursively by looking at the orthogonal projections π k on the set {b 1 , • • • , b k-1 } ⊥ for decreasing values of k and where π 1 is the identity.

More precisely, using the Gram-Schmidt relation

b i = b * i + i-1 j=1 µ i,j b * j , a vector c can be re-written as c = d i=1   v i b * i + i-1 j=1 v i µ i,j b * j   = d j=1   (v j + d i=j+1 µ i,j v j )b * j   ,
where the vectors b * i correspond to the Gram-Schmidt orthogonalization of the basis vectors b i and the µ i,j are the Gram-Schmidt coefficients. The internal nodes of the tree then correspond to projections of the vector c. The projection of the vector c for a given k = 1, 2, • • • , d is given by

π k (c) = d j=1   (v j + d i=j+1 µ i,j v i )π k (b * j )   = d j=k   (v j + d i=j+1 µ i,j v i )b * j   ,
At each level k of the tree, the algorithm verifies that ||π k (c)|| ≤ R which can be reduced to enumerating admissible values of v k that lie in a bounded interval. Indeed, searching for all plausible v k coefficient such that ||π k (c)|| 2 ≤ R 2 reduces to enumerating in the interval given by Equation 2.

v k + n i=k+1 µ i,k v i ≤ R 2 - n j=k+1 (v j + n i=j+1 µ i,j v i ) 2 ||b * j || 2 ||b * k || . ( 2
)
If the condition ||π k (c)|| 2 ≤ R 2 is satisfied, the algorithm explores the descendants (i.e., the algorithm moves to the k -1 level). Otherwise, the subtree is ignored. Once we reach the leaves, and the condition is still true, we have found a vector in L Q,p ∩ S n . The algorithm visits half the nodes since if c ∈ L Q,p then -c ∈ L Q,p . The pseudo-code for the full algorithm in our context is given in Algorithm 4.

Efficiently computing the vectors

c = v • M Q,p . The algorithm works with the coefficient vectors v = (v 1 , • • • , v d ).
However, in the end, we do not want the combinations v, but the vectors

c = v • M Q,p = d i=1 v i b i .
Computing these vectors c can either be done naively, at the leaf level by explicitly computing c = d i=1 v i b i for each leaf, or one can keep track of a partial sum d i=t v i b i for a fixed value t chosen as input to the algorithm and update the quantity v i b i once a v i is changed during the algorithm, i.e., once the algorithm visits a new internal node in levels t to d. We opt for the second option as it reduces the overall cost of enumeration.

More precisely, let common part = d i=t v i b i , where each v i b i is stored in a variable. Each time the algorithm visits a new internal node, thus updates v i for a given i = t, • • • , d, the algorithm updates common part by subtracting the current v i b i , computing the new v i b i with the new value of v i and adding it back to common part. Once at the leaf, in order to compute the vector c, it remains to compute c = t-1

i=1 v i b i + common part.
For most values of p we are concerned about, we use this optimized code with t = 2, thus updating all values v i b i during the algorithm, except at the leaf level, and finally computing c = v 1 b 1 +common part. When p becomes large and few leaves are found, it can be less efficient to choose t = 2, and thus one selects the appropriate t > 2 in order to optimize the number of operations performed for this computation. More details are given in the Section 5 below and the pseudo-code for the optimized enumeration algorithm is given in Algorithm 4.

Remark 8. This optimization makes sense in this specific context where our lattices are of small dimension and often dense (in particular for small primes). This would not translate well for general lattices of larger dimensions or if only a handful of small vectors were output.

Analysis of the relation collection

Number of leaves, nodes and enumeration cost

We now estimate the cost of our enumeration algorithm. This implies having an estimate of the number of nodes and leaves in the enumeration tree. This estimate is derived using the Gaussian heuristic. In order to do so, it is necessary to analyze the geometry of the input lattice L Q,p . In particular, we are interested in the ratio between the norms of two consecutive Gram-Schmidt vectors of the (reduced) lattice. Indeed, to count the number of nodes in the enumeration tree, we need to compute the volume of the projected lattices which is given by the product of the norms of the Gram-Schmidt vectors.

The dimension of the lattices we consider is small, i.e., precisely 6 in our computation but plausible dimensions are 4, 6 or 8 for other realistic targets. Because of these small dimensions, we observe that classical analyses of lattice reduction algorithms do not hold. For example, an expected lower bound β on the ratio ||b * i+1 || 2 /||b * i || 2 was observed in [START_REF] Nguyen | LLL on the average[END_REF] for vectors outputted from a reduction algorithm. The constant β depends on the reduction algorithm considered and in the case of LLL, we have β = 1/(δ -η 2 ). Sage's default LLL implementation uses δ = 0.99 and η = 0.501, thus β = 1.35. This value is obtained for random bases. Our lattices L Q,p are however not random. We thus experimentally measured that for 6-dimensional lattices, the ratio ||b * i+1 ||/||b * i || is smaller than expected, hence we introduce the following heuristic.

Heuristic 1 For 6-dimensional lattices L Q,p , ||b * i+1 ||/||b * i || ≈ 1.09 on average.
In what follows, we need to estimate the number of lattice vectors in a sphere. For this, we rely on the Gaussian heuristic, which tells us that the number of points belonging to the intersection of a lattice L and a set S is roughly the ratio of the volumes, i.e., vol(S)/ vol(L). This heuristic was suggested to analyze enumeration algorithms in [START_REF] Hanrot | Improved analysis of Kannan's shortest lattice vector algorithm[END_REF] and experimentally confirmed to be accurate in [START_REF] Gama | Lattice enumeration using extreme pruning[END_REF] for random lattices.

Number of leaves.

The volume of a full-rank d-dimensional lattice L is given by det(L) = d i=1 ||b * i || and in our case the volume of L Q,p is p. Using the Gaussian heuristic, and taking into account the fact that we visit only half of the tree, the number of leaves is thus given by

Ξ leaves ≈ 1 2 vol(S d (R)) det(L Q,p ) = R d π d/2 2Γ (d/2 + 1)p . Algorithm 4 Optimized enumerating L Q,p ∩ S d Input: LLL-reduced basis {b1, • • • , b d } of L Q,p , radius R of d-sphere S d , variable t for optimization. Output: List K of vectors c ∈ L Q,p ∩ S d (R).
1: Pre-computation: compute all Gram-Schmit coefficients µi,j for i < j and the norms of the Gram-Schmidt vectors ||b * i || 2 for all i ≤ d.

2: K ← {}, σ ← (0) (d+1)×d , r0 = 0, r1 = 1, • • • , r d = d, v1 = 1, v2 = • • • = v d = 0. 3: ρ1 = ρ2 = ρ d+1 = 0 ▷ with ρ k = ||π k (c)|| 2 4: c1 = • • • = c d = 0 ▷ with c k = -d i=k+1 µ i,k vi 5: w1 = • • • = w d = 0 6: last nonzero = 1, common part = vtbt + • • • + v d b d 7: k = 1 8: while true do 9: ρ k = ρ k+1 + (v k -c k ) 2 ||b * k || 2 10: if ρ k ≤ R 2 then 11: if k = 1 then 12: c = t-1 i=1 vibi + common part ▷ opt. computation of c 13: K ← K ∪ c 14:
if last nonzero = 1 then 15:

Skip ▷ this generates ζ2-duplicates 16:

else 17: if v k > c k then v k ← v k -w k 18: else 19: v k ← v k + w k 20: w k ← w k + 1 21: else 22:
k ← k -1 ▷ we go down the tree 23:

r k ← max(r k , r k+1 ) 24:

for i = r k+1 to k + 2 do 25:

σ i,k ← σ i+1,k + viµ i,k 26: c k ← -σ k+1,k 27: v k = ⌈c k ⌋, w k = 1. 28: if k = ℓ for ℓ = t, • • • , d then 29:
Re-compute common part by updating v ℓ b ℓ . 30: else 31:

k ← k + 1 ▷ going back up the tree. 32:

if k = d + 1 then 33:
return K ▷ we find no more solutions 34:

r k ← k 35: if k ≥ last nonzero then 36: last nonzero ← k 37: v k ← v k + 1 38: if k = ℓ for ℓ = t, • • • , n then 39:
Re-compute common part by updating v ℓ b ℓ . 40:

else 41: if v k > c k then v k ← v k -w k 42: if k = ℓ for ℓ = t, • • • , n then 43:
Re-compute common part by updating v ℓ b ℓ . 44: else 45:

v k ← v k + w k 46: if k = ℓ for ℓ = t, • • • , n then 47:
Re-compute common part by updating v ℓ b ℓ . 48:

w k ← w k + 1
Number of nodes. Let Ξ k denote the number of nodes at level k which corresponds to the number of points in π k (L Q,p ) ∩ S d-k+1 (R). From the Gaussian heuristic and dividing by 2 for the half-tree, we have

Ξ k = |π k (L Q,p )∩S d-k+1 (R)| and Ξ k = vol(S d-k+1 (R))/(2 • vol(π k (L Q,p ))).
The volume of the projected lattice π k (L Q,p ) is d i=k ||b * i ||, and we can use Heuristic 1 to estimate it. We get 1) . We therefore get

vol(π k (L Q,p )) ≈ ||b 1 || d-k+1 (1.09) d-1 i=k-1 i ≈ ||b 1 || d-k+1 (1.09) 0.5(d-k+1)(d+k-2) . Since for k = 1 we have vol(π 1 (L Q,p )) = p, we set ||b 1 || ≈ p 1/d /(1.09) ( d-1 i=1 i)/d . We then have vol(π k (L Q,p )) ≈ p (d-k+1)/d (1.09) d-1 i=k-1 i-((d-k+1)/d) d-1 i=1 i that leads to vol(π k (L Q,p )) = p (d-k+1)/d (1.09) 0.5(d-k+1)(k-
Ξ k ≈ R d-k+1 π (d-k+1)/2 2 • Γ ((d -k + 1)/2 + 1) • p (d-k+1)/d • (1.09) 0.5(d-k+1)(k-1) .
Finally, the total number of nodes is Ξ = d k=1 Ξ k . Experimental verification of these formulae are provided in Section 6.

Running time of enumeration. The running time of our enumeration algorithm is given by the number of nodes Ξ times the number of operations per node. At each node, the algorithm performs 7 arithmetic operations on average to compute and update the linear combinations v. In addition, one must also compute the Once at the leaf, in order to compute the vector c, it remains to perform

vector c = v • M Q,p =
(t -1)(2d -1) + t -1 operations, c = v 1 b 1 + • • • + v t-1 b t-1 + common part.
In summary, we have for the additional cost of computing the vector c Comp c naively = Ξ leaves × (2d 2 -1) but using common part, the cost of computing the vector c is Comp c opt = # int. nodes t→d × (4d -1) + Ξ leaves × ((t -1)(2d -1) + t -1) so

Comp c opt = d i=t Ξ i (4d -1) + Ξ leaves ((t -1)(2d -1) + t -1).
We experimentally verify that the optimized code results in less operations than the naive one to compute all the vectors c for all but too large values of p when choosing t = 2. When p becomes too large and there aren't many leaves, the optimized code uses more operations than the naive one. One easy way to resolve this is to increase the value of t in the definition of common part. However, this occurs when p is large enough that the predominant cost is in generating the lattice L Q,p and not in the enumeration algorithm. Finally, the total cost of enumeration on average is thus equal to:

Cost enum = 7 × Ξ + Comp c opt.
Number of leaves per node. The number of leaves per node is given by r = Ξ leaves /Ξ as a function of p. This ratio r captures the behavior of our algorithm. The higher r is, the more efficient our algorithm becomes: we want this ratio to remain high as internal nodes correspond to (necessary) operations which do not produce any information as lattice vectors are seen only at the leaf level. When p increases, r decreases, as illustrated in Figure 7 for parameters specific to our computation. Indeed, the probability of a norm being divisible by a small prime is higher than for larger primes. Hence for small primes, r is close to 1. This explains why we enumerate on small primes first, and switch to batch algorithms for larger primes.

Comparing enumeration and construction of the lattice. Figure 6 illustrates the variation of the number of operations for the construction of the basis M Q,p for the lattice L Q,p and the enumeration algorithm for increasing values of p and a fixed special-q. When p is small, the enumeration algorithm is costlier (in terms of number of operations) than constructing the lattice itself. However, when p becomes large enough, constructing the basis M Q,p becomes much costlier. The intersection point varies depending on the radius R and can be chosen to be close to p max .

Overall complexity of relation collection. The total cost of Algorithm 1 is the sum of the cost of constructing L Q,p , the cost of enumerating in L Q,p ∩S, and the costs of batch algorithm on the sieve-survivors and ECM on the batch-survivors. In order to optimize the overall complexity, it is important to correctly set the many parameters that come into play during this step. In particular, one must decide the size of (many) fixed parameters: the radius R, the smoothness bound B, the range of special-q's to consider, the bounds p max , p batch and the balance between sieving, batch smoothness and ECM based and the size of the cofactors.

Comparison with previous methods

Our enumeration algorithm vs [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF]. Grémy's algorithm uses a d-orthotope as sieving space, whereas we consider a d-sphere. The number of nearly-transition vectors required in [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF] for the algorithm to enumerate most of the vectors also increases with the dimension. These nearly-transition vectors are generated during Fig. 6: Sketch of number of operations for enumeration and constructing a basis of L Q,p as a function of p. This plot illustrates the behaviour of these two costs. the initialization of the enumeration procedure using various strategies. Moreover, [START_REF] Grémy | Higher dimensional sieving for the number field sieve algorithms[END_REF] states that in dimension 6, the number of calls to the fall-back strategy is important, indicating that the nearly-transition-vectors are of poor quality, and thus the algorithm requires the use of skew-small-vectors (also to be computed). Finally, Grémy's algorithm is not exhaustive in its search of vectors in L Q,p ∩ S, and as the dimension increases, in addition to what was mentioned just before, we suspect the percentage of missing vectors increases as well.

Our enumeration algorithm vs [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF][START_REF] Robinson | An implementation of the Extended Tower Number Field Sieve using 4d sieving in a box and a record computation in F p 4[END_REF]. Similarly as Grémy's algorithm, this algorithm also uses a d-orthotope as sieving space. Moreover, the algorithm presented in [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF] is very similar to the classical enumeration algorithm of Fincke-Pohst-Kannan (FPK) [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF][START_REF] Kannan | Improved Algorithms for Integer Programming and Related Lattice Problems[END_REF] adapted to a rectangular sieving region. One important cost in both FPK and this algorithm is finding the initial point in each plane from which the enumeration starts. In [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF], this is done with linear programming. Every time the algorithm changes hyperplane, an integer linear programming problem must be solved. This does not add much complexity to the algorithm, but its cost is non-negligible with respect to the rest of the operations performed, and increases with the dimension. Our algorithm is based on Schnorr-Euchner's variant which starts its enumeration of a given interval at its center. This avoids the computation of the edge of the interval at each level as required in FPK or the linear programming cost.

Moreover, as the dimension grows, so does the number of hyperplanes. Thus, we believe that the algorithm would struggle to be competitive when this number becomes too large and a linear program must be solved for each hyperplane.

Finally, our algorithm is exhaustive by construction, and thus enumerates every single vector in L Q,p ∩ S. As mentioned previously, the algorithm in [START_REF] Mcguire | Lattice Sieving in Three Dimensions for Discrete Log in Medium Characteristic[END_REF] encounters boundary issues when the planes intersect only the corners of the sieving region. The loss is reasonable in small dimensions but may become more and more problematic as the dimension grows.

6 A 521-bit computation 6.1 A target from the pairing world Considering finite fields with composite extensions is highly motivated by pairingbased cryptography. The security of pairing-based protocols relies on both the discrete logarithm problem in the curve and in the finite field. MNT curves [START_REF] Miyaji | New explicit conditions of elliptic curve traces for fr-reduction[END_REF] are pairing-friendly elliptic curves with small embedding degree 6, meaning that the security of the related pairing-based protocols relies on the discrete logarithm problem in F * p 6 for a prime p. Our target is precisely F * p 6 with an 87-bit prime. MNT curves were introduced in the early 2000's but are back into the spotlight due to the recent arising of zk-SNARKS within the zero-knowledge community, that brings other needs and other uses. For instance, the need of cycles of curves4 in zk-SNARKS, that are currently only available with MNT curves explains why MNT-6 curves are so useful, as explained in Guillevic's blogpost [START_REF] Guillevic | Pairing-friendly curves[END_REF]. Two of them are widely deployed: one with a 298-bit prime [START_REF] Ben-Sasson | Scalable zero knowledge via cycles of elliptic curves[END_REF] and the other with a 753-bit prime [START_REF] Ben-Sasson | Scalable zero knowledge via cycles of elliptic curves[END_REF][START_REF]CODA: MNT-6 curve with parameter 753 for Snark prover[END_REF]. With our 87-bit prime we are still far from these concrete parameters, but our work shows that in order to evaluate the security of these curves the right threat to consider is TNFS.

More precisely, we consider the 521-bit finite field F p n where n = 6 and p = 0x6fb96ccdf61c1ea3582e57 is a 87-bit prime. The extension degree n is composite with factors η = 3 and κ = 2. The prime p is "random" in the sense that it is the closest prime to the 87 first bits of RSA-1024, the 1024-bit integer coming from the RSA Factoring Challenge, such that p 2 -p + 1 is also prime. Moreover, we choose as target an element in F p 6 whose decimal digits are taken from π: target =(31415926535897932384626433 + 83279502884197169399375105ι + 82097494459230781640628620ι 2 ) + x(89986280348253421170679821

+ 48086513282306647093844609ι + 55058223172535940812848111ι 2 ).
This does not fully define the element since this depends on the representation taken for F p 6 . For this, we will simply choose the one that follows from the polynomial selection below.

Because the computation of a discrete logarithm in a group can be reduced to its computation in one of its prime subgroups by Pohlig-Hellman's reduction. We want to consider a prime order subgroup for which the computation is the hardest. To do so, we will work modulo ℓ = p 2 -p + 1 = 0x30c252a90b588491be0a93f6fd11924531a80adb333b, the 174-bit prime order of a subgroup of the multiplicative group of our target finite field. Indeed, any other factor of p 6 -1, namely p -1, p + 1 and p 2 + p + 1, correspond to subfields in which DLP would be much easier to solve. For example, if ℓ divides p -1, the elements considered in DLP belong to F * p and solving DLP with NFS in this prime field of 87 bits can be done in nearly negligible time. On the other hand, the value p 2 -p + 1 does not correspond to any subfields of F p 6 .

Polynomial selection

Three polynomials with specific characteristics must be chosen for TNFS. The following polynomials were provided to us by Guillevic after careful consideration of which polynomial selection method would provide the best polynomials. As explained in Section 2.2, in order to choose between the Conjugation method or JLSV1, it suffices to compare the size of the norms N 1 and N 2 for many (a(ι), b(ι))-pairs. The parameters (i.e., degree of polynomial and coefficient size) of f 2 outputted by Conjugation are the same as the parameters of f 1 and f 2 outputted by JLSV1 and thus it suffices to compare the norms N 1 , N 2 for the Conjugation method. If N 1 is smaller than N 2 , one should choose the Conjugation method. On the other hand, if N 2 is smaller than N 1 , one should consider the JLSV1 method. Averaging over 10 5 (a(ι), b(ι))-pairs clearly showed that N 1 was much smaller than N 2 , and thus the Conjugation method was finally considered to choose the polynomials. To fix ideas, with (a(ι), b(ι))-pairs where the coefficients of a and b are bounded by 500, which is the order of magnitude of what is needed for the computation, the norms N 1 and N 2 have about 110 and 185 bits respectively, with the Conjugation method. With JLSV1 they would be both around 185 bits. Clearly, choosing Conjugation leads to a product of norms with smaller bitsize. Code to reproduce these results can be found at https://gitlab.inria.fr/tnfs-alpha/alpha.git.

The polynomial h is of degree η = 3, monic and irreducible modulo p. In our computation, we use

h(ι) = ι 3 -ι + 1.
This polynomial has the following property: 1/ζ 2 (K h ) = 0.9009. We could have chosen a polynomial h of degree η = 2. This would have resulted in a sieving space of dimension 4 instead of 6. However, for a first large-scale experiment, the goal was to explore the efficiency of sieving in higher dimension, thus the choice of a degree 3 polynomial. We leave for future work the comparison of a TNFS computation with a polynomial h of degree 2. The polynomials f 1 , f 2 are selected thanks to the Conjugation method [START_REF] Barbulescu | Improving NFS for the discrete logarithm problem in non-prime finite fields[END_REF]. We recall that this method looks for polynomials of degree κ and 2κ. We get

f 1 = x 4 + 1,
and

f 2 = 11672244015875x 2 + 1532885840586x + 11672244015875.
These polynomials are irreducible over Z[ι][x] and the polynomial f 2 corresponds to the irreducible common factor modulo p of these two polynomials, as it is the case for the Conjugation method.

Relation collection

Many parameters have to be balanced in practice in Algorithm 1 to optimise the relation collection step. The computational cost of sieving greatly varies depending on the balance between these parameters. In particular, one needs to fix a smoothness bound B, a range of special-q's to consider and a sieving space, which in our context reduces to choosing the radius R of the 6-dimensional sphere we sieve with.

Getting enough relations. In order for the linear algebra step of the algorithm to succeed, one must collect enough relations to construct the linear system of equations. The smoothness bound B gives the number of relations that are needed for the linear algebra step to succeed, i.e., the required number of relations N tot corresponds to 2π(B), where π(x) is the prime counting function. Indeed, the factor basis regroups prime ideals of O 1 and O 2 of norm less than B and of degree 1 and thus the size of the factor basis is twice the number of prime ideals of norm less than B. By Chebotarev density theorem, the latter is given by the counting function π. A good approximation for the counting function is the logarithmic integral function. Interestingly enough, two opposite considerations can be made. In theory, we would want slightly more relations in order to obtain a full-rank matrix. In practice, we require slightly less relations since some ideals will not be considered in the factorizations of the norms. Now that we know an approximation of how many relations we need, one must balance the range of special-q's, the smoothness bound B and the radius R of the sieving space in order to optimize the total cost of the sieving step. Let [q min , q max ] denote the range of special-q to use for sieving.

In order to choose this interval in an optimal way, one must first estimate how many relations are generated on average from a single special-q of a given size. To do so, one can use the Dickman ρ function to estimate the probability of smoothness for the norms N 1 and N 2 . This allows us to get an estimate of the number of relations expected from a special-q as a function of B. Using this estimation, one can then balance the parameters (q min , R, B) in order to find the optimal combination. We defined the total cost (of relation collection) in this context to be the number of special-q required times the computation time for a single special-q. At this early stage, since we are looking at estimations, the time of sieving for a single special-q is taken to be R 6 . The volume of a 6-sphere is given by π 3 Γ (4) • R 6 and we ignore the constants at this stage. These parameters influence the total cost of sieving in the following way.

Impact of R: When choosing a large radius R, one expects to find more relations per special-q since the sieving space is larger. However, increasing R also increases the cost of enumeration for a given special-q. Overall for a fixed q min and B, we observed in our experiments that when R increases, the total cost first decreases, then increases. Indeed, when R increases the number of special-q needed decreases (which is both good and expected). However, this is counterbalanced by the increase in the cost of enumeration. Furthermore, the amount of memory increases with R.

Impact of B: Similarly, increasing the smoothness bound B naturally increases the probability of being smooth. This results in more expected relations per special-q and thus a smaller interval would be required. On the other hand, the total number of relations required is equal to 2π(B) relations and thus the higher the value of B, the more relations are needed. This can be observed in our experiments where for increasing B, the total cost decreases and then starts increasing again.

Impact of q min : The larger the special-q, the less relation it is expected to produce and thus we will require a larger interval. But if q min is too small, one must take into account the effect of the special-q duplicates.

The behaviour of the parameters are summarized in Table 4 where ↗ means the parameters is being increased and ↘ decreased.

parameters # relations required # special-qs total cost qmin ↗ - ↗ ↘ then ↗ R ↗ - ↘ ↘ then ↗ B ↗ ↗ ↘ then ↗ ↘ then ↗
Table 4: Influence of increasing the size of parameters

In our computation, we chose the parameters q min = 5, 000, 113 ≈ 2 22.2 , q max = 26, 087, 683 ≈ 2 24.6 , B = 2 27 , R = 21,

p max = 10 7 , T sieve = 60, p batch = 2 27 , T batch = 0.
This results in a total of 1,280,000 special-q's subsets of polynomials to sieve on. Further optimizing these parameters with more extensive experiments is left for future work.

Sieving and enumeration. For each special-q, the first step in relation collection is to run a sieving algorithm to collect promising relations. This is done using Algorithm 4 which enumerates all vectors in L Q,p ∩ S 6 [START_REF] Grémy | Computing discrete logarithms in F p 6[END_REF], for each prime ideal up to p max . In our implementation, we used this algorithm only on the f 2side. On the f 1 -side, the norms are much smaller, and the cost of enumerating is too high compared to the information it gives about the probability of being smooth.

In our code, enumeration is done with the program enum.c which takes as input a radius R, a cofactor bound T siev and pre-computed files containing roots of the polynomials h, f 1 , f 2 (mod p) for primes p ≤ p max and a range of specialq with the associated reduced bases M Q . It outputs the list of sieve-survivors. Let us fix a special-q Q. The enumeration algorithm must be run for each prime ideal p in K 2 up to p max = 10, 000, 000 and promising candidates, i.e., promising (a(ι), b(ι))-pairs, correspond to vectors for which the norms have a small cofactor.

In order to keep track of hits, we use a sieving table indexed by the vectors ϕ of the coefficients of a(ι), b(ι) converted to an unsigned 64-bit integer value. Whenever ϕ is in L Q,p ∩ S 6 (21) for a given p, we add an approximation of log p to the sieving table at the corresponding index, where p is the prime below p. We will then only look at promising candidates which are the (a(ι), b(ι))-pairs for which log p > 50. For each of these promising candidates, we compute approximations of the corresponding norms, meaning using floating numbers to accelerate the computation, and finally output the (a(ι), b(ι))-pairs for which the cofactor C sieve (N 2 (a(ι)b(ι)α 2 )) ≤ T sieve = 60. Note that we also divide by the special-q. These sievesurvivors obtained at the end of enumeration as the output of enum.c are represented as

(rel1) a 1 (ι) b 1 (ι) N 1,f2 N 1,f1 (rel2) a 2 (ι) b 2 (ι) N 2,f2 N 2,f1 • • •
where a i (ι), b i (ι) are encoded into 64-bit integer values. The formatting is chosen to match the pre-existing format in CADO-NFS in order to directly branch ourselves into CADO-NFS's code for the batch and ECM algorithms.

All in all, we collect approximately 76,401 million sieve-survivors. Note that these survivors are dealt with on-the-fly: in order to avoid storing all of them, they are removed just after the batch algorithm. Recall that at this stage of the algorithm, we also remove the K h -unit duplicates and the ζ 2 -duplicates.

Number of leaves and nodes in the enumeration trees. We analyze our enumeration algorithm by computing the expected number of leaves and nodes for a fixed special-q as the value of p increases. As seen in Figure 7, the output of our enumeration algorithm matches the expected values given by the formulae in Section 5. Both the amount of nodes and leaves decrease when p increases. The ratio r between the amount of leaves and nodes also decreases with p. We see that the estimation of the number of internal node is not precise. However, it gives a good idea of the general behavior of the algorithm. Furthermore r indeed remains high, which is a good indication that we do not spend too much computation for each divisibility information gathered by the process.

Balancing sieving, batch and ECM. The sieve-survivors outputted by the enumeration algorithm are now the inputs to the batch algorithm implemented in CADO-NFS [START_REF] Pierrot | CADO-NFS, An Implementation of the Number Field Sieve Algorithm[END_REF]. Running batch and ECM is done sequentially in CADO-NFS. Here we choose not to run ECM as the computation is efficient enough Fig. 7: Number of leaves and nodes (left) and the ratio between the amount of leaves and nodes (right) as a function of p for a fixed 24-bit special-q. We see that as p increases, both the number of nodes visited by the enumeration algorithm and the number of leaves decreases, as expected. We compare the output of our code with the formulae given in Section 5 using the Gaussian heuristic.

for the record to finish in reasonable time. Further optimizing the parameters including the ECM algorithm is left for future work. We therefore select the batch-survivors with p batch = B = 2 27 and T batch = 0. Indeed, we want the batch-survivors to correspond to our relations which is equivalent to saying that all the norms have no cofactor left, i.e., they completely factor into primes up to the smoothness bound p batch = B. Finally, finishbatch will output the final relations encoded as follows

a(ι), b(ι): ⊔, ⊔, ⊔, • • • : ⊔, ⊔, ⊔, • • •
where ⊔ represents the prime factors of N 2 (before the :) and N 1 (after the :) expressed in hexadecimal. Removing all the possible duplicates further reduces the final amount of relations. This is described in Table 5.

The relation collection was run with an early version of our code, and took the equivalent of 25,300 core-hours. After the optimization given in Algorithm 4, it was going 10 % faster, and would have taken only 23,300 core-hours. On our sample computations, the relations were strictly identical to the one computed with the previous code, so we did not run again the whole computation.

Sieve-survivors Batch-survivors (removing K h /ζ2-dup.)

Removing special-q duplicates # survivors 76 401M 18.69M 13.63M % kept 0.013% 0.02 % 73 % The percentage is given with respect to the previous step. The percentage of sieve-survivors is taken with respect to vol(S 6 (21)) × #special-q's.

From a set of relations to a matrix

The goal is now to transform the factorization of the norms into a factorization of ideals in order to construct the matrix. Each relation will correspond to a row of this matrix, each column corresponds to an ideal, and the coefficients in the row indicate the power of this ideal that occurs in the ideal factorizations on each side, for this relation. This step is easy in theory, and efficient algorithms are given, for instance, in Cohen's textbook [START_REF] Cohen | Advanced Topics in Computational Number Theory[END_REF]. Furthermore, these algorithms are implemented in computer algebra software like PARI or Magma [START_REF] Bosma | The Magma algebra system. I. The user language[END_REF]. A version that works for non-tower extensions fields is also present in CADO-NFS.

With the intention of keeping our toolchain simple for this computation, of avoiding external dependencies with the associated format conversions that are prone to error, and of having an easy integration with CADO-NFS, we decided to sacrifice some relations and write a simple and robust tool for this step. This could and should be improved in a later phase of the development of our TNFS code. Nevertheless, we described it briefly, as an illustration of the simplifications that can be done in an early stage of experimentation with variants of NFS. Currently, our code takes only into account prime ideals for which we can apply Proposition 1, and more precisely those that can be put in the form:

p = ⟨p, ϕ h (ι), x -ρ(ι)⟩, (3)
where p is a prime, ϕ h is a monic irreducible factor5 of h modulo p, and ρ(ι) is a root of f 1 (resp. a root of f 2 in the other number field) in O K h /⟨p, ϕ h (ι)⟩. This corresponds more or less to excluding the so-called "bad ideals" in CADO-NFS terminology, for which there is no nice mathematical definition. Furthermore, our code does not take properly into account multiplicities.

In concrete terms, we proceed as follows:

1. Build a database of all ideals of the form of Equation ( 3), for each side, up to the bound B = 2 27 . This is actually a file similar to the renumber file in the classical CADO-NFS setting, that contains one ideal per line, with the side, p, ϕ h (ι) and ρ(ι). 2. For each relation, for each prime p that arises in the factorization of a norm, for each prime ideal p above p in the database, check whether p divides the relation.

3. If the sum of the degrees of the dividing ideals is equal to the multiplicity of p in the factorization of the norm, we deduce that they all have multiplicity one. If there is only one dividing ideal, we deduce its multiplicity from the multiplicity of p in the norm. Otherwise, we discard the relation.

Finally, we remark that due to the simple form of the ideals we consider, testing divisibility is easy. Let (a(ι), b(ι)) be a relation, and p = ⟨p, ϕ h (ι), x-ρ(ι)⟩ be an ideal. The question if whether p divides the principal ideal of the element a(ι) -b(ι)α 1 (resp. a(ι) -b(ι)α 2 , if we are considering the other side). From Proposition 1, this translates into checking the following equality:

a(ι) ≡ ρ(ι)b(ι) (mod p), (mod ϕ h (ι)).
Our code does not generically handle projective ideals, that are ideals above primes that divide the leading coefficient of f 1 and f 2 . However, we made an ad-hoc treatment for f 2 and p = 5, since rejecting relations involving this prime would be too costly. As in the classical NFS, this is handled by considering the root 0 of f2 where f2 is the polynomial obtained by reversing the coefficients of f 2 and exchanging the roles of a and b.

In the end, we discard relations that involve ideals that are above p dividing the discriminant of the fields, and those for which there are non-trivial multiplicities. Fortunately, the amount of relations we throw away in this step only corresponds to a loss of 2% in our computation. The number of batch-survivors given in Table 5 is 18.69M, and removing the relations for which we are not able to obtain the ideal factorization we finally have 18.25M batch-survivors.

Linear algebra

Before starting the linear algebra step, the matrix must undergo a few modifications in order to speed up the resolution of the system. This is done by a step called filtering. More precisely, the aim of filtering is to reduce the size of the matrix of relations without modifying its kernel.

Dealing with special-q duplicates. As mentioned in Section 3.4, only ζ 2 -duplicates and K h -unit duplicates can be dealt with prior to constructing the matrix. To remove special-q duplicates, we compare the ideal factorizations of each relation and remove identical lines in the file containing all our relations. Before eliminating special-q duplicates we had 18.25M batch-survivors. Removing these duplicates decreased the amount of survivors to 13.63M, a loss of 27%.

Filtering. The matrix of relations is now ready to be sent to CADO-NFS's filter. We have 15.21M ideals in the factor basis, and thus the input matrix to CADO-NFS's filter is a matrix of size 13.63M × 15.21M. Note that not all the ideals intervene in the relations. The goal of filtering is to reduce the size of the matrix and make it square. Filtering in CADO-NFS uses two steps: purge and merge.

The purge step consists in removing columns that only contain zero coefficients. Indeed only 87% of the ideals of the factor basis appear in relations.

The rest leading to zero-columns are deleted. Besides, the purge step removes columns (and corresponding lines) that contain a unique element. These columns correspond to prime ideals, called singletons, that occur only once in all the relations. We start with 13.63M lines in the matrix. After removing the singletons, we are left with only 5.21M lines. Hence, purge reduces the number of lines in our matrix by approximately 62%. Thus even if the purge step and more generally filtering is not present in the complexity analysis of TNFS, it is of significant importance in practice for the feasibility of the linear algebra step.

The next step of filtering is merge, which corresponds to a structured Gaussian elimination. It aims at further reducing the matrix size by performing linear combinations of the rows of the input matrix. In our computation, the merge takes as input a square matrix of dimension 5.21M. A Gaussian elimination stopped when we got 100 coefficients per line permitted to decrease the matrix size to 1.73M. If we eliminate up to 150 coefficients per line, the size is decreased to 1.51M.

Finally, after filtering, we have 1.51M relations and a 1.51M × (1.51M + 7) dimension matrix. The entire filtering step removes 89% of the relations (or 92% if we count before the removal of the duplicates). The 7 extra columns come from the Schirokauer maps, as we see now.

Schirokauer maps. Equalities between ideals do not translate immediately into equalities between number fields elements. This would be true only for principal ideals, in a field without units. Assuming that the class number is coprime to ℓ, which is true with high probability, principality is not a problem. The presence of units is classically tackled by the use of Schirokauer maps.

We follow the general theory of virtual logarithms [START_REF] Joux | Improvements to the General Number Field Sieve for discrete logarithms in prime fields[END_REF][START_REF] Schirokauer | Virtual logarithms[END_REF] (see also Section 4.2.3 of [START_REF] De Micheli | Discrete Logarithm Cryptanalyses: Number Field Sieve and Lattice Tools for Side-Channel Attacks[END_REF]) and recall that a Schirokauer map is any surjective morphism from K * i /(K * i ) ℓ → (Z/ℓZ) ri where K i is a number field and r i its unit rank. In the classical NFS setup, K i is simply an extension of Q, whereas in the Tower setup, K i is an extension of K h . In order to easily use CADO-NFS implementation of Schirokauer maps, we propose a rather simple trick: represent the tower of number fields as an absolute (non-tower) extension field.

Therefore, we first define an isomorphism from the intermediate fields K i = K h (α i ) to a number field K Fi of degree deg h × deg f i and then we use a classical Schirokauer map Λ classical from the latter to (Z/ℓZ) ri . In other words, we define the map Λ i as

Λ i : K * i /(K * i ) ℓ ≃ -→ K * Fi /(K * Fi ) ℓ → (Z/ℓZ) ri .
A polynomial F i and the corresponding isomorphism

Φ i : K i → K Fi
are easy to find, and can be represented by the images of each base elements. Thereafter, the map from K i to K Fi is seen as a linear map and applying it to an element is essentially free.

There are as many Schirokauer maps as the rank of units in K i . For our computation, this means 2 on the f 1 -side and 5 on the f 2 -side. Computing Schirokauer maps, i.e., filling seven columns, takes 40 core-hours.

Remark 9. In general, and also true in our computation, the values Φ i (1), Φ i (ι), • • • have denominators. As Schirokauer maps, as implemented in CADO-NFS, only require integers, we directly multiply the coefficients by the least common multiplier of these denominators. This denominator-clearing can be made completely transparent by choosing Schirokauer maps Λ i that evaluate to zero over Q. This is the legacy mode in CADO-NFS's implementation of Schirokauer maps.

Solving the system. Solving the linear system with 1.51M rows and columns, including the 7 dense columns of Schirokauer maps is done with the block-Wiedemann algorithm, as implemented in CADO-NFS. We used the default behavior which is to run 7 sequences, each one taking one of the heavy columns as input (see [START_REF] Joux | Nearly Sparse Linear Algebra and application to Discrete Logarithms Computations[END_REF]). Heavy columns are columns with a large number of non zero large coefficients. Therefore, the large number of Schirokauer maps does not induce an increase in the running time of this step.

All the sequences can be run in parallel, for a total cost of 1,210 core hours. The reconstruction of the linear generator and the final sum-up leading to the kernel vector must be added up, and the overall cost of linear algebra is 1,403 core hours. We emphasize that the most expensive steps of the linear algebra part are the computation of the sequences and the solution step where the sparse matrix-vector multiplication is the most costly operation.

Un-filtering. The kernel vector gives the virtual logarithms of 1.51M ideals belonging to the factor basis. Using the relations that were deleted during the purge and merge process, many more can be deduced. This can be seen as reverting the filtering, where each time a relation is re-added, we check if it involves a (unique) ideal for which the virtual logarithm is not yet known. If so, we can deduce it. After this process, we know the virtual logarithms of 12M ideals, corresponding to 79.4% of the factor bases elements.

Descent step and discrete logarithm of the target

Now that we know the virtual logarithms of (a large proportion of) the factor basis elements, we are ready for the descent step. We choose as generator the element g = x + ι. This element g lifted in the field defined by f 1 is a unit (of infinite order). This allows us to easily compute its virtual logarithm as it is found using the virtual logarithms outputted by the linear algebra step and an additional Schirokauer map computation.

Remark 10. Note that the virtual logarithm of the generator is computed in an arbitrary basis, say γ, the same basis for which we have the virtual logarithms of the elements of the factor basis outputted by the linear algbebra step. In order to get the discrete logarithm of our target element in base g, we first compute the discrete logarithm of the target in base γ. Because we know the discrete logarithm of g in base γ we can finally obtain the discrete logarithm of our target in base g.

As mentioned in Section 2.2, we use Guillevic's algorithm [START_REF] Guillevic | Faster individual discrete logarithms in finite fields of composite extension degree[END_REF] to optimize the initial splitting step. The descent starts by a smoothing step which required 45 core hours to generate 64M candidates and 10 core hours to identify an element s ∈ F * p 6 such that its lift to K 1 has a 35-bit smooth norm. The factors of s greater than 27-bit for which we do not have the virtual logarithms yet are descended in a single special-q step. This descent is done with the same strategy as for the relation collection, namely enumeration and batch, but using a larger radius R = 33. Because of the small amount of factors concerned, the time is negligible. The descent step takes 55 core hours. The overall time in core hours of the computation is reported in Table 6. We finally find the discrete logarithm of our target element: log(target) = 7627280816875322297766747970138378530353852976315498.

To confirm the validity of our computation, we verify that g log(target) = target is true, modulo ℓ-th powers, as we computed the discrete logarithm only modulo ℓ.

7 Towards an efficient use of automorphisms in TNFS 7.1 Automorphisms present in our 521 example

In our 521-bit example, the f 1 and f 2 polynomials are obtained by the Conjugation method, so that both are palindromic polynomials. Their coefficients are the same if one reads them in reverse order. As a consequence, there is an explicit automorphism of order 2 of the form σ : x → 1/x in the fields K 1 and K 2 . From Section 3, a degree 1 ideal p of norm p in O 1 of interest in the relation collection has the form p = ⟨p, ι -r ι , x -r x ⟩, where r ι is a root of h modulo p and r x is a root of f 1 modulo p. Its conjugate p σ has the same form, where r x is replaced by 1/r x modulo p, which is also a root of f 1 , due to its palindromic form. This generalizes to any ideal of the form given by Equality (3).

Let ϕ(x, ι) = a(ι) -b(ι)x be a polynomial that gives a relation, so that, when mapped to K 1 , its ideal-factorization contains only prime ideals below the smoothness bound. Taking the conjugate ϕ σ (x, ι) = b(ι) -a(ι)x, its mapping to K 1 also has an ideal-factorization containing only prime ideals below the smoothness bound, since each ideal will be replaced by its conjugate. This is the same on both sides, and therefore, each relation gives another relation for free.

This property is well-known and when the automorphism is of order 2, it leads to a factor-2 saving in the timing of the relation collection phase, for instance by using only one special-q in each σ-orbit.

In order to also save on the linear algebra computation time, one needs to be able to replace each pair of columns representing a pair of conjugate ideals (p, p σ ) of the factor basis, by a single column. It is tempting to hope that the virtual logarithms of two conjugate ideals take opposite values modulo ℓ. Then the two columns could be replaced by the difference between them. The matrix size would be reduced by a factor of 2, leading to a factor-4 saving.

Unfortunately, this is not true in general, and it is actually wrong in our 521-bit computation. Thus, a naive use of automorphisms would save a factor 2 in the relation collection, but would not help the linear algebra phase. In the rest of this section, we propose a construction to compute one virtual logarithm from the virtual logarithm of the conjugate ideal, and thus improve the linear algebra too.

Galois-compatible Schirokauer maps (GCSM)

We start by giving a precise definition of the kind of automorphisms that can be useful in the TNFS context. Definition 3. Let us fix a TNFS-diagram as in Figure 2. A TNFS-automorphism of order r is a set of 3 automorphisms of order r:

an automorphism of K 1 over Q; an automorphism of K 2 over Q; an automorphism of F p n over F p ; such that all of them can be expressed as z → τ (z), where τ is the same rational fraction, in the coordinate systems of the diagram. We abuse notations and write σ : z → τ (z) for all these automorphisms. In all generality, the element z is a bivariate expression in x and ι. Since τ represent field automorphisms, it is enough to write its image on x and ι separately. Note that when we wrote σ : x → 1/x in the previous subsection, we left implicit the fact that it should be extended to σ : ι → ι, leaving the second variable unchanged. Definition 4 (Galois-compatible Schirokauer map). Let us fix a TNFSdiagram as in Figure 2 and let σ be a TNFS-automorphism. Let ℓ be the prime dividing Φ n (p) modulo which we want to compute discrete logarithms. A Galoiscompatible Schirokauer map (GCSM) of K i (for a side i = 1 or 2) is a Schirokauer map Λ : K * i /(K * i ) ℓ → (Z/ℓZ) ri where r i is the unit rank of K i , such that Λ(z) = 0 for all the elements z that are fixed by σ.

This definition is sufficient to obtain a relation between a virtual logarithm of an ideal and the virtual logarithm of its conjugate, as we now explain. This fixes what is missing in our 521-bit example.

Theorem 1. In a TNFS-diagram context, let σ be a TNFS-automorphism of order 2. Let ℓ be the prime dividing Φ n (p) modulo which we want to compute discrete logarithms, and let Λ be a GCSM of K i for this ℓ. Then the associated virtual logarithms vlog are such that for all prime ideals p of O i , vlog p ≡ -vlog p σ mod ℓ.

Proof. Let cl i be the class number of K i . For any prime ideal p, we can consider γ p ∈ K i a generator of the principal ideal p cli . The element γ p is defined up to a unit, and, by surjectivity of Λ, we can choose it so that Λ(γ p ) = 0. Then, by definition, the virtual logarithm vlog p is equal to the (classical) discrete logarithm of γp , the image of γ p in the target finite field F p n .

Let us now evaluate vlog p σ . First we have (p σ ) cli = (γ σ p ). If we can show that Λ(γ σ p ) = 0 then γ σ p will be a generator of (p σ ) cli that is valid to define vlog p σ as equal to log(γ σ p ) modulo ℓ. By the morphism property of the Schirokauer maps, Λ(γ p γ σ p ) = Λ(γ p ) + Λ(γ σ p ). In this equation, we already know that Λ(γ p ) is zero. In addition, since γ p γ σ p belongs to the subfield of K i of all the elements fixed by the automorphism, by our hypothesis on Λ, we have that Λ(γ p γ σ p ) = 0. Therefore, the last term of the equation is also zero, namely Λ(γ σ p ) = 0. Hence vlog p σ = log(γ σ p ) = log( γp σ ) = -log( γp ) = -vlog p mod ℓ.

In the conditions of this theorem, we can use the strategy of merging pairs of columns in the matrix. This leads to the following result.

Corollary 1. In the TNFS algorithm, if the diagram is such that there exists a TNFS-automorphism of order 2, together with Galois-compatible Schirokauer maps on both sides, then a factor 4 can be saved in the complexity of the linear algebra step.

Constructions of GCSM

We place ourselves in the setting of Definition 4 and consider the field K 1 . Let L 1 be the subfield of K 1 of elements fixed by the automorphism σ. Since σ has order 2, then L 1 is of index 2 in K 1 . We make this extension explicit, and write K 1 = L 1 (w), so that any element z of K 1 can be uniquely written z = z 0 + z 1 w, with z 0 and z 1 in L 1 .

The traditional construction of Schirokauer maps is based on the map z → z ′ = (z ε -1)/ℓ mod ℓ, where ε is the LCM of all the orders of the multiplicative groups of the residue fields of K 1 modulo ℓ. We follow this strategy, and subsequently write z ′ as z ′ 0 + z ′ 1 w. The coefficients of z ′ 1 in its polynomial representation are then candidates for being Galois-compatible Schirokauer maps. Indeed, if z is in the subfield L 1 , then z ′ is also in L 1 , and therefore z ′ 1 is equal to 0. Therefore, we get the expected property.

The number of coefficients in the representation of z ′ 1 is the degree of L 1 , that is 1 2 (deg h)(deg f 1 ). If this number is not smaller than the unit rank r 1 of K 1 , then we can pick r 1 such coefficients, and they form a GCSM. We will discuss later (see Section 7.4) a condition under which this is the case.

The case of the 521-bit example. In the 521-bit computation, we used h(ι) = ι 3 -ι + 1, f 1 (x) = x 4 + 1, and f 2 (x) a palindromic polynomial of degree 2. The TNFS-automorphism is given by σ : x → 1/x. For K 2 , the subfield L 2 is K h . The expression of z ′ as z ′ 0 + z ′ 1 w is then the natural expression coming from the TNFS diagram. The element z ′ 1 has 3 coefficients and the unit rank is 2, so there are enough choices to define a GCSM on the K 2 side.

On the K 1 side, this is slightly more complicated. The subfield L 1 fixed by σ is the quadratic extension of K h defined by ξ = x + 1/x. One can directly check that ξ 2 = 2, so that In order to define Λ that is zero on L 1 , it suffices to pick coefficients of (c 1 + c 3 ) and c 2 . This gives 2 deg h = 6 coefficients among which to choose, which is enough, since the unit rank is 5.

L 1 = K h ( √ 2
We discovered this GCSM strategy too late to apply it during our record computation. However, we tested it on a small example with the same polynomials h and f 1 . We checked again that with the traditional choice of Schirokauer maps, the property vlog p ≡ -vlog p σ mod ℓ did not hold. However, our GCSM construction allowed to enforce it, as predicted by the theory. Since this adds just an easy linear transform, the additional cost of the GCSM computation is completely negligible.

An example for F p 12 with deg h = 4. The approach taken in the previous example is to have the order 2 automorphism σ come from f 1 and f 2 being palindromic. In the case of an F p 12 TNFS-computation with deg h = 4, this would not work. Indeed, in the TNFS-diagram, the field K h is mapped to F p 4 (because h is irreducible modulo p). Hence, the common irreducible factor φ of f 1 and f 2 modulo p has to be of degree 3. As an automorphism of K 1 of order 2, if σ fixes K h , then it will be mapped to an automorphism in F p 12 fixing the subfield F p 4 . However, since the extension F p 12 /F p 4 is cyclic of degree 3, it cannot have an automorphism of order 2. As a consequence, in this context, any TNFS-automorphism of order 2 must come from h and not from f 1 and f 2 .

We propose to study the case where the construction is based on the following polynomial defining K h : h(ι) = ι 4 -ι 3 + ι 2 -ι + 1, which has σ : ι → 1/ι as order-2 automorphism. We leave the polynomials f 1 and f 2 undefined, since their shape do not affect the discussion. We only assume that their coefficients are in Z which is possible because deg φ = 3 is coprime to deg h = 4. Let us make the field extension with L 1 explicit. For this, we consider the field K + h , the subfield of K h fixed by σ. Let ξ = y +y σ . We have ξ = -y 3 +y 2 +1, and its minimal polynomial is h + = ξ 2 -ξ -1. One can also check that K h = K + h [ι]/(ι 2 -ιξ + 1), and that K + h is isomorphic to Q( √ 5). The subfield L 1 of K 1 fixed by σ is then

Initial tower

K1 = K h [x]/f1(x) K h = Q( √ 5
L 1 = Q( √ 5)[x]/f (x).
In order to compute a GCSM on the K 1 side, we can then apply to z ′ the linear transformation corresponding to the field isomorphism that maps the original tower of extensions defining K 1 to the one that makes L 1 visible, as in Figure 8. We can then easily take the coordinates that are always equal to 0 for elements that belong to L 1 . The same can be done for K 2 . The only remaining question is whether there are enough coordinates compared to the unit rank.

Condition on the number of real roots

We have seen that the Conjugation method used for our 521-bit computation allows the construction of GCSM. However, in general, the unit rank might be too large. We now make this obstruction more explicit.

Let f be one of the polynomial f 1 or f 2 . Our construction produces a set of 1 2 (deg h)(deg f ) values from which to pick, in order to build a Galois-compatible Schirokauer map. From Dirichlet's unit theorem, this will be enough only if the number of real embeddings in K f is sufficiently low. More precisely, if r 1f is the number of real roots of f and r 1h is the number of real roots of h, then the number of real embeddings of K f is r 1f r 1h . The unit rank of K f is then Since this condition must be satisfied on both sides, it is much easier to reach if h is chosen to have zero or one real root (depending on the parity of its degree). In any case, this condition on the number of real roots is in contradiction with the common practice of favoring polynomials with many real roots in order to have smaller norms. Still, the benefit of using automorphisms should more than balance this penalty.

Concluding remarks

We recall the data from Table 1 in the introduction: the time for collecting relations in our 521-bit computation is only 23,300 core-hours, much less that the 69,120 core-hours of McGuire and Robinson for a 423-bit computation, also in a field of the form F p 6 ; and this was already much faster than Grémy's work.

This huge improvement is mostly due to the fact that our efficient sieving technique allows to work in large dimensions, and therefore enables the use of Tower NFS. While asymptotic complexities can hardly lead to definitive statements about the performance of TNFS for such "small" target finite fields, the norms that it produces are indeed quite small.

In an attempt to quantify this smallness, we compare them to the norms obtained for equivalent target sizes with the classical NFS algorithm for factoring and DLP in prime fields. For those, CADO-NFS can serve as a reference, since the provided parameters are reasonably well optimized (we use 512-bit targets for the comparison instead of our 521-bit size, since 512-bit is a standard size for CADO-NFS). The result of this comparison is that, while in our computation we encountered norms with product of size around 250 bits, the equivalent for a 512-bit factorisation is around 280 bits, and for a 512-bit prime field DLP with Joux-Lercier polynomial selection, it is around 270 bits. We therefore notice that even if F p 6 is not a high degree extension, and even if a 521-bit size is still far from a secure cryptographic size, the "tower" effect is already pretty impactful.

Furthermore, we would like to emphasize that our experiment was merely a first demonstration. First, considering the total computation time needed: this record used 1400 times less core years than for current discrete logarithm computations in prime field. Indeed, we used roughly 2.8 core years to perform our computation while the last discrete logarithm record [START_REF] Boudot | Comparing the difficulty of factorization and discrete logarithm: A 240-digit experiment[END_REF] in a 795-bit prime field took 4000 core years. There is also still much room for improvement in the tuning of the various parameters and the use of the explicit Galois action that is available with the Conjugation method. These will be necessary when working with Tower NFS on larger size finite fields.

Fig. 2 :

 2 Fig. 2: Commutative diagram of Tower NFS.

Fig. 5 :Algorithm 1

 51 Fig. 5: Sequence of algorithms for relation collection.

  Input: (a, b)-pair corresponding to a sieve-survivor Output: primitive (a, b)-pair corresponding to the same sieve-survivor, or Fail 1: Compute gcd(N1(a, b), N2(a, b)) 2: if gcd(N1(a, b), N2(a, b)) = 1 then 3: Return (a, b)-pair. 4: else 5: for each prime ℓ| gcd(N1(a, b), N2(a, b)) do 6: Try to find β in OK h of norm ℓ such that a/β and b/β are in OK h . 7: if Such a value β is found then 8: a ← a/β and b ← b/β 9: Recompute gcd(N1(a, b), N2(a, b)) 10: if gcd(N1(a, b), N2(a, b)) = 1 then 11: Return new (a, b)-pair 12: else 13:

  The transition-vectors are divided into d subsets T 1 , • • • , T d , with T k the set of k-transition-vectors for k = 1, • • • , d. The latter have at least a non-zero k-coordinate and the last d -k coordinates all equal to 0. The algorithm starts from (0, 0, • • • , 0) ∈ L Q,p and enumerates all vectors in L Q,p ∩ S by adding or subtracting transition-vectors. It starts with vectors of T 1 until it reaches the edges of S, then looks at additions (or subtractions) of vectors of T 2 etc, increasing from 1 to d step by step.

d

  i=1 v i b i . As mentioned above, this can either be done naively at the leaf level by explicitly computing c = d i=1 v i b i for each leaf, which costs 2d 2 -1 extra operations per leaf. Or, one uses common part = d i=t v i b i . Each time the algorithm visits a new internal node in the levels t up to d, thus updates v i for a given i = t, • • • , d, the algorithm performs 4d -1 operations: in order to update common part, we subtract the current v i b i (d operations), compute the new v i b i (2d -1 operations) with the new value of v i and add it back to common part (again, d operations).

  ). In the construction, the element z ′ has the formz ′ = c 0 + c 1 x + c 2 x 2 + c 3 x 3 ,where the c i 's are elements of Z[ι]/ℓZ[ι]. In order to control what happens over L 1 , we apply a basis change and use ⟨1, ξ, x, xξ⟩ instead of ⟨1, x, x 2 , x 3 ⟩, as a basis of K 1 over K h . We obtain the following rewriting of z ′ :z ′ = (c 0 -c 2 ) + (-c 3 )ξ + (c 1 + c 3 )x + (c 2 )xξ.

2 σ deg f1 2 Fig. 8 :

 228 Fig.8: Change of field representation in order to define a Galois-compatible Schirokauer map.

  h)(deg f ) + r 1f r 1h -1, and this will not exceed the number of available coefficients only when the following condition is satisfied: number of real roots of f × number of real roots of h ≤ 2.

Table 1 :

 1 Medium and large characteristics complexities of various algorithms, expressed as L p

	Algorithm Medium characteristic Boundary Large characteristic
	NFS	96	48	64
	TNFS	-	-	64
	exTNFS	≥ 48	48	64

n (1/3, 3 c/9), where c is the reported value in this table.

Table 2 :

 2 Comparison of the relation collection step in core hours with

  describes the properties of these algorithms.

	Properties	Sieving	Batch	ECM
	Input candidates	Numerous and structured	Numerous	Few
	Prime factors extracted	Small	Small or medium Large
	RAM	Very large	Large	Tiny
	Cost per candidate	Small	Medium	High

Table 3 :

 3 Properties of the different relation collection algorithms

Table 5 :

 5 Number of survivors after each step of the relation collection algorithm.

Table 6 :

 6 Overall time of our record computation in core hours.

We use the usual notation LQ(α, c) = exp((c + o(1))(log Q) α (log log Q) 1-α ), where o(1) tends to 0 when Q tends to infinity. We do not write c when it is not of interest.

We use the same abuse in the abstract and title too.

Indeed, if u is somehow big then there is a chance that either ua or ub would be outside the sieving region.

A cycle of curves is a pair of pairing-friendly elliptic curves E1, E2 such that E1 is defined over a finite prime field Fp 1 with prime order p2, and E2 is defined over the finite field Fp 2 with order p1.

Here h is already monic and irreducible modulo p so ϕ h = h.

Acknowledgements. We are indebted to Léo Ducas and Wessel van Woerden for insightful discussions about the lattice points enumeration aspect of this work. Many thanks to Aurore Guillevic, for numerous discussions, in particular about polynomial selection and the blockchain ecosystem. Experiments in this paper were carried out using the Grid'5000 testbed, supported by a scientific interest group hosted by Inria and including CNRS, RENATER and several Universities as well as other organizations (see https://www.grid5000.fr).