Lattice Enumeration for Tower NFS: A 521-Bit Discrete Logarithm Computation

The Tower variant of the Number Field Sieve (TNFS) is known to be asymptotically most efficient algorithm solve discrete logarithm problem in finite fields medium characteristics, when extension degree composite. A major obstacle an implementation TNFS collection algebraic relations, as it happens dimension greater than 2. This requires construction new sieving algorithms which remain grows. In this article, we overcome difficulty by considering a lattice enumeration adapt specific context. We also consider area, high-dimensional sphere, whereas previous for classical NFS considered orthotope. Our technique leads much smaller running time, despite larger search space, and even target, demonstrated record computation performed 521-bit field \({\mathbb F}_{p^6}\). target same form used recent zero-knowledge proofs some blockchains. first reported TNFS.