A construction of 3-dimensional lattice sieve for number field sieve over F_{p^n}

The security of pairing-based cryptography is based on the hardness of solving the discrete logarithm problem (DLP) over extension field GF(p) of characteristic p and degree n. Joux et al. proposed an asymptotically fastest algorithm for solving DLP over GF(p) (JLSV06-NFS) as the extension of the number field sieve over prime field GF(p) (JL03-NFS). The lattice sieve is often used for a largescaled experiment of solving DLP over GF(p) by the number field sieve. Franke and Kleinjung proposed a 2-dimensional lattice sieve which efficiently enumerates all the points in a given sieve region of the lattice. However, we have to consider a sieve region of more than 2 dimensions in the lattice sieve of JLSV06-NFS. In this paper, we extend the Franke-Kleinjung method to 3-dimensional sieve region. We construct an appropriate basis using the Hermite normal form, which can enumerate the points in a given sieve region of the 3-dimensional lattice. From our experiment on GF(p) of 303 bits, we are able to enumerate more than 90% of the points in a sieve region in the lattice generated by special-q. Moreover, we implement the number field sieve using the proposed 3-dimensional lattice sieve. Our implementation of the JLSV06 over GF(p) of 240 bits is about as efficient as that of the current record over GF(p) using 3-dimensional line sieve by Zajac.