The Function Field Sieve in the Medium Prime Case

In this paper, we study the application of the function field sieve algorithm for computing discrete logarithms over finite fields of the form

${\mathbb {F}}_{q^n}$

when

q

is a medium-sized prime power. This approach is an alternative to a recent paper of Granger and Vercauteren for computing discrete logarithms in tori, using efficient torus representations. We show that when

q

is not too large, a very efficient

L

(1/3) variation of the function field sieve can be used. Surprisingly, using this algorithm, discrete logarithms computations over some of these fields are even easier than computations in the prime field and characteristic two field cases. We also show that this new algorithm has security implications on some existing cryptosystems, such as torus based cryptography in

T

30

, short signature schemes in characteristic 3 and cryptosystems based on supersingular abelian varieties. On the other hand, cryptosystems involving larger basefields and smaller extension degrees, typically of degree at most 6, such as LUC, XTR or

T

6

torus cryptography, are not affected.