2014 Volume 6 Pages 53-56
The security of the optimal Ate pairing using the BN curves is based on the hardness of the DLP over $\text{GF}(p^{12})$. At CRYPTO 2006, Joux et al. proposed the number field sieve over $\text{GF}(p^n)$, but the number field sieve needs multi-dimensional sieving. In this paper, we deal with the multi-dimensional sieving, and discuss its parameter sizes such as the dimension of sieving and the size of the sieving region from some experiments of the multi-dimensional sieving. Using efficient parameters, we have solved the DLP over $\text{GF}(p^{12})$ of 203 bits in about 43 hours using a PC of 16 CPU cores.