G. Adj, A. Menezes, T. Oliveira, and F. , Computing discrete logarithms in F 3 6·137 and F 3 6·163 using Magma, Arithmetic of Finite Fields, p.322, 2014.
DOI : 10.1007/978-3-319-16277-5_1

L. Adleman, A subexponential algorithm for the discrete logarithm problem with applications to cryptography, 20th Annual Symposium on Foundations of Computer Science (sfcs 1979), p.5560, 1979.
DOI : 10.1109/SFCS.1979.2

L. Adleman, The function eld sieve, Algorithmic Number Theory (ANTS-I), p.141154, 1994.

M. Leonard, . Adleman, A. Ming-deh, and . Huang, Function eld sieve method for discrete logarithms over nite elds, Information and Computation, vol.151, issue.12, p.516, 1999.

D. Adrian, K. Bhargavan, Z. Durumeric, P. Gaudry, M. Green et al., Imperfect Forward Secrecy, Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, CCS '15, p.517, 2015.
DOI : 10.1145/2810103.2813707
URL : https://hal.archives-ouvertes.fr/hal-01184171

M. Albrecht, S. Bai, D. Cadé, X. Pujol, and D. Stehlé, fplll-4.0, a oating-point LLL implementation

S. Bai, Polynomial Selection for the Number Field Sieve, 2011.

S. Bai, R. Brent, and E. Thomé, Root optimization of polynomials in the number eld sieve, Mathematics of Computation, vol.84, issue.295, p.24472457, 2015.

R. Barbulescu, Algorithmes de logarithmes discrets dans les corps nis, 2013.

R. Barbulescu, C. Bouvier, J. Detrey, P. Gaudry, H. Jeljeli et al., Discrete logarithm in GF(2 809 ) with FFS, PKC 2014: 17th International Conference on Theory and Practice of Public Key Cryptography, p.221238, 2014.
DOI : 10.1007/978-3-642-54631-0_13
URL : https://hal.archives-ouvertes.fr/hal-00818124

R. Barbulescu, P. Gaudry, A. Guillevic, and F. Morain, Improving NFS for the discrete logarithm problem in non-prime nite elds, Advances in Cryptology EUROCRYPT 2015, Part I, p.129155, 2015.

R. Barbulescu, P. Gaudry, A. Joux, and E. Thomé, A heuristic quasi-polynomial algorithm for discrete logarithm in nite elds of small characteristic, Advances in Cryptology EUROCRYPT 2014, pp.116-125

R. Barbulescu, P. Gaudry, and T. Kleinjung, The tower number eld sieve, Advances in Cryptology ASI- ACRYPT 2015, p.3155, 2015.

R. Barbulescu and C. Pierrot, Abstract, LMS Journal of Computation and Mathematics, vol.17, issue.A, p.230246, 2014.
DOI : 10.1017/CBO9781139856065

S. L. Paulo, B. Barreto, M. Lynn, and . Scott, Constructing elliptic curves with prescribed embedding degrees, Security in Communication Networks, p.257267, 2002.

S. L. Paulo, M. Barreto, and . Naehrig, Pairing-friendly elliptic curves of prime order, Selected Areas in Cryptography (SAC 2005), p.319331, 2006.

J. Daniel, T. Bernstein, and . Lange, Computing small discrete logarithms faster, Progress in Cryptology INDOCRYPT 2012, p.317338, 2012.

J. Daniel, T. Bernstein, and . Lange, Non-uniform cracks in the concrete: The power of free precomputation, Advances in Cryptology ASIACRYPT 2013, p.321340, 2013.

D. J. Bernstein, T. Lange, and P. Schwabe, On the Correct Use of the Negation Map in the Pollard rho Method, Public Key Cryptography PKC 2011, p.128146, 2011.
DOI : 10.1007/978-3-642-19379-8_8

Y. Bistritz and A. Lifshitz, Bounds for resultants of univariate and bivariate polynomials, Linear Algebra and its Applications, vol.432, issue.8, 2009.
DOI : 10.1016/j.laa.2009.08.012

R. Simon, E. Blackburn, and . Teske, Baby-step giant-step algorithms for nonuniform distributions, Algorithmic Number Theory (ANTS- IV), volume 1838 of Lecture Notes in Computer Science, p.153168, 2000.

I. F. Blake, R. Fuji-hara, R. C. Mullin, and S. A. Vanstone, Computing logarithms in nite elds of characteristic two, SIAM Journal on Algebraic Discrete Methods, vol.5, issue.2, p.276285, 1984.

I. F. Blake, R. C. Mullin, and S. A. Vanstone, Computing logarithms in GF(2 n ), Advances in Cryptology, Proceedings of CRYPTO '84, p.7382, 1984.

D. Boneh, B. Lynn, and H. Shacham, Short signatures from the Weil pairing, Advances in Cryptology ASIACRYPT 2001, p.514532, 2001.

C. Bouvier, Algorithmes pour la factorisation d'entiers et le calcul de logarithme discret, 2015.
URL : https://hal.archives-ouvertes.fr/tel-01167281

R. P. Brent, An improved Monte Carlo factorization algorithm, BIT, vol.17, issue.2, p.176184, 1980.
DOI : 10.1007/BF01933190

F. Brezing and A. Weng, Elliptic curves suitable for pairing based Discrete Logarithms, pp.9-37
DOI : 10.1007/s10623-004-3808-4
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.6.3813

J. P. Buhler, H. W. Lenstra-jr, and C. Pomerance, Factoring integers with the number eld sieve The Development of the Number Field Sieve, Lecture Notes in Mathematics, vol.1554, p.5094, 1993.

R. Earl, P. Caneld, C. Erd®s, and . Pomerance, On a problem of Oppenheim concerning "factorisatio numerorum, Journal of Number Theory, vol.17, issue.1, p.128, 1983.

Y. Chen, Réduction de réseau et sécurité concrète du chirement complètement homomorphe, 2013.

J. Hee-cheon, J. Hong, and M. Kim, Speeding up the pollard rho method on prime elds, Advances in Cryptology ASIACRYPT 2008, p.471488, 2008.

Y. Ju-choie, E. K. Jeong, and E. J. Lee, Supersingular hyperelliptic curves of genus 2 over nite elds, Journal of Applied Mathematics and Computation, vol.163, issue.2, p.565576, 2005.

A. Commeine and I. Semaev, An algorithm to solve the discrete logarithm problem with the number eld sieve, Public Key Cryptography PKC 2006, p.174190, 2006.

D. Coppersmith, Solving Homogeneous Linear Equations Over GF(2) via Block Wiedemann Algorithm, Mathematics of Computation, vol.62, issue.205, p.333350, 1994.
DOI : 10.2307/2153413

D. Coppersmith, Fast evaluation of logarithms in elds of characteristic two, IEEE Transactions on Information Theory, vol.30, issue.4, p.587594, 1984.

D. Coppersmith, Modications to the number eld sieve, Journal of Cryptology, vol.6, issue.3, p.169180, 1993.

D. Coppersmith, A. M. Odlyzko, and R. Schroeppel, Discrete logarithms in GF(p), Algorithmica, vol.1, issue.1, p.115, 1986.

W. Die and M. E. Hellman, New directions in cryptography, IEEE Transactions on Information Theory, vol.22, issue.6, p.644654, 1976.

M. Iwan, P. Duursma, F. Gaudry, and . Morain, Speeding up the discrete log computation on curves with automorphisms, Advances in Cryptology ASIACRYPT '99, p.103121, 1999.

A. E. Escott, J. C. Sager, A. P. Selkirk, and D. Tsapakidis, Attacking elliptic curve cryptosystems using the parallel Pollard rho method, CryptoBytes, vol.4, 1999.

P. Flajolet and A. M. Odlyzko, Random Mapping Statistics, Advances in Cryptology EURO- CRYPT '89, p.329354, 1990.
DOI : 10.1007/3-540-46885-4_34
URL : https://hal.archives-ouvertes.fr/inria-00075445

F. Laboratories, K. Nict, and . University, DL record in F 3 6·97 of 923 bits (278 dd) NICT press release, 2012.

S. Galbraith, Quasi-polynomial-time algorithm for discrete logarithm in nite elds of small/medium characteristic. The Elliptic Curve Cryptography blog, 2013.

D. Steven and . Galbraith, Supersingular curves in cryptography, Lecture Notes in Computer Science, vol.2248, pp.495513-495522, 2001.

D. Steven, P. Galbraith, and . Gaudry, Recent progress on the elliptic curve discrete logarithm problem, Cryptology ePrint Archive, 1022.

D. Steven, R. S. Galbraith, and . Ruprai, An improvement to the Gaudry-Schost algorithm for multidimensional discrete logarithm problems, Cryptography and Coding, p.368382, 2009.

D. Steven, R. S. Galbraith, and . Ruprai, Using equivalence classes to accelerate solving the discrete logarithm problem in a short interval, Public Key Cryptography PKC 2010, p.368383, 2010.

S. D. Galbraith, P. Wang, and F. Zhang, Computing elliptic curve discrete logarithms with improved baby-step giant-step algorithm. Cryptology ePrint Archive, 2015.

P. Gaudry and É. Schost, A Low-Memory Parallel Version of Matsuo, Chao, and Tsujii???s Algorithm, Algorithmic Number Theory (ANTS-VI), p.208222, 2004.
DOI : 10.1007/978-3-540-24847-7_15

M. Daniel and . Gordon, Discrete logarithms in GF(p) using the number eld sieve, SIAM Journal on Discrete Mathematics, vol.6, issue.1, p.124138, 1993.

R. Granger, T. Kleinjung, and J. Zumbrägel, Breaking '128-bit secure' supersingular binary curves -(or how to solve discrete logarithms in F 2 4·1223 and F 2 12·367 ), Advances in Cryptology CRYPTO 2014, Part II, p.126145, 2014.

R. Granger, T. Kleinjung, and J. Zumbragel, Discrete logarithms in GF, 2014. Announcement available at the NMBRTHRY archives, p.9234

T. Hayashi, T. Shimoyama, N. Shinohara, and T. Takagi, Breaking pairing-based cryptosystems using ? T pairing over GF(3 97 ), Advances in Cryptology ASIACRYPT 2012, p.4360, 2012.
DOI : 10.1007/978-3-642-34961-4_5
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.261.3190

T. Hayashi, N. Shinohara, L. Wang, M. Shin-'ichiro-matsuo, T. Shirase et al., Solving a 676-bit discrete logarithm problem in GF, p.6

Y. Hitchcock, P. Montague, G. Carter, and E. Dawson, The eciency of solving multiple discrete logarithm problems and the implications for the security of xed elliptic curves, International Journal of Information Security, vol.3, issue.2, p.8698, 2004.

J. Jeong and T. Kim, Extended tower number eld sieve with application to nite elds of arbitrary composite extension degree, Cryptology ePrint Archive, 2016.

A. Joux, Faster index calculus for the medium prime case application to 1175-bit and 1425-bit nite elds, Advances in Cryptology EUROCRYPT 2013, p.177193, 2013.

A. Joux, A New Index Calculus Algorithm with Complexity $$L(1/4+o(1))$$ in Small Characteristic, Selected Areas in Cryptography SAC 2013, p.355379, 2014.
DOI : 10.1007/978-3-662-43414-7_18

A. Joux and R. Lercier, The function eld sieve is quite special, Algorithmic Number Theory, p.431445, 2002.
DOI : 10.1007/3-540-45455-1_34

A. Joux and R. Lercier, Improvements to the general number eld sieve for discrete logarithms in prime elds. A comparison with the Gaussian integer method, Mathematics of Computation, issue.242, p.72953967, 2003.

A. Joux and R. Lercier, The function eld sieve in the medium prime case, Advances in Cryptology EUROCRYPT 2006, p.254270, 2006.

A. Joux, R. Lercier, N. Smart, and F. Vercauteren, The number eld sieve in the medium prime case, Advances in Cryptology CRYPTO 2006, p.326344

A. Joux and C. Pierrot, Improving the polynomial time precomputation of frobenius representation discrete logarithm algorithms -simplied setting for small characteristic nite elds, Advances in Cryptology ASIACRYPT 2014, p.378397, 2014.

A. Joux and C. Pierrot, The special number eld sieve in F p n -application to pairing-friendly constructions, Pairing-Based Cryptography Pairing 2013, p.4561, 2014.

A. Joux and C. Pierrot, Nearly sparse linear algebra. Cryptology ePrint Archive, 2015.
URL : https://hal.archives-ouvertes.fr/hal-01154879

M. Kalkbrener, An upper bound on the number of monomials in determinants of sparse matrices with symbolic entries, Mathematica Pannonica, vol.8, p.7382, 1997.

M. Kim, J. H. Cheon, and J. Hong, Subset-Restricted Random Walks for Pollard rho Method on ${\mathbf{F}_{p^m}}$, Public Key Cryptography PKC 2009, p.5467, 2009.
DOI : 10.1007/978-3-642-00468-1_4

T. Kim and R. Barbulescu, Extended tower number eld sieve: A new complexity for the medium prime case, Advances in Cryptology CRYPTO 2016, Part I, Lecture Notes in Computer Science, p.543571, 2016.

T. Kleinjung, On polynomial selection for the general number eld sieve, Mathematics of Computation, vol.75, issue.256, p.20372047, 2006.
DOI : 10.1090/s0025-5718-06-01870-9
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.153.8539

T. Kleinjung, Polynomial selection Invited talk at the CADO-NFS workshop, 2008.

T. Kleinjung, Discrete logarithms in GF Announcement available at the NMBRTHRY archives, 1279.

N. Koblitz and A. Menezes, Another look at non-standard discrete log and Die-Hellman problems, Journal of Mathematical Cryptology, vol.2, issue.4, p.311326, 2008.
DOI : 10.1515/jmc.2008.014
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.215.1664

M. Kraitchik, Recherches sur la Théorie des Nombres, GauthierVillars, 1924.

F. Kuhn and R. Struik, Random Walks Revisited: Extensions of Pollard???s Rho Algorithm for Computing Multiple Discrete Logarithms, Selected Areas in Cryptography, pp.212229-212238, 2001.
DOI : 10.1007/3-540-45537-X_17

K. Arjen and . Lenstra, Unbelievable security: Matching AES security using public key systems (invited talk), Advances in Cryptology ASI- ACRYPT 2001, p.6786, 2001.

K. Arjen and . Lenstra, Key lengths, Handbook of Information Security, p.617635, 2006.

K. Arjen, H. W. Lenstra, L. Lenstra-jr, and . Lovász, Factoring polynomials with rational coecients, Mathematische Annalen, vol.261, issue.4, p.515534, 1982.

K. Arjen, E. R. Lenstra, and . Verheul, Selecting cryptographic key sizes, Journal of Cryptology, vol.14, issue.4, p.255293, 2001.

D. V. Matyukhin, Eective version of the number eld sieve for discrete logarithms in the eld GF(p k ) (in Russian), Trudy po Discretnoi Matematike, vol.9, p.121151, 2006.

M. Ueli, S. Maurer, and . Wolf, The relationship between breaking the Die- Hellman protocol and computing discrete logarithms, SIAM Journal on Computing, vol.28, issue.5, p.16891721, 1999.

M. Ueli, S. Maurer, and . Wolf, The Die-Hellman protocol. Designs, Codes and Cryptography, p.147171, 2000.

K. S. Mccurley, The discrete logarithm problem, Cryptology and Computational Number Theory of Proceedings of Symposia in Applied Mathematics, p.4974, 1990.
DOI : 10.1090/psapm/042/1095551

A. J. Menezes, T. Okamoto, and S. A. Vanstone, Reducing elliptic curves logarithms to logarithms in a nite eld, IEEE Transactions on Information Theory, vol.39, issue.5, p.16391646, 1993.
DOI : 10.1109/18.259647

A. Miyaji, M. Nakabayashi, and S. Takano, Characterization of Elliptic Curve Traces Under FR-Reduction, Lecture Notes in Computer Science, vol.2015, p.90108, 2000.
DOI : 10.1007/3-540-45247-8_8

L. Peter and . Montgomery, Speeding the Pollard and elliptic curve methods of factorization, Mathematics of Computation, vol.48, issue.177, p.243264, 1987.

B. A. Murphy, Polynomial Selection for the Number Field Sieve Integer Factorisation Algorithm, 1999.

B. A. Murphy, Modelling the yield of number eld sieve polynomials, Algorithmic Number Theory: Third International Symposiun, ANTS-III Portland, p.137150, 1998.

M. Andrew and . Odlyzko, Discrete logarithms in nite elds and their cryptographic significance, Advances in Cryptology EUROCRYPT '84, p.224314, 1985.

H. Orman and P. Homan, Determining strengths for public keys used for exchanging symmetric keys. Request for Comments RFC 3766, 2004.
DOI : 10.17487/rfc3766

C. Pierrot, The multiple number eld sieve with conjugation and generalized jouxlercier methods, Advances in Cryptology EUROCRYPT 2015, p.156170, 2015.

J. M. Pollard, Monte Carlo methods for index computation (mod p) Mathematics of Computation, p.918924, 1978.

J. M. Pollard, Kangaroos, Monopoly and Discrete Logarithms, Journal of Cryptology, vol.13, issue.4, pp.9-41
DOI : 10.1007/s001450010010

H. Rück, On the discrete logarithm in the divisor class group of curves, Mathematics of Computation, vol.68, issue.226, p.805806, 1999.
DOI : 10.1090/S0025-5718-99-01043-1

P. Sarkar and S. Singh, New complexity trade-os for the (multiple) number eld sieve algorithm in non-prime elds. Cryptology ePrint Archive, 2015.

P. Sarkar and S. Singh, A general polynomial selection method and new asymptotic complexities for the tower number eld sieve algorithm, Cryptology ePrint Archive, 2016.

P. Sarkar and S. Singh, A generalisation of the conjugation method for polynomial selection for the extended tower number eld sieve algorithm, Cryptology ePrint Archive, vol.537, 2016.

P. Sarkar and S. Singh, Tower number eld sieve variant of a recent polynomial selection method. Cryptology ePrint Archive, 2016.

T. Satoh and K. Araki, Fermat quotients and the polynomial time discrete log algorithm for anomalous elliptic curves, p.8192, 1998.

J. Sattler and C. Schnorr, Generating random walks in groups, Ann. Univ. Sci. Budapest. Sect. Comput, vol.6, p.6579, 1985.

O. Schirokauer, Discrete Logarithms and Local Units, Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, vol.345, issue.1676, p.409423, 1676.
DOI : 10.1098/rsta.1993.0139

D. Shanks, Class number, a theory of factorization, and genera, Number Theory Institute of Proceedings of Symposia in Applied Mathematics, p.415440, 1969.
DOI : 10.1090/pspum/020/0316385

W. Peter and . Shor, Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM Journal on Computing, vol.26, issue.5, p.14841509, 1997.

N. P. Smart, The Discrete Logarithm Problem on Elliptic Curves of Trace One, Journal of Cryptology, vol.12, issue.3, p.193196, 1999.
DOI : 10.1007/s001459900052

A. Stein and E. Teske, Optimized baby stepgiant step methods, J. Ramanujan Math. Soc, vol.20, issue.1, p.2758, 2005.

R. Douglas and . Stinson, Cryptography: Theory and Practice. Discrete Mathematics and Its Applications, 2006.

C. The and . Team, CADO-NFS, an implementation of the number eld sieve algorithm

C. David and . Terr, A modication of Shanks' baby-step giant-step algorithm, Mathematics of Computation, vol.69, issue.230, p.767773, 2000.

E. Teske, Speeding up Pollard's rho method for computing discrete logarithms, Algorithmic Number Theory (ANTS-III), volume 1423 of Lecture Notes in Computer Science, p.541554, 1998.
DOI : 10.1007/BFb0054891
URL : http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.36.9419

E. Thomé, Computation of Discrete Logarithms in $$ \mathbb{F}_{2^{607} } $$, Advances in Cryptology ASIACRYPT 2001, p.107124, 2001.
DOI : 10.1007/3-540-45682-1_7

E. Thomé, Discrete logarithms in GF(2 607 ) Announcement available at the NMBRTHRY archives, 2002.

E. Thomé, Algorithmes de calcul de logarithme discret dans les corps nis, Thèse, École polytechnique, 2003.

C. Paul, M. J. Van-oorschot, and . Wiener, Parallel collision search with cryptanalytic applications, Journal of Cryptology, vol.12, issue.1, p.128, 1999.

A. E. Western and J. C. Miller, Tables of Indices and Primitive Roots, Royal Society Mathematical Tables, vol.9, 1968.

D. H. Wiedemann, Solving sparse linear equations over nite elds, IEEE Transactions on Information Theory, vol.32, issue.1, p.5462, 1986.
DOI : 10.1109/tit.1986.1057137

P. Zajac, Discrete Logarithm Problem in Degree Six Finite Fields, 2008.