Very interesting. Thanks for the analysis. Bernstein's analysis is based on space*time as your cost metric. What happens if we assume that space comes for free, and we use simply time as our cost metric? Do his techniques lead to an improvement in this case?
It looks to me like there is no improvement in the first phase, but there is some improvement in the second phase (reduction in time from B^2 to B^1.5). Then, of course, we need to re-consider the parameters to balance the work, and it seems we would want to choose E = B^1.25, subject to the constraint that E is large enough to produce at least B relations. What does this solve for, in terms of L? How much do his matrix solving techniques speed up the total computation, in the case where we count only the running time of the adversary? --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]