Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields

Detlef Huhnlein, Tsuyoshi Takagi

Research output: Chapter in Book/Report/Conference proceedingConference contribution

8 Citations (Scopus)

Abstract

We discuss the discrete logarithm problem over the class group Cl(Δ) of an imaginary quadratic order OΔ, which was proposed as a public-key cryptosystem by Buchmann and Williams [8]. While in the meantime there has been found a subexponential algorithm for the computation of discrete logarithms in Cl(Δ) [16], this algorithm only has running time LΔ[1/2, c] and is far less efficient than the number field sieve with Lp[1/3, c] to compute logarithms in IF*p. Thus one can choose smaller parameters to obtain the same level of security. It is an open question whether there is an LΔ[1/3, c] algorithm to compute discrete logarithms in arbitrary Cl(Δ). In this work we focus on the special case of totally non-maximal imaginary quadratic orders OΔpsuch that Δp = Δ1p2 and the class number of the maximal order h(Δ1) = 1, and we will show that there is an LΔp[1/3, c] lgorithm to compute discrete logarithms over the class group Cl(Δp). The logarithm problem in Cl(Δp) can be reduced in (expected) O(log3 p) bit operations to the logarithm problem in IF*p (if (Δ1/ p) = 1) or IF *p2 (if (Δ1/ p) = -1) respectively. This result implies that the recently proposed efficient DSA-analogue in totally non-maximal imaginary quadratic order OΔp [21] are only as secure as the original DSA scheme based on finite fields and hence loose much of its attractiveness.

Original languageEnglish
Title of host publicationAdvances in Cryptology - ASIACRYPT 1999 - International Conference on the Theory and Application of Cryptology and Information Security, Proceedings
EditorsKwok Yan Lam, Eiji Okamoto, Chaoping Xing
PublisherSpringer Verlag
Pages220-231
Number of pages12
ISBN (Print)3540666664, 9783540666660
Publication statusPublished - Jan 1 1999
Event5th International Conference on the Theory and Applications of Cryptology and Information Security, ASIACRYPT 1999 - Singapore, Singapore
Duration: Nov 14 1999Nov 18 1999

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume1716
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other5th International Conference on the Theory and Applications of Cryptology and Information Security, ASIACRYPT 1999
CountrySingapore
CitySingapore
Period11/14/9911/18/99

Fingerprint

Discrete Logarithm
Logarithm
Galois field
Class Group
Number Field Sieve
Discrete Logarithm Problem
Maximal Order
Public-key Cryptosystem
Sieves
Class number
Small Parameter
Cryptography
Choose
Analogue
Imply
Arbitrary

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Cite this

Huhnlein, D., & Takagi, T. (1999). Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields. In K. Y. Lam, E. Okamoto, & C. Xing (Eds.), Advances in Cryptology - ASIACRYPT 1999 - International Conference on the Theory and Application of Cryptology and Information Security, Proceedings (pp. 220-231). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 1716). Springer Verlag.

Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields. / Huhnlein, Detlef; Takagi, Tsuyoshi.

Advances in Cryptology - ASIACRYPT 1999 - International Conference on the Theory and Application of Cryptology and Information Security, Proceedings. ed. / Kwok Yan Lam; Eiji Okamoto; Chaoping Xing. Springer Verlag, 1999. p. 220-231 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 1716).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Huhnlein, D & Takagi, T 1999, Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields. in KY Lam, E Okamoto & C Xing (eds), Advances in Cryptology - ASIACRYPT 1999 - International Conference on the Theory and Application of Cryptology and Information Security, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 1716, Springer Verlag, pp. 220-231, 5th International Conference on the Theory and Applications of Cryptology and Information Security, ASIACRYPT 1999, Singapore, Singapore, 11/14/99.
Huhnlein D, Takagi T. Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields. In Lam KY, Okamoto E, Xing C, editors, Advances in Cryptology - ASIACRYPT 1999 - International Conference on the Theory and Application of Cryptology and Information Security, Proceedings. Springer Verlag. 1999. p. 220-231. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
Huhnlein, Detlef ; Takagi, Tsuyoshi. / Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields. Advances in Cryptology - ASIACRYPT 1999 - International Conference on the Theory and Application of Cryptology and Information Security, Proceedings. editor / Kwok Yan Lam ; Eiji Okamoto ; Chaoping Xing. Springer Verlag, 1999. pp. 220-231 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
@inproceedings{a94b6b0b9c4c4c2ebf1ff020bc86d1c7,
title = "Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields",
abstract = "We discuss the discrete logarithm problem over the class group Cl(Δ) of an imaginary quadratic order OΔ, which was proposed as a public-key cryptosystem by Buchmann and Williams [8]. While in the meantime there has been found a subexponential algorithm for the computation of discrete logarithms in Cl(Δ) [16], this algorithm only has running time LΔ[1/2, c] and is far less efficient than the number field sieve with Lp[1/3, c] to compute logarithms in IF*p. Thus one can choose smaller parameters to obtain the same level of security. It is an open question whether there is an LΔ[1/3, c] algorithm to compute discrete logarithms in arbitrary Cl(Δ). In this work we focus on the special case of totally non-maximal imaginary quadratic orders OΔpsuch that Δp = Δ1p2 and the class number of the maximal order h(Δ1) = 1, and we will show that there is an LΔp[1/3, c] lgorithm to compute discrete logarithms over the class group Cl(Δp). The logarithm problem in Cl(Δp) can be reduced in (expected) O(log3 p) bit operations to the logarithm problem in IF*p (if (Δ1/ p) = 1) or IF *p2 (if (Δ1/ p) = -1) respectively. This result implies that the recently proposed efficient DSA-analogue in totally non-maximal imaginary quadratic order OΔp [21] are only as secure as the original DSA scheme based on finite fields and hence loose much of its attractiveness.",
author = "Detlef Huhnlein and Tsuyoshi Takagi",
year = "1999",
month = "1",
day = "1",
language = "English",
isbn = "3540666664",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer Verlag",
pages = "220--231",
editor = "Lam, {Kwok Yan} and Eiji Okamoto and Chaoping Xing",
booktitle = "Advances in Cryptology - ASIACRYPT 1999 - International Conference on the Theory and Application of Cryptology and Information Security, Proceedings",
address = "Germany",

}

TY - GEN

T1 - Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields

AU - Huhnlein, Detlef

AU - Takagi, Tsuyoshi

PY - 1999/1/1

Y1 - 1999/1/1

N2 - We discuss the discrete logarithm problem over the class group Cl(Δ) of an imaginary quadratic order OΔ, which was proposed as a public-key cryptosystem by Buchmann and Williams [8]. While in the meantime there has been found a subexponential algorithm for the computation of discrete logarithms in Cl(Δ) [16], this algorithm only has running time LΔ[1/2, c] and is far less efficient than the number field sieve with Lp[1/3, c] to compute logarithms in IF*p. Thus one can choose smaller parameters to obtain the same level of security. It is an open question whether there is an LΔ[1/3, c] algorithm to compute discrete logarithms in arbitrary Cl(Δ). In this work we focus on the special case of totally non-maximal imaginary quadratic orders OΔpsuch that Δp = Δ1p2 and the class number of the maximal order h(Δ1) = 1, and we will show that there is an LΔp[1/3, c] lgorithm to compute discrete logarithms over the class group Cl(Δp). The logarithm problem in Cl(Δp) can be reduced in (expected) O(log3 p) bit operations to the logarithm problem in IF*p (if (Δ1/ p) = 1) or IF *p2 (if (Δ1/ p) = -1) respectively. This result implies that the recently proposed efficient DSA-analogue in totally non-maximal imaginary quadratic order OΔp [21] are only as secure as the original DSA scheme based on finite fields and hence loose much of its attractiveness.

AB - We discuss the discrete logarithm problem over the class group Cl(Δ) of an imaginary quadratic order OΔ, which was proposed as a public-key cryptosystem by Buchmann and Williams [8]. While in the meantime there has been found a subexponential algorithm for the computation of discrete logarithms in Cl(Δ) [16], this algorithm only has running time LΔ[1/2, c] and is far less efficient than the number field sieve with Lp[1/3, c] to compute logarithms in IF*p. Thus one can choose smaller parameters to obtain the same level of security. It is an open question whether there is an LΔ[1/3, c] algorithm to compute discrete logarithms in arbitrary Cl(Δ). In this work we focus on the special case of totally non-maximal imaginary quadratic orders OΔpsuch that Δp = Δ1p2 and the class number of the maximal order h(Δ1) = 1, and we will show that there is an LΔp[1/3, c] lgorithm to compute discrete logarithms over the class group Cl(Δp). The logarithm problem in Cl(Δp) can be reduced in (expected) O(log3 p) bit operations to the logarithm problem in IF*p (if (Δ1/ p) = 1) or IF *p2 (if (Δ1/ p) = -1) respectively. This result implies that the recently proposed efficient DSA-analogue in totally non-maximal imaginary quadratic order OΔp [21] are only as secure as the original DSA scheme based on finite fields and hence loose much of its attractiveness.

UR - http://www.scopus.com/inward/record.url?scp=46749154744&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=46749154744&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:46749154744

SN - 3540666664

SN - 9783540666660

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 220

EP - 231

BT - Advances in Cryptology - ASIACRYPT 1999 - International Conference on the Theory and Application of Cryptology and Information Security, Proceedings

A2 - Lam, Kwok Yan

A2 - Okamoto, Eiji

A2 - Xing, Chaoping

PB - Springer Verlag

ER -