An efficient nice-schnorr-type signature scheme

Abstract

Recently there was proposed a novel public key cryptosystem [17] based on non-maximal imaginary quadratic orders with quadratic decryption time. This scheme was later on called NICE for New Ideal Coset Encryption [6]. First implementations show that the decryption is as efficient as RSA-encryption with e = 216 +1. It was an open question whether it is possible to construct comparably efficient signature schemes based on non-maximal imaginary quadratic orders. The major drawbacks of the ElGamal-type [7] and RSA/Rabin-type signature schemes [8] proposed so far are the slow signature generation and the very inefficient system setup,w hich involves the computation of the class number h(Δ1) of the maximal order with a subexponential time algorithm. To avoid this tedious computation it was proposed to use totally non-maximal orders, w here h(Δ1) = 1,to set up DSA analogues. Very recently however it was shown in [10],t hat the discrete logarithm problem in this case can be reduced to finite fields and hence there seems to be no advantage in using DSA analogues based on totally non-maximal orders. In this work we will introduce an efficient NICE-Schnorr-type signature scheme based on conventional non-maximal imaginary quadratic orders which solves both above problems. It gets its strength from the difficulty of factoring the discriminant Δp = −rp2, r, p prime. To avoid the computation of h(Δ1),ou r proposed signature scheme only operates in (a subgroup of) the kernel of the map ϕ−1 Cl,wh ich allows to switch from the class group of the non-maximal order to the maximal order. Note that a similar setup is used in NICE. For an efficient signature generation one may use the novel arithmetic [9] for elements of Ker(ϕ−1 Cl). While the signature generation using this arithmetic is already slightly faster than in the original scheme,w e will show in this work that we can even do better by applying the Chinese Remainder Theorem for (OΔ1/pOΔ1)∗. First implementations show that the signature generation of our scheme is more than twice as fast as in the original scheme in IF∗p,wh ich makes it very attractive for practical applications.