Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields

Abstract

We discuss the discrete logarithm problem over the class group Cl(Δ) of an imaginary quadratic order OΔ, which was proposed as a public-key cryptosystem by Buchmann and Williams [8]. While in the meantime there has been found a subexponential algorithm for the computation of discrete logarithms in Cl(Δ) [16], this algorithm only has running time LΔ[1/2, c] and is far less efficient than the number field sieve with Lp[1/3, c] to compute logarithms in IF*p. Thus one can choose smaller parameters to obtain the same level of security. It is an open question whether there is an LΔ[1/3, c] algorithm to compute discrete logarithms in arbitrary Cl(Δ). In this work we focus on the special case of totally non-maximal imaginary quadratic orders OΔpsuch that Δp = Δ1p2 and the class number of the maximal order h(Δ1) = 1, and we will show that there is an LΔp[1/3, c] lgorithm to compute discrete logarithms over the class group Cl(Δp). The logarithm problem in Cl(Δp) can be reduced in (expected) O(log3 p) bit operations to the logarithm problem in IF*p (if (Δ1/ p) = 1) or IF *p2 (if (Δ1/ p) = -1) respectively. This result implies that the recently proposed efficient DSA-analogue in totally non-maximal imaginary quadratic order OΔp [21] are only as secure as the original DSA scheme based on finite fields and hence loose much of its attractiveness.