A survey of cryptosystems based on imaginary quadratic orders

Since nobody can guarantee that popular public key cryptosystems based on factoring or the computation of discrete logarithms in some group will stay secure forever, it is important to study different primitives and groups which may be utilized if a popular class of cryptosystems gets broken. A promising candidate for a group in which the DL-problem seems to be hard is the class group Cl(∆) of an imaginary quadratic order, as proposed by Buchmann and Williams [BuWi88]. Recently this type of group has obtained much attention, because there was proposed a very efficient cryptosystem based on non-maximal imaginary quadratic orders [PaTa98a], later on called NICE (for New Ideal Coset Encryption) with quadratic decryption time. To our knowledge this is the only scheme having this property. First implementations show that the time for decryption is comparable to RSA encryption with e = 216 + 1. Very recently there was proposed an efficient NICE-Schnorr type signature scheme [HuMe99] for which the signature generation is more than twice as fast as in the original scheme based on IFp. Due to these results there has been increasing interest in cryptosystems based on imaginary quadratic orders. Therefore it seems necessary to provide an up to date survey to facilitate further work in this direction. Our survey will discuss the history, the state of the art and future directions of cryptosystems based on imaginary quadratic orders.