An Efficient NICE-Schnorr-Type Signature Scheme

Recently there was proposed a novel public key cryptosystem [17] based on non-maximal imaginary quadratic orders with quadratic decryption time. This scheme was later on called NICE for New Ideal Coset Encryption [6]. First implementations show that the decryption is as efficient as RSA-encryption with e = 2 +1. It was an open question whether it is possible to construct comparably efficient signature schemes based on non-maximal imaginary quadratic orders. The major drawbacks of the ElGamal-type [7] and RSA/Rabin-type signature schemes [8] proposed so far are the slow signature generation and the very inefficient system setup, which involves the computation of the class number h(∆1) of the maximal order with a subexponential time algorithm. To avoid this tedious computation it was proposed to use totally non-maximal orders, where h(∆1) = 1, to set up DSA analogues. Very recently however it was shown in [10], that the discrete logarithm problem in this case can be reduced to finite fields and hence there seems to be no advantage in using DSA analogues based on totally non-maximal orders. In this work we will introduce an efficient NICE-Schnorr-type signature scheme based on conventional non-maximal imaginary quadratic orders which solves both above problems. It gets its strength from the difficulty of factoring the discriminant ∆p = −rp2, r, p prime. To avoid the computation of h(∆1), our proposed signature scheme only operates in (a subgroup of) the kernel of the map φ−1 Cl , which allows to switch from the class group of the non-maximal order to the maximal order. Note that a similar setup is used in NICE. For an efficient signature generation one may use the novel arithmetic [9] for elements of Ker(φ−1 Cl ). While the signature generation using this arithmetic is already slightly faster than in the original scheme, we will show in this work that we can even do better by applying the Chinese Remainder Theorem for (O∆1/pO∆1). First implementations show that the signature generation of our scheme is more than twice as fast as in the original scheme in IFp, which makes it very attractive for practical applications. H. Im ai , Y. Zh e n g ( E d s. ): P KC 2000, LNCS 1751, p p . 14– 27, 2000. c © Springer-Verlag Berlin Heidelberg 2000 An Efficient NICE-Schnorr-Type Signature Scheme 15