Cryptography based on number fields with large regulator

J

OURNAL DE

T

HÉORIE DES

N

OMBRES DE

B

ORDEAUX

J

OHANNES

B

UCHMANN

M

ARKUS

M

AURER

B

ODO

M

ÖLLER

Cryptography based on number fields with large regulator

Journal de Théorie des Nombres de Bordeaux, tome

12, n

o

_{2 (2000),}

p. 293-307

<http://www.numdam.org/item?id=JTNB_2000__12_2_293_0>

© Université Bordeaux 1, 2000, tous droits réservés.

L’accès aux archives de la revue « Journal de Théorie des Nombres de Bordeaux » (http://jtnb.cedram.org/) implique l’accord avec les condi-tions générales d’utilisation (http://www.numdam.org/conditions). Toute uti-lisation commerciale ou impression systématique est constitutive d’une infraction pénale. Toute copie ou impression de ce fichier doit conte-nir la présente mention de copyright.

Article numérisé dans le cadre du programme Numérisation de documents anciens mathématiques

Cryptography

based

on

number

fields

with

_{large regulator}

par JOHANNES

BUCHMANN,

MARKUS MAURER et BODO

MÖLLER

RÉSUMÉ. Nous introduisons une variante du

_protocole

de

signa-ture et d’identification de

Fiat-Shamir,

basée sur la difficulté

pra-tique

qu’il

y a à calculer des

_{générateurs}

des idéaux _principaux

dans les corps de nombres. Nous montrons en outre comment

utiliser les

heuristiques

de Cohen-Lenstra-Martinet _pour les

grou-pes de classes dans le but de construire des corps de nombres dans

lesquels

le calcul de

_{générateurs}

des idéaux _principaux est encore

hors d’atteinte.

ABSTRACT. We

_explain

a variant of the Fiat-Shamir identification

and _signature

_protocol

that is based on the

intractability

of

com-puting generators of

_principal

ideals in

_algebraic

number fields. We also show how to use the Cohen-Lenstra-Martinet heuristics

for class _{groups to construct} number fields in which _computing

generators of

_principal

ideals is intractable.

1. Introduction

The

_security

of

_{public key}

_{cryptosystems}

is based on the

intractability

of

computational problems

in mathematics and in

_particular

in number

the-ory.

Examples

are the

_problems

of

_factoring

_integers

or

_computing

discrete

logarithms

in certain finite abelian groups

(see

[24]).

However,

there is

currently

no such

_problem

whose

_{computational}

difficulty

can be

_proved.

On the

_contrary:

_Experience

with the

_factoring

_problem

shows that

unex-pected breakthroughs

are

_{always possible.}

To

_guarantee

that

_{public key}

cryptography

is

_possible

even if the

currently

used

_systems

are

broken,

it is

necessary to

_identify

alternative

_{computational problems}

that can be used as the basis of

_public

_key

schemes.

In this _paper, we consider the

_principal

ideal

_problems

(PIP):

Let 0 be an order of an

algebraic

number field F. Given a

principal

O-ideal

I,

find a

_generator

of that

ideal,

i.e. an element a E F such that I = a0. We

show how to use the heuristics of

_Cohen,

_Lenstra,

and Martinet

([13], [14],

[15],

and

_[16])

for class _groups of

_algebraic

number fields to

_generate

orders for which PIP is

_intractable,

and we

_present

PIP-FS,

a variant of the

Fiat-Shamir identification and

_signature

scheme

_[17]

whose

_security

is based on

PIP. We describe an

_{implementation}

of PIP-FS in real

_{quadratic fields,}

we

discuss its

_security,

and we

_present

_timings

that show that PIP-FS has the

potential

to become

_practical.

PIP is a

special

case of the number field discrete

_logarithm

problem

(NFDL),

which was introduced in

_[8].

_There,

it has been

_suggested

to

develop cryptographic

primitives

based on NFDL. For number fields with

large

class

_number,

a new scheme has been

presented

in

[2];

also some

pre-viously

known

_{cryptographic}

schemes such as

[18]

and

[26]

can be

adopted

to the class _group of a number field since

they

do not

_require

_knowledge

of the _group order

_{(cf. [2]}

and

_[19)).

A bit commitment and an oblivious

transfer scheme for

_{real-quadratic}

number fields have been described in

_[3].

Here,

we

_present

first identification and

signature

schemes for number fields

with

_large

_regulators.

We show how to

_generate

such fields that are suitable

for

_{cryptographic applications.}

This _{paper is}

_organized

as follows: In Section

_2,

we

_present

a

_general

version of the Fiat-Shamir

_protocol

_(FS).

In Section

_3,

we

explain PIP-FS,

an FS variant based on PIP in number fields. A detailed

_description

of

the

_{implementation}

of PIP-FS in real

_quadratic

number fields is

_given

in

Section 4.

2. Fiat-Shamir identification

In this

_section,

we

_present

a

_fairly

_general

version of the Fiat-Shamir

identification

_protocol

_(FS).

_(For

_{generalizations}

of the

_original

Fiat-Shamir scheme

_[17],

see also

[12]

and

[11].)

The

_goal

of the FS

_protocol

is that one

_party,

called the _prover, convinces

the other

_party,

called the

_verifier.,

of his

_knowledge

of a

_private

_key

without

revealing

any relevant information

concerning

that

private

key.

We will also

explain

how a

_{digital signature}

scheme can be obtained from this

_protocol.

In the

_setup

_phase

of the

_protocol,

the prover and the verifier agree on

two abelian _groups G and

_H,

on a

_{homomorphism cp :}

G -

_H,

and on a

positive integer

k. The prover selects k group

elements 9i

E

_G,

1 i k. The _sequence

_{(gl, ..., gk)}

is his

_private

_key.

He then

_computes

_hi

=

cp(gi),

1 i k. The sequence

(hl,

...,

hk)

is his

public key.

(In

the

_original

Fiat-Shamir

_protocol,

a

_key

_issuing

center is

_responsible

for

_{selecting G,}

_H,

_{and cp}

such that the center can

efficiently

invert cp

using

certain additional

_information,

which must be

_kept

secret. Then the

components

of _any

_prover’s

_public

_key

can be derived from a

_description

applying

a hash

function;

the

key

issuing

center can

_compute

an

_appropriate

private

key

and _{pass it} to the _prover. We note that our variant of the

Fiat-Shamir

_protocol

does not have this

_property.

_Instead,

_public

_keys

must be

explicitly

given,

as _{e.g. in} Schnorr’s identification scheme

[28].)

The FS identification

_protocol

works as follows:

1.

_(Commitment

and

_Witness)

The _prover

_randomly

selects a

commit-ment g E G and

_computes

the witness h = The

prover sends

the witness h to the verifier.

2.

_(Challenge)

The verifier selects a

_challenge

e E

10, Ilk

and sends it to

the _prover.

3.

_(Response)

The _prover

_computes

the _response r =

g

giei

z and

sends it to the verifier.

4.

_{(Verification)}

The verifier checks whether =

cp(r).

Clearly,

a _prover who knows the

_private

_key

can convince the verifier of

his

_identity.

Assume that _cp has the

_following

one _way

_property:

Without

knowledge

of the

_private

_key,

it is intractable to

_compute,

_given

_{( fl, ..., fk)}

E

_10,

±Ilk

where at least one

_{f i}

is not

_0,

an s with

p(s) =

IT1

We show that the

probability

to detect that a _prover does not know the

_private

_key

is at least

1-1/2 k.

To increase the

_probability,

the basic

_protocol

can be

_repeated

several times.

If the _prover is able to

_give

the correct answer for two different

chal-lenges

and

_{(el, ... ,}

_e’),

then he knows

_{r, r’}

E G such that

k

cp(r)

=

hii

and

_cp(r’)

=

h;i.

This

implies

that he _can

com-pute s

=

r’r-1

such that

p(s) =

he’-ei .

Note that

_{e’ -}

ei E

f 0, :l:1}.

By assumption, computing s

without the

_knowledge

of the

_private

_key

is

intractable.

_Therefore,

a

_cheating

_{prover cannot} know the correct answer

for two different

_challenges,

and the

_probability

for him to be detected is

at least

_{I - 1/2 k}

When we

_explain

our variant PIP-FS in Section

_3,

we will also show

that the verifier or an observer are not able to derive the

_private

_key

from information transmitted

_during

the

_protocol.

The FS identification

_protocol

is efficient if

_{multiplication}

in the groups

G and H can be

performed efficiently

and if the

_homomorphism

_cp can be

computed

efficiently.

In the

_following

_way, the FS identification

_protocol

can be transformed

into a

_signature

_{protocol. Suppose}

a document d is to be

_signed.

The

signer

selects a

_{commitment g}

and

_computes

the witness h as in the above

protocol.

To

_generate

the

_challenge,

the

_signer

uses a

cryptographic

hash

function

_f

_(see

_[24]).

He

_computes

_{f (d o}

_h)

where o is concatenation and

challenge

is the _sequence of the first k bits of the hash value. The

signa-ture consists of the witness and the response. The verifier

computes

the

challenge

from the witness and the document and

_proceeds

as in the FS

protocol.

3. PIP-FS

We

_{explain PIP-FS,}

our FS variant that is based on the

intractability

of

solving

the

_principal

ideal

_problem

in number fields. Let F be an

_algebraic

number field and let 0 be an order of F. In the Fiat-Shamir

_protocol,

we use

the

_{multiplicative}

_group F* of all non-zero elements in

F,

the

multiplicative

group

of

_principal

fractional

_0-ideals,

and the

_homomorphism

With this choice of

_G,

_H,

and _cp, the

_general

Fiat-Shamir

_protocol

described

in the

_previous

section can be

implemented.

We call the

_{resulting protocol}

PIP-FS.

In order for PIP-FS to be _secure,

_inverting

_cp must be intractable.

Invert-ing

p means

solving

the

principal

ideal

problem

for 0-ideals. We discuss

the

_difficulty

of this PIP. The two most efficient methods known for

solv-ing

the

_principal

ideal

_problem

are the

_{babystep-giantstep}

_algorithm

[7] [1]

and the index calculus method

_{[29] [6].}

The

_running

time of the

babystep-giantstep

algorithm

is where n is the

degree

of

F, A

is

the discriminant of

_0,

and R is the

_regulator

of 0. More

_precisely,

the

following

is true. Let I be a

_principal

0-ideal. Let a be a

_generator

of

I such that the euclidean

_length

of the

_{logarithmic embedding}

of a

(see

[4])

is

_minimal,

and let a be that

_length.

Then a can be

_computed

in

time

no(n)

_minla,

The

_running

time of the index calculus

algorithm

is

_Thus,

in order for the

principal

ideal

_problem

to be

_intractable,

the

_{discriminant,}

the

_regulator,

and the minimal

_{logarithmic length}

of the

_generators

must be

_sufficiently

large.

We note that no

Pohlig-Hellman

attack

(see

[24])

is known for PIP.

Therefore,

no further condition for the order 0 _{appears to} be _necessary.

For the

_appropriate

choice of the order

_0,

we use the

_analytic

class

number formula

_[4]

and the heuristics of

_Cohen,

_Lenstra,

and Martinet

([13], [14], [15], [16]).

The

_analytic

class number formula tells us that the

product

of the class number h and the

_regulator

R of the

_algebraic

number field F is

_{asymptotically}

_proportional

to

_{where 0}

is the discriminant of F. The heuristics of

_{Cohen, Lenstra,}

and Martinet

_predict

when the class number is small with _very

_{high probability.}

_Thus,

if we choose the

1. with

_{sufficiently large}

discriminant in order to make index calculus attack infeasible and

2. with small class number

_(using

the heuristics of

_{Cohen, Lenstra,}

and

Martinet),

then the

_principal

ideal

_problem

appears to be intractable.

Next,

we must answer the

_question

how the

keys,

_commitment,

witness,

challenge,

and _response are selected or

_computed.

The idea is to use reduced

principal

0-ideals and their

_generators.

We will

_explain

this in detail for the

case of real

quadratic

orders. The methods

explained

for these orders can

be

_generalized

to

_general

orders. This will be

_explained

in a

forthcoming

paper.

4. PIP-FS in real

_quadratic

fields

In this

_section,

we show how to

_implement

PIP-FS

_using

a real

_quadratic

order in which the

_principal

ideal

_problem

is intractable. In

_particular,

we

explain

1. how the order 0 is

_selected,

2. how the

_private

_key

and the commitment are selected and

represented,

3. how the

_public

_key,

the

_witness,

and the _response are

_computed

and

represented,

and

4. how the verification is

_performed.

We let 0 be a real

_quadratic

order of discriminant

_A,

class number

_h,

and

_regulator

R.

_{By F}

we denote the field of fractions of 0.

4.1. The order. As

_explained

in Section

_3,

we have to choose the order 0 such that both the index calculus

_algorithm

and the

_{babystep-giantstep}

algorithm

cannot be used to solve the

_principal

ideal

_problem

in 0. We

will,

in

_fact,

choose 0 as a maximal order.

The most efficient variant of the index calculus

_algorithm

that is

cur-rently

known is due to Jacobson

_[21].

_{Extrapolating}

_experiments

with Jacobson’s

_algorithm,

_Hamdy

_[19]

found that the

_difhculty

of

_applying

the index calculus

_algorithm

in an order with a 687 bit discriminant is the same as the

difficulty

of

factoring

a 1024 bit number with the number field sieve.

Therefore,

we

_require

that

Further

_comparisons

can be found in Table 1.

To make the

_{babystep-giantstep}

attack

_impossible,

we choose the order

such that

where 160 is a

security

_parameter.

The reason for this choice is

given

TABLE 1.

_Comparison

of

_factoring

with the number field

sieve and

_solving

PIP-FS with index calculus.

To

_satisfy

_requirement

_(2),

we choose A to be the

_product

of two random

primes

3 mod 4. We will show below

_{that, assuming}

the Cohen-Lenstra heuristics

_[13]

and the extended Riemann

_hypothesis,

condition

₍₂₎

is satisfied with

_probability

1 -

_{2-~2 ,}

_N,

if

For

_example,

if

kl

+

k2

=

240,

we obtain that A &#x3E;

25°9

is sufficient. So if

(1)

holds,

then

₍₂₎

is satisfied.

_Choosing

A to be the

_product

of two

_primes

has additional

_appeal

when these

_primes

are not disclosed.

_Being

able to

solve PIP for

_arbitrary

reduced

_principal

ideals

_{implies being}

able to factor the discriminant

_{([9], [27]).}

Thus in this case PIP is

provably

at least as

hard as

breaking

_{cryptosystems}

such as RSA that

rely

on the

assumption

that

_factoring

_integers

of this form is intractable.

So let us

_{explain why}

it suffices to choose A

_according

to

_(3).

Since A is

_square-free,

0 is a maximal order. We can relate the

regulator R

to

the class number h

_by

_using

the

_analytic

class number formula

_[4]:

We

have 2hR =

~ ~

where

L(1, X) _

flp

prime

(l -

is the

value at 1 of the Dedekind L-series for the Kronecker

_{symbol X}

_{= (~).}

So our initial condition

(2)

translates to &#x3E; *

Assuming

the

_ERH,

we

_{have, by}

a result of Littlewood

[23],

that

L(1,

x)

&#x3E;

(1

-I- 1

_{where q}

= . 0.5772... is Euler’s _constant

(cf.

[25],

where it is also discussed how 1 +

_o(l)

can be

replaced by

explicit

bounds).

As

_12e~/~r2

_4,

_certainly

_L(I,

_X)

&#x3E;

4(1

+ and from this we obtain the new condition

We now examine the class number h in more detail. For the even

_part

of

_h,

we can use well-known theorems from _genus

_theory

[20]:

Since A is the

For

_estimating

the odd

_part

of the class

_number,

we

_apply

the heuristics

of Cohen and Lenstra

_[13]

with the

_assumption

that our restriction on the

choice of A does not affect the statistical behaviour of the odd

_part

of the class number. Then the

_probability

that h &#x3E; x is

_asymptotic

to

_{1 / (2x)}

(cf.

[13],

§

9,

(C12) a).

With

_probability

at least 1-

_2-~2,

we have h

2*~2 .

By substituting

this into

_(4),

we obtain the condition

Assuming

that A is

_{large enough}

such that 1 +

_o(l)

can be

omitted,

we

arrive at

_(3).

4.2. Reduced 0-ideals. To

_implement

PIP-FS in

_0,

we use reduced

0-ideals,

which we describe in this section. For more details on reduced

ideals,

we refer to

[27]

and

[30].

Every

fractional 0-ideal I has a

_{representation}

where q

is a

_positive

rational

number, a

is a

_{positive integer,}

and b is an

integer.

The numbers _q and a are

uniquely

determined. The

integer

b is

unique

modulo 2a. For a &#x3E;

ae,

we choose b such that -a b _a; for a

B/A,

we choose b such that

J3 -

2a b

ae.

We

_represent

I

by

(q,

a,

b,

c)

where c =

(b2 -

A)/(4a)

_E Z.

If q

= 1,

then _we write I =

(a,

b,

c).

The 0-ideal I =

(a, b, c)

is called reduced if

IVK - 2al

I

b

U1.

If

I =

(a,

b,

c)

is a reduced

0-ideal,

then lal

+

_Icl

01.

This

_implies

that

the number of reduced 0-ideals is finite. For

_example,

the order 0 itself is

a reduced

principal

0-ideal.

We

_explain

the reduction

_operator

_p, which is the basic

_algorithmic

prim-itive in reduction

_theory

of 0-ideals. If I =

(q,

a,

b,

c)

is an

0-ideal,

then

with

We can also write this as

If I is not

_reduced,

then a reduced ideal J that is

equivalent

to I and an

1.

_{Set -y}

= 1 and J = I.

2. While J is not

_{reduced, replace y by}

and J

_by

_p(J).

This

_algorithm

terminates with the correct result in

_quadratic

time. We

write q

=

-y(I)

and J =

reduce(I).

The fact that reduction of O-ideals is

_possible

in

_polynomial

time

_implies

the

_following

_theorem,

which shows that

_using

_only

reduced O-idea,ls does

not harm the

_security

of PIP-FS.

Theorem 4.1. There is a

polynomials

time reduction

from

PIP

for

D-ideals

to PIP

_for

reduced O-ideals.

Proof.

Let I be a fractional O-ideal. Instead of

_solving

PIP for

_I,

we solve

PIP for J =

reduce(7) =

If J is not

_principal,

then I is not

_principal.

If J is

_principal

and J

_{= a0,}

then I is

_principal

and I = D

Restricted to the set of reduced ideals in an

_equivalence

class of

_O-ideals,

the reduction

_operator

_p is a transitive

_permutation.

This

implies

that

there is a

positive integer

_p such that the set of reduced

_principal

ideals

is

_{fpz (0) :}

0 i

_p}

and

_p2(O)

= if and

only

if i

- j

mod p.

If

I =

(a,

b,

c)

is

reduced,

then

which can also be written as

We also have

_(see

_[27,

Lemma

_3.2]

and

for reduced I.

From

₍₁₀₎

and

_(11),

we obtain the

following

lemma,

which is used in

the construction of the

_private

and

_{public key}

and the commitment and

witness.

Lemma 4.2. Let r be a real number,. Then there is a reduced O-ideal that

has a

_positive

_generator

a with

Ilna - r[

(In~)/4.

Proof.

Let r &#x3E; 0. Set

_Io

=

0,

ao =

1,

Ii+l =

p(1i),

ai+l = Then

Ii

is a reduced O-ideal with

_generator

_{cx2, cx2 &#x3E;}

_0,

0 In _{0152i+l -} In _0152i =

(In A) /2

by

(10),

and

_{limi,,,,,Inai}

= _oo

by

(11).

This

_implies

the assertion. For r

_0,

the

proof

is

analogous

and uses

p-1.

D

4.3. Private

_key,

_{commitment, public}

_key,

and witness. Assume that A is chosen as described in Section 4.1.

The

_private

key

and the commitment are chosen such that the

corre-sponding

principal

ideal

_problems

are difficult. We now

explain

how we can choose them as

_generators

of reduced

principal

ideals.

It follows from Theorem 4.1 that is is not harder to solve PIP for O-ideals than for reduced O-ideals.

_Therefore,

we _may limit ourselves to

_generators

of reduced 0-ideals when

_choosing

the

_private

_key

and the commitment.

We denote the set of all reduced

_principal

O-ideals

_by

Po.

The

_public

_key

and the witnesses are

_computed

_using

the function

which is described in Section 4.6.

_Here,

we use the

following

properties

of

that function:

1. Given n E

_N,

the value

_close(n)

can be

computed

in

polynomial

time.

2. For _every n E

_N,

there is a

_positive

_generator

a of

close(n)

with

can [

(lnA)/4

+

1,

where c =

((ln 0)/2

+ 21.

It _can be

com-puted

in

_polynomial

time.

3.

_The

restriction of close to _any interval of

2ki

consecutive

_integers

is

injective,

where 160 is chosen as in Section 4.1.

To

_generate

the

_private

_key,

the _prover

_randomly

chooses k

_integers

nl, ..., nk in

[0,2kl -

1].

The

corresponding

public key

is

(I1, ..., Ik)

with

Ii

=

close(n2),

1 i k. For the

generation

of the

commitment,

_we

need two more

_security

_parameters

N. The

_{integer 1~2}

is chosen

such that an event that

_happens

with

_probability

_{1 /2~2}

is considered

prac-tically

impossible.

Parameter

_1~3

is chosen such that

2k3

is an _upper bound for the number of

_applications

of the PIP-FS

_protocol

with one

_key

_pair.

For

_example,

_k3

= 30 allows _{to use} the _same

key

pair

every second for

more than 30 years. The commitment is a random

_{integer n}

E

[0,2£ -

_1~,

-f-1~2

+

_k3

+ 1. The witness is I =

close(n) .

4.4.

_Response

and verification. Let A and c be as in Section 4.3. Let

(nl, ..., nk )

be the

_private

_key

and

_{(h, ... , Ik )}

the

_{corresponding}

_{public key,}

both chosen as in the

_previous

section. Assume that n is a

_commitment,

I =

close(n)

is the

corresponding

witness,

and

_{(e1, ..., ek)}

E is the

challenge.

Then the _response is r = _{n +}

eini .

Using

r, the verifier

is able to

_verify

that there is a

_generator

of i that is close to cr.

This is

_explained

in Section 4.7.

4.5.

_Security.

We

_{explain why}

PIP-FS as described is secure. Let

Pl

[0, ..., 2kl -

1],

it is

_impossible

to tabulate the elements of

Pi

with

gen-erators or to _guess a

_private

key yielding

the same

_{public key.}

We

ana-lyze

the time

_required

to

_compute

a

_generator

of an element I of

Pi.

Let

I =

close(n)

with n _E

[0,2~ -1].

Since

by

(2)

we have R &#x3E;

c - 2 ki,

it follows

that the

_logarithm

of the smallest

_{positive generator}

of I is

_{approximately}

cn.

Therefore,

the

babystep-giantstep algorithm

[1]

for

computing

a

gen-erator of I takes

2~1 ~2 Do(1)

bit

_operations.

So it is

_impossible

to

_compute

a

_generator

of I this _way.

Also, by

choice of

A, determining

a

_generator

of I

_by

the index calculus

_algorithm

is

_impossible.

_{Hence, computing}

gen-erators for elements of

_Pi

is intractable. Similar

_arguments

_apply

to close restricted to any other interval

[m,...,

m +

2~1 -

_1~,

and hence to close on

intervals

_{(o, ..., b~}

where

Now we show that

_knowledge

of values of _r, collected from _{up to}

2 k3

executions of the

_protocol,

with

_{overwhelming probability}

does not allow the verifier or an observer to deduce _any sub-sum of the secrets nl, ..., n~.

For

_simplicity,

assume that an attacker

_targets

only

which is most

easily

done

_by

_always

_using

the

_challenge

_{( 1, 0, ..., 0),}

so that r = _{n +}

nl .

As n E

[0, 2~ - 1],

this _response r

only

reveals that nl E

[r

-

2~ -~-1,

r].

It is

known beforehand that nl E

[0,2~ -

1~,

so r is

helpful

for

determining

nl

only

if r -

2~

+ 1 &#x3E; 0 or r

2ki - 1,

which

implies

that n +

2 ki -2t

&#x3E; 0

or n

2kl - 1,

respectively.

Thus,

for

uniformly

chosen n E

[0,2£ -

1],

the

_probability

is less than 2 - Combined over

2 k3

iterations of the

protocol,

the

_probability

still is less than 1 -

_{(1 -}

2 -

2~1-~ ) 2k3 ,

i.e. under

2 ~ 2~1-~ ~ 2k3

_{= 2-~2 ,}

which

_by

choice of

1~2

is considered

_negligible.

4.6. The function close. Let

_k2,

_{1~3, .~, l~, 0, F, A,}

and R be as in

Section 4.3. We

_explain

the

_{implementation}

of a function

with the

_properties

from Section 4.3

_{where Po}

is the set of all reduced

principal

0-ideals. We will show that this function restricted to _any interval of

2ki

consecutive

_integers

is

_injective,

and that for _{any n} E N the ideal

close(n)

has a

_{positive generator}

a with

cn[

(lnA)/4

+ 1 where

This function is used for the

_generation

of the

_{public key,}

the

_computation

of the

_witness,

and in the verification.

Let n e N. The

algorithm

_computes

b =

[1092 n]

₊

1,

i.e. the

binary

length

of _n, and t =

cn/2b.

Then it

recursively

_computes,

for 0 i

b,

reduced O-ideals

Ii

that have

_positive

_generators

0152i with

To initialize the

recursion,

an 0-ideal

10

is

computed

that has a

_positive

generator

ao with

I In ao - t) I

(lnA)/4

+ 1. This is done

_by

the

_following

procedure:

1. Set

_{Io = 0,}

0:0 = 1.

2. While

_{(In A) /4,}

set 0:0 = and

Io

=

p(Io).

It follows from

₍₁₀₎

and

₍₁₁₎

that the

_algorithm

terminates with the correct

result after

_0(ln

_A)

iterations of the while

_loop.

Since the

_{implementation}

uses rational

_{approximations}

to the

_logarithms,

it can

only

_guarantee

that

when the while-condition is found to be false. The details are

explained

below.

Next we

explain

the recursion. When

Ii

has been

found,

i

b,

then

Ii+1

is

_computed

as follows.

First,

the ideal

Ii

is determined. This is a

principal

0-ideal with

_generator

_0:;.

Note that

So

_{In a?}

is

_pretty

close to

_2i+lt,

but

₍₁₃₎

_{may not} be satisfied.

_Also,

the ideal

_Ii

_is,

in

_general,

not reduced. To make

_I2

_reduced,

the reduction

algorithm

explained

above is

_applied.

It

_yields

a reduced

_principal

0-ideal

Ii+1

and an element _{1’i+l E} F* such that

li+l

=

1’i+lIl.

If In

1’i+l is too

small,

then we

_replace

_1’i+l

_by

1’i+la(Ii+l)

and

_by

until

(13)

holds for _ai+1 =

1’i+ 1 aT .

If is too

_large,

then we

replace

_{1’i+ 1}

by

and

_Ii+l

_by

until

₍₁₃₎

holds for Note

that is a

_generator

of the reduced

principal

ideal

Ii+l.

As we can

_only

work with

_{approximations}

to the

_{logarithms, things}

are

somewhat more difficult. We

explain

the details. To obtain

(13),

we

ap-proximate

In a2

by

a rational

number a2

with

for 0 i

_b,

and each _l’i+l is chosen such that

Then _ai+l = satisfies

(13).

To find such that

₍₁₆₎

_holds,

we work with rational

_{approximations}

to the

_logarithms

and

_modify

the

_algorithm

from above as follows:

_If,

after

reduction,

the

_{approximation}

to the

_logarithm

1’i+l is too

_small,

we start

with ,3o

= _1’i+l and determine ideals

by

iterative

application

of

p, such that

2i+lt -

2ai

is

larger

than or

equal

to the

approximation

of

but smaller than the

_{approximation}

of If the

_logarithm

of

is too

_large,

we use

p-1

instead. At the

end,

_{1’i+l is}

replaced by

or

depending

of which

logarithm

_{approximation}

is closer to

2i+1t -

_2ai.

2. Set T =

2ai.

3.

_{If bo T,}

do the

_following:

_{Set j}

= 0. While

T,

set

Jj+l

=

flj+i

= and

compute

with

_1/4;

_replace

j

Otherwise:

_{Set j}

= 1. While _&#x3E;

T,

replace j by j -

1;

set

jj-1

= = and

compute

with

1/4.

4. then set

_Ii+l

=

Jj-l

and =

Otherwise,

set

_Ii+l

=

Jj

and =

We _prove that this

_procedure

is correct.

Theorem _{4.3. -yi+1} determined

_by

the

_{procedure satisfies}

_(16).

Proof.

Let

_T,

_bj

be as in the

procedure

and

let j

be with the value at

the end of the

_procedure.

It is

If T -

_T,

set c =

Otherwise,

_{set c} =

bj.

First,

we examine the case T It is

lc - Tj

+

_1/4

_T~,

_{lln,3j -}

_T~}

+

_1/2.

So,

(10)

implies

Iln1’i+l -

TI

(In

A)/4

+

_1/2.

The second case is T . It is

Iln1’i+1 -

TI

c - T ~

+

_{1 /4 ~}

- - - - -

-We can use the same

_arguments

for the third case T D

The initial value ao is

computed by executing

the

procedure

with i

= -1,

I-1

=

0,

and

a-1 = 0. Then the

procedure

determines ,0, and we set

cxo =

70.

Finally,

we remark that the

approximations

ai can be

computed

as

fol-lows. Each

_generator

is of the form aj = .

After 73

has been

computed by

the

_{procedure above,}

we

approximate

its

logarithm by

_{cj such}

that

_{lcj - ln7jl}

_[

2-n+j-b-3.

. We set ao = co and a2+1 =

2ai

+ Then

ai satisfies

(15)

for 0 i b.

4.7.

_Implementing

the verification. In the verification

_step,

the

veri-fier knows the

_{positive integer}

_r, the

_principal

O-ideals

_{I, h, ..., Ik ,}

and the exponents el, ..., e~ E

_~0,1~.

He wants to

_verify

that the

_principal

O-ideal

1 n7=1

17i

Z

has a

_positive

_generator

a such that In ct is close _{to cr,} where c

is defined

_according

to

_(12).

The verifier uses the reduction

algorithm

from Section 4.2 to

_compute

a reduced O-ideal J and ₇ E F* with J =

~yI

17i.

This is done _as

follows:

2. For i =

1, ...,1:

If

ei =

1,

then

replace q by

and J

by

reduce

If a is a

_generator

of then _{aq is} a

_generator

of J. Since

I

_I1f=1

_Ii

has a

positive generator

whose

logarithm

is close to cr and since

In I

is

_small,

it follows that the reduced O-ideal J has a

_generator

whose

logarithm

is close to cr. The verifier can

verify

this

by computing

K =

close(r)

and

_{by searching}

for J in the

_neighborhood

of K. More

_precisely,

he

_applies

the

_{following algorithm}

where n is chosen

_according

to Theorem 4.4: .

1.

_Compute

K =

close(r).

Set

Kr

=

Ki

= K and i = 0.

2. While i n,

J ~

KI

and

J ~

Kr

replace

i

by

i +

1,

Kr

by

p(Kr),

and

Ki

by

p-l(KI).

In the next

_theorem,

we

_give

an _upper bound on the number of

_steps

that are _necessary for the verification to succeed.

Theorem 4.4.

_{If r}

is chosen

_according

to the

_protocol,

then the

_verification

succeeds

_{a f ter}

at most n = ₊

(In A) /4

₊

1) /In 21

iterations,

where

Proof.

Let

_Ji-l

denote the value of J before the i-th iteration of the

for-loop

used in the reduction of

III:==117i.

Then

_In(32A)

holds for each i

_(see

_[30,

Theorem

_{5.2~ ) .}

This

_implies

Assume that the _response is

_correct,

_i.e.,

there exists a

_positive

_generator

a E F* with = aO and

Ilna -

cr~ [

((1n0)/4+1)(1+~~ 1

ei).

It follows from

₍₁₇₎

that there is a

_generator

~3

=

aq of J with

Iln /3 - cr

x.

By

(13),

we have

~close(cr) - cr) [

(lnA)/4

+ 1. Since we

apply

_p and

p 1

to find J and since

_by

₍₁₁₎

the

_step

width of two such

_applications

is

at least In

_2,

we obtain the assertion. D

4.8.

_Timings.

We have

_implemented

the real

_quadratic

order PIP-FS identification

_protocol

in C++. The

_running

times

_given

in this section has been measured on a Pentium

II,

300

MHz,

64 MB main memory,

_running

SuSe Linux

_{2.0.35, using}

the

_compiler

_egcs-2.91.57

with

_option

_-02,

and

using

the LiDIA-2.0

_library

_[22]

with libI as

underlying

kernel arithmetic.

All

_timings

are

_given

in seconds.

The

_setup

is as follows. For each m E

_{{687,968,1208,1665,2084},}

we

choose several discriminants with m

bits,

run the

_protocol,

_including

order and

_key

_generation,

and measure the _{average time per} discriminant. We

have run the tests with k =

30, i.e.,

the

probability

that a

_cheating

_prover

bits set to 1.

_Furthermore,

the

_security

_parameters

are chosen as

1~1

=

160,

1~2

=

80,

and

~3

= 30

(see

Section

4.3).

References

[1] 1. BIEHL, J. BUCHMANN, Algorithms for quadratic orders. In: Mathematics of Computation 1943-1993: a _half-century of computational mathematics, Vancouver 1993, W. _Gautschi,

Ed., vol. 48 of Proceedings of Symposia in _{Applied Mathematics,} American Mathematical

Society (1995), pp. 425-449.

[2] I. BIEHL, J. BUCHMANN, S. _HAMDY, A. _MEYER, A _signature scheme based on the

intractabil-ity of extracting roots. Tech. _{Rep. TI-1/00,} Technische Universität _Darmstadt, Fachbereich Informatik, 2000. http: //www. informatik. tu-darmstadt. de/TI/Veroeffentlichung/TR/.

[3] I. BIEHL, B. _MEYER, C. _{THIEL, Cryptographic protocols} based on _{real-quadratic A-fields}

(ex-tended _abstract). In Advances in Cryptology - ASIACRYPT _’96, K. Kim and T. _Matsumoto, Eds., vol. 1163 of Lecture Notes in _{Computer Science, Springer-Verlag (1996),} pp. 15-25.

[4] Z. I. BOREVICH, I. R. SHAFAREVICH, Number _theory. Academic _Press, New York _(1966).

[5] G. BRASSARD, Ed., Advances in _{Cryptology -} CRYPTO _’89, vol. 435 of Lecture Notes in

Computer Science, Springer-Verlag (1990).

[6] J. BUCHMANN, On the _{computation of} units and class numbers _by a _{generalization of}

La-grange’s algorithm. Journal of Number Theory 26 _(1987), 8-30.

[7] J. BUCHMANN, it Zur Komplexität der _Berechnung von Einheiten und Klassenzahlen

algebra-ischer _Zahlkörper. Habilitationsschrift _(1987).

[8] J. _BUCHMANN, S. _PAULUS, A one way function based on ideal arithmetic in number _fields. In: Advances in _{Cryptology -} CRYPTO _’97, B. S. _{Kaliski, Ed.,} vol. 1294 of Lecture Notes in _{Computer Science, Springer-Verlag (1997),} pp. 385-394.

[9] J. BUCHMANN, H. C. WILLIAMS, A key exchange system based on real quadratic _fields. In

Brassard _[5], pp. 335-343.

[10] D. A. _{BUELL, Binary quadratic forms. Springer-Verlag,} New York _(1989).

[11] M. V. D. _BURMESTER, Y. _DESMEDT, F. _PIPER, M. _WALKER, A _{general zero-knowledge} scheme. In: Advances in _{Cryptology -} EUROCRYPT _’89, J.-J. _Quisquater and J. Vande-walle, Eds., vol. 434 of Lecture Notes in _{Computer Science, Springer-Verlag (1990),} pp. 122-133.

[12] D. _CHAUM, J.-H. EVERTSE, J. VAN DE _GRAAF, An _{improved protocol for demonstrating}

posession of discrete logarithms and some _{generalizations.} In: Advances in _Cryptology -EUROCRYPT ’87, D. Chaum and W. L. Price, Eds., vol. 304 of Lecture Notes in _Computer

Science, Springer-Verlag (1988), pp. 127-142.

[13] H. COHEN, J. W. LENSTRA, JR., Heuristics on class groups of number fields. In: Number

Theory, Noordwijkerhout 1983, H. _{Jager, Ed.,} vol. 1068 of Lecture Notes in Mathematics.

Springer-Verlag (1984), pp. 33-62.

[14] H. COHEN, J. MARTINET, Class groups of number _fields: numerical heuristics. Mathematics of _Computation 48 _(1987), 123-137.

[15] H. _COHEN, J. MARTINET, Étude heuristique des groupes de classes des corps de nombres. Journal für die reine und _angewandte Mathematik 404 _(1990), 39-76.

[16] H. _COHEN, J. MARTINET, Heuristics on class groups: Some good primes are not too good.

[17] A. _FIAT, A. _SHAMIR, How to prove yourself: practical solutions to _{identification} and sig-nature _problems. In: Advances in _{Cryptology -} CRYPTO ’86 _(1987), A. M. Odlyzko, Ed., vol. 263 of Lecture Notes in Computer Science, Springer-Verlag, pp. 186-194.

[18] L. C. GUILLOU, J.-J. _{QUISQUATER, A practical zero-knowledge protocol fitted} to _security

microprocessors minimizing both transmission and memory. In: Advances in Cryptology

- EUROCRYPT ’88

(1988), C. G. Günther , Ed., vol. 330 of Lecture Notes in _Computer

Science, Springer-Verlag, pp. 123-128.

[19] S. _HAMDY, B. MÖLLER, Security of cryptosystems based on class _groups of imaginary qua-dratic orders. In: Advances in _{Cryptology -} ASIACRYPT 2000 _(2000), T. Matsumoto, Ed., Lecture Notes in _{Computer Science,} Springer-Verlag. To appear.

[20] E. _{HECKE, Vorlesungen} über die Theorie der Algebraischen Zahlen. Leipzig (1923). [21] M. J. _{JACOBSON, JR.,} Subexponential Class Group Computation in _Quadratic Orders. PhD

thesis, Technische Universität Darmstadt, Fachbereich Informatik, Darmstadt, Germany,

1999.

[22] LiDIA - a C++ library for computational number theory. http://www.informatik.

tu-darmstadt . de/TI/LiDIA/. The LiDIA Group.

[23] J. E. _LITTLEWOOD, On the class number of the corpus

P(~-k).

Proceedings of the London Mathematical _Society 2nd series 27 _(1928), 358-372.

[24] A. J. _MENEZES, P. C. VAN OORSCHOT, S. A. VANSTONE, Handbook _{of Applied Cryptography.} CRC Press _(1997).

[25] R. A. _MOLLIN, H. C. WILLIAMS, Computation of the class number of a real quadratic field.

Utilitas Mathematica 41 _(1992), 59-308.

[26] G. POUPARD, J. STERN, Security analysis of a _practical "on the fly" authentication and siganture generation. In: Advances in _{Cryptology -} EUROCRYPT ’98 _(1998), K. Nyberg, Ed., vol. 1403 of Lecture Notes in _{Computer Science, Springer-Verlag,} pp. 422-436.

[27] R. SCHEIDLER, J. BUCHMANN, H. C. WILLIAMS, A _{key-exchange protocol using} real _quadratic

fields. Journal of Cryptology 7 _(1994), 171-199.

[28] C. P. SCHNORR, Efficient identification and signatures for smart cards. In: Brassard _[5], pp. 239-252.

[29] U. VOLLMER, Asymptotically fast discrete _logarithms in _quadratic number _fields. In: Algo-rithmic Number _Theory, ANTS-IV _(2000), W. _{Bosma, Ed.,} vol. 1838 of Lecture Notes in

Computer Science, Springer-Verlag, pp. 581-594.

[30] H.C. _WILLIAMS, M.C. _WUNDERLICH, On the _{parallel generation of} the residues _for the continued _{fraction factoring algorithm.} Mathematics of _Computation 48 _(1987), 405-423.

Johannes BUCHMANN, Markus MAURER, Bodo M6LLER

Technische Universitat Darmstadt Fachbereich Informatik

Alexanderstr. 10 64283 Darmstadt Germany