A New Public-Key Cryptosystem over a Quadratic Order with Quadratic Decryption Time

An Adaptation of the NICE Cryptosystem to Real Quadratic Orders

“…We summarize some important properties of reduced ideals; see for example [6,13,21] as well as Sections 2.1 and 2.2 of [19].…”

“…The original NICE cryptosystem [18,13] exploits the relationship between ideals in a maximal and a non-maximal imaginary quadratic order of prime conductor q as described in (2.1) and (2.2). The key observation is that images of O Δq -ideals under the map φ −1 of (2.1) are efficiently computable if q is known, whereas without knowledge of the trapdoor information q (i.e.…”

“…It follows that decryption step 2 is successful with high probability for t sufficiently large. The security of NICE was analyzed in detail in [13], [7], and [19], and resides in the difficulty of factoring Δ q . We only briefly review some facts here.…”

“…An algorithm for computing images of primitive O Δq -ideals under φ −1 without knowledge of q would lead to the decryption of any message. However, according to Theorem 1 of [13], such an algorithm could be used as an oracle for factoring Δ q in random polynomial time. Hence, the security of NICE is equivalent to factoring an integer of the form q 2 p, so p and q need to be chosen sufficiently large to render the factorization of Δ q via the elliptic curve method and the number field sieve infeasible.…”

“…A lesser known factoring-based system is the NICE (New Ideal Coset Encryption) scheme [13,18], a cryptosystem whose trapdoor decryption makes use of the relationship between ideals in the maximal and a non-maximal order of an imaginary quadratic number field. The security of NICE relies on the presumed intractability of factoring an integer of the form q 2 p where p and q are prime, thereby providing a similar level of security as RSA, but with much faster decryption.…”