An Adaptation of the NICE Cryptosystem to Real Quadratic Orders

Advances in Cryptology - EUROCRYPT 2009

2009

Abstract. We describe the first polynomial time chosen-plaintext total break of the NICE family of cryptosystems based on ideal arithmetic in imaginary quadratic orders, introduced in the late 90's by Hartmann, Paulus and Takagi [HPT99]. The singular interest of these encryption schemes is their natural quadratic decryption time procedure that consists essentially in applying Euclid's algorithm. The only current specific cryptanalysis of these schemes is Jaulmes and Joux's chosen-ciphertext attack to recover the secret key [JJ00]. Originally, Hartmann et al. claimed that the security against a total break attack relies only on the difficulty of factoring the public discriminant Δq = −pq 2 , although the public key was also composed of a specific element of the class group of the order of discriminant Δq, which is crucial to reach the quadratic decryption complexity. In this article, we propose a drastic cryptanalysis which factors Δq (and hence recovers the secret key), only given this element, in cubic time in the security parameter. As a result, performing our cryptanalysis on a cryptographic example takes less than a second on a standard PC.

Section: Resultsmentioning

confidence: 96%

On the Security of Cryptosystems with Quadratic Decryption: The Nicest Cryptanalysis

Advances in Cryptology - EUROCRYPT 2009

2009

“…In [JSW08], Jacobson, Scheidler and Weimer embedded the original NICE cryptosystem in real quadratic fields. Whereas the idea remains essentially the same as the original, the implementation is very different.…”

Section: Cryptanalysis Of the Nice Cryptosystemsmentioning

confidence: 99%

“…The rough ideas to understand these systems and our new attacks are given in the following. The full description of the systems is omitted for lack of space but can be found in [HPT99,JSW08].…”

Section: Cryptanalysis Of the Nice Cryptosystemsmentioning

confidence: 99%

“…These hints are different from the usual ones of lattice-based factoring methods [Cop97,BDH99,How01] where they are a fraction of the bits of the secret prime factors. Instead, our hints are arithmetic, and correspond exactly to the situation of NICE, including both the imaginary [HPT99, PT99, PT00] and real versions [JSW08]. This gives rise to the first general key-recovery polynomial-time attack on NICE, using only the public key.…”

Section: Introductionmentioning

confidence: 97%

“…But for infinitely many p (including square-free numbers of the form p = k 2 + r, where p > 5, r|4k and −k < r ≤ k, see [Deg58]), the regulator is at most polynomial in log p. For these unusually small regulators, our algorithm heuristically runs in time polynomial in the bit-length of N = pq 2 , which gives the first total break of REAL-NICE [JSW08]. We stress that although such p's are easy to construct, their density is believed to be arbitrary small.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Factoring pq 2 with Quadratic Forms: Nice Cryptanalyses

Joux

Advances in Cryptology – ASIACRYPT 2009

et al. 2009

Abstract. We present a new algorithm based on binary quadratic forms to factor integers of the form N = pq 2 . Its heuristic running time is exponential in the general case, but becomes polynomial when special (arithmetic) hints are available, which is exactly the case for the so-called NICE family of public-key cryptosystems based on quadratic fields introduced in the late 90s. Such cryptosystems come in two flavours, depending on whether the quadratic field is imaginary or real. Our factoring algorithm yields a general key-recovery polynomial-time attack on NICE, which works for both versions: Castagnos and Laguillaumie recently obtained a total break of imaginary-NICE, but their attack could not apply to real-NICE. Our algorithm is rather different from classical factoring algorithms: it combines Lagrange's reduction of quadratic forms with a provable variant of Coppersmith's lattice-based root finding algorithm for homogeneous polynomials. It is very efficient given either of the following arithmetic hints: the public key of imaginary-NICE, which provides an alternative to the CL attack; or the knowledge that the regulator of the quadratic field Q( √ p) is unusually small, just like in real-NICE.

Linearly Homomorphic Encryption from $$\mathsf {DDH}$$

Lecture Notes in Computer Science

2015

We design a linearly homomorphic encryption scheme whose security relies on the hardness of the decisional Diffie-Hellman problem. Our approach requires some special features of the underlying group. In particular, its order is unknown and it contains a subgroup in which the discrete logarithm problem is tractable. Therefore, our instantiation holds in the class group of a non maximal order of an imaginary quadratic field. Its algebraic structure makes it possible to obtain such a linearly homomorphic scheme whose message space is the whole set of integers modulo a prime p and which supports an unbounded number of additions modulo p from the ciphertexts. A notable difference with previous works is that, for the first time, the security does not depend on the hardness of the factorization of integers. As a consequence, under some conditions, the prime p can be scaled to fit the application needs.