Reducing Logarithms in Totally Non-maximal Imaginary Quadratic Orders to Logarithms in Finite Fields

We discuss the discrete logarithm problem over the class group Cl(Δ) of an imaginary quadratic order O Δ , which was proposed as a public-key cryptosystem by Buchmann and Williams [8]. While in the meantime there has been found a subexponential algorithm for the computation of discrete logarithms in Cl(Δ) [16], this algorithm only has running time L Δ [1/2,c] and is far less efficient than the number field sieve with L p [1/3,c] to compute logarithms in IF * p . Thus one can choose smaller parameters to obtain the same level of security. It is an open question whether there is an L Δ [1/3,c] algorithm to compute discrete logarithms in arbitrary Cl(Δ). In this work we focus on the special case of totally non-maximal imaginary quadratic orders O Δp such that Δ p = Δ 1p2 and the class number of the maximal order h(Δ 1 ) = 1, and we will show that there is an L Δp [1/3,c] algorithm to compute discrete logarithms over the class group Cl(Δ p ). The logarithm problem in Cl(Δ p ) can be reduced in (expected) O(log 3 p) bit operations to the logarithm problem in IF * p (if (Δ 1 /p) = 1) or IF* p 2 (if (Δ 1 /p) = -1) respectively. This result implies that the recently proposed efficient DSA-analogue in totally non-maximal imaginary quadratic order O Δp [21] are only as secure as the original DSA scheme based on finite fields and hence loose much of its attractiveness.