Quadratic orders for {NESSIE} - Overview and parameter sizes of three public key families

In the scope of the European project NESSIE 1 there was issued a Call for Cryptographic Primitives NESSIE] soliciting proposals for block ciphers, stream ciphers, hash functions, pseudo-random functions and public key primitives for digital signatures, encryption and identiication. Since the security of all popular puplic key cryptosystems is based on unproven assumptions and therefore nobody can guarantee that schemes based on factoring or the computation of discrete logarithms in some group, like the multiplicative group of a nite eld or the jacobian of (hyper-) elliptic curves over nite elds, will stay secure forever, it is especially important to provide a variety of diierent primitives and groups which may be utilized if a popular class of cryptosystems gets broken. In this work we propose three diierent public key families based on the discrete logarithm problem in quadratic orders to be considered for NESSIE. The two families based on (maximal) real BuWi89,ScBW94], BiBT94,HaMa00,HuPa00] and imaginary BuWi88,BBHM00] quadratic orders are very interesting from a conservative point of view, because their DL-problem is known to be at least as hard as, and when considering todays algorithms apparently much harder than, factoring (arbitrary) integers. On the other hand the systems in the NICE-family HJPT98,PaTa98,HuMe00] are 'only equivalent' to factoring integers of the form qp 2 and very attractive for practical application, because they allow very eecient decryption and signature generation. Besides an overview of all these systems, we will propose a reenement of LeVe00], which allows to compare the diiculty of diierent cryptographic problems in a more sophisticated, yet practical, manner. We will use this framework to derive the necessary key sizes for the proposed families.