A Method to Solve Cyclotomic Norm Equations

We present a technique to recover f ∈ Q(ζp) where ζp is a primitive pth root of unity for a prime p, given its norm g = f ∗ ¯f in the totally real field Q(ζp + ζ−1 p ). The classical method of solving this problem involves finding generators of principal ideals by enumerating the whole class group associated with Q(ζp), but this approach quickly becomes infeasible as p increases. The apparent hardness of this problem has led several authors to suggest the problem as one suitable for cryptography. We describe a technique which avoids enumerating the class group, and instead recovers f by factoring Nf , the absolute norm of f, (for example with a subexponential sieve algorithm), and then running the Gentry-Szydlo polynomial time algorithm for a number of candidates. The algorithm has been tested with an implementation in PARI.

• Type: Conference
• Year: 2004
• Where: ANTS
• Authors: Nick Howgrave-Graham, Michael Szydlo
• Keywords: Algorithms, ANTS 2004, Class Group, Primitive Pth Root, Subexponential Sieve Algorithm