An efficient NICE-Schnorr-type signature scheme

. Recently there was proposed a novel public key cryptosystem [17] based on non-maximal imaginary quadratic orders with quadratic decryption time. This scheme was later on called NICE for New Ideal Coset Encryption [6]. First implementations show that the decryption is as efficient as RSA-encryption with e = 2 16 + 1. It was an open question whether it is possible to construct comparably efficient signature schemes based on non-maximal imaginary quadratic orders. The major drawbacks of the ElGamal-type [7] and RSA/Rabin-type signature schemes [8] proposed so far are the slow signature generation and the very inefficient system setup, which involves the computation of the class number h(\Delta 1 ) of the maximal order with a subexponential time algorithm. To avoid this tedious computation it was proposed to use totally non-maximal orders, where h(\Delta 1) = 1, to set up DSA analogues. Very recently however it was shown in [10], that the discrete logarithm problem in this..