(. , ,. , ,. , G. , and F. Gen, , vol.1

?. Pick,

. Return,

G. , F. , and M. ). ,

A. Encrypt,

?. ,

, Pick ? ?, vol.0, p.1

?. Pick, ?. , and ?. ,

?. ,

, Return (? = ? ? )

, 1, modulo is at negligible distance of the uniform and is independent of modulo . So even if an unbounded adversary can learn modulo from ?, modulo remains at negligible distance of the uniform from his point of view and ? + perfectly hides ? ? Z/ Z. Therefore: |P

F. , Let be an adversary for the HSM problem, its advantage is defined as: 1. Let ? be the bit size of . Pick?a random ?(?) ? ? bits prime such that?? ?

?. , ?. ?-2-?-k, and G. ,

C. Sec and . Param, Modulus Expo. (ms) Keygen (ms) Signing (ms) Keygen (b) Signing (b), p.112

C. Sec and . Param, Discriminant Expo. (ms) Keygen (ms) Signing (ms) Keygen (b) Signing (b), p.112

?. ,

, If gets as input an element of whatever the value of ? * , * follows the uniform distribution modulo and is independent of . So 's success probability in outputting

M. Abdalla, F. Bourse, A. D. Caro, and D. Pointcheval, Simple functional encryption schemes for inner products, PKC 2015, vol.9020, p.140, 2015.
URL : https://hal.archives-ouvertes.fr/hal-01131971

M. Abdalla, F. Bourse, A. D. Caro, and D. Pointcheval, Better security for functional encryption for inner product evaluations, Cryptology ePrint Archive, vol.139, p.140, 2016.
URL : https://hal.archives-ouvertes.fr/hal-01380726

S. Agrawal, S. Bhattacherjee, D. H. Phan, D. Stehlé, and S. Yamada, Efficient public trace and revoke from standard assumptions: Extended abstract, ACM CCS 2017, vol.37, p.139, 2017.

P. Ananth, Z. Brakerski, G. Segev, and V. Vaikuntanathan, From selective to adaptive security in functional encryption, CRYPTO 2015, Part II, vol.9216, p.138, 2015.

L. M. Adleman, The function field sieve, Algorithmic Number Theory, p.142, 1994.

S. Agrawal, S. Gorbunov, V. Vaikuntanathan, and H. Wee, Functional encryption: New perspectives and lower bounds, CRYPTO 2013, Part II, vol.8043, p.144, 2013.

G. Asharov, A. Jain, A. López-alt, E. Tromer, V. Vaikuntanathan et al., Multiparty computation with low communication, computation and interaction via threshold FHE, EUROCRYPT 2012, vol.7237, pp.483-501, 2012.

E. Allender, J. Jiao, M. Mahajan, and V. Vinay, Non-commutative arithmetic circuits: depth reduction and size lower bounds, Theoretical Computer Science, vol.209, issue.1, p.105, 1998.

S. Agrawal, B. Libert, and D. Stehlé, Fully secure functional encryption for inner products, from standard assumptions, CRYPTO 2016, Part III, vol.9816, p.173, 2016.
URL : https://hal.archives-ouvertes.fr/hal-01228559

G. Asharov, Y. Lindell, T. Schneider, and M. Zohner, More efficient oblivious transfer extensions with security for malicious adversaries, EURO-CRYPT 2015, Part I, vol.9056, pp.673-701, 0104.

L. M. Adleman and K. S. Mccurley, Open problems in number theoretic complexity, ii, Proceedings of the First International Symposium on Algorithmic Number Theory, ANTS-I, vol.64, pp.291-322, 1994.

F. Arnault, Formes quadratiques de discriminants emboîtés, 2014.

D. Boneh, J. Bonneau, B. Bünz, and B. Fisch, Verifiable delay functions, CRYPTO 2018, Part I, LNCS 10991, vol.185, p.202, 2018.

D. Boneh, B. Bünz, and B. Fisch, A survey of two verifiable delay functions, Cryptology ePrint Archive, vol.712, p.211, 2018.

I. Biehl, J. Buchmann, S. Hamdy, and A. Meyer, A signature scheme based on the intractability of computing roots. Designs, Codes and Cryptography, vol.25, p.41, 2002.

F. Benhamouda, F. Bourse, and H. Lipmaa, CCA-secure inner-product functional encryption from projective hash functions, PKC 2017, Part II, vol.10175, p.143, 2017.
URL : https://hal.archives-ouvertes.fr/hal-01613546

I. Biehl, J. Buchmann, and C. Thiel, Cryptographic protocols based on discrete logarithms in real-quadratic orders, CRYPTO'94, vol.839, pp.56-60, 1994.

E. Bresson, D. Catalano, and D. Pointcheval, A simple public-key cryptosystem with a double trapdoor decryption mechanism and its applications, ASIACRYPT 2003, vol.2894, p.150, 1994.

D. Boneh, G. Durfee, and N. Howgrave-graham, Factoring N = prq for large r, CRYPTO'99, vol.1666, p.75, 1947.

P. Bogetoft, I. Damgård, T. Jakobsen, K. Nielsen, J. Pagter et al., A practical implementation of secure auctions based on multiparty integer computation, FC 2006, vol.4107, pp.142-147, 2006.

R. Bendlin, I. Damgård, C. Orlandi, and S. Zakarias, Semi-homomorphic encryption and multiparty computation, EUROCRYPT 2011, vol.6632, pp.169-188, 0104.

J. Buchmann, S. Düllmann, and H. C. Williams, On the complexity and efficiency of a new key exchange system, EUROCRYPT'89, vol.434, p.99, 1990.

D. Beaver, Foundations of secure interactive computing, CRYPTO'91, vol.576, pp.377-391, 0104.

J. C. Benaloh, Verifiable Secret-Ballot Election, vol.23, p.80, 1988.

D. J. Bernstein, List decoding for binary goppa codes, Coding and Cryptology, vol.19, p.74, 2011.

A. Bernard and N. Gama, Smallest reduction matrix of binary quadratic forms, Algorithmic Number Theory, vol.21, pp.32-49, 2010.
URL : https://hal.archives-ouvertes.fr/hal-01083360

S. Badrinarayanan, V. Goyal, A. Jain, and A. Sahai, Verifiable functional encryption, ASIACRYPT 2016, Part II, vol.10032, p.138, 2016.

D. Boneh, E. Goh, and K. Nissim, Evaluating 2-DNF formulas on ciphertexts, TCC 2005, vol.3378, p.81, 2005.

A. Bostan, P. Gaudry, and E. Schost, Linear recurrences with polynomial coefficients and application to integer factorization and cartier-manin operator, SIAM J. Comput, vol.36, issue.6, p.76, 1966.
URL : https://hal.archives-ouvertes.fr/inria-00103401

J. Buchmann and S. Hamdy, A survey on IQ cryptography, Public Key Cryptography and Computational Number Theory, vol.10, p.203, 2001.

M. L. Bauer and S. Hamdy, On class group computations using the number field sieve, ASIACRYPT 2003, vol.2894, p.185, 2003.

J. Biasse, Improvements in the computation of ideal class groups of imaginary quadratic number fields, Advances in Mathematics of Communications, vol.4, issue.2, pp.141-154, 2010.
URL : https://hal.archives-ouvertes.fr/inria-00397408

J. Biasse, M. J. Jacobson, and A. K. Silvester, Security estimates for quadratic field based cryptosystems, ACISP 10, vol.6168, p.209, 2010.
URL : https://hal.archives-ouvertes.fr/inria-00477949

W. Beullens, T. Kleinjung, and F. Vercauteren, Csi-fish: Efficient isogeny based signatures through class group computations, Cryptology ePrint Archive, vol.7, p.40, 2019.

R. Broker, K. Lauter, and A. V. Sutherland, Modular polynomials via isogeny volcanoes. Mathematics of Computation, vol.81, p.40, 2012.

J. Buchmann, M. Maurer, and B. Möller, Cryptography based on number fields with large regulator, Journal de théorie des nombres de Bordeaux, vol.12, issue.2, p.11, 2000.

M. Bellare and A. O'neill, Semantically-secure functional encryption: Possibility results, impossibility results and the quest for a general definition, CANS 13, vol.8257, p.144, 2013.

F. Bourse, Functional Encryption for Inner-Product Evaluations, vol.139, p.143, 2017.
URL : https://hal.archives-ouvertes.fr/hal-01380726

C. Boyd, Digital multisignature. Cryptography and Coding, p.182, 1986.

I. Biehl, S. Paulus, and T. Takagi, Efficient undeniable signature schemes based on ideal arithmetic in quadratic orders. Designs, Codes and Cryptography, vol.31, p.78, 2004.

R. P. Brent, Public key cryptography with a group of unknown order, p.81, 2000.

J. Buchmann, K. Sakurai, and T. Takagi, An IND-CCA2 public-key cryptosystem with fast decryption, ICISC 01, vol.2288, p.61, 2002.

D. Boneh, A. Sahai, and B. Waters, Functional encryption: Definitions and challenges, TCC 2011, vol.6597, p.144, 0138.

J. Buchmann, T. Takagi, and U. Vollmer, Number field cryptography, High Primes and Misdemeanours: Lectures in Honour of the 60th birthday of Hugh Cowie Williams, Fields Institute Communications 41, vol.41, p.64, 2004.

J. Buchmann, C. Thiel, and H. Williams, Short representation of quadratic integers, Computational Algebra and Number Theory, vol.52, p.89, 1995.

J. Buchmann and U. Vollmer, Binary Quadratic Forms. An Algorithmic Approach, vol.98, p.99, 1997.

Z. Brakerski and V. Vaikuntanathan, efficient fully homomorphic encryption from (standard) lwe, SIAM Journal on Computing, vol.43, issue.2, p.81, 2014.

J. Buchmann and H. C. Williams, A key-exchange system based on imaginary quadratic fields, Journal of Cryptology, vol.1, issue.2, p.99, 1988.

J. Buchmann and H. C. Williams, A key exchange system based on real quadratic fields, Heidelberg, vol.435, pp.335-343, 1990.

R. Canetti, Security and composition of multiparty cryptographic protocols, Journal of Cryptology, vol.13, issue.1, pp.143-202, 0104.

G. Castagnos, Two generic constructions of probabilistic cryptosystems and their applications, SCN 08, vol.5229, pp.92-108, 2002.

D. V. Chudnovsky and G. V. Chudnovsky, Approximations and complex multiplication according to Ramanujan, p.75, 1987.

G. Castagnos and B. Chevallier-mames, Towards a DL-based additively homomorphic encryption scheme, ISC 2007, vol.4779, p.80, 2007.

P. Chaidos and G. Couteau, Efficient designated-verifier non-interactive zeroknowledge proofs of knowledge, EUROCRYPT 2018, Part III, vol.10822, p.33, 2018.

G. Castagnos, D. Catalano, F. Laguillaumie, F. Savasta, and I. Tucker, Two-Party ECDSA from Hash Proof Systems and Efficient Instantiations, CRYPTO 19, vol.41, p.181, 2019.
URL : https://hal.archives-ouvertes.fr/hal-02281931

D. Chaum, D. Das, F. Javani, A. Kate, A. Krasnova et al., cmix: Anonymization by high-performance scalable mixing. 25th USENIX Security Sym-posium, p.33, 2016.

R. Cramer, I. Damgård, and J. B. Nielsen, Multiparty computation from threshold homomorphic encryption, EUROCRYPT 2001, vol.2045, p.131, 2001.

D. Catalano and D. Fiore, Using linearly-homomorphic encryption to evaluate degree-2 functions on encrypted data, ACM CCS 2015, p.82, 2015.

R. Cramer, R. Gennaro, and B. Schoenmakers, A secure and optimally efficient multi-authority election scheme, EUROCRYPT'97, vol.1233, pp.103-118, 1994.

R. A. Croft and S. P. Harris, Public-key cryptography and reusable shared secret. Cryptography and Coding, p.182, 1989.

. Chia, , vol.40, p.210

A. L. Chistov, The complexity of constructing the ring of integers of a global field, Dolk. Akad. Nauk. SSSR, vol.306, p.64, 1989.

J. Coron, H. Handschuh, and D. Naccache, ECC: Do we need to count, ASIACRYPT'99, vol.1716, p.81, 1999.

G. Castagnos, L. Imbert, and F. Laguillaumie, Encryption switching protocols revisited: Switching modulo p, CRYPTO 2017, Part I, vol.10401, p.202, 2017.
URL : https://hal.archives-ouvertes.fr/lirmm-01587451

G. Castagnos, A. Joux, F. Laguillaumie, and P. Q. Nguyen, Factoring 2 with quadratic forms: Nice cryptanalyses, ASIACRYPT 2009, vol.5912, p.81, 2009.
URL : https://hal.archives-ouvertes.fr/hal-01082340

J. Camenisch, A. Kiayias, and M. Yung, On the portability of generalized Schnorr proofs, EUROCRYPT 2009, vol.5479, p.211, 2009.

H. Cohen and H. W. Lenstra, Heuristics on class groups, Number Theory, p.76, 1984.

G. Castagnos and F. Laguillaumie, On the security of cryptosystems with quadratic decryption: The nicest cryptanalysis, EUROCRYPT 2009, vol.5479, p.184, 2009.
URL : https://hal.archives-ouvertes.fr/hal-01082343

G. Castagnos and F. Laguillaumie, Homomorphic encryption for multiplications and pairing evaluation, SCN 12, vol.7485, p.81, 2012.
URL : https://hal.archives-ouvertes.fr/hal-00763110

G. Castagnos and F. Laguillaumie, Linearly homomorphic encryption from DDH, CT-RSA 2015, vol.9048, p.204, 0202.
URL : https://hal.archives-ouvertes.fr/hal-01213284

G. Castagnos, F. Laguillaumie, and I. Tucker, Practical fully secure unrestricted inner product functional encryption modulo p, ASIACRYPT 2018, Part II, vol.11273, p.205, 0201.
URL : https://hal.archives-ouvertes.fr/hal-01934296

J. Coron, D. Naccache, and P. Paillier, Accelerating okamoto-uchiyama public-key cryptosystem, Electronics Letters, vol.35, issue.4, p.48, 1999.

H. Cohen, A course in computational algebraic number theory, vol.172, p.203, 1999.

D. Coppersmith, Small solutions to polynomial equations, and low exponent RSA vulnerabilities, Journal of Cryptology, vol.10, issue.4, p.72, 1997.

D. A. Cox, Primes of the form 2 + 2, vol.89, p.100, 1999.

R. Crandall and C. Pomerance, Prime numbers: a computational perspective, p.65, 2001.

B. Chevallier-mames, P. Paillier, and D. Pointcheval, Encoding-free ElGamal encryption without random oracles, PKC 2006, vol.3958, pp.91-104

. Springer, , vol.80, p.87, 1924.

G. Couteau, T. Peters, and D. Pointcheval, Encryption switching protocols, CRYPTO 2016, Part I, vol.9814, p.131, 2016.
URL : https://hal.archives-ouvertes.fr/hal-01407341

R. Cramer and V. Shoup, A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack, CRYPTO'98, vol.1462, p.190, 0142.

R. Cramer and V. Shoup, Universal hash proofs and a paradigm for adaptive chosen ciphertext secure public-key encryption, EUROCRYPT 2002, vol.2332, p.192, 2002.

J. Camenisch and V. Shoup, Practical verifiable encryption and decryption of discrete logarithms, CRYPTO 2003, vol.2729, p.210, 2003.

K. Cheng and H. Williams, Some results concerning certain periodic continued fractions, Acta Arithmetica, vol.117, p.77, 2005.

G. Degert, Über die bestimmung der grundeinheit gewisser reell quadratischer zahlkörper, Abhandlungen aus dem Mathematischen Seminar der Universität Hamburg, vol.22, issue.1, p.65, 1958.

Y. Desmedt, Society and group oriented cryptography: A new concept, CRYPTO'87, vol.293, p.182, 1988.

Y. Desmedt and Y. Frankel, Threshold cryptosystems, CRYPTO'89, vol.435, p.182, 0108.

I. Damgård and E. Fujisaki, A statistically-hiding integer commitment scheme based on groups with hidden order, ASIACRYPT 2002, vol.2501, p.211, 2002.

A. Caro, V. Iovino, A. Jain, A. O'neill, O. Paneth et al., On the achievability of simulation-based security for functional encryption, CRYPTO 2013, Part II, vol.8043, pp.519-535

I. Damgård and M. Jurik, A generalisation, a simplification and some applications of Paillier's probabilistic public-key system, PKC 2001, vol.80, p.94, 1923.

V. Dixon, M. J. Jacobson, and R. Scheidler, Improved exponentiation and key agreement in the infrastructure of a real quadratic field, LATIN-CRYPT 2012, vol.7533, pp.214-233, 2011.

P. Das, M. J. Jacobson, and R. Scheidler, Improved efficiency of a linearly homomorphic cryptosystem, Codes, Cryptology and Information Security, vol.31, p.40, 2019.

I. Damgård and M. Koprowski, Generic lower bounds for root extraction and signature schemes in general groups, EUROCRYPT 2002, vol.2332, p.131, 2002.

J. Doerner, Y. Kondi, E. Lee, and . Shelat, Secure two-party threshold ECDSA from ECDSA assumptions, 2018 IEEE Symposium on Security and Privacy, vol.182, p.184, 1935.

J. Doerner, Y. Kondi, E. Lee, and . Shelat, Threshold ECDSA from ECDSA assumptions: The multiparty case, 2019 IEEE Symposium on Security and Privacy, vol.41, p.182, 2019.

I. Damgård and G. L. Mikkelsen, Efficient, robust and constant-round distributed RSA key generation, TCC 2010, vol.5978, pp.183-200

. Springer, , vol.122, p.136, 2010.

I. Damgård and J. B. Nielsen, Universally composable efficient multiparty computation from threshold homomorphic encryption, CRYPTO 2003, vol.2729, pp.247-264, 2003.

I. Damgård and R. Thorbek, Linear integer secret sharing and distributed exponentiation, PKC 2006, vol.3958, p.42, 2006.

I. Damgård and S. Zakarias, Constant-overhead secure computation of Boolean circuits using preprocessing, TCC 2013, vol.7785, pp.621-641, 2013.

T. , A public key cryptosystem and a signature scheme based on discrete logarithms, IEEE Transactions on Information Theory, vol.31, pp.469-472, 1985.

D. M. Freeman, O. Goldreich, E. Kiltz, A. Rosen, and G. Segev, More constructions of lossy and correlation-secure trapdoor functions, Journal of Cryptology, vol.26, issue.1, p.41, 2013.

F. Fontein, The infrastructure of a global field of arbitrary unit rank, Mathematics of Computation, vol.80, pp.2325-2357, 2008.

P. Fouque and G. Poupard, On the security of RDSA, EURO-CRYPT 2003, vol.2656, pp.462-476, 2003.
URL : https://hal.archives-ouvertes.fr/inria-00563964

, FPLLL development team. fplll, a lattice reduction library, 2016.

P. Fouque, G. Poupard, and J. Stern, Sharing decryption in the context of voting or lotteries, Heidelberg, pp.90-104, 0109.
URL : https://hal.archives-ouvertes.fr/inria-00565275

S. D. Galbraith, Elliptic curve Paillier schemes, Journal of Cryptology, vol.15, issue.2, p.80, 2002.

C. Gentry, Fully homomorphic encryption using ideal lattices, 41st ACM STOC, vol.80, p.81, 2009.

R. Gennaro and S. Goldfeder, Fast multiparty threshold ECDSA with fast trustless setup, ACM CCS 2018, vol.41, p.182, 2018.

S. Garg, C. Gentry, S. Halevi, and M. Zhandry, Functional encryption without obfuscation, TCC 2016-A, Part II, vol.9563, p.138, 2016.

R. Gennaro, S. Goldfeder, and A. Narayanan, Threshold-optimal DSA/ECDSA signatures and an application to bitcoin wallet security, ACNS 16, vol.9696, p.182, 2016.

R. Gennaro, S. Jarecki, H. Krawczyk, and T. Rabin, Robust threshold DSS signatures, EUROCRYPT'96, vol.1070, pp.354-371, 0182.

K. Gjøsteen, Symmetric subgroup membership problems, PKC 2005, vol.3386, p.147, 0140.

[. Gkp-+-13a, ]. S. Goldwasser, Y. T. Kalai, R. A. Popa, V. Vaikuntanathan et al., How to run turing machines on encrypted data, CRYPTO 2013, Part II, vol.8043, p.138, 2013.

[. Gkp-+-13b, ]. S. Goldwasser, Y. T. Kalai, R. A. Popa, V. Vaikuntanathan et al., Zeldovich. Reusable garbled circuits and succinct functional encryption, 45th ACM STOC, p.138, 2013.

S. Goldwasser and S. Micali, Probabilistic encryption, Journal of Computer and System Sciences, vol.28, issue.2, p.124, 1984.

S. D. Galbraith and J. F. Mckee, Pairings on elliptic curves over finite commutative rings, Cryptography and Coding, p.40, 2005.

G. Gavin and M. Minier, Oblivious multi-variate polynomial evaluation, INDOCRYPT 2009, vol.5922, pp.430-442
URL : https://hal.archives-ouvertes.fr/inria-00524361

S. Goldwasser, S. Micali, and C. Rackoff, The knowledge complexity of interactive proof systems, SIAM Journal on Computing, vol.18, issue.1, p.212, 1989.

O. Goldreich, S. Micali, and A. Wigderson, How to play any mental game or A completeness theorem for protocols with honest majority, 19th ACM STOC, pp.218-229, 0104.

O. Goldreich, Foundations of Cryptography: Basic Tools, p.212, 2001.

M. Girault, G. Poupard, and J. Stern, On the fly authentication and signature schemes based on groups of unknown order, Journal of Cryptology, vol.19, issue.4, p.215, 0185.

C. Gentry, C. Peikert, and V. Vaikuntanathan, Trapdoors for hard lattices and new cryptographic constructions, 40th ACM STOC, vol.145, p.174, 0135.

S. Gorbunov, V. Vaikuntanathan, and H. Wee, Functional encryption with bounded collusions via multi-party computation, CRYPTO 2012, vol.7417, p.138, 2012.

J. E. Gower and S. S. Wagstaff, Square form factorization, Math. Comput, vol.77, p.65, 2008.

A. Gélin, On the complexity of class group computations for large degree number fields. arXiv e-prints, p.41, 2018.

D. Hühnlein, M. J. Jacobson, S. Paulus, and T. Takagi, A cryptosystem based on non-maximal imaginary quadratic orders with fast decryption, EUROCRYPT'98, LNCS 1403, vol.92, p.99, 1990.

D. Hühnlein, M. J. Jacobson, and D. Weber, Towards practical noninteractive public-key cryptosystems using non-maximal imaginary quadratic orders. Designs, Codes and Cryptography, vol.30, pp.281-299, 2003.

C. Hazay and Y. Lindell, Efficient Secure Two-Party Protocols: Techniques and Constructions, p.188, 2010.

J. L. Hafner and K. S. Mccurley, A rigorous subexponential algorithm for computation of class groups, J. Amer. Math. Soc, vol.2, issue.4, p.47, 1989.

S. Hamdy and B. Möller, Security of cryptosystems based on class groups of imaginary quadratic orders, ASIACRYPT 2000, pp.234-247, 1976.

. Springer, , vol.8, p.99, 2000.

D. Hühnlein and J. Merkle, An efficient NICE-Schnorr-type signature scheme, PKC 2000, vol.1751, p.61, 2000.

D. Hühnlein, A. Meyer, and T. Takagi, Rabin and RSA analogues based on non-maximal imaginary quadratic orders, ICISC 98, pp.221-240

B. Hemenway and R. Ostrovsky, Lossy trapdoor functions from smooth homomorphic hash proof systems, Electronic Colloquium on Computational Complexity (ECCC), vol.16, p.191, 1941.

B. Hemenway and R. Ostrovsky, Extended-DDH and lossy trapdoor functions, PKC 2012, vol.7293, p.148, 2012.

N. Howgrave-graham, Finding small roots of univariate modular equations revisited, Crytography and Coding, p.72, 1997.

N. Howgrave-graham, Approximate integer common divisors, Cryptography and Lattices, pp.51-66, 2001.

D. Hühnlein and S. Paulus, On the implementation of cryptosystems based on real quadratic number fields, SAC 2000, vol.2012, pp.288-302

. Springer, , 2001.

M. Hartmann, S. Paulus, and T. Takagi, NICE -new ideal coset encryption, CHES'99, vol.1717, p.90, 1999.

D. Hühnlein and T. Takagi, Reducing logarithms in totally non-maximal imaginary quadratic orders to logarithms in finite fields, ASIACRYPT'99, vol.1716, pp.219-231, 1999.

D. Hühnlein, Efficient implementation of cryptosystems based on nonmaximal imaginary quadratic orders, SAC 1999, vol.1758, pp.147-162

. Springer, , vol.52, p.61, 1999.

D. Hühnlein, Faster generation of NICE-Schnorr-type signatures, CT-RSA 2001, vol.2020, p.61, 2001.

L. Imbert, M. J. Jacobson, and A. Schmidt, Fast ideal cubing in imaginary quadratic number and function fields, Advances in Mathematics of Communications, vol.4, issue.2, p.210, 2010.

M. Jacobson and J. , Applying sieving to the computation of quadratic class groups, Mathematics of Computation, vol.68, issue.7, pp.859-867, 1998.

M. J. Jacobson, Computing discrete logarithms in quadratic orders, Journal of Cryptology, vol.13, issue.4, p.204, 2000.

M. J. Jacobson, The security of cryptosystems based on class semigroups of imaginary quadratic non-maximal orders, ACISP 04, vol.3108, pp.149-156, 0100.

É. Jaulmes and A. Joux, A NICE cryptanalysis, EUROCRYPT 2000, vol.1807, p.100, 2000.

M. Joye and B. Libert, Efficient cryptosystems from 2 -th power residue symbols, EUROCRYPT 2013, vol.7881, p.80, 2013.
URL : https://hal.archives-ouvertes.fr/hal-01394400

M. J. Jacobson, R. F. Lukes, and H. C. Williams, An investigation of bounds for the regulator of quadratic fields, Experimental Mathematics, vol.4, issue.3, p.67, 1995.

A. Joux, Algorithmic Cryptanalysis, p.74, 2009.

M. J. Jacobson, R. Scheidler, and H. C. Williams, An improved realquadratic-field-based key exchange procedure, Journal of Cryptology, vol.19, issue.2, pp.211-239, 2006.

M. J. Jacobson, R. Scheidler, and D. Weimer, An adaptation of the NICE cryptosystem to real quadratic orders, AFRICACRYPT 08, vol.5023, p.81, 2008.

M. J. Jacobson and A. J. Van-der-poorten, Computational aspects of nucomp, Algorithmic Number Theory, p.40, 2002.

M. J. Jacobson and H. C. Williams, Solving the Pell Equation, vol.5, p.11, 2009.

T. Kleinjung, K. Aoki, J. Franke, A. K. Lenstra, E. Thomé et al., Factorization of a 768-bit RSA modulus, CRYPTO 2010, vol.6223, pp.333-350, 2010.
URL : https://hal.archives-ouvertes.fr/inria-00444693

P. Kaplan, Divisibilité par 8 du nombre des classes des corps quadratiques dont le 2-groupe des classes est cyclique, et réciprocité biquadratique, J. Math. Soc. Japan, vol.25, issue.4, p.98, 1973.

T. Kleinjung, C. Diem, A. K. Lenstra, C. Priplata, and C. Stahlke, Computation of a 768-bit prime field discrete logarithm, EUROCRYPT 2017, Part I, LNCS 10210, pp.185-201, 2017.

J. Katz and Y. Lindell, Introduction to Modern Cryptography, p.108, 2014.

T. Kleinjung, Quadratic sieving, Mathematics of Computation, vol.85, issue.7, pp.1861-1873, 2016.

H. Kim and S. Moon, Public-key cryptosystems based on class semigroups of imaginary quadratic non-maximal orders, ACISP 03, vol.2727, pp.488-497, 2003.

V. Kolesnikov and T. Schneider, Improved garbled circuit: Free XOR gates and applications, ICALP 2008, Part II, vol.5126, pp.486-498, 0118.

J. Katz, A. Sahai, and B. Waters, Predicate encryption supporting disjunctions, polynomial equations, and inner products, EUROCRYPT 2008, vol.4965, p.139, 2008.

A. Kiayias and M. Yung, Secure games with polynomial expressions, Automata, Languages and Programming, 28th International Colloquium, p.105, 2001.

J. Katz and M. Yung, Threshold cryptosystems based on factoring, ASI-ACRYPT 2002, vol.2501, p.131, 0125.

S. Katsumata and S. Yamada, Non-zero inner product encryption schemes from various assumptions: LWE, DDH and DCR, PKC 2019, Part II, vol.11443, p.37, 2019.

H. W. Lenstra, Factoring integers with elliptic curves, Annals of Mathematics, vol.126, issue.3, p.47, 1987.

Y. Lindell, How to simulate it -A tutorial on the simulation proof technique, Cryptology ePrint Archive, 2016.

Y. Lindell, Fast secure two-party ECDSA signing, CRYPTO 2017, Part II, vol.10402, p.215, 0208.

H. Lipmaa, Secure accumulators from euclidean rings without trusted setup, ACNS 12, vol.7341, p.42, 2012.

A. K. Lenstra and H. W. Lenstra, The Development of the Number Field Sieve, vol.1554, p.47, 1993.

A. K. Lenstra, H. W. Lenstra, and L. Lovász, Factoring polynomials with rational coefficients, Mathematische Annalen, vol.261, issue.4, p.73, 1982.

R. W. Lai, G. Malavolta, and D. Schröder, Homomorphic secret sharing for low degree polynomials, ASIACRYPT 2018, Part III, vol.11274, p.33, 2018.

Y. Lindell and A. Nof, Fast secure multiparty ECDSA with practical distributed key generation and applications to cryptocurrency custody, ACM CCS 2018, vol.41, p.182, 2018.

Y. Lindell and B. Pinkas, Secure two-party computation via cut-and-choose oblivious transfer, Heidelberg, vol.6597, pp.329-346, 0104.

Y. Lindell, B. Pinkas, and N. P. Smart, Implementing two-party computation efficiently with security against malicious adversaries, SCN 08, vol.5229, pp.2-20, 0104.

H. Lipmaa and T. Toft, Secure equality and greater-than tests with sublinear online complexity, ICALP 2013, Part II, vol.7966, pp.645-656

. Springer, , 0117.

H. W. Lim, S. Tople, P. Saxena, and E. Chang, Faster secure arithmetic computation using switchable homomorphic encryption. Cryptology ePrint Archive, vol.539, 2014.

S. Lucks, A variant of the Cramer-Shoup cryptosystem for groups of unknown order, ASIACRYPT 2002, vol.2501, p.150, 2002.

Y. Lu, R. Zhang, L. Peng, and D. Lin, Solving linear equations modulo unknown divisors: Revisited, ASIACRYPT 2015, Part I, vol.9452, pp.189-213, 2015.

J. Martinet, Perfect Lattices in Euclidean Spaces. Grundlehren der mathematischen Wissenschaften 327, vol.161, p.170, 2003.

A. May, Using LLL-reduction for solving RSA and factorization problems, ISC, p.72, 2010.

K. S. Mccurley, Cryptographic key distribution and computation in class groups, Number Theory and Applications (Proc. NATO Advanced Study Inst. on Number Theory and Applications, vol.46, p.172, 1927.

J. Mckee, Speeding fermat's factoring method, Math. Comput, vol.68, issue.228, p.66, 1999.

J. Milan, Factoring Small Integers: An Experimental Comparison. working paper or preprint, p.66, 2007.
URL : https://hal.archives-ouvertes.fr/inria-00188645

A. Meyer, S. Neis, and T. Pfahler, First implementation of cryptographic protocols based on algebraic number fields, Information Security and Privacy, p.41, 2001.

D. Malkhi, N. Nisan, B. Pinkas, and Y. Sella, Fairplay -secure two-party computation system, Proceedings of the 13th USENIX Security Symposium, August 9-13, vol.104, pp.287-302, 2004.

S. Micali and P. Rogaway, Secure computation (abstract), CRYPTO'91, vol.576, pp.392-404, 0104.

P. D. Mackenzie and M. K. Reiter, Two-party generation of DSA signatures, Int. J. Inf. Sec, vol.2, issue.3-4, p.183, 2004.

D. Micciancio and O. Regev, Worst-case to average-case reductions based on Gaussian measures, 45th FOCS, p.145, 2004.

D. Micciancio and O. Regev, Worst-case to average-case reductions based on gaussian measures, SIAM J. Comput, vol.37, issue.1, p.170, 2007.

P. Q. Nguyen, La Géométrie des Nombres en Cryptologie, vol.161, p.170, 1991.

J. B. Nielsen, P. S. Nordholt, C. Orlandi, and S. S. Burra, A new approach to practical active-secure two-party computation, CRYPTO 2012, vol.7417, pp.681-700, 2012.

M. Naor and B. Pinkas, Oblivious polynomial evaluation, SIAM J. Comput, vol.35, issue.5, p.105, 2006.

D. Naccache and J. Stern, A new public key cryptosystem based on higher residues, ACM CCS 98, vol.23, p.80, 1998.

T. Okamoto, Fast public-key cryptosystem using congruent polynomial equations, Electronics Letters, vol.22, issue.11, pp.581-582, 1964.

T. Okamoto, A fast signature scheme based on congruential polynomial operations, IEEE Transactions on Information Theory, vol.36, issue.1, p.64, 1990.

. N10]-a.-o'neill, Definitional issues in functional encryption, Cryptology ePrint Archive, vol.138, p.144, 2010.

T. Okamoto and D. , REACT: Rapid Enhanced-security Asymmetric Cryptosystem Transform, CT-RSA 2001, vol.2020, pp.159-175

. Springer, , vol.14, p.47, 2001.

T. Okamoto and S. Uchiyama, A new public-key cryptosystem as secure as factoring, EUROCRYPT'98, LNCS 1403, vol.64, p.80, 1923.

P. Paillier, Public-key cryptosystems based on composite degree residuosity classes, EUROCRYPT'99, vol.1592, p.146, 1999.

. Pari-group, . Univ, and . Bordeaux, PARI/GP version 2.11.1, vol.40, p.207, 2018.

T. P. Pedersen, A threshold cryptosystem without a trusted party (extended abstract) (rump session), EUROCRYPT'91, vol.547, pp.522-526

. Springer, , 0122.

R. Peralta, Elliptic curve factorization using a "partially oblivious" function, Cryptography and Computational Number Theory, p.64, 2001.

R. Peralta and E. Okamoto, Faster factoring of integers of a special form, IEICE Transactions on Fundamentals of Electronics, issue.4, p.64, 1996.

B. Pinkas, T. Schneider, N. P. Smart, and S. C. Williams, Secure two-party computation is practical, ASIACRYPT 2009, vol.5912, pp.250-267

H. Springer, , 0104.

S. Paulus and T. Takagi, A generalization of the Diffie-Hellman problem and related cryptosystems allowing fast decryption, ICISC 98, vol.52, p.76, 1998.

S. Paulus and T. Takagi, A new public-key cryptosystem over a quadratic order with quadratic decryption time, Journal of Cryptology, vol.13, issue.2, p.81, 2000.

C. Peikert and B. Waters, Lossy trapdoor functions and their applications, 40th ACM STOC, p.41, 2008.

M. Sayles,

R. Scheidler, J. Buchmann, and H. C. Williams, Implementation of a key exchange protocol using some real quadratic fields, EUROCRYPT'90, vol.473, pp.98-109, 1991.

R. Scheidler, J. Buchmann, and H. C. Williams, A key-exchange protocol using real quadratic fields, Journal of Cryptology, vol.7, issue.3, pp.171-199, 1994.

R. Schoof, Quadratic fields and factorization, Computational Methods in Number Theory, vol.154, p.66, 1982.

C. Schnorr, Efficient identification and signatures for smart cards, CRYPTO'89, vol.435, p.47, 1990.

C. Schnorr, Efficient signature generation by smart cards, Journal of Cryptology, vol.4, issue.3, pp.161-174, 0192.

A. Schönhage, Fast reduction and composition of binary quadratic forms, Proceedings of the 1991 International Symposium on Symbolic and Algebraic Computation, ISSAC '91, vol.7, p.94, 1991.

R. Schoof, Computing arakelov class groups, Algorithmic number theory: lattices, number fields, curves and cryptograph 44, pp.447-495, 2008.

, Sepior, vol.35, p.182

I. D. Services, , vol.35, p.182

V. Shoup and R. Gennaro, Securing threshold cryptosystems against chosen ciphertext attack, EUROCRYPT'98, p.182, 1998.

V. Shoup and R. Gennaro, Securing threshold cryptosystems against chosen ciphertext attack, Journal of Cryptology, vol.15, issue.2, pp.75-96, 0109.

A. Shamir, Identity-based cryptosystems and signature schemes, CRYPTO'84, vol.196, p.138, 1984.

V. Shoup, Practical threshold signatures, EUROCRYPT 2000, vol.1807, pp.207-220, 0182.

D. Schielzeth and M. E. Pohst, On real quadratic number fields suitable for cryptography, Experiment. Math, vol.14, issue.2, p.99, 2005.

A. Sahai and H. Seyalioglu, Worry-free encryption: functional encryption with public keys, ACM CCS 2010, p.138, 2010.

V. Strassen, Einige Resultate über Berechnungskomplexität, Jahresbericht der Deutschen Mathematiker Vereinigung, vol.78, issue.1, p.75, 1976.

A. Sahai and B. R. Waters, Fuzzy identity-based encryption, EURO-CRYPT 2005, vol.3494, pp.457-473, 0138.

T. Takagi, Fast RSA-type cryptosystem modulo, CRYPTO'98, vol.1462, p.64, 1998.

E. Thomé, Algorithmic Number Theory and Applications to the Cryptanalysis of Cryptographical Primitives. Habilitation à diriger des recherches, p.128, 2012.

T. Tassa, A. Jarrous, Y. Ben-ya, and &. Akov, Oblivious evaluation of multivariate polynomials, J. Mathematical Cryptology, vol.7, issue.1, p.105, 2013.

S. Tople, S. Shinde, Z. Chen, and P. Saxena, AUTOCRYPT: enabling homomorphic computation on servers to protect sensitive web content, ACM CCS 2013, p.105, 2013.

B. Terelius and D. Wikström, Efficiency limitations of S-protocols for group homomorphisms revisited, SCN 12, vol.7485, p.211, 2012.

S. Vanstone, Responses to nist's proposal, Communications of the ACM, vol.35, p.186, 1992.

L. G. Valiant, S. Skyum, S. Berkowitz, and C. Rackoff, Fast parallel computation of polynomials using few processors, SIAM Journal on Computing, vol.12, issue.4, pp.641-644, 1983.

B. Vallée and A. Vera, Lattice reduction in two dimensions : analyses under realistic probabilistic models, Proc. of AofA'07, p.56, 2007.

B. Waters, A punctured programming approach to adaptively secure functional encryption, CRYPTO 2015, Part II, vol.9216, pp.678-697

. Springer, , 0138.

D. Weimer, An adaptation of the nice cryptosystem to real quadratic orders, vol.12, p.77, 2004.

B. Wesolowski, Efficient verifiable delay functions, EUROCRYPT 2019, Part III, vol.11478, p.202, 2019.

H. Wang, Z. Wang, and J. Domingo-ferrer, Anonymous and secure aggregation scheme in fog-based public cloud computing, Future Generation Computer Systems, vol.78, p.33, 2018.

L. Wang, L. Wang, Y. Pan, Z. Zhang, and Y. Yang, Discrete logarithm based additively homomorphic encryption and secure data aggregation, Information Sciences, vol.181, issue.16, p.80, 2011.

A. C. and -. Yao, Protocols for secure computations (extended abstract), 23rd FOCS, pp.160-164, 0104.

Q. Ye, H. Wang, J. Pieprzyk, and X. Zhang, Efficient disjointness tests for private datasets, Heidelberg, vol.5107, p.105, 2008.