A Method to Solve Cyclotomic Norm Equations

We present a technique to recover f ∈ Q(ζp) where ζp is a primitive pth root of unity for a prime p, given its norm g = f ∗ f̄ in the totally real field Q(ζp + ζ −1 p ). The classical method of solving this problem involves finding generators of principal ideals by enumerating the whole class group associated with Q(ζp), but this approach quickly becomes infeasible as p increases. The apparent hardness of this problem has led several authors to suggest the problem as one suitable for cryptography. We describe a technique which avoids enumerating the class group, and instead recovers f by factoring Nf , the absolute norm of f , (for example with a subexponential sieve algorithm), and then running the Gentry-Szydlo polynomial time algorithm for a number of candidates. The algorithm has been tested with an implementation in PARI.