A Ring-LWE-based digital signature inspired by Lindner–Peikert scheme

1 Introduction

The advent of Quantum computing threatens to break a lot of classical cryptographic schemes. This leads to innovations in public key cryptography that focus on post-quantum cryptography primitives and protocols resistant to quantum computing threats. Lattice-based cryptography is a promising post-quantum cryptography family, both in terms of foundational properties and its application to both traditional and emerging security problems such as encryption, digital signature, key exchange, homomorphic encryption, etc.

The breakthrough work of Ajtai [1] provides confidence for adopting lattice-based schemes in cryptography. Ajtai proved that solving NP-hard lattice problems, e.g., Shortest Vector Problem (SVP), in the average case is as hard as solving the worst-case assumption. It is conjectured that there is no probabilistic polynomial-time algorithm that can approximate certain computational problems on lattices within polynomial factors [2]. This is the basis for the security of lattice-based schemes. Based on the Ajtai’s works in the past two decades, great progress has been made in the lattice-based cryptography on various hard lattice computational problems such as closest vector problem (CVP), Shortest Independent Vectors Problem (SIVP), bounded distance decoding (BDD), Shortest Integer Solution (SIS), etc. [2,3,4,5].

Due to Regev [6] a large number of cryptographic constructions based on the lattices are built over the average-case Learning With Errors (LWE) problem.

There are two main versions of the LWE problem: the search version which is finding the secret according to the given LWE samples, and the decision version which is distinguishing between LWE samples and uniformly random samples:

The LWE-based schemes, however, are not particularly efficient because LWE-based schemes inherently give rise to key sizes and/or outputs which are O ˜ ( λ 2 ) in the security parameter λ . In 2010, Lyubashevsky et al. [7] introduced the Ring-LWE Problem that is the ring-based analogue of LWE, and proved the hardness of the related problems. Ring-LWE is parameterized by a ring R of degree n over Z , a positive integer modulus q that defines the quotient ring R q = R / q , and an error distribution χ over R . Typically, one takes R to be a cyclotomic ring, and χ to be some kind of discrete Gaussian in the canonical embedding of R .

We conclude this section by introducing the “Short Integer Solution (SIS) Problem” whose hardness is needed as a part of security of our proposed scheme. (For the hardness of the SIS problem relative to worst-case lattice problems, see ref. [3, Section 4.1.2].) The SIS Problem is parameterized by positive integers n and q , which defines the group Z q n a positive real number β and a number m of group elements.

Inspired by the ideas behind the “NTRU cryptosystem” [9], Micciancio [10] introduced a compact ring-based analogue of Ajtai’s SIS problem. This analogue has come to be known as the “Ring-SIS Problem" and is parameterized by a ring R which is often (but not always) taken to be a degree- n polynomial of the form R = Z [ X ] ⟨ f ( X ) ⟩ , a positive integer modulus q , a real norm bound β > 0 , and a number m of samples.

2 Related works and our contribution

For a long time, lattice-based signatures have been designed so that their security were obtainable only for inefficiently large parameters, i.e., they were far from practicality, e.g., ref. [11], or were, like GGH [12] and NTRUSign [13] broken due to flaws in the ad-hoc design approaches [14,15]. Though using the ideal lattices, introduced by Micciancio [10], and the related computationally hard problems, such as Ring-SIS and Ring-LWE, one can find many promising digital signatures in this area. In particular, the schemes that use the Fiat–Shamir approach [16] have led to a family of fast signature schemes with reasonable signature and key sizes [11,17,18, 19,20].

In general, for building lattice-based signatures, there are two (seemingly distinct) frameworks: one using lattice trapdoors [21,22,23] and the other, as mentioned above, through the Fiat–Shamir heuristic, whereas, a strong connection between these two approaches has been recently found, see ref. ([24], Theorem 1.4). In this article, inspiring from the protocol introduced by Lindner–Peikert [25] and using the Fiat–Shamir paradigm, we present a lattice-based digital signature scheme whose structure is designed for a fixed length message, i.e., we will use the hash and sign approach. Our contribution is a straight applying the Lindner–Peikert scheme [25], which can be seen, to the best of our knowledge, as a novel idea for constructing digital signature through this primitive. In addition, as we will see in Section 6, we get an appropriate trade off between the security levels and the key sizes, where the security of the proposed scheme has been estimated by a very pessimistic approach (from the viewpoint of the defender against a quantum adversary), namely the core SVP hardness, see Section 5.1. Although we cannot claim that the proposed signature is the best one (for a summarized comparison between some similar lattice-based digital signatures, see Section 6), but one may hope for future improvements on this “naive” framework.

3 The proposed digital signature

In 2011, as a generalization of the previous LWE-based cryptosystems such as [6,21] and as an instance of Micciancio’s proposed system in ref. [26], Lindner–Peikert [25] gave a cryptosystem based on LWE and Ring-LWE problems. The Lindner–Peikert cryptosystem provided smaller keys and ciphertexts by a factor of about log q and a concrete security stronger than the previous works (by the convention, the base-2 logarithm is denoted by log ).

In this article, using the Lindner–Peikert cryptosystem [25], we give a Ring-LWE-based digital signature whose public key/signature sizes lie in the range 1–1.5 kilobytes, along with an easier implementation and a slightly weaker security than the proposed scheme in ref. [25].

Let R = Z [ X ] ⟨ f ( X ) ⟩ be the cyclotomic polynomial ring where f ( X ) = X n + 1 with n a power of 2. Other properties of this ring such as its security and cyclotomic polynomials, including degrees n ≠ 2 of the mentioned ring, are discussed in detail in ref. [7]. Suppose that the following considerations hold: q ∈ Z is a sufficiently large integer modulus for which f ( x ) splits into linear (or very low-degree) factors modulo q ; R q = Z q [ X ] f ( X ) ; χ k and χ e are error distributions over R which are concentrated on “small” elements of R . Hence, the error distributions enable rigorous security proofs (see refs [7] and [25]).

Let Σ be a message alphabet, e.g., Σ = { 0 , 1 } . The message encoder and decoder are functions encode : Σ n → R q and decode : R q → Σ n , such that

As an example consider an e such that for some integer threshold t ≥ 1 , its coefficients as a polynomial in R are all in [ − t , t ) .

In this protocol, we use a uniformly random a ∈ R q that can be generated by a trusted source or it is chosen by the user. Suppose that the signer (from now on will be called Alice) wants to sign the message m and send it to the verifier (from now on will be called Bob).

• First Alice computes the values r 1 , r 2 ← χ k and m ¯ = encode ( H ( m ) ) where H is a collision-resistant hash function. The public key consists of the pair ( p = r 1 − a r 2 , a ) ∈ R q 2 and the secret key is r 2 .

• For per-signing, Alice generates e i ← χ e , i = 1 , … , 4 , and Computes the values C i s as follows:

  C 1 ≔ p e 1 + e 2 , C 2 ≔ p a e 1 + e 3 + m ¯ , C 3 ≔ a e 2 + e 4 .

  Note that following Section 3.1 in ref. [25], we take a , p , m ∈ Σ n .

• The assigned signature to m is the quadruple ( C 1 , C 2 , C 3 , h ) , where

  h = H ( m ∣ ∣ H ( decode ( a r 2 e 1 ) ) ) ,

  with a collision-resistant hash function H . (Note that computing the value of decode( a r 2 e 1 ) is meaningful, since a r 2 e 1 ∈ R q , see Definition 3.1.)

4 Security

The standard security notion for digital signatures is UF-CMA security, which is unforgeability under Chosen Message Attacks. In this security model, the adversary gets the public key and has access to a signing oracle to sign messages of his choice. The adversary’s goal is to come up with a valid signature of a new message. A slightly stronger security requirement which can be useful sometimes is SUF-CMA (Strong Unforgeability under Chosen Message Attacks), which also allows the adversary to win by producing a different signature of a message that he has already seen.

We also take quantum attackers into account. We need to consider the security of the scheme when the adversary can query the hash function on a superposition of inputs (i.e., security in the quantum random oracle model QROM). The UF-CMA security of our signature scheme is based on two hard assumptions:

• The Decision Ring-LWE assumption which is needed to protect against key-recovery.

• An “intermediate problem” that is the assumption upon which the new message forgery is based. It is based on the combined hardness of the Ring-SIS problem and the cryptography hash function H .

By the decision Ring-LWE assumption, the public key ( p = r 1 − a r 2 , a ) is indistinguishable from ( t , a ) where t is chosen uniformly at random. Hence, to prove UF-CMA security, we only need to analyze the hardness of the experiment where the adversary receives a random ( t , a ) and then needs to output a valid message/signature pair m , ( C 1 ′ , C 2 ′ , C 3 ′ , h ′ ) such that

1. decode ( C 2 ′ − a C 1 ′ + C 3 ′ ) = H ( m ) ;

2. h ′ = H ( m ∣ ∣ H ( decode ( − C 1 ′ ) ) ) .

In particular, a (quantum) adversary who is successful at creating a forgery of a new message is able to find C 1 ′ such that H ( decode ( − C 1 ′ ) ) = H ( decode ( a r 2 e 1 ) ) (corresponding to the fixed message m ). But ( t , a ) is completely random, so this is the aforementioned intermediate problem. Note that a standard forking lemma [28] shows that an adversary solving the above problem in the (standard) random oracle model, can be used to solve the Ring-SIS problem.

5 Choosing parameters

Recall that our proposed digital signature has been inspired by the Lindner–Peikert cryptosystem [25]. Hence, we can estimate the concrete security and also compute the space requirements for the Ring-LWE-based digital signature, completely similar to ref. [25]. Note that for any message m with length ( H ( m ) ) = 128 ≤ n , the public key and signature sizes, respectively, are 2 n log q and 3 n log q + 128 bits.

In the first step we set s k = s e = s > 0 , whereas we can use slightly smaller s k and correspondingly larger s e parameters to get a slightly stronger overall security versus a more complicated implementation, see [25, Section 6]. Indeed distinguishing the public key and the components of C i s of a signature ( C 1 , C 2 , C 3 , h ) , from the uniform ones, is not equally hard. It is because compared to the signature, the public key exposes fewer LWE samples (the random polynomials r 1 , r 2 are fixed, but the error terms e i change for per-signing).

The modulus q should be chosen large enough (according to the bounds in Table 1) such that for a Gaussian parameter s ≥ 8 , one has the discrete Gaussian D Z q m , s that approximates the continuous Gaussian D s as well. On the other hand, as in most lattice-based schemes that are based on operations over polynomial rings, we have to choose our ring so that the multiplication operation has a very efficient implementation via the Number Theoretic Transform (NTT), see e.g., [29,30], which is just a version of FFT that works over the finite field Z q rather than over the complex numbers. To enable the NTT, we need to choose a prime number q so that the group Z q ∗ has an element of order 2 n or equivalently q ≡ 1 ( mod 2 n ) . Thereby we have set q = 7,681 , which slightly reduces the security level compared to the ones proposed in ([25], Section 6), (Tables 2 and 3).

6 Comparison

In this section, we give a brief comparison between the proposed signature algorithm and a few other Ring-LWE-based algorithms [18,19,38, 39,40]. For comparison, we chose those algorithms that to the best of our knowledge seem more related to our scheme. The results are listed in Table 4, which show that our proposed algorithm has a good trade off between the key sizes and security levels. In particular, it provides relatively shorter keys and signatures among most of the similar schemes.