SHORTER HASH-AND-SIGN LATTICE-BASED SIGNATURES - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

SHORTER HASH-AND-SIGN LATTICE-BASED SIGNATURES

Thomas Espitau
Mehdi Tibouchi
Yang Yu

Résumé

Lattice-based digital signature schemes following the hash-and-sign design paradigm of Gentry, Peikert and Vaikuntanathan (GPV) tend to offer an attractive level of efficiency, particularly when instantiated with structured compact trapdoors. In particular, NIST postquantum finalist Falcon~is both quite fast for signing and verification and quite compact: NIST notes that it has the smallest bandwidth (as measured in combined size of public key and signature) of all round 2 digital signature candidates. Nevertheless, while Falcon-512, for instance, compares favorably to ECDSA-384 in terms of speed, its signatures are well over 10 times larger. For applications that store large number of signatures, or that require signatures to fit in prescribed packet sizes, this can be a critical limitation. In this paper, we explore several approaches to further improve the size of hash-and-sign lattice-based signatures, particularly instantiated over NTRU lattices like Falcon and its recent variant Mitaka. In particular, while GPV signatures are usually obtained by sampling lattice points according to some \emph{spherical} discrete Gaussian distribution, we show that it can be beneficial to sample instead according to a suitably chosen ellipsoidal discrete Gaussian: this is because only half of the sampled Gaussian vector is actually output as the signature, while the other half is recovered during verification. Making the half that actually occurs in signatures shorter reduces signature size at essentially no security loss (in a suitable range of parameters). Similarly, we show that reducing the modulus $ with respect to which signatures are computed can improve signature size as well as verification key size almost ``for free''; this is particularly true for constructions like Falcon and Mitaka that do not make substantial use of NTT-based multiplication (and rely instead on transcendental FFT). Finally, we show that the Gaussian vectors in signatures can be represented in a more compact way with appropriate coding-theoretic techniques, improving signature size by an additional 7 to 14%. All in all, we manage to reduce the size of, e.g., Falcon signatures by 30-40% at the cost of only 4--6 bits of Core-SVP security.
Fichier principal
Vignette du fichier
main.pdf (899.07 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03854905 , version 1 (16-11-2022)
hal-03854905 , version 2 (10-05-2023)

Identifiants

Citer

Thomas Espitau, Mehdi Tibouchi, Alexandre Wallet, Yang Yu. SHORTER HASH-AND-SIGN LATTICE-BASED SIGNATURES. Advances in Cryptology – CRYPTO 2022, Aug 2022, Santa Barbara, United States. pp.245-275, ⟨10.1007/978-3-031-15979-4_9⟩. ⟨hal-03854905v1⟩
74 Consultations
163 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More