SHORTER HASH-AND-SIGN LATTICE-BASED SIGNATURES
Résumé
Lattice-based digital signature schemes following the hash-and-sign
design paradigm of Gentry, Peikert and Vaikuntanathan (GPV) tend to offer an
attractive level of efficiency, particularly when instantiated with
structured compact trapdoors. In particular, NIST postquantum finalist
Falcon~is both quite fast for signing and verification and quite compact:
NIST notes that it has the smallest bandwidth (as measured in combined
size of public key and signature) of all round 2 digital signature
candidates. Nevertheless, while Falcon-512, for instance, compares
favorably to ECDSA-384 in terms of speed, its signatures are well over
10 times larger. For applications that store large number of signatures,
or that require signatures to fit in prescribed packet sizes, this can be
a critical limitation.
In this paper, we explore several approaches to further improve the size
of hash-and-sign lattice-based signatures, particularly instantiated over
NTRU lattices like Falcon and its recent variant Mitaka. In particular,
while GPV signatures are usually obtained by sampling lattice points
according to some \emph{spherical} discrete Gaussian distribution, we
show that it can be beneficial to sample instead according to a suitably
chosen ellipsoidal discrete Gaussian: this is because only half of
the sampled Gaussian vector is actually output as the signature, while
the other half is recovered during verification. Making the half that
actually occurs in signatures shorter reduces signature size at
essentially no security loss (in a suitable range of parameters).
Similarly, we show that reducing the modulus $ with respect to which
signatures are computed can improve signature size as well as
verification key size almost ``for free''; this is
particularly true for constructions like Falcon and Mitaka that do not
make substantial use of NTT-based multiplication (and rely instead on
transcendental FFT). Finally, we show that the Gaussian vectors in
signatures can be represented in a more compact way with appropriate
coding-theoretic techniques, improving signature size by an additional
7 to 14%. All in all, we manage to reduce the size of, e.g., Falcon
signatures by 30-40% at the cost of only 4--6 bits of Core-SVP
security.
Domaines
Cryptographie et sécurité [cs.CR]Origine | Fichiers produits par l'(les) auteur(s) |
---|