MPSign: A Signature from Small-Secret Middle-Product Learning with - - PowerPoint PPT Presentation

▶
mpsign a signature from small secret middle product
SMART_READER_LITE
LIVE PREVIEW

MPSign: A Signature from Small-Secret Middle-Product Learning with - - PowerPoint PPT Presentation

Dec 08, 2022 161 likes •824 views

MPSign: A Signature from Small-Secret Middle-Product Learning with Errors Shi Bai Dipayan Das Ryo Hiromasa Miruna Rosca Amin Sakzad Damien Stehl Ron Steinfeld Zhenfei Zhang Miruna Rosca MPSign PKC 2020 1 / 22 What is this talk about?

slide-1
SLIDE 1

MPSign: A Signature from Small-Secret Middle-Product Learning with Errors

Shi Bai Dipayan Das Ryo Hiromasa Miruna Rosca Amin Sakzad Damien Stehlé Ron Steinfeld Zhenfei Zhang

Miruna Rosca MPSign PKC 2020 1 / 22

slide-2
SLIDE 2

What is this talk about?

A digital signature scheme whose security in the QROM relies on the hardness of solving ApproxSVPf for many polynomials f.

Main ingredient:

A reduction from small secret PLWEf to small secret MP-LWE which works for many f’s.

Miruna Rosca MPSign PKC 2020 2 / 22

slide-3
SLIDE 3

Overview

  • 1. Background
  • 2. Hardness of MP-LWE with small secrets
  • 3. MPSign: our digital signature based on small secret MP-LWE

Miruna Rosca MPSign PKC 2020 3 / 22

slide-4
SLIDE 4

Background

Miruna Rosca MPSign PKC 2020 4 / 22

slide-5
SLIDE 5

Digital signature DS = (Gen, Sign, Ver)

sk pk

Miruna Rosca MPSign PKC 2020 5 / 22

slide-6
SLIDE 6

Digital signature DS = (Gen, Sign, Ver)

(m, σ = Signsk(m))

sk pk

Miruna Rosca MPSign PKC 2020 5 / 22

slide-7
SLIDE 7

Digital signature DS = (Gen, Sign, Ver)

(m, σ = Signsk(m)) Verpk(m, σ) ∈ {0, 1}

sk pk

Miruna Rosca MPSign PKC 2020 5 / 22

slide-8
SLIDE 8

Digital signature DS = (Gen, Sign, Ver)

(m, σ = Signsk(m)) Verpk(m, σ) ∈ {0, 1}

sk pk Correctness: Verpk(m, Signsk(m)) = 1 w.h.p.

Miruna Rosca MPSign PKC 2020 5 / 22

slide-9
SLIDE 9

Digital signature DS = (Gen, Sign, Ver)

(m, σ = Signsk(m)) Verpk(m, σ) ∈ {0, 1}

sk pk Correctness: Verpk(m, Signsk(m)) = 1 w.h.p. ufCMA Security: DS is secure if no adversary, having access to many signatures, is able to produce a signature for a new message.

Miruna Rosca MPSign PKC 2020 5 / 22

slide-10
SLIDE 10

How to build lattice-based crypto?

PSISf PLWEf ApproxSVPf [LM06],[PR07] [SSTX09],[LPR10]

Miruna Rosca MPSign PKC 2020 6 / 22

slide-11
SLIDE 11

How to build lattice-based crypto?

PSISf PLWEf ApproxSVPf [LM06],[PR07] [SSTX09],[LPR10]

[CDPR16], [BBV+17], [CDW17], etc.

ApproxSVPf is easier than ApproxSVP for some f’s in some parameter regimes and setups.

Miruna Rosca MPSign PKC 2020 6 / 22

slide-12
SLIDE 12

[Lyu16]: A problem at least as hard as many PSISf

PSISf1 PSISf2 . . . . . . PSISfm PSIS over Zq[x]

Miruna Rosca MPSign PKC 2020 7 / 22

slide-13
SLIDE 13

[Lyu16]: A problem at least as hard as many PSISf

PSISf1 PSISf2 . . . . . . PSISfm PSIS over Zq[x] Application: digital signature scheme

Miruna Rosca MPSign PKC 2020 7 / 22

slide-14
SLIDE 14

[RSSS17]: A problem at least as hard as many PLWEf

PLWEf1 PLWEf2 . . . . . . PLWEfm MP-LWE

Miruna Rosca MPSign PKC 2020 8 / 22

slide-15
SLIDE 15

[RSSS17]: A problem at least as hard as many PLWEf

PLWEf1 PLWEf2 . . . . . . PLWEfm MP-LWE

Applications of MP-LWE

public key encryption: [RSSS17], [SSZ18], [BBD+19] identity based encryption: [LVV19]

Miruna Rosca MPSign PKC 2020 8 / 22

slide-16
SLIDE 16

The PLWEf and MP-LWE problems

f poly. of degree n PLWEf

q,χ1,χ2

Miruna Rosca MPSign PKC 2020 9 / 22

slide-17
SLIDE 17

The PLWEf and MP-LWE problems

f poly. of degree n PLWEf

q,χ1,χ2

Pf

q,χ1(s) for s ∈ Zq[x]/f

a ← ֓ U(Zq[x]/f) and e ← ֓ χ1 return (a, b = a · s + e mod f)

Miruna Rosca MPSign PKC 2020 9 / 22

slide-18
SLIDE 18

The PLWEf and MP-LWE problems

f poly. of degree n PLWEf

q,χ1,χ2

Distinguish between

Pf

q,χ1(s) for s ∈ Zq[x]/f

a ← ֓ U(Zq[x]/f) and e ← ֓ χ1 return (a, b = a · s + e mod f) and U(Zq[x]/f × Rq[x]/f)<n

Miruna Rosca MPSign PKC 2020 9 / 22

slide-19
SLIDE 19

The PLWEf and MP-LWE problems

f poly. of degree n PLWEf

q,χ1,χ2

Distinguish between

Pf

q,χ1(s) for s ∈ Zq[x]/f

a ← ֓ U(Zq[x]/f) and e ← ֓ χ1 return (a, b = a · s + e mod f) and U(Zq[x]/f × Rq[x]/f)<n with non-negl. probability over the choice of s ← ֓ χ2.

Miruna Rosca MPSign PKC 2020 9 / 22

slide-20
SLIDE 20

The PLWEf and MP-LWE problems

f poly. of degree n PLWEf

q,χ1,χ2

MP-LWEn,d

q,χ1,χ2

Distinguish between

Pf

q,χ1(s) for s ∈ Zq[x]/f

a ← ֓ U(Zq[x]/f) and e ← ֓ χ1 return (a, b = a · s + e mod f) and U(Zq[x]/f × Rq[x]/f)<n with non-negl. probability over the choice of s ← ֓ χ2.

Miruna Rosca MPSign PKC 2020 9 / 22

slide-21
SLIDE 21

The PLWEf and MP-LWE problems

f poly. of degree n PLWEf

q,χ1,χ2

MP-LWEn,d

q,χ1,χ2

Distinguish between

Pf

q,χ1(s) for s ∈ Zq[x]/f

a ← ֓ U(Zq[x]/f) and e ← ֓ χ1 return (a, b = a · s + e mod f)

MPn,d

q,χ1(s) for s ∈ Z<n+d−1 q

[x]

a ← ֓ U(Z<n

q [x]) and e ←

֓ χ1 return (a, b = a ⊙d s + e) and U(Zq[x]/f × Rq[x]/f)<n with non-negl. probability over the choice of s ← ֓ χ2.

Miruna Rosca MPSign PKC 2020 9 / 22

slide-22
SLIDE 22

The PLWEf and MP-LWE problems

f poly. of degree n PLWEf

q,χ1,χ2

MP-LWEn,d

q,χ1,χ2

Distinguish between Distinguish between

Pf

q,χ1(s) for s ∈ Zq[x]/f

a ← ֓ U(Zq[x]/f) and e ← ֓ χ1 return (a, b = a · s + e mod f)

MPn,d

q,χ1(s) for s ∈ Z<n+d−1 q

[x]

a ← ֓ U(Z<n

q [x]) and e ←

֓ χ1 return (a, b = a ⊙d s + e) and and U(Zq[x]/f × Rq[x]/f)<n U(Z<n

q [x] × R<d q [x])

with non-negl. probability over the choice of s ← ֓ χ2.

Miruna Rosca MPSign PKC 2020 9 / 22

slide-23
SLIDE 23

Hardness of MP-LWE with small secrets

Miruna Rosca MPSign PKC 2020 10 / 22

slide-24
SLIDE 24

Towards the hardness of MP-LWE with small secret

* D: distribution which produces small elements w.h.p * U: uniform distribution

MP-LWEn,d

q,D,U

PLWEf

q,D,U

error secret

[RSSS17]

Miruna Rosca MPSign PKC 2020 11 / 22

slide-25
SLIDE 25

Towards the hardness of MP-LWE with small secret

* D: distribution which produces small elements w.h.p * U: uniform distribution

MP-LWEn,d

q,D,U

MP-LWEn,d

q,D,D

PLWEf

q,D,U

error secret

[RSSS17] ?

Miruna Rosca MPSign PKC 2020 11 / 22

slide-26
SLIDE 26

Towards the hardness of MP-LWE with small secret

* D: distribution which produces small elements w.h.p * U: uniform distribution

MP-LWEn,d

q,D,U

MP-LWEn,d

q,D,D

PLWEf

q,D,U

PLWEf

q,D,D

error secret

[RSSS17] [ACPS09] ?

Miruna Rosca MPSign PKC 2020 11 / 22

slide-27
SLIDE 27

Towards the hardness of MP-LWE with small secret

* D: distribution which produces small elements w.h.p * U: uniform distribution

MP-LWEn,d

q,D,U

MP-LWEn,d

q,D,D

PLWEf

q,D,U

PLWEf

q,D,D

error secret

[RSSS17] [ACPS09] This work

Miruna Rosca MPSign PKC 2020 11 / 22

slide-28
SLIDE 28

From PLWEf to MP-LWE for many f’s

* f ∈ Z[x] of degree n, d ≤ n * DR,σ: Gaussian on R with standard deviation σ * DZ,σ: Gaussian on Z with standard deviation σ

[RSSS17] MP-LWEn,d

q,χ1,χ2

PLWEf

q,χ1,χ2

χ1 DRd,α′q DRn,αq χ2 U(Zn+d−1

q

) U(Zn

q )

This work MP-LWEn,d

q,χ1,χ2

PLWEf

q,χ1,χ2

χ1 DZd,α′′q DZn,αq χ2 DZn+d−1,α′q DZn,αq

Miruna Rosca MPSign PKC 2020 12 / 22

slide-29
SLIDE 29

Recall [RSSS17]

= Rotf(b) Rotf(a) × Rotf(s) + Rotf(e)

Miruna Rosca MPSign PKC 2020 13 / 22

slide-30
SLIDE 30

Recall [RSSS17]

= Rotf(b) Rotf(a) × Rotf(s) + Rotf(e) Take first column Mf b = Rotf(a) × Mf s + Mf e

Miruna Rosca MPSign PKC 2020 13 / 22

slide-31
SLIDE 31

Recall [RSSS17]

= Rotf(b) Rotf(a) × Rotf(s) + Rotf(e) Take first column Mf b = Rotf(a) × Mf s + Mf e Decompose Rotf(a) b′ = Toep(a) × Rotf(1) Mf s + Mf e

Miruna Rosca MPSign PKC 2020 13 / 22

slide-32
SLIDE 32

Recall [RSSS17]

= Rotf(b) Rotf(a) × Rotf(s) + Rotf(e) Take first column Mf b = Rotf(a) × Mf s + Mf e Decompose Rotf(a) b′ = Toep(a) × Rotf(1) Mf s + Mf e Rename b′ = Toep(a) × s′ + e′

Miruna Rosca MPSign PKC 2020 13 / 22

slide-33
SLIDE 33

From small secret PLWEf to small secret MP-LWE

Mf e + e

Miruna Rosca MPSign PKC 2020 14 / 22

slide-34
SLIDE 34

From small secret PLWEf to small secret MP-LWE

Mf e + e DZ,α + DZ,β ≈ DZ,γ

Miruna Rosca MPSign PKC 2020 14 / 22

slide-35
SLIDE 35

From small secret PLWEf to small secret MP-LWE

Mf e + e DZ,α + DZ,β ≈ DZ,γ We need a lower bound on the smallest singular value of Mf.

Miruna Rosca MPSign PKC 2020 14 / 22

slide-36
SLIDE 36

From small secret PLWEf to small secret MP-LWE

Mf e + e DZ,α + DZ,β ≈ DZ,γ We need a lower bound on the smallest singular value of Mf.

  • more restrictive family of f’s

Mf =

        

∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗

        

Miruna Rosca MPSign PKC 2020 14 / 22

slide-37
SLIDE 37

From small secret PLWEf to small secret MP-LWE

Mf e + e DZ,α + DZ,β ≈ DZ,γ We need a lower bound on the smallest singular value of Mf.

  • more restrictive family of f’s
  • larger noise amplification

Mf =

        

∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗

        

Miruna Rosca MPSign PKC 2020 14 / 22

slide-38
SLIDE 38

From small secret PLWEf to small secret MP-LWE

Mf e + e DZ,α + DZ,β ≈ DZ,γ We need a lower bound on the smallest singular value of Mf.

  • more restrictive family of f’s
  • larger noise amplification
  • α is related to the family

Mf =

        

∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗ ∗

        

Miruna Rosca MPSign PKC 2020 14 / 22

slide-39
SLIDE 39

Digital signature based on MP-LWE

Miruna Rosca MPSign PKC 2020 15 / 22

slide-40
SLIDE 40

Identification scheme ID = (IGen, P, V)

sk vk

Miruna Rosca MPSign PKC 2020 16 / 22

slide-41
SLIDE 41

Identification scheme ID = (IGen, P, V)

sk vk

Miruna Rosca MPSign PKC 2020 16 / 22

slide-42
SLIDE 42

Identification scheme ID = (IGen, P, V)

W

sk vk

Miruna Rosca MPSign PKC 2020 16 / 22

slide-43
SLIDE 43

Identification scheme ID = (IGen, P, V)

W c ← ֓ ChallengeSet

sk vk

Miruna Rosca MPSign PKC 2020 16 / 22

slide-44
SLIDE 44

Identification scheme ID = (IGen, P, V)

W c ← ֓ ChallengeSet Z

sk vk

Miruna Rosca MPSign PKC 2020 16 / 22

slide-45
SLIDE 45

Identification scheme ID = (IGen, P, V)

W c ← ֓ ChallengeSet Z

sk vk

V(W, c, Z) ∈ {0, 1} Miruna Rosca MPSign PKC 2020 16 / 22

slide-46
SLIDE 46

Identification scheme ID = (IGen, P, V)

W c ← ֓ ChallengeSet Z

sk vk

V(W, c, Z) ∈ {0, 1}

Security: ID is secure if no adversary having access to multiple transcripts (W,c,Z) is able to fool the verifier.

Miruna Rosca MPSign PKC 2020 16 / 22

slide-47
SLIDE 47

Our identification scheme based on MP-LWE

(s, e) (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 17 / 22

slide-48
SLIDE 48

Our identification scheme based on MP-LWE

y1, y2 small

W = a ⊙ y1 + y2 (s, e) (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 17 / 22

slide-49
SLIDE 49

Our identification scheme based on MP-LWE

y1, y2 small

W = a ⊙ y1 + y2 c ← ֓ ChallengeSet (s, e) (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 17 / 22

slide-50
SLIDE 50

Our identification scheme based on MP-LWE

y1, y2 small z1 = c ⊙ s + y1 z2 = c ⊙ e + y2 reject z1, z2?

W = a ⊙ y1 + y2 c ← ֓ ChallengeSet Z = (z1, z2) (s, e) (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 17 / 22

slide-51
SLIDE 51

Our identification scheme based on MP-LWE

y1, y2 small z1 = c ⊙ s + y1 z2 = c ⊙ e + y2 reject z1, z2? check if: W = a ⊙ z1 + z2 − c ⊙ b z1, z2 small

W = a ⊙ y1 + y2 c ← ֓ ChallengeSet Z = (z1, z2) (s, e) (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 17 / 22

slide-52
SLIDE 52

MPSign: from ID to DS using Fiat-Shamir

(s, e) m (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 18 / 22

slide-53
SLIDE 53

MPSign: from ID to DS using Fiat-Shamir

y1, y2 small W = a ⊙ y1 + y2

(s, e) m (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 18 / 22

slide-54
SLIDE 54

MPSign: from ID to DS using Fiat-Shamir

y1, y2 small W = a ⊙ y1 + y2 c = H(W||m)

(s, e) m (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 18 / 22

slide-55
SLIDE 55

MPSign: from ID to DS using Fiat-Shamir

y1, y2 small W = a ⊙ y1 + y2 c = H(W||m) z1 = c ⊙ s + y1 z2 = c ⊙ e + y2 reject z1, z2?

(s, e) m (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 18 / 22

slide-56
SLIDE 56

MPSign: from ID to DS using Fiat-Shamir

y1, y2 small W = a ⊙ y1 + y2 c = H(W||m) z1 = c ⊙ s + y1 z2 = c ⊙ e + y2 reject z1, z2?

(s, e) m (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 18 / 22

slide-57
SLIDE 57

MPSign: from ID to DS using Fiat-Shamir

y1, y2 small W = a ⊙ y1 + y2 c = H(W||m) z1 = c ⊙ s + y1 z2 = c ⊙ e + y2 reject z1, z2?

(m, (z1, z2, c)) (s, e) m (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 18 / 22

slide-58
SLIDE 58

MPSign: from ID to DS using Fiat-Shamir

y1, y2 small W = a ⊙ y1 + y2 c = H(W||m) z1 = c ⊙ s + y1 z2 = c ⊙ e + y2 reject z1, z2? W = a ⊙ z1 + z2 − c ⊙ b

(m, (z1, z2, c)) (s, e) m (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 18 / 22

slide-59
SLIDE 59

MPSign: from ID to DS using Fiat-Shamir

y1, y2 small W = a ⊙ y1 + y2 c = H(W||m) z1 = c ⊙ s + y1 z2 = c ⊙ e + y2 reject z1, z2? check if: c = H(W, m) z1, z2 small W = a ⊙ z1 + z2 − c ⊙ b

(m, (z1, z2, c)) (s, e) m (a, b = a ⊙ s + e)

Miruna Rosca MPSign PKC 2020 18 / 22

slide-60
SLIDE 60

Correctness and Security of MPSign

  • correctness uses the associativity property of middle product

Miruna Rosca MPSign PKC 2020 19 / 22

slide-61
SLIDE 61

Correctness and Security of MPSign

  • correctness uses the associativity property of middle product
  • we fix the wrong security analysis from [Hir18]
  • they incorrectly assume a ⊙n y is uniform for fixed y and uniform a

[KLS18]: ID has some "good properties" ⇒ DS is tightly secure in QROM

Miruna Rosca MPSign PKC 2020 19 / 22

slide-62
SLIDE 62

Concrete parameters for MPSign

λQ = 143 λQ = 89 degree of a 3800 2500 degree of z2 1910 1300 degree of c 512 512 q ≈ 291 ≈ 287 public key size 26.9 KB 19.5 KB secret key size 1.1 KB 0.8 KB signature size 20.1 KB 12.8 KB

  • chosen accordingly to the best known attacks with the coreSVP

hardness methodology

Miruna Rosca MPSign PKC 2020 20 / 22

slide-63
SLIDE 63

MPSign vs [Lyu16]

λ = 89 MPSign [Lyu16] public key size 19.5 KB 9.6 KB secret key size 0.8 KB 8.8 KB signature size 12.8 KB 27 KB

Miruna Rosca MPSign PKC 2020 21 / 22

slide-64
SLIDE 64

MPSign vs [Lyu16]

λ = 89 MPSign [Lyu16] public key size 19.5 KB 9.6 KB secret key size 0.8 KB 8.8 KB signature size 12.8 KB 27 KB

  • our security proof is tight, while [Lyu16] is not
  • we give an efficient key recovery attack on [Lyu16] when sk has very

small coefficients

⇒ you cannot decrease too much the size of the secret key in [Lyu16] to improve it

Miruna Rosca MPSign PKC 2020 21 / 22

slide-65
SLIDE 65

Summary

  • we proved hardness of MP-LWE with short secrets
  • we built a digital signature scheme whose security in QROM is based
  • n it
  • we provide concrete parameters for our scheme
  • we provide a proof-of-concept implementation in Sage
  • https://github.com/pqc-ntrust/middle-product-LWE-signature

Miruna Rosca MPSign PKC 2020 22 / 22