Message Authentication Codes Against Related‐Key Attacks Under LPN and LWE

Chinese Journal of ElectronicsVolume 30, Issue 4 p. 697-703 Original Research PaperFree Access Message Authentication Codes Against Related-Key Attacks Under LPN and LWE CUI Nan, Corresponding Author cuinan913@sjtu.edu.cn Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 ChinaSearch for more papers by this authorLIU Shengli, Corresponding Author slliu@sjtu.edu.cn Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 China State Key Laboratory of Cryptology, P.O. Box 5159, Beijing, 100878 China Westone Cryptologic Research Center, Beijing, 100070 ChinaSearch for more papers by this author CUI Nan, Corresponding Author cuinan913@sjtu.edu.cn Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 ChinaSearch for more papers by this authorLIU Shengli, Corresponding Author slliu@sjtu.edu.cn Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, 200240 China State Key Laboratory of Cryptology, P.O. Box 5159, Beijing, 100878 China Westone Cryptologic Research Center, Beijing, 100070 ChinaSearch for more papers by this author First published: 01 July 2021 https://doi.org/10.1049/cje.2021.05.011 This work is supported by Guangdong Major Project of Basic and Applied Basic Research (No.2019B030302008) and the National Natural Science Foundation of China (No.61925207). AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onEmailFacebookTwitterLinked InRedditWechat Abstract Message authentication code (MAC) guarantees the authenticity of messages and is one of the most important primitives in cryptography. We study related-key attacks with which the adversary is able to choose function f and observe the behavior of the MAC under the modified authenticated key f(k), and consider unforgeability of MAC under (selectively) chosen message attack with f(k). We focus on MAC schemes from the Learning parity with noise (LPN) and the Learning with errors (LWE) problem by Kiltz et al. in EUROCRYPT 2011. We first prove that the MAC schemes from LPN/ LWE can resist key-shift attacks and enlarge the key-shift function set to support a subclass of affine functions. I. Introduction As an essential cryptographic primitive, Message authentication code (MAC) plays an important role in modern cryptography. Traditionally, MAC can be constructed from block-ciphers under CBC mode. However, the security of MAC is only based on heuristic arguments. To provide vigorous proofs, many algebraic MACs were proposed[1-7], the security can be reduced to number-theoric assumptions such as the Computational Diffie-Hellman (CDH) assumption, the Factoring assumption, etc. However, these algebraic MACs can not withstand quantum attacks due to Shor's algorithms[8]. As a promising post-quantum hard problem, Learning parity with noise (LPN) problem and Learning with errors (LWE) problem have grabbed researcher's attention and lots of schemes[9-11] were proposed under these problems. Recently, authentication schemes and MACs were constructed from LPN/LWE problem[12,13]. Traditional security notion for MAC is unforgeability against (selectively) chosen message attacks. Roughly speaking, it requires that the adversary cannot forge a valid authenticator even if it sees lots of message-authenticator pairs under authentication key k. It is for granted that the adversary cannot influence the use of key k. In practice, however, it is possible for the adversary to tamper with key k (for instance, fault injection attack[14]). This type of attack is called Related-key attack (RKA) where the adversary is able to designate a function f and observe the output of MAC under f ( k ) . Han et al.[15] proposed a framework of constructing RKA secure MAC under some restricted affine functions and presented instantiations from the DDH, DCR, k-Lin assumptions. Based on number-theoretic assumptions, the aforementioned constructions cannot provide RKA security any more in face of quantum attacks. In this paper, we investigate the RKA security of the post-quantum MAC scheme from LPN[12,13] and refine the MAC scheme from LWE[13]. For the first time, we prove these MAC schemes are able to resist key-shifts attacks and even resist a subclass of affine functions. II. Preliminaries 1. Notation We use normal, bold and capital bold letters like x, x, X to denote element, column vector and matrix, respectively. Let X t denote the transpose of matrix X, rank( X) denote the rank of matrix X, and X i j denote the element of the ith row and the jth column in X. For a , b ∈ R , define [ a , b ] : = { x ∈ R | a ≤ x ≤ b } , ( a , b ) : = { x ∈ R | a < x < b } , and define ⌊ x ⌉ as the integer part of x + 1 / 2 . Let Z q denote the set of integers modulo positive integer q, and [ n ] denote the set { 1 , 2 , ⋯ , n } . For a column vector x = ( x 1 , . . . , x m ) t ∈ Z 2 m , let x ¯ : = ( 1 - x 1 , . . . , 1 - x m ) t , | x | ( = m ) denote the length of x, x [ i ] denote the ith component of x, and hw ( x ) denote the Hamming Weight of vector x, i.e., the number of nonzero components in x. The Euclidean norm of a vector x ∈ R n is given by ∥ x ∥ : = ( ∑ i x i 2 ) 1 / 2 . Let Z q mod q be the set of Z ∩ ( - q 2 , - q 2 ] . For two vectors x ∈ Z 2 n and v ∈ Z 2 n , x ↓ v represents the shrunk vector derived from x by deleting those x [ i ] 's such that v [ i ] = 0 . If x ∈ Z q l , v ∈ Z q l , then x ⊙ v means component-wise multiplication between the two vectors, i.e., x ⊙ v = ( x [ 1 ] · v [ 1 ] , . . . , x [ l ] · v [ l ] ) ∈ Z q l . Given matrix X ∈ Z q m × n , X ↓ v represents the submatrix derived from matrix X by deleting the ith row such that v [ i ] = 0 . For a set X, x ← X denotes sampling x from X according to the uniform distribution and for a distribution χ, x ← χ denotes sampling x according to χ. A function f ( λ ) is negligible if it is O ( λ - c ) for all c > 0 . We use negl ( λ ) to denote a negligible function of λ and PPT to denote probabilistic polynomial-time. 2. Message authentication codes A Message authentication code (MAC) is a triple of algorithms MAC = ( KG , Tag , Vrfy ) with key space K, message space M, tag space T. KG ( 1 λ ) → k . The probabilistic KG algorithm takes security parameter λ ∈ N as input and outputs a secret key k ∈ K . Tag ( k , m ) → σ . The probabilistic TAG algorithm takes the secret key k ∈ K and message m ∈ M as input and outputs the authentication tag σ ∈ T . Vrfy ( k , m , σ ) → 0 / 1 . The deterministic verification algorithm Vrfy takes k ∈ K , m ∈ M , σ ∈ T as input and outputs b ∈ { 0 , 1 } . Correctness. We say that the MAC has correctness error α if for all m ∈ M and λ ∈ N , it holds that Pr [ k ← KG ( 1 λ ) , σ ← Tag ( k , m ) : Vrfy ( k , m , σ ) = 0 ] ≤ α . Security. Now, we illustrate the security notion of (selectively) unforgeable under chosen message attack (uf-cma) which performed by the following interactive experiment Exp MAC , A suf - cma ( λ ) between a challenger C and an adversary A under the security parameter λ. 1) The adversary A submits the challenge message m * to the challenger C. 2) The challenger C runs key generation algorithm k ← KG ( 1 λ ) and keep the key k secret. 3) The adversary A can make TAG k , m * ( · ) queries. Oracle TAG k , m * ( m ) returns the output of Tag ( k , m ) if m ≠ m * and ⊥ if m = m * . 4) Finally, the adversary A outputs σ * to C. If Vrfy ( k , m * , σ * ) = 1 , the challenger C outputs 1; otherwise C outputs 0. Define the advantage of A as Adv MAC , A suf - cma ( λ ) : = Pr [ Exp MAC , A suf - cma ( λ ) = 1 ] . MAC is unforgeable against chosen message attack if for any PPT adversary A in the experiment Exp MAC , A suf - cma ( λ ) , its advantage Adv MAC , A suf - cma ( λ ) is negligible. Remark. Here we consider selectively security of MAC where A has to determine a target message m * to forge at the beginning of the experiment. A stronger security allows A to adaptively choose message m * after its access to oracle TAG k ( · ) . 3. The LPN assumption The Learning parity with noise (LPN) problem[16,17] is a well-known hard problem in the quantum world. Let Ber τ be the Bernoulli distribution over Z 2 with bias τ ∈ ( 0 , 1 / 2 ) (that is, Pr [ x = 1 ] = τ and Pr [ x = 0 ] = 1 - τ if x ← Ber τ ). For l ≥ 1 , Ber τ l denotes the distribution over Z 2 l where l samples are drawn from Ber τ independently. Given x ∈ Z 2 l and τ ∈ ( 0 , 1 / 2 ) , define Λ τ , l ( x ) as an oracle outputting ( r , r t · x ⊕ e ) over Z 2 l × Z 2 , where r ← Z 2 l and e ← Ber τ . Define U l + 1 ( ) as an oracle outputing uniform distribution over Z 2 l × Z 2 . The LPN problem is to distinguish Λ τ , l ( x ) and U l + 1 ( ) . The decisional LPN τ , l assumption suggests the LPN problem is hard. Definition 1 (LPN Assumption)[13] The decisional LPN τ , l problem is hard if for any PPT adversary A, it holds that Pr [ x ← Z 2 l : A Λ τ , l ( x ) = 1 ] - Pr [ A U l + 1 ( ) = 1 ] = negl ( λ ) We describe a Subspace LPN problem[13](SLPN for short). First, define oracle Γ τ , l , d ( x , · , · ) as Γ τ , l , d ( x , A , b ) : = ⊥ , if rank ( A ) < d ( r , r t · ( A · x ⊕ b ) ⊕ e ) , otherwise where r ← Z 2 l and e ← Ber τ . Define oracle U l + 1 ( · , · ) as U l + 1 ( A , b ) : = ⊥ , if rank ( A ) < d ( r , u ) , otherwise where r ← Z 2 l and u ← Z 2 . The adversary is able to query two oracles Γ τ , l , d ( x , · , · ) , U l + 1 ( · , · ) with A and b, and the SLPN problem for the adversary is to distinguish Γ τ , l , d ( x , · , · ) and U l + 1 ( · , · ) . The decisional SLPN τ , l , d + g assumption suggests the SLPN problem is hard, which can be defined formally as below. Definition 2 (SLPN Assumption)[13] Let d , l ∈ Z , the decisional SLPN τ , l , d problem is hard if for any PPT adversary A, it holds that Pr x ← Z 2 l : A Γ τ , l , d ( x , · , · ) = 1 - Pr A U l + 1 ( · , · ) = 1 = negl ( λ ) The SLPN τ , l , d + g assumption can be reduced to the LPN τ , d assumption[18]. Theorem 1[18] For any l , d , g ∈ Z (where l ≥ d + g ), if there exists a PPT adversary A solving the LPN τ , d problem with probability ε after Q tag queries, then there exists another PPT adversary A ' solving the SLPN τ , l , d + g problem with probability ε', where ε ' = ε + 2 Q / 2 g + 1 . 4. The LWE assumption The Learning with errors (LWE) problem is a generalization of LPN problem. It is specified by l , q ∈ N , and error distribution χ over Z q . The error distribution is a discrete Gaussian distribution[19]. Define Λ χ , l , q ( x ) as an oracle outputting ( r , r t · x ⊕ e ) over Z q l × Z q , where r ← Z q l and e ← χ τ , q l . When sampling e ← χ τ , q l , it first picks up x from continuous Gaussian distribution determined by τ (that is, Pr [ x = k ] = 1 τ e - π k 2 / τ 2 ), then outputs the result of ⌊ q · x ⌉ mod q. Lemma 1[20] Define the continuous Gaussian probability distribution over R by its density function D r ( x ) = 1 r e - π x 2 r 2 . Then extend to R n as D r n ( x ) = 1 r n e - π ( ∥ x ∥ ) 2 r 2 . When sampling x ∈ R n from D r n , we have Pr [ ∥ x ∥ > r n : x ← D r n ] < 2 - n . Define U l + 1 , q ( ) be an oracle outputting uniform distribution over Z q l × Z q . The LWE problem is to distinguish Λ χ , l , q ( x ) and U l + 1 , q ( ) . The decisional LWE χ , l , q assumption can be defined formally as below. Definition 3 (LWE assumption)[18]. The decisional LWE χ , l , q problem is hard if for any PPT adversary A, it holds that Pr x ← Z q l : A Λ χ , l , q ( x ) = 1 - Pr A U l + 1 , q ( ) = 1 = negl ( λ ) where oracle Λ τ , l , q ( x ) chooses r ← Z q l , e ← χ and outputs ( r , r t · x + e ) over Z q l × Z q , while oracle U l + 1 ( ) outputs uniform distribution over Z q l × Z q . We describe a Subspace LWE problem[18](SLWE for short). For a Subspace LWE problem, define oracle Γ τ , l , q , d ( x , · , · ) as Γ τ , l , q , d ( x , A , b ) : = ⊥ , if rank ( A ) < d ( r , r t · ( A · x ⊕ b ) ⊕ e ) , otherwise where r ← Z q l and e ← χ τ , q l . Define oracle U l + 1 , q ( · , · ) as U l + 1 , q ( A , b ) : = ⊥ , if rank ( A ) < d ( r , u ) , otherwise where r ← Z q l and u ← Z q . The adversary is able to query two oracles Γ τ , l , q , d ( x , · , · ) , U l + 1 , q ( · , · ) with A ∈ Z q l × l and b ∈ Z q l , and the SLWE problem for the adversary is to distinguish Γ τ , l , q , d ( x , · , · ) and U l + 1 , q ( · , · ) . The decisional SLWE χ , l , q , d assumption suggests the SLWE problem is hard, which can be defined formally as below. Definition 4 (SLWE assumption)[18] Let d , l ∈ Z , q ≥ 2 is a prime, the decisional SLWE χ , l , q , d problem is hard if for any PPT adversary A, it holds that Pr x ← Z q l : A Γ χ , l , q , d ( x , · , · ) = 1 - Pr A U l + 1 , q ( · , · ) = 1 = negl ( λ ) The SLWE χ , l , q , d assumption can be reduced to the LWE χ , q , d assumption[18]. Theorem 2[18] For any l , q , d , g ∈ Z (where l ≥ d + g ) with q a prime, if there exists a PPT adversary A solving the LWE χ , q , d problem with probability ε after Q tag queries, then there exists another PPT adversary A ' solving the SLWE χ , l , q , d problem with probability ε', where ε ' = ε + 2 Q / q g + 1 . Lemma 2[13] For n , t ∈ Z , let Δ ( n , d ) denote the probability that a random matrix in Z 2 n + d × n has rank less than n, then Δ ( n , d ) < 2 - d . III. MAC from LPN and LWE In this section, we present the MAC schemes based on LPN and LWE. We note that these schemes are implicitly contained in Ref.[13]. Here we will present refined versions of the MAC schemes. 1. MAC from LPN The LPN-based message authentication code scheme MAC LPN = ( KG , Tag , Vrfy ) is given as follows, and it was noted that MAC LPN is unforgeable against selectively chosen message attack[13] (without explicit proof). The key space is K = Z 2 2 l , message space M = Z 2 l and tag space T = Z 2 ( l + 1 ) n . The public parameter is given by pp = ( λ , n , l , τ ' ) where λ denotes the security parameter, n, l ∈ Z such that l > n + ω ( log ( λ ) ) , τ ' = 1 / 4 + τ / 2 , and τ determines the Bernoulli distribution Ber τ . To clearly describe the scheme, we define an encoding function Ω ( · ) which maps a vector m ∈ Z 2 l into another v ∈ Z 2 2 l . More precisely, for i ∈ [ l ] , v : = Ω ( m ) satisfying v [ 2 i - 1 ] = 1 , v [ 2 i ] = 0 if m [ i ] = 1 v [ 2 i - 1 ] = 0 , v [ 2 i ] = 1 if m [ i ] = 0 Function Ω ( · ) guarantees that Ω ( m ) has hamming weight l. Specific construction of MAC LPN is shown as follows. KG ( 1 λ ) : sample x ← Z 2 2 l and return x. Tag ( x , m ) : sample R ← Z 2 l × n , e ← Ber τ n , set v : = Ω ( m ) , compute z : = ( R t · x ↓ v + e ) and return σ = ( R , z ) . Vrfy ( x , m , σ ) : parse σ = ( R , z ) , and set v : = Ω ( m ) . If rank ( R ) = n and hw ( R t · x ↓ v - z ) ≤ τ ' n , return 1; otherwise, return 0. Correctness For MAC LPN to be correct, two conditions must be satisfied. Firstly, R should be full rank. In the scheme, R is uniformly chosen from Z q l × n . It is full rank with overwhelming probability by Lemma 2. Secondly, the hamming weight of the noise e = R t · x ↓ v - z ∈ Ber τ n should be less than n · τ ' . Owing to the fact that e ← Ber τ n , the probability that the hamming weight of e is larger than k can be expressed as Pr [ hw ( e ) > k ] = ∑ i = k + 1 n n i τ i ( 1 - τ ) n - i According to Hoeffding inequality, if there exists some ϵ > 0 such that k = ( τ + ϵ ) n , then Pr [ hw ( e ) ≥ ( τ + ϵ ) n ] ≤ e - 2 ϵ 2 n Let ϵ = 1 4 - τ 2 , we know ϵ > 0 due to τ ∈ ( 0 , 1 2 ) . Then, the correctness can be obtained by setting τ ' = τ + ϵ , i.e., Pr hw ( e ) > n · τ ' : e ← Ber τ n < 2 - τ 2 2 n 2. MAC from LWE The key space K = Z q 2 l , message space M = Z 2 l and tag space T = Z q ( l + 1 ) n . The public parameter is given by pp = ( λ , n , l , q , τ ' ) where λ denotes the security parameter, q > 2 is a prime, n, l ∈ Z such that l > n + ω ( log ( λ ) ) , τ ∈ ( 0 , 1 ) , and τ ' = 1 / 4 + τ / 2 determines the discrete Gaussian distribution χ τ , q l . The message authentication code MAC LWE = ( KG , Tag , Vrfy ) is shown as follows. KG ( 1 λ ) : sample x ← Z q 2 l and return x. Tag ( x , m ) : sample R ← Z q l × n , e ← χ τ , q n , set v : = Ω ( m ) , compute z : = ( R t · x ↓ v + e ) and return σ = ( R , z ) . Vrfy ( x , m , σ ) : parse σ = ( R , z ) , and set v : = Ω ( m ) . If rank ( R ) = n and ∥ R t · x ↓ v - z ∥ ≤ ⌊ q 4 ⌋ n τ ' , return 1; otherwise, return 0. Correctness. For MAC LWE to be correct, two conditions must be satisfied. Firstly, R should be full rank. In the scheme, R is uniformly chosen from Z q l × n . It is full rank with overwhelming probability by Lemma 2. Secondly, the Euclidean norm of vector R t · x ↓ v - z should be less than ⌊ q 4 ⌋ n τ ' . Note that, if the tag z is generated by Tag algorithm, then e = R t · x ↓ v - z follows χ τ , q l distribution. Recall that the χ τ , q distribution is defined as follow: it first picks up x from continuous Gaussian distribution D τ where D τ is described by this probability density function Pr [ x = k ] = 1 τ e - π k 2 / τ 2 , then sets e = ⌊ q · x ⌉ mod q . Note that each component of e can be expressed as e i = ⌊ q · x i ⌉ mod q. Then, Eq.(1) is owing to ( ⌊ q · x i ⌉ mod q ) ≤ ⌊ q · | x i | ⌉ . Eq.(2) follows from the fact that ⌊ | x | ⌉ ≤ | x | + 1 2 . We know q | x | + 1 2 ≤ 2 q | x | when | x | ≥ 1 2 q . If | x | ∈ ( 0 , 1 2 q ) , it doesn't affect ∥ e ∥ because ⌊ q | x | ⌉ = 0 . Hence, by enlarging q | x | + 1 2 to 2 q | x | , Eq.(3) follows. Let y i = 2 q x i , y i follows Gauss distribution with mean value of 0 and standard deviation of 2 q τ , which leads to Eq.(4). Eq.(5) is according to Lemma 1. Pr ∥ e ∥ > ⌊ q 4 ⌋ n τ ' : e ← χ τ , q n ] = Pr [ e 1 2 + ⋯ + e n 2 > ⌊ q 4 ⌋ n τ ' : e i ← χ τ , q ] ≤ Pr [ ⌊ q | x 1 | ⌉ 2 + ⋯ + ⌊ q | x n | ⌉ 2 > ⌊ q 4 ⌋ n τ ' : x i ← D τ ] (1) ≤ Pr [ ( q | x 1 | + 1 2 ) 2 + ⋯ + ( q | x n | + 1 2 ) 2 > ⌊ q 4 ⌋ n τ ' : x i ← D τ ] (2) ≤ Pr [ ( 2 q | x 1 | ) 2 + ⋯ + ( 2 q | x n | ) 2 > ⌊ q 4 ⌋ n τ ' : x i ← D τ ] (3) = Pr [ | y 1 | 2 + ⋯ + | y n | 2 > ⌊ q 4 ⌋ τ ' n : y i ← D 2 q τ ] (4) = Pr [ ∥ y ∥ > ⌊ q 4 ⌋ τ ' n : y ← D 2 q τ n ] < 2 - c n , c is a constant (5) IV. F-Related-Key-Attack for MAC 1. F-Related-key-attack for MAC F-Related-key-attack ( F-RKA attack) considers active adversaries who can obtain the outputs of the cryptographic system under not only the original key k, but also some related keys f ( k ) where f is adaptively chosen from F by A. Now, we illustrate the security notion of F-RKA secure which performed by the following experiment Exp MAC , A suf - F - RKA - cma ( F , λ ) between a challenger C and an adversary A under the security parameter λ. 1) The adversary A submits the challenge message m * to the challenger C. 2) The challenger C runs key generation algorithm k ← KG ( 1 λ ) and keeps the key k secret. 3) The adversary A can make RKA k , m * ( · , · ) queries. Oracle RKA k , m * ( m , f ) returns the output of Tag ( f ( k ) , m ) if m ≠ m * and ⊥ if m = m * . 4) Finally, the adversary A outputs σ * to C. If Vrfy ( k , m * , σ * ) = 1 , the challenger C outputs 1; otherwise C outputs 0. MAC is suf - F - RKA - cma secure if for any PPT adversary A in Exp MAC , A suf - F - RKA - cma ( F , λ ) , its advantage Adv MAC , A suf - F - RKA - cma ( λ ) Adv MAC , A suf - F - RKA - cma ( λ ) : = Pr [ Exp MAC , A suf - F - RKA - cma ( F , λ ) = 1 ] is negligible. 2. Security proof Theorem 3 MAC LPN ( MAC LWE ) is suf - F - RKA - cma secure with F = { f Δ : x ↦ x + Δ | Δ ∈ Z 2 l ( Δ ∈ Z q l ) } . More precisely, if there exists a PPT algorithm A who implements suf - F - RKA - cma attack with advantage ε in Exp MAC , A suf - F - RKA - cma ( F , λ ) , a PPT algorithm A ' can be constructed to implement suf - cma attack with the same advantage ε in Exp MAC , A ' suf - cma ( λ ) . Theorem 4. MAC LWE is suf - F - RKA - cma secure with F = { f Δ : x ↦ x + Δ | Δ ∈ Z q l } . More precisely, if there exists a PPT algorithm A ¯ who implements suf - F - RKA - cma attack with advantage ε in Exp MAC , A ¯ suf - F - RKA - cma ( F , λ ) , a PPT algorithm A ¯ ' can be constructed to implement suf - cma attack with the same advantage ε in Exp MAC , A ' ¯ suf - cma ( λ ) . Proof We only give the proof for MAC LPN . As for MAC LWE , the proof is almost the same except Δ ∈ Z q l . Given a PPT adversary A for Exp MAC , A suf - F - RKA - cma , we construct another PPT adversary A ' for Exp MAC , A ' suf - cma . To invoke A, A ' simulates Exp MAC , A suf - F - RKA - cma for A as follows. 1) If A submits a target message m * ∈ M to A ' . Then, A ' will transfer m * to its own experiment as a target message. 2) If A makes a tag query ( m , f ▵ ) to oracle RKA k , m * ( · , · ) , then A ' asks m to its own oracle TAG k , m * ( · ) and gets the answer σ ' = ( R , z ' ) . Then A ' computes z = z ' + R t ▵ ↓ v with v = Ω ( m ) , and sends σ = ( R , z ) to A. 3) If A outputs σ * = ( R * , z * ) . A ' will output ( m * , σ * ) as its own forgery. Obviously, Exp MAC , A ' suf - cma outputs 1 (i.e., A ' wins) if Vrfy ( k , m * , σ * ) = 1 , rank ( R * ) = n and | R * t · s ↓ v * * - z * | ≤ τ ' n . A ' perfectly simulates Exp MAC , A suf - F - RKA - cma since ( R , z ) = ( R , R t ( x + ▵ ) ↓ v + e ) = ( R , R t · x ↓ v + e ) + ( 0 , R t ▵ ↓ v ) = ( R , z ' ) + ( 0 , R t ▵ ↓ v ) . If Exp MAC , A suf - F - RKA - cma ( F , λ ) outputs 1 for the ( m * , σ * ) submitted by A, then Vrfy k ( m * , σ * ) = 1 , which implies Exp MAC , A ' suf - cma ( λ ) = 1 . Hence, Pr Exp MAC , A suf - F - RKA - cma ( F , λ ) = 1 = Pr Exp MAC , A ' suf - cma ( λ ) = 1 = ε A natural question is: is it possible for MAC LPN to resist more complicated RKA attacks for affine functions? In other words, can we enlarge F = { f Δ : x ↦ x + Δ } to the set of affine functions? We first introduce two lemmas. Lemma 3 For matrix A ∈ Z q 2 l × 2 l , vector x ∈ Z q 2 l , v ∈ Z 2 2 l ( hw ( v ) = l ) , then ( A x ) ↓ v = A ↓ v x . Proof Assume that A t = [ a 1 , . . . , a 2 l ] . Then, A x = a 1 t x , a 2 t x , ⋯ , a 2 l t x t . Suppose v [ i j ] = 1 for j ∈ [ l ] , then we have ( A x ) ↓ v = a i 1 t x ⋮ a i l t x = a i 1 t ⋮ a i l t · x = A ↓ v x Lemma 4 For matrix A ∈ Z q l × l , vector x ∈ Z q l , u ∈ Z 2 l , matrix U ii = u [ i ] and U ij = 0 ( i ≠ j ) , we have A · ( x ⊙ u ) = ( A · U ) · x . (6) Proof Let x i , u i , a i j ( i , j ∈ [ l ] ) denote the com-ponent of x, u and A, respectively. In Eq.(6), the ith component of the left side is: a i 1 ( x 1 ⊙ u 1 ) + ⋯ + a i l ( x l ⊙ u l ) while the ith component of the right side is a i 1 u 1 x 1 + ⋯ + a i l u l x l . The left side is equal to the right side. Before presenting the theorem, we define an algorithm Fill v which converts matrix R l × n or x ∈ Z 2 l to matrix R 2 l × n ' or x ' ∈ Z 2 2 l with v = Ω ( m ) where m ∈ Z 2 l . Fill v expands R or x by inserting l zero rows according to v, and its specification is shown in Algorithm 1. For R l × n , R ¯ 2 l × n , A l × w , and v = Ω ( m ) where m ∈ Z 2 l , we have R l × n = ( Fill v ( R l × n ) ) ↓ v (7) R t A = Fill v ( R ) t Fill v ( A ) (8) R ¯ t Fill v ( A ) = ( R ¯ ↓ v ) t A (9) Theorem 4 MAC LPN is suf - F - RKA - cma secure with F = { f A , b : x ↦ A x + b | A ∈ Z 2 2 l × 2 l , b ∈ Z 2 2 l , A isadiagonalmatrix , rank ( submatrix ( A ) l × l ) ≥ d } . More precisely, if there exists a PPT algorithm A who implements suf - F - RKA - cma attack with advantage ε in Exp MAC , A suf - F - RKA - cma ( F , λ ) , then a PPT algorithm A ' can be constructed to distinguish the SLPN distribution and uniform distribution with the advantage ε - 2 - c τ · n . Proof Given a PPT algorithm A, we construct another PPT algorithm A ' which has access to oracle Γ τ , 2 l , d ( s , · , · ) or oracle U l + 1 ( · , · ) . Recall that oracle Γ τ , 2 l , d ( s , · , · ) takes matrix A and b as input, returns a pair ( R , R t · ( A x + b ) + e ) if rank ( A ) ≥ d and ⊥ otherwise, and U l + 1 ( · , · ) takes matrix A and vector b as input and returns a random pair. The aim of A ' is to distinguish the SLPN distribution output by Γ τ , 2 l , d ( s , · , · ) and uniform distribution output by U l + 1 ( · , · ) . To invoke A, A ' simulates Exp MAC , A suf - F - RKA - cma for A as follows. 1) A submits a target message m * ∈ M to A ' . Then A ' computes v * : = Ω ( m * ) and samples s * ← Z 2 2 l . A ' implicitly sets the secret key of MAC LPN as x : = ( s * ⊙ v * ) + ( s ⊙ v * ¯ ) . Clearly, x ↓ v * = s ↓ v * * . 2) If A makes a RKA k , m * ( · , · ) query with ( m , f A , b ) where f A , b is specified by ( A , b ), then A ' checks if rank ( submatrix ( A ) ) l × l ≥ d , and returns ⊥ if not. Then A ' computes v : = Ω ( m ) , encodes v * ¯ into a diagonal matrix V such that V ii = v * ¯ [ i ] for 1 ≤ i ≤ 2 l , and 0's elsewhere and computes A ˜ : = A ↓ v · V and A ^ := Fill v ( A ˜ ) . Besides, A ' submits ( A ^ , 0 ) to its own oracle, which is Γ τ , 2 l , d ( s , · , · ) or U l + 1 ( · , · ) and obtain ( R ^ , z 1 ) to compute z 0 = R t · A ↓ v · ( s * ⊙ v * ) where R = ( R ^ 2 l × n ) ↓ v , and sets z : = z 0 + z 1 + R t · b ↓ v . Finally, A ' returns ( R , z ) to A. 2) If A outputs σ * = ( R * , z * ) , A ' runs Vrfy ( k , m * , σ * ) algorithm to check if rank ( R * ) = n and | R * t · s ↓ v * * - z * | ≤ τ ' n . A ' outputs ( m * , σ * ) if yes, and ⊥ otherwise. First, we claim that rank( A ^ ) ≥ d . Note that A ^ = Fill v ( A ↓ v · V ) , so there are l zero row vectors depending on v an