Lattice signatures using NTRU on the hardness of worst‐case ideal lattice problems

IET Information SecurityVolume 14, Issue 5 p. 496-504 Research ArticleFree Access Lattice signatures using NTRU on the hardness of worst-case ideal lattice problems Dipayan Das, Dipayan Das Department of Mathematics, NIT Durgapur, Durgapur, West Bengal, IndiaSearch for more papers by this authorVishal Saraswat, Corresponding Author Vishal Saraswat vishal.saraswat@gmail.com orcid.org/0000-0001-7082-9568 Robert Bosch Engineering & Business Solutions Pvt Ltd (RBEI/ESY), Bangalore, IndiaSearch for more papers by this authorKajla Basu, Kajla Basu Department of Mathematics, NIT Durgapur, Durgapur, West Bengal, IndiaSearch for more papers by this author Dipayan Das, Dipayan Das Department of Mathematics, NIT Durgapur, Durgapur, West Bengal, IndiaSearch for more papers by this authorVishal Saraswat, Corresponding Author Vishal Saraswat vishal.saraswat@gmail.com orcid.org/0000-0001-7082-9568 Robert Bosch Engineering & Business Solutions Pvt Ltd (RBEI/ESY), Bangalore, IndiaSearch for more papers by this authorKajla Basu, Kajla Basu Department of Mathematics, NIT Durgapur, Durgapur, West Bengal, IndiaSearch for more papers by this author First published: 01 September 2020 https://doi.org/10.1049/iet-ifs.2019.0580AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Recently, lattice signatures based on the Fiat-Shamir framework have seen a lot of improvements which are efficient in practice. The security of these signature schemes depends mainly on the hardness of solving short integer solutions (SIS) and/or learning with errors problem in the random oracle model. The authors propose an alternative lattice-based signature scheme on the Fiat-Shamir framework over the ring . The key generation in the signature scheme is based on the combination of NTRU and Ring SIS like key generation. Both the signature and the verification are done efficiently by doing polynomial convolutions in the ring . The proposed signature scheme is provably secure based on the hardness of the Ring SIS problem in the random oracle model. The scheme is also efficient up to constant factors as the highly practical schemes which have provable secure instantiation. 1 Introduction Recently, lattices have been found to be of immense importance in cryptography. The traditional number-theoretic hardness assumptions (like factoring and discrete log problems) are not safe against quantum algorithms [1], but the hard lattice problems are believed to have negative quantum threats. Further, the worst-case to average-case reduction for short integer solutions (SIS) and learning with errors (LWE) problem [2, 3] and its ring variants [4, 5] make them an attractive choice for designing cryptographic primitives. Many lattice-based schemes for public key encryption [3, 5-9], signature [10-13], identity-based encryption [14], fully homomorphic encryption [15, 16] and so on have been proposed over the years. The lattice-based encryption schemes have seen a lot of improvements, in both computational and space requirements, in the last decade and many provably-secure schemes [3, 5, 8, 9], almost as practical as the NTRU [7], have been proposed. These encryption schemes are almost at par with the traditional number-theoretic cryptographic schemes. However, the trade-off between the signature size and the key size, time for a signature generation and the practical and provable security is not necessarily optimal for lattice-based signature schemes. Hence, more improvements are required for making signature schemes at par with the number-theoretic signature schemes. The initial lattice-based signature schemes [6, 17] were proven to be insecure and were broken [18, 19]. To mitigate the threat, some new signature schemes were proposed [20, 21], but the improved attack of Ducas and Nguyen [22] fail to give necessary security. Later, some signature schemes were proposed [11-13, 23], which have worst-case security guarantee. To improve efficiency, the signature scheme in [24] has considered some non-standard computational assumptions related to lattice problems, which are always under scrutiny [25, 26]. 1.1 Related work Currently proposed lattice-based signatures can be broadly distinguished into two categories. One which follows 'hash and sign' framework [27], and other which follows Fiat-Shamir framework [28]. The first category uses a method called trapdoor sampling for lattices, proposed by Gentry et al. [11], which uses a short basis of the underlying lattice as a trapdoor. Since then, this sampling algorithm has become a key part in many lattice-based constructions, like hierarchical identity-based encryption [29, 30], multi-linear map [31], encryption scheme [11]. Ducas et al. [14] used this sampling method to construct a signature scheme on the NTRU lattice, which is further studied in Falcon [32]. The main drawback is the trapdoor sampling method, which is still a complex operation after many years of research [33-36], requiring high running time. The second category is based on the Fiat-Shamir framework [28]. These signatures are simple and efficient in both running time and space requirement. Lyubashevsky [12] proposed the first scheme on this framework, which is on the Ring SIS problem. Lyubashevsky further studied the work in [13], where it is shown how to extend the result from Ring SIS to Ring LWE problem to get better efficiency in the signature and key size. Later, Bai and Galbraith [23] introduced a compression technique to reduce the signature size of the Fiat-Shamir type signatures. In [37], the signature scheme of [23] has been further studied by the name TESLA, where the authors have provided with a tight security proof from the LWE problem. The ring version of TESLA has been proposed in [38], which is on the hardness of the Ring LWE problem. The TESLA signature scheme in the quantum random oracle model has been studied in [39]. In BLISS [10], a signature scheme with further tricks has been proposed to reduce the signature size, which is on the hardness of the NTRU problem. In [40], a new signature scheme is proposed on a variant of the Ring SIS problem, which can be based on many Ring SIS problems. In the signature scheme, Dilithium [41], an improved compression technique from [23] has been proposed, which is on the Module LWE problem. 1.2 Ring SIS on Fiat-Shamir framework In this section, we discuss the working principle of the Fiat-Shamir lattice-based signature schemes, which is on the Ring SIS problem. Let be a polynomial ring (generally of the form or ). The key generation algorithm uniformly samples from the low norm elements in , from and computes . The algorithm returns signing key and verification key . The signing algorithm, in order to sign a message , first samples randomly from a low norm distribution (generally discrete Gaussian or uniform) and computes and , , where H is the required cryptographic hash function which acts as the random oracle. The algorithm returns as the potential signature after applying one additional step, called rejection sampling step, which is discussed in Section 2.3. The verification algorithm accepts as a valid signature if all s are small, and . In the security proof, it can be shown that forging signatures is as hard as solving the Ring SIS problem in the ring . The secrets 's are generally chosen uniformly at random from the low norm elements in . Is it possible to choose secrets like NTRU secrets? Is it still possible to achieve security based on the lattice problem which allows worst-case to average-case reduction? We answer these questions in this paper. 1.3 Our contribution The main contribution of this paper is to give a variant of the signature scheme on the Fiat-Shamir framework with the feature that the secrets can be chosen according to the NTRU secrets, and the scheme is still secure on the hardness of the Ring SIS problem. To prove the security of our scheme, we introduce a variant of the Ring SIS problem, which we call Ring NSIS problem, and show that the Ring NSIS problem is at least as hard as the Ring SIS problem and that forging our proposed signature is at least as hard as the Ring SIS problem. NTRU secrets provide more flexibility in choosing the parameters, resulting better secret key and signature size than using Ring SIS secrets [13, 40]. The hardness of the new signature scheme from the Ring SIS problem then allows having the security on the worst-case lattice problems. The Ring NSIS problem asks to find non-trivial with small norm such that given uniformly random and generated like the NTRU public keys. We have shown the Ring NSIS problem is at least as hard as the Ring SIS problem in some ring . The public key of the signature scheme is an Inhomogeneous Ring NSIS instance , and g such that , where has small norm. A signature on a message M is generated by sampling small norm and computing and . The rejection sampling step is applied before outputting the signature on the message M. The verification is done by checking whether all the s are small and . In this paper, we have considered as the ring , where n is a power of two, q is a prime of the form . In such a ring, polynomial multiplication can be done efficiently (in time ) using fast Fourier transformation. This polynomial multiplication is usually called the convolution product, which is the only major operation needed in the proposed scheme. The basic signature scheme is given in Section 4. The security analysis of the signature scheme is given in Section 5. The parameters of the signature scheme are given in Section 3. We also show how to optimise the parameters to get a better result in Section 6 from the idea given in [13]. 2 Preliminaries Here we introduce the notations used in the paper, some relevant definitions, computational problems and hardness assumptions. 2.1 Notations We will denote to represent x is sampled according to the distribution D. If S is a finite set, then will represent x is sampled uniformly at random from the set S. Throughout the paper, we will use n a power of 2 and q a prime modulus of the form . This choice admits an optimised implementation that works over the entire field and is very fast on modern architectures. Any element in will be represented by integers within the interval Whenever we will consider elements in , we will assume that all operations end with a reduction modulo q (unless stated otherwise). We will denote to the ring modulo . By we represent the elements of R whose coefficients are in . For any integer , represent the elements in R whose coefficients are in the interval . All logarithms used in this paper are base 2. Definition 1.(Anticirculant matrix): An n dimensional anticirculant matrix corresponding to is defined as where is the coefficient of in f. Definition 2.(Convolution product): Let . The convolution product of is denoted by and is defined by where represents the coefficient vector of the polynomial g. That is, if then the k th coordinate of h is One can easily check that the convolution product is associative and commutative. That is, for all, We will use polynomials in R and vectors in as the same data type. The norm of a polynomial is just the Euclidean norm of the corresponding vector. For example, means . By , we mean , , respectively. We will write to represent m vectors in R, that is , where . By we mean . We denote the inverses of and so on in as , respectively. We also denote and so on to represent the set of all invertible elements in , respectively. Then, for all, Finally, we define , and by (1) (2) (3) Definition 3.(Discrete Gaussian distribution): The m dimensional discrete Gaussian distribution function is defined as where is the continuous normal distribution over with centre c and standard deviation and is defined by Additionally, which is a scaling factor to make the function a probability distribution. We write when . We have the following result on discrete Gaussian distribution over from the full version of [13]: Lemma 1.. 2.3 Rejection sampling One important characteristic needed in the lattice-based signature schemes is the signature distribution must be free of the signing key. There are two main reasons for this strategy. The first reason is due to an attack proposed by Nguyen and Regev [19]. Nguyen and Regev [19] have shown how to find the secret verification key on the lattice-based signature schemes using the signature distribution. Secondly, unlike number-theoretic signature schemes, where we add a random ring element while signing making the signature distribution uniform in the whole ring (and hiding information about the secret key), we cannot just add any random lattice element as we want short signatures too. So, we choose an element from some narrow distribution (generally from a discrete Gaussian distribution with small standard deviation or a uniform distribution with small norm) and apply rejection sampling to make the distribution of the signature free from the secret signing key. We explain briefly about the rejection sampling mechanism. Let g be the signature distribution obtained by selecting a random element from some distribution D and adding secret key dependent value. If for a distribution function f there exists a small constant and for all x, then if one sample and output with probability , the resulting distribution is statistically close to the distribution sample and output with probability . Finally, the distribution obtained from f has no dependency on the secret key. There are mainly two types of rejection sampling known in the literature; one uses discrete Gaussian distribution, and the other uses uniform distribution. When both the distributions f and D are discrete Gaussian, can be set to a small constant and the signature distribution g is statistically close to the distribution of f. Discrete Gaussian based rejection is used in the signature schemes [10, 13, 40]. When both f and D are low norm uniform distribution, the rejection sampling part outputs signature from the distribution g if the norm is smaller than some predefined value, which defines the distribution f. Uniform based rejection sampling is used in the signature schemes [12, 24, 38]. In this paper, we consider the discrete Gaussian based rejection sampling. We have the following theorem, which is adapted from [13]. Theorem 1.Let V be a subset of in which all elements have norm less than T, r be some element in such that , and g is a probability distribution from V to . Then there exists a constant such that the following algorithm: ; ; Output with probability is within the statistical distance of the distribution of the following algorithm: ; ; Output with probability Further, with probability at least , the first algorithm outputs something. 2.4 Computational hard problems In this subsection, we will define the problems which will be used in our signature scheme. Problems like Homogeneous Ring SIS, NTRU are already well studied in the literature. We define a new problem called the Homogeneous Ring NSIS problem (Definition 7) and have shown that solving it is no easier than solving the Homogeneous Ring SIS problem. Definition 4.(NTRU lattice): Let and . The NTRU lattice corresponding to g and q is defined as It is easy to verify that is a full rank lattice of and a basis of is where and represent the order n identity and zero matrix, respectively. Definition 5.(NTRU problem): Given such that where have small norm, find polynomials . NTRU problem is equivalent to finding a short vector in the NTRU lattice, which has been conjectured to be a hard problem. The hardness lies with the fact that if we take two random small polynomials , then is indistinguishable from random in . The NTRU problem is investigated from the early time of NTRU cryptosystem [7] and is well studied in [42-44]. Many improvements of NTRU have been proposed since then for improving hardness result of the NTRU problem [9, 45]. Stehlé and Steinfeld [9] have shown if the polynomials and f are selected by rejection from a discrete Gaussian distribution with standard deviations approximately , then the polynomial g, which is their ratio, is uniform in . Definition 6.(Homogeneous Ring problem): Given , find a non-trivial such that with . For a (non-trivial) solution of the Homogeneous Ring SIS problem, it is important to have . It can be shown that if , then with high probability, the solution of the Homogeneous Ring SIS problem is not unique, and finding a solution for is at least as hard as solving -approximate shortest vector problem in all ideal lattices of [4]. We have the following theorem from [4], which has the worst-case to average-case connection and guarantees the hardness of solving the Homogeneous Ring SIS problem. Theorem 2.For , if there exists an algorithm that solves the Homogeneous Ring problem, then there exists another algorithm with approximately same time complexity that solves for any ideal lattices of , where . Definition 7.(Homogeneous Ring problem): Given and generated independently like the NTRU problem, find a non-trivial such that with . The next lemma shows Homogeneous Ring problem is at least as hard as the Homogeneous Ring problem. Lemma 2.There exists a polynomial-time reduction from Homogeneous Ring problem to Homogeneous Ring problem. Proof.Given a Homogeneous Ring instance , we generate like the NTRU problem such that each polynomial is invertible in and define , where . Note that because each is invertible in , so the transformation maps the uniform to uniform . Thus, is a valid Homogeneous Ring NSIS instance.We give to the oracle which solves the Homogeneous Ring problem. Let be the oracle output. That is and .We claim that is the solution of the Homogeneous Ring problem. This follows since and . □ Definition 8.(Inhomogeneous Ring problem): Given , generated independently like the NTRU problem and , find a such that with . Lemma 3.Let be a deterministic function and are finite sets with . If , then with probability at least , there exists another such that . The next lemma shows a probabilistic polynomial-time reduction from the Homogeneous Ring problem to the Inhomogeneous Ring problem. Lemma 4.For , if there is a polynomial-time algorithm which solves the Inhomogeneous Ring problem with probability , then there exists a polynomial-time algorithm which solves the Homogeneous Ring problem with probability at least . Proof.Let us consider the function defined as , where are same as in Definition 8 and is chosen uniform at random from . Since and , implies is uniformly random in . Thus, the domain and range size of the function is and , respectively. If , the domain size is greater than times of the range size. By Lemma 3, there exists another such that .Let be an instance of the Homogeneous NSIS problem. We choose a such that and set . We give to the Inhomogeneous oracle. Since it is perfectly indistinguishable whether or was used to generate g (because both of them have the equal chance of being chosen), so the oracle outputs such that with probability at least . Thus, with the above probability, we have a solution of the Homogeneous problem as , since and . □ 2.5 Digital signatures A digital signature consists of three efficient algorithms: KeyGen : It takes the security parameter as input, and output a pair of key , where pk is called the public key (or verification key) and sk is called the secret key (or signing key). This algorithm is called the key generation algorithm. Sign : It takes the secret key sk and message M to be signed as input, and output a signature . This algorithm is called the signature generation algorithm. Ver : It takes the public key pk and message-signature pair as input, and output accept/reject. This algorithm is called the verification algorithm. 2.5.1 Correctness The verification algorithm should output accept when a signature is generated by an honest signer with high probability. That is where the probability is taken over the randomness of the signing and the verification algorithms. 2.5.2 Strong unforgeability Informally, strong unforgeability states that it is computationally infeasible for an adversary, who does not possess a secret key, to create a new signature for any message of his choice (including the one whose signature he has seen), that will output accept by the verification algorithm. In the random oracle model (ROM), the adversary is also allowed to query any hash value (which act as the random oracle) of his choice during the attack. Definition 9.(Strong unforgeability): A digital signature scheme (KeyGen, Sign, Ver) is said to have the strong unforgeability security notion in the ROM if for any probabilistic-polynomial-time (PPT) adversary with the public key pk, having polynomially many access to the random oracle and message-signature pair for any s messages of his choice, outputs a message-signature pair , then Ver happens with negligible probability. The signature scheme proposed in this paper satisfies the strong unforgeability notion. We show the strong unforgeability notion is provably secure based on the hardness of solving the Homogeneous Ring SIS problem in the ROM. 3 Parameter selection for the proposed signature scheme In this section, we use the parameters as defined in Table 1. Table 1. Sample instantiation of the scheme Parameters Definitions Sample instantiations security parameter in bits 103 265 n integer, power of 2 512 1024 q prime of the form m integer 5 5 d real number 40 40 integer such that 15 38 k integer 30 38 r real number 136,610 619,945 7.4 7.4 R ring ring , centre-lifted coefficients set set H random oracle that map elements from to signature size in bits 49,616 110,406 signing key size in bits 15,182 32,085 verification key size in bits 90,224 191,938 root Hermite factor required for a forging signature 1.007 1.004 We want bits security for our hash function H, which acts as the random oracle. So, we will assume the hash function will output bits. It is to be noted that for obtaining bits secure digital signatures using the Fiat-Shamir framework, a random oracle that outputs bits is only required (i.e. collision-resistance property is not required). In general, finding collisions in the random oracle permit the signer to generate two different messages that have an identical signature, but this does not help to forge signatures [13]. In the signature scheme, we need the output of the hash function of a particular form. For this, initially a cryptographic hash function is used that outputs binary strings in the set (i.e. hash function with bits of security is considered) and then a one-to-one mapping is applied to the set to get the hash function . The idea of such a mapping is given in [10, 24], which can be implemented in linear time. The parameters r and are chosen carefully so that there is a balance between the statistical distance of the two distributions (as in Theorem 1) and . The secret key consists of m polynomials, each of which is a degree less than n polynomial with the absolute value of the coefficients less than k. So, the size of the secret key is approximately bits. The public key is . As mentioned earlier, to reduce the public key size, can be included in the signing and verification algorithm. So, the public key size depends on the polynomials in , which has size approximately bits. The signature size depends mainly on . From Lemma 1, we know that the absolute values of each coefficient of all the polynomials are less than with probability greater than . So, the size of the signature is approximately . 4 Basic signature scheme The key generation algorithm outputs the signing and verification key as and , respectively. The signature generation algorithm outputs the signature on any message as along with the hash value . The rejection sampling method ensures the distribution of is statistically close to the distribution of (by Theorem 1), which follows discrete Gaussian distribution. The verification algorithm outputs accept if is small and . We now describe our proposed signature scheme in detail (see Fig. 1). KeyGen : The key generation algorithm first samples from , from , and from . Then it computes and . The signing key is and the verification key is . The verification key is, in fact, an instance of the Inhomogeneous Ring NSIS problem from Definition 8. Fig. 1Open in figure viewerPowerPoint Proposed signature scheme If proper randomness is accessible, then everyone can have the same , which significantly reduces the size of the public key as can be included in the signature generation and verification algorithms. Sign : The signing algorithm, to sign a message M, first samples from the discrete Gaussian distribution and computes , where H is a hash function as defined in Table 1. Then it computes (reduction is not required here). Finally, the rejection sampling step is applied, and the signature generation algorithm outputs the signature with probability If the signature generation algorithm outputs nothing, the signer needs to repeat the algorithm. The expected number of times the signer needs to run the signing algorithm is in order to get a signature. Ver : The verification algorithm accept a signature of a message M if (this is due to Lemma 1) and 4.1 Correctness of the proposed scheme A signature is valid if the random oracle inputs during the signature generation and verification algorithms are the same. We will show that is indeed a valid signature. Note that The last equality shows that is indeed a valid signature since 5 Security analysis of the proposed scheme In this section, we will discuss the security of the proposed scheme. The adversary can break the scheme in either of the two ways. He can either recover the signing key from the verification key or produce a forged signature on any message. In Section 5.1, we will discuss the hardness of recovering the signing key. In Section 5.2, we will discuss the hardness of forging signatures. The possibility of an adversary recovering the signing key from the signature distribution (like the attack provided in [19, 22]) can probably be neglected due to the rejection sampling step (Theorem 1). 5.1 Hardness of recovering the secret key from verification key The adversary can recover the signing key in one of the three ways: He can find from . But this is an instance of the NTRU problem, which is a hard problem. There have been more recent attacks [26, 46] on NTRU but those are on 'overstretched' parameters, which do not apply in our sample instantiations. He can find from , thus can learn about . But is an instance of the Inhomogeneous Ring problem which is at least as hard as the Homogeneous Ring problem (the proof is similar to Lemma 4 and is thus omitted). He can learn about from , but this is an instance of the Inhomogeneous problem, which is at least as hard as the Homogeneous Ring problem (Lemma 4). Both the average-case problems, Homogeneous SIS and NSIS, give worst-case security guarantee as given in Theorem 2. Thus, we conclude that a polynomial-time adversary knowing the verification key , cannot recover the private signing key . 5.2 Strong unforgeability In this subsection, we will show that forging signature is as hard as solving the Homogeneous Ring SIS problem. First, we show how to simulate signatures in the proof without the knowledge of the secret key (Theorem 3). Then we show how one can use the potential adversary, who forges a signature, to solve the Homogeneous Ring SIS problem (Theorem 4). The result of Theorem 4 then permits one to solve worst-case ideal lattice problems in (Theorem 2). Lemma 5.If , then with probability at least , there exists another secret signing key corresponding to a verification key. Proof.Let is a verification key generated using the key generation algorithm, then the signing key must satisfy the following equation: Since is uniformly random in and each polynomial in is invertible in , so is uniformly random in .As in Lemma 4, let us consider the function defined as , where is chosen uniformly random in . The domain and range size of the function is and , respectively. Since , so the domain size is greater than times of the range size. By Lemma 3, there exists another such that . □ In our sample instantiations, there exists two different signing keys corresponding to a verification key with probability at least . Theorem 3.Let there exist an adversary who can query the random oracle H ( times) and either the signing algorithm or the Hybrid 2 ( times). Then his distinguishing advantage of t