Lattice‐based hash‐and‐sign signatures using approximate trapdoor, revisited

IET Information SecurityVolume 16, Issue 1 p. 41-50 ORIGINAL RESEARCH PAPEROpen Access Lattice-based hash-and-sign signatures using approximate trapdoor, revisited Huiwen Jia, Huiwen Jia orcid.org/0000-0002-9289-5918 Key Laboratory of Information Security, Guangzhou University, Guangzhou, ChinaSearch for more papers by this authorYupu Hu, Yupu Hu State Key Laboratory of Integrated Service Networks, Xidian University, Xi'an, ChinaSearch for more papers by this authorChunming Tang, Corresponding Author Chunming Tang cmtang@gzhu.edu.cn Key Laboratory of Information Security, Guangzhou University, Guangzhou, China Correspondence Chunming Tang, Key Laboratory of Information Security, Guangzhou University, No. 230 Wai Huan Xi Road, Guangzhou 510006, China. Email: cmtang@gzhu.edu.cnSearch for more papers by this author Huiwen Jia, Huiwen Jia orcid.org/0000-0002-9289-5918 Key Laboratory of Information Security, Guangzhou University, Guangzhou, ChinaSearch for more papers by this authorYupu Hu, Yupu Hu State Key Laboratory of Integrated Service Networks, Xidian University, Xi'an, ChinaSearch for more papers by this authorChunming Tang, Corresponding Author Chunming Tang cmtang@gzhu.edu.cn Key Laboratory of Information Security, Guangzhou University, Guangzhou, China Correspondence Chunming Tang, Key Laboratory of Information Security, Guangzhou University, No. 230 Wai Huan Xi Road, Guangzhou 510006, China. Email: cmtang@gzhu.edu.cnSearch for more papers by this author First published: 22 July 2021 https://doi.org/10.1049/ise2.12039AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract For the purpose of improving the efficiency of the cryptosystems built upon lattice trapdoors, Chen, Genise and Mukherjee at ASIACRYPT 2019 modified the gadget trapdoor (G-trapdoor) to an approximate trapdoor, which enables one to sample short preimages approximately from a discrete Gaussian distribution. The implementation shows that the sizes of the hash-and-sign signature scheme can be reduced to 3.67 kB for an estimation of 81.67-bit security, and 9.97 kB for an estimation of 168.81-bit security. In this study, the spherical sampling method is adapted to the non-spherical setting, without leaking any information about the trapdoor. Due to the fact that the signature size and the concrete security are closely related to the Gaussian parameter of the sampling algorithm, this technique provides a tradeoff between them. Specifically, two modes of parameters were set up for different goals. (a) Mode 1 admits to achieve the 'win–win' scenario, that is, gain concrete security and simultaneously reduce the signature size. Our proof-of-concept implementation shows that for an estimation of 94.5- and 185.88-bit security, the signature sizes can be reduced to 3.3 and 6.98 kB. (b) Mode 2 aims mainly to further reduce the signature sizes, without a decrease in the security level. The implementation shows that the signature size can be reduced to 2.35 kB for an estimation of 81.67-bit security, and 5.75 kB for an estimation of 168.82-bit security. 1 INTRODUCTION Over the past decade, lattice-based cryptography has emerged as one of the most attractive area in post-quantum cryptography and has been rapidly developing due to its conjectured security against quantum attacks, algorithmic simplicity and strong security guarantees from average case to worst case hardness. Furthermore, it is versatile for building not only various powerful cryptographic primitives, such as (hierarchical) identity-based encryption [1-5], attribute-based encryption [6-8], fully homomorphic encryption [9, 10], but also practical public-key encryptions and signatures, such as the candidates for the third round of the NIST post-quantum cryptography standardisation procedure [11]. At the heart of many of the lattice-based cryptographic applications is a trapdoor inversion algorithm that solves the inhomogeneous short integer solution (ISIS) problem [5, 12], which, given a public random matrix A ∈ Z q n × m and a target u ∈ Z q n , asks to find a short preimage x such that A ⋅ x = u mod q . Without a trapdoor for A, solving the ISIS problem for appropriate parameters is known to be as hard as certain lattice problems in the worst case [5, 12, 13]. In the seminal work [5], Gentry et al. initiated the study of the proper use of lattice trapdoors. Specifically, they devised a sampling algorithm that samples preimages from a given lattice coset with a discrete Gaussian distribution, which leaks no information about the trapdoor. Such a sampling algorithm makes the lattice-based hash-and-sign signature very simple: first, compute the hash value of the given message; then sample a short preimage of the hash value as the signature. Since the distribution of the signatures is simulatable without the trapdoor, the secret key is guaranteed to be hidden. However, the sampling algorithm itself is inefficient and consumes a lot of memory to store public parameters during the procedure, which obstructed the practical applications of these schemes. A series of works [14-19] has been carried out to improve the efficiency on generating the trapdoors and sampling the preimages. Recently, Chen et al. [20] concentrate on reducing the sizes of the public key and signature of the underlying lattice-based hash-and-sign signature scheme. In particular, they modified the gadget trapdoor (G-trapdoor) to an approximate trapdoor, which can be used to sample short preimages approximately from a discrete Gaussian distribution. The proof-of-concept implementation shows that the sizes of the public key and signature can be reduced to 4 and 3.67 kB for an estimation of 81.67-bit security, and 11.25 and 9.97 kB for an estimation of 168.81-bit security.11 The experimental data comes from our own implementation. Actually, we use smaller standard deviation for the LWE errors to enhance the signature performance. These are much closer to the sizes of the signatures based on the rejection sampling approach [21-24]. For example, the sizes of the public key and signature for qTESLA [21] are 4.03 and 3.05 kB for an estimation of 128-bit security, and 8.03 and 6.03 kB for an estimation of 192-bit security. 1.1 Our contributions In this study, we focus on improving the hash-and-sign signature in the random oracle model under the (ring-)LWE and (ring-)SIS assumptions. Specifically, we generalise the original discrete spherical Gaussian distribution to the non-spherical setting, without leaking any information about the trapdoor. This technique is applicable to both the exact trapdoor setting [18] and the approximate trapdoor setting [20]. Since the signature size and the concrete security are closely related to the Gaussian parameter of the sampling algorithm, our technique admits to set the parameters to improve the security level and/or to reduce the signature size. In more detail, we set up two modes of parameters for different goals Mode 1 targets mainly at improving the concrete security meanwhile reducing the signature size. Our proof-of-concept implementation shows that for an estimation of 94.5- and 185.88-bit security, the signature sizes can be reduced to 3.3 and 6.98 kB. Mode 2 focus mainly on further reducing the signature sizes, with no decrease in the security level. The implementation shows that the signature size can be reduced to 2.35 kB for an estimation of 81.67-bit security, and 5.75 kB for an estimation of 168.82-bit security. 1.2 Technical overview Recall that, given a random matrix A ∈ Z q n × m and a target u ∈ Z q n , the ISIS problem asks to find a short vector x ∈ Z m such that A ⋅ x = u mod q . In [18], the G-trapdoor for A is defined as a matrix R such that A R I = G ∈ Z q n × n k , where G is the commonly used gadget matrix G = I n ⊗ g t = I n ⊗ 1 b b 2 ⋯ b k − 1 , and k = ⌈ logb q⌉ for some integer base b.22 We omit the trapdoor tag matrix H for simplicity. Specifically, the public matrix A is defined as A = [ A ¯ ∣ G − A ¯ R ] , with A ¯ ∈ Z q n × m ¯ being a uniformly random matrix ( m ¯ ≈ n k for the statistically secure instantiation and m ¯ = 2 n for the computationally secure instantiation). For efficiency concern, we only consider the latter case, thus the dimension of the underlying lattice Λ q ⊥ ( A ) is m = (2 + k)· n. Usually, the hermite normal form is used, in which A ¯ = [ I n ∣ A ˆ ] for A ˆ ∼ U ( Z q n × n ) . With trapdoor R ∈ Z 2 n × k n , the preimages of any given target u are efficiently sampleable from the spherical discrete Gaussian distribution D Λ u ⊥ ( A ) , s for relatively small s. One may first sample short coset representative z ← D Λ u ⊥ ( G ) , s , then by the definition of G-trapdoor, output R I z. However, this would leak sufficient information about the trapdoor. Therefore, a perturbation is needed to make the distribution of the preimages spherical, thus hiding the trapdoor statistically. In particular, let Σ p = s 2 ⋅ I − σ 2 ⋅ R I ⋅ R t I be a positive definite matrix, where σ ≥ η ϵ ( Λ q ⊥ ( G ) ) . The perturbation is first sampled offline p ← D Z m , Σ p . Then, run the G-lattice sampling algorithm with target v = u − A· p and obtain z ← D Λ v ⊥ ( G ) . Finally, output x = p + R I z. The correctness of the sampler requires that the value of s should be large enough s ≥ σ ⋅ s 1 ( R I ) such that Σp is positive definite, where s1(⋅) denotes the largest singular value of its input matrix. Note that when the parameters n, q are fixed (thus, the dimension m = (2 + k)· n is fixed), the concrete security and the signature size of the underlying hash-and-sign signature are entirely determined by the Gaussian parameter s. Specifically, the l2 norm of the signature is upper-bounded by s m , and the maximum number of bits required to store the signature is upper-bounded by m⋅(1 + ⌈ log s⌉). With m being fixed, can we further reduce the value of s to improve security and efficiency (smaller signature sizes)? The answer is 'no', at least in the spherical setting, because s ≈ σ·s1(R) is optimal to keep Σp positive definite. How about the non-spherical Gauss? It is to be observed that during the preimage sampling procedure, the G-lattice sampling preimage z is mapped to y = R I z by the linear transformation R I , which distorts the top 2n entries of y much more than the bottom kn entries. When compared with the MP12 sampler [18] that uses a Σp such that the shape of the final output x is s2 ·Im (spherical), our non-spherical technique takes this uneven distortion into account and changes the Σp such that x's shape is Σ = s ¯ 2 ⋅ I 2 n s ∼ 2 ⋅ I k n , where s ¯ ≫ s ∼ , that is, we set Σ p = Σ − σ 2 ⋅ R I ⋅ R t I = s ¯ 2 ⋅ I 2 n − σ 2 ⋅ R R t − σ 2 ⋅ R − σ 2 ⋅ R t ( s ∼ 2 − σ 2 ) ⋅ I k n . As a result, a smaller s ∼ would both improve security and reduce signature size. In more detail, the upper bounds on the l2 norm and storage size of the preimage x are changed to s ¯ 2 ⋅ 2 n + s ∼ 2 ⋅ k n and 2 n ⋅ ( 1 + ⌈ log s ¯ ⌉ ) + k n ⋅ ( 1 + ⌈ log s ∼ ⌉ ) , respectively. However, the changes in s ¯ and s ∼ are not necessarily linear since the shape of Σp is complicated. We derive this tradeoff in Section 3. 1.3 Related works In [25], Zhang et al. proposed asymmetric variants of the (module-)LWE and (module-)SIS assumptions and size-optimised KEM and signature schemes. In their signature scheme, two different parameters are used to specify the distribution of the signature, instead of one parameter in Dilithium [23], just like we use different values s ¯ and s ∼ instead of s to specify the distribution of the final output. However, there are two main differences: their scheme is based on the rejection sampling approach and the signatures follow a uniform distribution; while ours follow the GPV framework [5] and the preimages are sampled from a discrete Gaussian distribution. 2 PRELIMINARIES Notations: We denote by R and Z the set of real numbers and integers, respectively. Vectors, in column form by default, are represented as bold lower-case letters, for example, v, and its ith component is represented by vi. The concatenation of vectors v1, v2 is denoted by (v1, v2). Matrices are written as upper-case letters, for example, A, and the ith column is denoted by ai. The transpose of A is written as At. The Euclidean norm (l2 norm) of v is defined as ‖ v ‖ = ∑ i v i 2 . The length of a matrix is defined as the l2 norm of its longest column: ‖A‖ = maxi‖ai‖. For any two matrices A,B, their tensor product is denoted by A ⊗ B. The direct sum of A and B, written as A ⊕ B, is given by their block diagonal concatenation. For distributions D1, D2 with the same support X, by D1≈ϵD2 we mean that each x ∈ X has D1(x) ∈ [1 ± ϵ]D2(x) and D2(x) ∈ [1 ± ϵ]D1(x). 2.1 Linear algebra For a matrix A, its span is the span of its column vectors. For an ordered set of vectors V = { v 1 , … , v n } ⊂ R m , the Gram–Schmidt orthogonalisation V ∼ = { v ∼ 1 , … , v ∼ n } is defined iteratively in the following way: v ∼ 1 = v 1 , and for each i = 2, …, n, v ∼ i is the component of vi orthogonal to span(v1, …, vi−1). A symmetric matrix Σ ∈ R m × m is positive definite (resp., semi-definite), written Σ > 0 (resp., Σ ≥ 0), if xtΣx > 0 (resp., xtΣx ≥ 0) for all non-zero x ∈ R m . We say Σ1 > Σ2 if (Σ1 −Σ2) > 0. This forms a partial ordering on symmetric matrices (similarly for ≥, < and ≤). If Σ = BBt, we call B a square root of Σ ≥ 0, written as Σ = B. For any scalar s, Σ > s means all eigenvalues of Σ are strictly greater than s. We denote by s1(B) = maxu‖Bu‖ the largest singular value of B, where the maxima are taken over all unit vectors u ∈ R n . For any n × n matrix S and non-empty index sets I, J ⊂{1, …, n}, we write S[I, J] for the square matrix obtained by selecting the elements at positions (i, j) ∈ I × J from S. If I = J, we write S[I] as a shorthand for S[I, J]. For any non-singular matrix S ∈ R n × n and index partition I ∪ I ¯ = { 1 , … , n } , I ∩ I ¯ = ∅, S / I = S [ I ] − S [ I , I ¯ ] ⋅ S [ I ¯ ] − 1 ⋅ S [ I ¯ , I ] is called the Schur complement of S [ I ¯ ] . Particularly, if S = A B B t D , then the Schur complement of A is the matrix S/A = D − BtA−1B. For any index set I, a symmetric matrix S is positive definite if and only if both S[I] and S/S[I] are positive definite. 2.2 Lattices and Gaussians A lattice Λ ⊂ R m is a discrete subgroup of R m . Given a matrix B = { b 1 , … , b n } ⊂ R m with linearly independent vectors, we can also define a rank-n lattice by L ( B ) = { B ⋅ z : z ∈ Z n } , where B is known as a basis. The dual of a lattice is the set Λ * = { y ∈ s p a n ( Λ ) : ∀ x ∈ Λ , 〈 x , y 〉 ∈ Z } of all vectors that have integer scalar product with all lattice vectors. For n , m , q ∈ Z + and A ∈ Z q n × m , define the following m-dimension lattice: Λ q ⊥ ( A ) = { x ∈ Z m : A ⋅ x = 0 mod q } . For any u ∈ Z q n admitting an integral solution to A⋅x = u mod q, the 'shifted lattice' is the set Λ u ⊥ ( A ) = { z ∈ Z m : A ⋅ z = u mod q } = Λ q ⊥ ( A ) + x . The m-dimensional Gaussian function ρ : R m → 0 , 1 is defined as ρ(x) = exp(−π·〈x, x〉). Applying a linear transformation given by an invertible matrix B yields ρ B ( x ) = ρ ( B − 1 x ) = exp ( − π ⋅ x t Σ − 1 x ) , where Σ = BBt. For any c ∈ span(B), the shifted version of ρΣ (centred at c) is defined as ρ Σ , c ( x ) = ρ Σ ( x − c ) . Normalising ρ Σ , c , we obtain the continuous Gaussian distribution D Σ , c , with Σ 2 π being the covariance. Restricting the support of the distribution to some discrete structure, for example, a lattice Λ ⊂ R m , we get the discrete Gaussian distribution D Λ , Σ , c over lattice Λ. Formally, for any x ∈ Λ, D Λ , Σ , c ( x ) = ρ Σ , c ( x ) ρ Σ , c ( Λ ) . The smoothing parameter ηϵ(Λ) of lattice Λ for any positive ϵ is the smallest s > 0 such that ρ(s⋅Λ*) ≤ 1 + ϵ. The following definition is a generalised version to the non-spherical Gaussian setting. Definition 1.([19]). Let Σ > 0 and Λ ⊂ span(Σ) be a lattice. We write Σ ≥ η ϵ ( Λ ) , if ρ Σ − 1 ( Λ * ) ≤ 1 + ϵ. Lemma 1.([5]). Let Λ ⊂ R m be a lattice with basis B and let ϵ > 0, we have η ϵ ( Λ ) ≤ ‖ B ∼ ‖ ⋅ ln ( 2 m ( 1 + 1 / ϵ ) ) / π . Lemma 2.([13, 26]). Let B be a basis of an m-dimensional lattice Λ, and let s ≥ ηϵ(Λ) for some negligible function ϵ(m), then Pr x ← D Λ , s [ ‖ x ‖ ≥ s ⋅ m ] ≤ n e g l ( m ) . Lemma 3.([20]). For any positive definite Σ, vector c, lattice coset A = Λ + a ⊂ c + span(Σ), and linear transformation T, if the lattice ΛT = Λ ∩ ker(T) satisfies span(ΛT) = ker(T) and η ϵ ( Λ T ) ≤ Σ , then T ( D A , c , Σ ) ≈ ϵ ¯ D T A , T c , T Σ where ϵ ¯ = 2 ϵ / ( 1 − ϵ ) . Lemma 4.([27]). Let v ∈ Z m be a vector with ‖ v ‖ ≤ s m . Then, the maximum number of bits required to store this vector is bounded by m⋅(1 + ⌈ log s⌉). For simplicity, throughout this study, we fix a 'randomised-rounding parameter' r ≈ ln ( 2 / ϵ ) / π as in [18], where ϵ is a desired bound on the statistical error introduced by each randomised-rounding operation for Z. 2.3 Gadget trapdoor and its approximate version The gadget matrix G is usually designed as G = I n ⊗ g t ∈ Z q n × n k , where gt is the row vector g t = [ 1 b b 2 ⋯ b k − 1 ] ∈ Z q 1 × k , and k = ⌈ logb q⌉ for some integer base b. It is easy to check that Λ q ⊥ ( g t ) has a simple basis in sparse form, B q = 2 q 0 − 1 2 q 1 − 1 q 2 ⋱ ⋮ 2 q k − 2 − 1 q k − 1 ∈ Z k × k , where (q0, q1, …, qk−1) is the b-ary decomposition of the modulus q. If q = bk, then we can set q0 = … = qk−2 = 0 and qk−1 = b. Each integer coset of the lattice Λ u ⊥ ( g t ) corresponds to an element in Z q . Due to the special form of the gadget matrix G, the lattice Λ q ⊥ ( G ) and its integer cosets Λ u ⊥ ( G ) can be constructed through the direct sum: Λ q ⊥ ( G ) = Λ q ⊥ ( g t ) ⊕ ⋯ ⊕ Λ q ⊥ ( g t ) , Λ u ⊥ ( G ) = Λ u 1 ⊥ ( g t ) ⊕ ⋯ ⊕ Λ u n ⊥ ( g t ) , where u = ( u 1 , … , u n ) ∈ Z q n . In [18], the G-trapdoor for any A ∈ Z q n × m is defined as a matrix R ∈ Z m ¯ × n k such that A R I = G, where m = m ¯ + n k, m ¯ ≈ n k (for the statistical instantiation) or m ¯ = 2 n (for the computational instantiation). For efficiency concern, we only consider the latter case. Given any syndrome u ∈ Z q n , the MP12 sampler can sample a preimage of the target u from the distribution D Λ u ⊥ ( A ) , s using the trapdoor R as follows: Perturbation sampling, p ← D Z m , Σ p , where Σ p = s 2 ⋅ I m − σ 2 ⋅ R I [ R t I ] , σ = r ⋅ b 2 + 1 ≥ η ϵ Λ ⊥ ( G ) by Lemma 1 G-lattice sampling, z ← D Λ v ⊥ ( G ) , σ , where v = u − Ap mod q Output x = p + R I ⋅ z By Lemma 2, the l2 norm of the preimage x is upper-bounded by s ⋅ m with overwhelming probability. Lemma 4 implies that the maximum number of bits required to store x is upper-bounded by m⋅(1 + ⌈ log s⌉). In 2019, Chen et al. [20] modified the gadget G-trapdoor to an approximate trapdoor to solve the approximate ISIS problem, which asks to find a short x such that A ⋅ x = u + e mod q for some error vector e ∈ Z q n . Specifically, the gadget matrix G is modified to F = I n ⊗ f t = I n ⊗ [ b l ⋯ b k − 1 ] ∈ Z n × ( k − l ) n , correspondingly, the public matrix A is adapted to A = [ A ¯ ∣ F − A ¯ R ] ∈ Z q n × ( 2 + k − l ) n . The parameter l indicates the number of entries dropped from the G-trapdoor. Let w = n⋅(k − l), then m = n⋅(2 + k − l) is the dimension of the underlying lattice Λ q ⊥ ( A ) . The preimage sampling procedure is almost the same as that above, except that in the G-lattice sampling (Step 2), the first l entries of the preimage for each entry vi of the target v are dropped. As a result, for uniformly random target u, the final output x is an approximate preimage of u, with the error term e = u − Ax mod q such that e ∼ D Z n , σ ( b 2 l − 1 ) / ( b 2 − 1 ) . Similarly, the l2 norm of the approximate preimage x and the storage size for x are upper-bounded by s ⋅ m and m ⋅ (1 + ⌈ log s⌉), respectively. Since the dimension m is about half of its counterpart in the exact trapdoor setting [18] and the Gaussian parameter s is slightly reduced by the decrease in m, the sizes of the public key and signature are both reduced. 3 THE NON-SPHERICAL GAUSS IN THE EXACT TRAPDOOR SETTING As a warmup, we illustrate the non-spherical Gauss in the exact trapdoor setting. Recall that given the public matrix A ∈ Z q n × ( 2 + k ) n , its trapdoor R, and target u ∈ Z q n , preimage sampling algorithm, which consists of perturbation sampling (with covariance Σp) and G-lattice sampling (with covariance σ2), outputs a preimage x ∼ D Λ u ⊥ ( A ) , s for relative small s ≈ σ ⋅ s1(R). As introduced early, our main idea is to modify the Gaussian parameter s to Σ = s ¯ 2 ⋅ I 2 n ⊕ s ∼ 2 ⋅ I k n , with which the preimages leak no information about the trapdoor as well. Consequently, the quantities that are closely related to the covariance matrix Σ are affected by this modification: The perturbation covariance Σ p = Σ − σ 2 ⋅ R I ⋅ R t I = s ¯ 2 ⋅ I 2 n − σ 2 ⋅ R R t − σ 2 ⋅ R − σ 2 ⋅ R t ( s ∼ 2 − σ 2 ) ⋅ I k n ; 2. The l2 norm of the preimage, which is upper-bounded by s ¯ 2 ⋅ 2 n + s ∼ 2 ⋅ k n , (1)except with negligible probability in n by Lemma 2 3. The upper bound on the storage size of the preimage by Lemma 4 2 n ⋅ ( 1 + ⌈ log s ¯ ⌉ ) + k n ⋅ ( 1 + ⌈ log s ∼ ⌉ ) ≈ 2 n ⋅ ( 1 + log s ¯ ) + k n ⋅ ( 1 + log s ∼ ) . (2) By the above analysis, we have the following remarks: For correctness of the preimage sampling algorithm, it is necessary to keep Σ p − 5 4 ⋅ R I [ R t I ] positive definite.33 Because the Gaussian parameter for G-lattice σ ≥ b 2 + 1 ⋅ r ≥ 5 ⋅ r, we only need Σ p ≥ 5 4 ⋅ r 2 ⋅ R I [ R t I ] to guarantee the correctness of the preimage sampling algorithm. See the proof of Theorem 5.5 in [18] for more details. Quantity (1) determines the concrete security of the underling schemes. Quantity (2) determines the storage size of the preimages. As noted in Subsection 2.1, for any index set I, a symmetric matrix S is positive definite if and only if both S[I ] and S/S[I] are positive definite. For simplicity, let σ ′ 2 = σ 2 + 5 4 ⋅ r 2 . Then, to make Σp satisfy our condition, we need both ( s ∼ 2 − σ ′ 2 ) ⋅ I k n and Σ p / ( s ∼ 2 − σ ′ 2 ) ⋅ I k n = s ¯ 2 ⋅ I 2 k − σ ′ 2 ⋅ R ⋅ I k n s ∼ 2 − σ ′ 2 ⋅ σ ′ 2 ⋅ R t = s ¯ 2 ⋅ I 2 k − σ ′ 2 ⋅ s ∼ 2 s ∼ 2 − σ ′ 2 ⋅ R ⋅ R t to be positive definite. Now fix s ¯ = σ ′ ⋅ s ∼ ⋅ s 1 ( R ) s ∼ 2 − σ ′ 2 , it is easy to derive different s ∼ such that quantity (1) or quantity (2) is minimised. Naturally, we can set up two modes for different goals: Mode 1: for higher security levels. A routine calculation shows that quantity (1) is minimised if s ¯ 2 = 1 + 1 s 1 ( R ) ⋅ k 2 ⋅ σ ′ 2 ⋅ s 1 ( R ) 2 , s ∼ 2 = 1 + s 1 ( R ) ⋅ 2 k ⋅ σ ′ 2 . Mode 2: for more compact preimages. Quantity (2) is minimised if s ¯ 2 = 1 + k 2 ⋅ σ ′ 2 ⋅ s 1 ( R ) 2 , s ∼ 2 = 1 + 2 k ⋅ σ ′ 2 . We provide a proof-of-concept implementation of the ring-based hash-and-sign signature scheme for two groups of parameters. As the comparison in Figure 1 shows, Mode 1 improves the spherical Gaussian in [18] upon both concrete security and signature size, and Mode 2 has much smaller signature size, with almost no decrease in security. However, our sampling method has no effect on reducing the size of the public key. For example, the public key sizes for the two groups of parameters above are 37.5 and 22.5 kB, respectively. As mentioned before, the approximate preimage sampling [20] can be used to reduce both public key size and signature size. In the next section, we show how to apply our technique to this setting to get higher security level and/or smaller signature size. FIGURE 1Open in figure viewerPowerPoint A brief comparison of the security level and sizes of public key and signature, which are measured in kB. k = ⌈ logb q⌉ and τ is the standard deviation of the trapdoor R. s − and s ∼ are the Gaussian parameters for the final preimages. 'ISIS' refers to the security level of breaking the ISIS problem. 'LWE' refers to the security level of the pseudorandomness of the public key. For the concrete security estimation for ISIS and LWE, see Subsection 4.2 for more details 4 APPLYING TO THE APPROXIMATE TRAPDOOR SETTING Recall that the approximate gadget matrix [20] is defined as F = In ⊗ f, where f = [bl … bk−1], b is an integer base, and l is the number of lower-order entries dropped from the gadget vector g. The dimension of the underlying lattice Λ q ⊥ ( A ) is m = 2n + w = (2 + k − l)n, where the public matrix A is given by A = [ A ¯ ∣ F − A ¯ R ] ∈ Z q n × m for the approximate trapdoor R ∈ Z 2 n × w . It seems that we can apply directly the non-spherical Gauss in the previous section to the approximate trapdoor setting and obtain the similar two modes for different goals. That is, for higher security levels (Mode 1), we set s ¯ 2 = 1 + 1 s 1 ( R ) ⋅ k − l 2 ⋅ σ ′ 2 ⋅ s 1 ( R ) 2 , (3) s ∼ 2 = 1 + s 1 ( R ) ⋅ 2 k − l ⋅ σ ′ 2 ; (4) For more compact preimages (Mode 2), s ¯ 2 = 1 + k − l 2 ⋅ σ ′ 2 ⋅ s 1 ( R ) 2 , s ∼ 2 = 1 + 2 k − l ⋅ σ ′ 2 . However, it is non-trivial to show the simulatability (an essential property for various applications) of the modified sampling algorithm for the above choices of s ¯ and s ∼ . In the following, we first present the modified approximate preimage sampling algorithm ApproSampPre. Then, we show that the resulting signature scheme indeed allows us to set different parameters for different goals, with a slight difference in Mode 1. Algorithm 1. ApproSampPre In