MPSign: A Signature from Small-Secret Middle-Product Learning with - PowerPoint PPT Presentation

MPSign: A Signature from Small-Secret Middle-Product Learning with Errors Shi Bai Dipayan Das Ryo Hiromasa Miruna Rosca Amin Sakzad Damien Stehlé Ron Steinfeld Zhenfei Zhang Miruna Rosca MPSign PKC 2020 1 / 22

What is this talk about? A digital signature scheme whose security in the QROM relies on the hardness of solving ApproxSVP f for many polynomials f . Main ingredient: A reduction from small secret PLWE f to small secret MP-LWE which works for many f ’s. Miruna Rosca MPSign PKC 2020 2 / 22

Overview 1. Background 2. Hardness of MP-LWE with small secrets 3. MPSign: our digital signature based on small secret MP-LWE Miruna Rosca MPSign PKC 2020 3 / 22

Background Miruna Rosca MPSign PKC 2020 4 / 22

Digital signature DS = ( Gen , Sign , Ver ) pk sk Miruna Rosca MPSign PKC 2020 5 / 22

Digital signature DS = ( Gen , Sign , Ver ) ( m, σ = Sign sk ( m )) pk sk Miruna Rosca MPSign PKC 2020 5 / 22

Digital signature DS = ( Gen , Sign , Ver ) ( m, σ = Sign sk ( m )) pk sk Ver pk ( m, σ ) ∈ { 0 , 1 } Miruna Rosca MPSign PKC 2020 5 / 22

Digital signature DS = ( Gen , Sign , Ver ) ( m, σ = Sign sk ( m )) pk sk Ver pk ( m, σ ) ∈ { 0 , 1 } Correctness : Ver pk ( m, Sign sk ( m )) = 1 w.h.p. Miruna Rosca MPSign PKC 2020 5 / 22

Digital signature DS = ( Gen , Sign , Ver ) ( m, σ = Sign sk ( m )) pk sk Ver pk ( m, σ ) ∈ { 0 , 1 } Correctness : Ver pk ( m, Sign sk ( m )) = 1 w.h.p. ufCMA Security : DS is secure if no adversary, having access to many signatures, is able to produce a signature for a new message. Miruna Rosca MPSign PKC 2020 5 / 22

How to build lattice-based crypto? PSIS f PLWE f [LM06],[PR07] [SSTX09],[LPR10] ApproxSVP f Miruna Rosca MPSign PKC 2020 6 / 22

How to build lattice-based crypto? PSIS f PLWE f [LM06],[PR07] [SSTX09],[LPR10] ApproxSVP f [CDPR16], [BBV+17], [CDW17], etc. ApproxSVP f is easier than ApproxSVP for some f ’s in some parameter regimes and setups. Miruna Rosca MPSign PKC 2020 6 / 22

[Lyu16]: A problem at least as hard as many PSIS f PSIS over Z q [ x ] . . . . . . PSIS f 1 PSIS f 2 PSIS f m Miruna Rosca MPSign PKC 2020 7 / 22

[Lyu16]: A problem at least as hard as many PSIS f PSIS over Z q [ x ] . . . . . . PSIS f 1 PSIS f 2 PSIS f m Application : digital signature scheme Miruna Rosca MPSign PKC 2020 7 / 22

[RSSS17]: A problem at least as hard as many PLWE f MP - LWE . . . . . . PLWE f 1 PLWE f 2 PLWE f m Miruna Rosca MPSign PKC 2020 8 / 22

[RSSS17]: A problem at least as hard as many PLWE f MP - LWE . . . . . . PLWE f 1 PLWE f 2 PLWE f m Applications of MP-LWE public key encryption: [RSSS17], [SSZ18], [BBD+19] identity based encryption: [LVV19] Miruna Rosca MPSign PKC 2020 8 / 22

The PLWE f and MP-LWE problems f poly. of degree n PLWE f q,χ 1 ,χ 2 Miruna Rosca MPSign PKC 2020 9 / 22

The PLWE f and MP-LWE problems f poly. of degree n PLWE f q,χ 1 ,χ 2 P f q,χ 1 ( s ) for s ∈ Z q [ x ] /f a ← ֓ U ( Z q [ x ] /f ) and e ← ֓ χ 1 return ( a, b = a · s + e mod f ) Miruna Rosca MPSign PKC 2020 9 / 22

The PLWE f and MP-LWE problems f poly. of degree n PLWE f q,χ 1 ,χ 2 Distinguish between P f q,χ 1 ( s ) for s ∈ Z q [ x ] /f a ← ֓ U ( Z q [ x ] /f ) and e ← ֓ χ 1 return ( a, b = a · s + e mod f ) and U ( Z q [ x ] /f × R q [ x ] /f ) <n Miruna Rosca MPSign PKC 2020 9 / 22

The PLWE f and MP-LWE problems f poly. of degree n PLWE f q,χ 1 ,χ 2 Distinguish between P f q,χ 1 ( s ) for s ∈ Z q [ x ] /f a ← ֓ U ( Z q [ x ] /f ) and e ← ֓ χ 1 return ( a, b = a · s + e mod f ) and U ( Z q [ x ] /f × R q [ x ] /f ) <n with non-negl. probability over the choice of s ← ֓ χ 2 . Miruna Rosca MPSign PKC 2020 9 / 22

The PLWE f and MP-LWE problems f poly. of degree n PLWE f MP-LWE n,d q,χ 1 ,χ 2 q,χ 1 ,χ 2 Distinguish between P f q,χ 1 ( s ) for s ∈ Z q [ x ] /f a ← ֓ U ( Z q [ x ] /f ) and e ← ֓ χ 1 return ( a, b = a · s + e mod f ) and U ( Z q [ x ] /f × R q [ x ] /f ) <n with non-negl. probability over the choice of s ← ֓ χ 2 . Miruna Rosca MPSign PKC 2020 9 / 22

The PLWE f and MP-LWE problems f poly. of degree n PLWE f MP-LWE n,d q,χ 1 ,χ 2 q,χ 1 ,χ 2 Distinguish between MP n,d P f q,χ 1 ( s ) for s ∈ Z <n + d − 1 q,χ 1 ( s ) for s ∈ Z q [ x ] /f [ x ] q ֓ U ( Z <n a ← ֓ U ( Z q [ x ] /f ) and e ← ֓ χ 1 a ← q [ x ]) and e ← ֓ χ 1 return ( a, b = a · s + e mod f ) return ( a, b = a ⊙ d s + e ) and U ( Z q [ x ] /f × R q [ x ] /f ) <n with non-negl. probability over the choice of s ← ֓ χ 2 . Miruna Rosca MPSign PKC 2020 9 / 22

The PLWE f and MP-LWE problems f poly. of degree n PLWE f MP-LWE n,d q,χ 1 ,χ 2 q,χ 1 ,χ 2 Distinguish between Distinguish between MP n,d P f q,χ 1 ( s ) for s ∈ Z <n + d − 1 q,χ 1 ( s ) for s ∈ Z q [ x ] /f [ x ] q ֓ U ( Z <n a ← ֓ U ( Z q [ x ] /f ) and e ← ֓ χ 1 a ← q [ x ]) and e ← ֓ χ 1 return ( a, b = a · s + e mod f ) return ( a, b = a ⊙ d s + e ) and and U ( Z q [ x ] /f × R q [ x ] /f ) <n U ( Z <n q [ x ] × R <d q [ x ]) with non-negl. probability over the choice of s ← ֓ χ 2 . Miruna Rosca MPSign PKC 2020 9 / 22

Hardness of MP-LWE with small secrets Miruna Rosca MPSign PKC 2020 10 / 22

Towards the hardness of MP-LWE with small secret * D: distribution which produces small elements w.h.p * U: uniform distribution MP-LWE n,d q, D , U [RSSS17] PLWE f q, D , U error secret Miruna Rosca MPSign PKC 2020 11 / 22

Towards the hardness of MP-LWE with small secret * D: distribution which produces small elements w.h.p * U: uniform distribution MP-LWE n,d q, D , D ? MP-LWE n,d q, D , U [RSSS17] PLWE f q, D , U error secret Miruna Rosca MPSign PKC 2020 11 / 22

Towards the hardness of MP-LWE with small secret * D: distribution which produces small elements w.h.p * U: uniform distribution MP-LWE n,d q, D , D ? MP-LWE n,d PLWE f q, D , U q, D , D [RSSS17] [ACPS09] PLWE f q, D , U error secret Miruna Rosca MPSign PKC 2020 11 / 22

Towards the hardness of MP-LWE with small secret * D: distribution which produces small elements w.h.p * U: uniform distribution MP-LWE n,d q, D , D This work MP-LWE n,d PLWE f q, D , U q, D , D [RSSS17] [ACPS09] PLWE f q, D , U error secret Miruna Rosca MPSign PKC 2020 11 / 22

From PLWE f to MP-LWE for many f ’s * f ∈ Z [ x ] of degree n , d ≤ n * D R ,σ : Gaussian on R with standard deviation σ * D Z ,σ : Gaussian on Z with standard deviation σ MP-LWE n,d PLWE f [RSSS17] q,χ 1 ,χ 2 q,χ 1 ,χ 2 χ 1 D R d ,α ′ q D R n ,αq U ( Z n + d − 1 U ( Z n χ 2 ) q ) q MP-LWE n,d PLWE f This work q,χ 1 ,χ 2 q,χ 1 ,χ 2 χ 1 D Z d ,α ′′ q D Z n ,αq χ 2 D Z n + d − 1 ,α ′ q D Z n ,αq Miruna Rosca MPSign PKC 2020 12 / 22

Recall [RSSS17] = + × Rot f ( b ) Rot f ( a ) Rot f ( s ) Rot f ( e ) Miruna Rosca MPSign PKC 2020 13 / 22

Recall [RSSS17] = + × Rot f ( b ) Rot f ( a ) Rot f ( s ) Rot f ( e ) Take first column M f b = Rot f ( a ) M f s + M f e × Miruna Rosca MPSign PKC 2020 13 / 22

Recall [RSSS17] = + × Rot f ( b ) Rot f ( a ) Rot f ( s ) Rot f ( e ) Take first column M f b = Rot f ( a ) M f s + M f e × Decompose Rot f ( a ) b ′ = Rot f (1) M f s M f e Toep ( a ) + × Miruna Rosca MPSign PKC 2020 13 / 22

Recall [RSSS17] = + × Rot f ( b ) Rot f ( a ) Rot f ( s ) Rot f ( e ) Take first column M f b = Rot f ( a ) M f s + M f e × Decompose Rot f ( a ) b ′ = Rot f (1) M f s M f e Toep ( a ) + × Rename b ′ = s ′ e ′ Toep ( a ) + × Miruna Rosca MPSign PKC 2020 13 / 22

From small secret PLWE f to small secret MP-LWE M f e + e Miruna Rosca MPSign PKC 2020 14 / 22

From small secret PLWE f to small secret MP-LWE M f e + e D Z ,α + D Z ,β ≈ D Z ,γ Miruna Rosca MPSign PKC 2020 14 / 22

From small secret PLWE f to small secret MP-LWE M f e + e D Z ,α + D Z ,β ≈ D Z ,γ We need a lower bound on the smallest singular value of M f . Miruna Rosca MPSign PKC 2020 14 / 22

From small secret PLWE f to small secret MP-LWE M f e + e D Z ,α + D Z ,β ≈ D Z ,γ We need a lower bound on the smallest singular value of M f .  0 0  ∗ ∗ ∗ ∗ 0 0 0 ∗ ∗ ∗   • more restrictive family of f ’s   0 0 0 0 ∗ ∗   M f =   0 0 0 0 0  ∗     0 0 0 0 0  ∗   0 0 0 0 0 ∗ Miruna Rosca MPSign PKC 2020 14 / 22

From small secret PLWE f to small secret MP-LWE M f e + e D Z ,α + D Z ,β ≈ D Z ,γ We need a lower bound on the smallest singular value of M f .  0 0  ∗ ∗ ∗ ∗ 0 0 0 ∗ ∗ ∗   • more restrictive family of f ’s   0 0 0 0 ∗ ∗   M f =   • larger noise amplification 0 0 0 0 0  ∗     0 0 0 0 0  ∗   0 0 0 0 0 ∗ Miruna Rosca MPSign PKC 2020 14 / 22