Efficient lattice signature method based on lattice codes

Abstract

The invention discloses a more efficient lattice signature method based on lattice codes, and relates to the technical field of cryptography and information security, the method is improved on the basis of a Fiat-Shamir lattice signature scheme, a high-order hash technology and a one-dimensional character string are used for replacing a randomness technology of a multi-dimensional vector, and the more efficient lattice signature method is constructed. The rejection condition of the signature process can be optimized, so that the rejection frequency of the scheme is reduced, and meanwhile, the time required for single operation is reduced.

Description

Technical Field

[0001] The present invention relates to the fields of cryptography technology and information security technology, and in particular to a more efficient lattice signature method based on lattice code. Background Art

[0002] In 2009, Lyubashevsky first proposed the framework of the Fiat-Shamir lattice signature scheme using rejection sampling (Vadim Lyubashevsky: Fiat-Shamir with Aborts: Applications to Lattice and Factoring-Based Signatures. ASIACRYPT 2009: 598-616). The scheme uses the Fait-Shamir transformation (Amos Fiat, Adi Shamir: How to Prove Yourself: Practical Solutions to Identification and Signature Problems. CRYPTO 1986: 186-194) to transform the ID protocol (identification protocol) into a lattice signature scheme. Specifically, the scheme uses the output of RO (Random Oracle) to replace the challenge c raised by the verifier during the ID protocol interaction. To ensure the security of the scheme, the scheme uses rejection sampling technology to selectively output signatures so that the signature distribution has nothing to do with the "appearance" of the key. In 2012, Lyubashevsky implemented it on a ring (Vadim Lyubashevsky: Lattice Signatures without Trapdoors. EUROCRYPT 2012: 738-755). The article proposed a lattice signature algorithm with security based on the use of rejection sampling for the SIS (Small Integer Solution) problem. In order to shorten the signature, the article shortened the size of the key used. Its security is based on the difficulty of the low-density SIS problem on the lattice.

[0003] By using the Hermite normal form, Lyubashevsky transformed the solution based on the low-density SIS problem into a solution based on the LWE (learning with error) problem, and further shortened the signature size of the solution. The specific method is: remove part of the signature in the original signature to ensure that the signature is greatly shortened. At the same time, the signer and the verifier can most likely obtain two similar items, that is, the low bits of the string are different but the high bits are the same. Then, the high bits of the string are extracted as a public random number for signature verification. To ensure that the signature verification passes, a new bit is added to replace the removed part of the signature as a carry prompt to ensure that the signer and the verifier can definitely obtain two similar items.

[0004] Bai et al. made further modifications on this basis (Shi Bai, Steven D. Galbraith: An Improved Compression Technique for Signatures Based on Learning with Errors. CT-RSA 2014: 28-47): instead of adding a new bit as a carry hint, a rejection condition is added. When the signer and the verifier cannot obtain two similar items, the scheme determines that the signature is invalid and refuses to output, and rewinds back to the first step of the scheme until a valid signature is output. The Fiat-Shamir lattice signature scheme proposed by Bai et al. is as follows Figure 1 As shown, the following steps are included:

[0005] Step 1: Key Generation:

[0006] The key generation algorithm is distributed according to Select the matrix S, according to the distribution Select the matrix E, (S, E) as the signature key sk; from The matrix A is uniformly randomly selected from the matrix, and T = AS + E is calculated, (A, T) as the verification key pk. The verification key pk can be made public, and the signature key sk is sent to the signer. Among them, Represents an n×k-level matrix, each element of which obeys the integer A discrete Gaussian distribution with an upper center of 0 and a standard deviation of σ; represents an m×n matrix, where each element is taken from the ring of integers modulo q

[0007] Step 2: Signature:

[0008] First of all Figure 1 The high-order hash function f(·) used in the example is described. First, it is stipulated that for all operations of the form α mod a, To facilitate the explanation of the function f(·), we define the function right Consider the binary form of u, with a length of log q, where the first bit is the symbol of u. Separate the high and low bits of the binary form of u, define the first l bits as high bits, and the last l′ bits as low bits, l+l′=log q, log represents the logarithm with base 2, g(u) means retaining the first l bits of the string u, that is: for u=u1…u l u l+1 …u log q , g(u)=u1…u l . We further define the function f(·), the input of f(·) is For each component of the vector x in , the function g(·) is calculated.

[0009] To sign the message μ, the signer first distributes Extract the mask vector y (see Figure 1 Then, we calculate the vector Ay, perform high-order hashing on each item of the vector Ay, and send it together with the message μ to RO to get the answer c (see Figure 1 After the signature is generated, Figure 1 In step 3-4, vector w is calculated, and rejection condition 1 is applied to the calculated vector w (:=Az-Tc), and a "goodness" check is performed on the vector w (:=Ay-Tc) used in the calculation (see Figure 1 In step 5), the "bad" vector w is rejected to ensure the correctness of the scheme; for vector w that does not meet the rejection condition, the corresponding signature is rejected and the vector y is re-extracted back to step 1; for the signature (z, c) that passes the verification, the probability Output (see Figure 1 In step 6, In the ideal case, the signature z conforms to a Gaussian distribution with a standard deviation of σ on the n-dimensional integer grid. z A discrete Gaussian distribution centered at 0; represents the standard deviation σ on the n-dimensional integer grid y , a discrete Gaussian distribution with center Sc), thereby ensuring that the output signature distribution is statistically indistinguishable from a distribution independent of the private key, thus ensuring the security of the scheme.

[0010] Step 3: Verification:

[0011] To verify whether the signature is valid, the verifier first calculates the vector Az-Tc and performs high-order hashing, and sends it together with the message μ to RO and obtains the answer c′, and then compares the obtained c′ with the c in the signature. If c′=c, the verification program outputs 1, indicating that the signature is a legal signature.

[0012] The Fiat-Shamir grid signature scheme proposed by Bai et al. has a relatively mature framework. The scheme includes two rejection conditions: the first condition is rejection sampling, which ensures that the output signature distribution is independent of the key distribution, which is the guarantee of the security of the scheme; the second condition is valid signature detection, which rejects signatures that cannot pass the test, which is the guarantee of the correctness of the scheme. However, the two rejection sampling conditions will lead to an excessively high rejection rate, which will lead to a decrease in signature efficiency. If signature efficiency is to be guaranteed, the signature length will increase. Summary of the invention

[0013] The purpose of the present invention is to disclose a more efficient lattice signature method based on lattice code, which utilizes high-order hash technology and one-dimensional character string to replace the randomness technology of multi-dimensional vector to construct a more efficient lattice signature method, which can optimize the rejection conditions of the signature process, thereby reducing the number of rejections of the scheme and reducing the time required for a single run.

[0014] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0015] A more efficient signature method based on lattice code includes the following steps:

[0016] Improve the Fiat-Shamir lattice signature scheme to generate a new key generation algorithm and a new signature algorithm;

[0017] The new key generation algorithm is to convert the integer ring in the Fiat-Shamir lattice signature scheme into Change to polynomial ring R q ;

[0018] The new signature algorithm is based on R q Uniformly randomly extract the masking vector y and the string b, and construct the vector β from b; perform high-order hashing based on y and β, and combine b and the message μ to be signed to generate the answer c; construct vectors z and v based on y, β and c, and perform rejection condition detection on v; for v that does not meet the rejection condition, re-extract b and perform the above processing; for v that meets the rejection condition, the obtained (z, c, b) is the signature;

[0019] The signer establishes legal communication with the verifier;

[0020] Generate a signing key and a verification key according to the new key generation algorithm, send the signing key to the signer, and make the verification key public or send it to the verifier;

[0021] The signer signs the message μ to be signed according to the new key generation algorithm and makes the signature public;

[0022] The verifier uses the verification key to verify the validity of the signer's signature.

[0023] Furthermore, when the key is generated, the LWE instance is generated as a public verification key, and the secret and error used in the LWE instance generation process are used as the signing key.

[0024] Furthermore, the new key generation algorithm is Select vector s from Select vector e from the , and use (s, e) as the signature key; where m, n represent the vector dimensions, It represents a discrete Gaussian distribution on a ring R with a standard deviation of σ and a center point of 0, and q represents the modulus.

[0025] Furthermore, the new key generation algorithm is Select matrix A from the equation, and calculate t = As + e, using (A, t) as the verification key; Represents an m×n-level matrix, each component is R q element.

[0026] Further, x represents a variable, d represents R q The degree of the intermediate modulus polynomial.

[0027] Furthermore, the new signature algorithm is based on from A string b is uniformly randomly extracted from and expanded into an n-dimensional vector β = (b, ..., b).

[0028] Furthermore, the new signature algorithm first calculates the vector Ay+β, then performs high-order hash processing on each item of Ay+β, and then sends it together with μ, b to the RO for inquiry to obtain the answer c.

[0029] Furthermore, the new signature algorithm first calculates the vector z=y+sc, then calculates the vector v=Az-tc, and finally obtains the vector v(:=Ay-ec+β).

[0030] Furthermore, the verified signature generated by the new signature algorithm is (z, c, b), which is independent of the signature key.

[0031] Furthermore, when the new signature algorithm detects that the vector v belongs to the Bad set, it re-selects Extract y from v; the condition for judging whether v belongs to the Bad set is: the element v in v ij exist Where l represents the high-order length, l′ represents the low-order length, and k is traversed from -2 l′ To -2 l′ All integers of , ε represents the value range of Bad in each interval.

[0032] Furthermore, when the number of rejections reaches a certain limit, it is determined that the vector y does not meet the requirements and y is reselected.

[0033] Furthermore, the steps for the verifier to verify the validity of the signature include:

[0034] First, the vector Az-tc+β is calculated and the high-order hash is performed, and it is sent to RO together with the message μ,b and the answer c′ is obtained;

[0035] Then compare the obtained c′ with c in the signature. If c′=c, it is verified to be a legal signature.

[0036] Compared with the prior art, the present invention has the following advantages:

[0037] 1) The method of the present invention comprises: The mask vector y is uniformly randomly extracted in , and the rejection sampling condition is removed, so that the two rejection conditions are improved to one rejection condition, which reduces the rejection rate of a single run of the scheme and thus improves the efficiency of the signature.

[0038] 2) The method of the present invention improves the second rejection condition. When the signature needs to be repeated, the n-dimensional vector is no longer extracted again, but only a 1-dimensional string is extracted; the 1-dimensional string is used instead of the n-dimensional vector to provide randomness, thereby achieving the effect of shortening the time required for a single signature run. Since this method has little effect on the number of repetitions required for the signature, the time required for the signature is shortened. This method is also applicable to the situation where a multi-dimensional random number is repeatedly extracted with a certain probability without being output in the signature algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flowchart of the Fiat-Shamir lattice signature scheme.

[0040] Figure 2 This is a flow chart of a more efficient lattice signature method based on lattice code proposed by the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical method and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings.

[0042] The Fiat-Shamir lattice signature scheme proposed by Bai et al. has several disadvantages: 1. From the perspective of parameter size, the scheme is 1. The scheme runs on , which requires a larger parameter size; 2. The scheme sets two rejection conditions, which makes it easier for the signature process to enter the repetitive process, affecting the signature efficiency; 3. The single rewind of the scheme still has room for improvement.

[0043] The present invention aims at the shortcomings of the Fiat-Shamir lattice signature scheme and makes the following improvements: 1. The scheme is designed in the ring R q Finished on the ring R q Only a d-dimensional vector is needed to represent 1. By changing the distribution of the extracted masking vector y and the key, it is ensured that z in the signature is uniformly distributed when it is generated to ensure that the signature and the key "look" unrelated, thereby removing the first rejection condition; 2. By changing the single repetition of the scheme, the time required for a single repetition is reduced by extracting a single-dimensional string instead of re-extracting an n-dimensional vector.

[0044] The present invention specifically proposes a more efficient lattice signature method based on lattice code, such as Figure 2 As shown, the following steps are included:

[0045] Step 1: Key Generation:

[0046] The key generation algorithm is Select vector s from Select vector e, (s, e) as the signature key sk; from The matrix A is uniformly randomly selected from the matrix, and t = As + e, (A, t) is calculated as the verification key pk. The verification key pk can be made public, and the signature key sk is sent to the signer. Among them, The coefficient is The d-degree polynomial ring of represents an m-dimensional vector, where each component obeys a discrete Gaussian distribution with a standard deviation of σ on R and a center point of 0. Represents an n-dimensional vector, where each component is R q elements, where q represents the modulus in the polynomial ring; The coefficient is The polynomial ring of represents the integer ring modulo q, and d represents the dimension of the polynomial ring; Represents an m×n matrix, where each component is R q element.

[0047] Step 2: Signature:

[0048] The high-order hash function f(·) used by the method of the present invention is input as The vector on is slightly different from the solution of Bai et al., which is explained below. Similarly, the function g(u) means retaining the first l bits of the string u, that is, for u = u1…u l u l+1 …u log q , g(u)=u1…u l The present invention further defines a function h(·), which has the same function as g(·), but its input term is R q The elements on R q The elements on can be recorded in the form of vector u, and h(u) is calculated by using function g(·) for each component of u; now the present invention can define function f(·), and the input of f(·) is In the vector x, the present invention uses the function h(·) to calculate each component of x. This technology of retaining the high-order bits of a string or vector is called a high-order hash technology.

[0049] To sign the message μ, the signer first The mask vector y is uniformly randomly drawn from Figure 2 Step 1). Further, from The string b is uniformly randomly extracted from the R (i.e., the masked element) and expanded into an n-dimensional vector β = (b, ..., b) (i.e., b is regarded as a ring R q The upper element b+bx+…+bx n-1 )(See Figure 2 Then calculate the vector Ay+β, and perform high-order hashing on each item of the vector Ay+β. Then send it together with the message μ,b to RO for inquiry, and get the answer c (see Figure 2 The final content of the ID protocol is calculated by the signature key and the RO's answer c. After the signature is generated, the vector z = y + sc is calculated (see Figure 2 Step 4), then calculate the vector v = Az-tc (see Figure 2 In step 5), the public key shows that the vector v = Ay-ec + β. The present invention performs a rejection condition detection on the calculated vector v (see Figure 2 In step 6), for the vector v that does not meet the rejection condition, the present invention rejects the corresponding signature; unlike the solution of Bai et al. in which the vector y is re-extracted by returning to step 1, the present invention returns to step 2 to re-extract the element b; for the verified signature (z, c, b), since the masking vector y is uniformly distributed, the calculated vector z is also uniformly distributed and is independent of the signature key, so the rejection condition 2 is no longer required.

[0050] During the execution of the algorithm, if it is detected that the vector v is in the Bad set, the algorithm rewinds back to step 1 for execution (see Figure 2 In step 7), the specific setting of the Bad set is as follows: if there are i∈{1,…,m} and j∈{1,…,d} (where d is R q The degree of the modular polynomial, m is the number of rows of matrix A), so that (Indicates that when the variable k takes -2 l′ , -2 l′ +1, ..., 2 l′ When multiple [k·2 l -ε, k·2 l +ε]), then the vector v∈Bad. Among them, v ij The meaning is as follows: for modulus q, dimension m, ring R q ,remember The vector v in is (v1, ..., v m ), v ij It means that the i-th polynomial component v of v i The jth value after being represented by an integer vector (that is, v i for (v i1 , ..., v id ),in ). The value of the Bad range ε ​​of each interval must satisfy: with a probability close to 1, The e selected from Each component of c,ec selected in is bounded by [-ε, ε]; Represents a set of m-dimensional vectors with weight ω, each component of which is taken from {-1, 0, 1}.

[0051] In order to reduce the situation where the signature cannot be terminated after entering the repetitive cycle, the present invention needs to set the parameters carefully, so that q / 2 l is significantly larger than 2dmε, making its ratio a power of 2. In this way, for any y, a suitable b can be found with a high probability, thus ensuring that the cycle can be terminated. l When it is less than 2dmε, the signature algorithm may extract a "very bad" mask vector y, resulting in a high probability that the vector v will fail the rejection test even if the string b is reselected. The present invention determines that the vector y is bad when the number of rejections reaches a certain limit, and the scheme reruns the first step and reselects a y.

[0052] Step 3: Verification:

[0053] To verify whether the signature is valid, the verifier first calculates the vector Az-tc+β and performs high-order hashing, and sends it together with the message μ,b to RO and obtains the answer c′, and then compares the obtained c′ with the c in the signature. If c′=c, the verification program outputs 1, indicating that the signature is a legal signature.

[0054] When the method of the present invention is implemented in a specific embodiment, the key is generated according to the following specific parameters and the above steps to perform signing and verification: q = 2 23 , d=256, n=3, m=6, the infinite norm of e (i.e. the largest value among all components) is 6, ε=360, l=18, l′=5.

[0055] Analysis and evaluation:

[0056] 1. Correctness analysis:

[0057] The correctness of the scheme is guaranteed by the rejection condition. For a valid signature verified by the rejection condition, since v = Az-tc + β = Ay-ec + β, due to the restriction of the rejection condition, for a vector v that does not belong to the Bad set, with a probability of significant 1, we have: for k∈{-2 l′ , 2 l′}, if (Az-tc+b) ij ∈(k·2 l +ε,(k+1)·2 l -ε), then (Ay+b) ij ∈(k·2 l , (k+1)·2 l ). Due to the mapping relationship of the high-order hash function, (k·2 l , (k+1)·2 l ) is mapped to k, so f(Ay+β)=f(Az-tc+bβ), and thus c′=c, and the verification is successful.

[0058] 2. Security analysis:

[0059] The security of the scheme is guaranteed by the difficulty of the LWE problem and the difficulty of the BDD problem. Specifically, the present invention defines a variant of the BDD problem - ABDD b The difficulty of the problem can be reduced to the difficulty of the BDD problem, and the security of the algorithm can be reduced to the difficulty of the LWE problem and ABDD b The difficulty of the problem. Further, ABDD b The problem is that for a given high-order hash function f(·) and a ring R q , a polynomial-time adversary The probability of success in the following game is negligible. For a given matrix A and vector t, Reply vector w, the challenger randomly selects a challenge (c, b) and sends it to We need to find a vector z that satisfies: w = f(Az-ct+β). All matrices, vectors, and elements belong to R q .

[0060] The following is a detailed safety analysis.

[0061] In the key generation stage, the public key is in the form of an LWE sample. To ensure the security of the key, it is necessary to ensure that the adversary cannot obtain information about the signing key from the public verification key. This can be reduced to the difficulty of the LWE problem.

[0062] In the signing phase, the distribution of the masking vector y and the key ensures that z in the signature is uniformly distributed when it is generated; due to the nature of RO, the challenge c can be regarded as randomly selected from the uniform distribution; similarly, b is also randomly selected from the uniform distribution, so a simulator without a signature key can simulate a signature (z, c, b) that is statistically close to the real signature, so the attack on the signature scheme can be regarded as an attack on the simulator. Through the rewinding technology, the present invention can transform the attack capability on the simulator into solving the ABDD problem. b The ability to solve problems can then be transformed into the ability to solve BDD problems.

[0063] 3. Efficiency analysis:

[0064] In the solution proposed by the present invention, the efficiency of the signature algorithm is significantly improved. Specifically, in the previous signature algorithm, each rejection requires returning to the first step to re-extract the nd-dimensional vector y, and then calculating the hash value c and Ay-ec+β. Through the improvement of the present invention, the nd-dimensional vector y only needs to be extracted once at the beginning, and only needs to be extracted when repeated. The value b on the above is sufficient, and since Ay remains unchanged, the hash calculation takes a short time, each component of the vector e is very small, and the components in c are all extracted from {-1,0,1}. The time required to calculate ec is also very short, so the time required for each cycle is greatly reduced, which significantly improves the signature efficiency.

[0065] In summary, the performance of the present invention is relatively excellent in terms of security, time overhead and space overhead, has strong practical application value, and can provide users with better services.

[0066] Although the present invention has been disclosed as above by way of embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions of the technical solutions of the present invention made by ordinary technicians in the field should all be included in the protection scope of the present invention. The protection scope of the present invention shall be based on what is defined in the claims.

Claims

1. A more efficient signature method based on lattice code, characterized in that: The steps include: Improve the Fiat-Shamir lattice signature scheme to generate a new key generation algorithm and a new signature algorithm; The new key generation algorithm is to convert the integer ring in the Fiat-Shamir lattice signature scheme into Change to polynomial ring R q ,in x represents a variable, d represents R q The degree of the intermediate modulus polynomial; The new signature algorithm is based on R q Uniformly randomly extract the masking vector y and the string b, and construct the vector β from b; perform high-order hashing based on y and β, and combine b and the message μ to be signed to generate the answer c; construct vectors z and v based on y, β and c, and perform rejection condition detection on v; for v that does not meet the rejection condition, re-extract b and perform the above processing; for v that meets the rejection condition, the obtained (z, c, b) is the signature; The signer establishes legal communication with the verifier; Generate a signing key and a verification key according to the new key generation algorithm, send the signing key to the signer, and make the verification key public or send it to the verifier; The signer signs the message μ to be signed according to the new key generation algorithm and makes the signature public; The verifier uses the verification key to verify the validity of the signer's signature.

2. The method according to claim 1, characterized in that When generating keys, an LWE instance is generated as a public verification key, and the secret and error used in the LWE instance generation process are used as the signing key.

3. The method according to claim 1 or 2, characterized in that The new key generation algorithm is Select vector s from Select vector e from the , and use (s, e) as the signature key; where m, n represent the vector dimensions, Represents an m-dimensional vector, where each component obeys a discrete Gaussian distribution with a standard deviation of σ on R and a center point of 0, and q represents the modulus.

4. The method according to claim 3, characterized in that The new key generation algorithm is Select matrix A from the equation, and calculate t = As + e, using (A, t) as the verification key; Represents an m×n-level matrix, each component is R q element.

5. The method according to claim 4, characterized in that The new signature algorithm is based on from A string b is uniformly randomly extracted from and expanded into an n-dimensional vector β = (b, ..., b).

6. The method according to claim 5, characterized in that The new signature algorithm first calculates the vector Ay+β, then performs high-order hash processing on each item of Ay+β, and then sends it together with μ, b to RO for inquiry, and obtains the answer c.

7. The method according to claim 6, characterized in that The new signature algorithm first calculates the vector z=y+sc, then calculates the vector v=Az-tc, and finally obtains the vector v(:=Ay-ec+β).

8. The method according to claim 7, characterized in that When the new signature algorithm detects that the vector v belongs to the Bad set, it re-selects Extract y from v; the condition for judging whether v belongs to the Bad set is: the element v in v ij exist Where l represents the high-order length, l′ represents the low-order length, and k is traversed from -2 l′ To -2 l′ All integers of , ε represents the value range of Bad in each interval.

9. The method according to claim 1 or 7, characterized in that: When the number of rejections reaches a certain limit, it is determined that vector y does not meet the requirements and y is reselected.

10. The method according to claim 7, characterized in that The steps for the verifier to verify the validity of the signature include: First, the vector Az-tc+β is calculated and the high-order hash is performed, and it is sent to RO together with the message μ,b and the answer c′ is obtained; Then compare the obtained c′ with c in the signature. If c′=c, it is verified to be a legal signature.

Images