A lattice-based cryptographic digital signature scheme using masking
Patent Information
- Application Number
- JP2024546176
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2022-02-03
- Filing Date
- 2023-02-03
- Publication Date
- 2025-03-11
Smart Images
Figure 2025506414000029 
Figure 2025506414000030 
Figure 2025506414000001
Abstract
Description
[Technical field]
[0001] The present invention relates to a cryptographic digital signature scheme for verifying the integrity and origin of an electronic message.The present invention relates to a post-quantum lattice based cryptographic digital signature scheme that utilizes masking as a countermeasure against side channel attacks. [Background technology]
[0002] A digital signature scheme allows a signer to attach a digital signature to a message, which allows a verifier to verify that the message is the same as the message signed by the signer. Digital signature schemes typically include three operations: key generation, signing, and verification. In the key generation operation, a signing key sk and a verification key vk are generated. The signing key sk is private to the signer, while the verification key vk may be public and is known to the verifier. In the signing operation, the signer generates a digital signature for the message. In the verification operation, the verifier verifies the message using the digital signature and the verification key vk.
[0003] The Fiat-Shamir transformation (or heuristics) is a methodology that transforms an identification scheme into a signature scheme through a general transformation. A signature derived from this method is called a Fiat-Shamir signature. The three-pass identification scheme involves: i) the prover makes a commitment available to the verifier; ii) the verifier sends a challenge to the prover; and iii) the prover sends a response to the challenge to the verifier, which processes the response to verify that the prover knows the private key without the verifier acquiring any knowledge of the private key. The corresponding digital signature scheme involves the signer generating a challenge by applying a hash function to data including the commitment, the verification key, and the signed message, forming a digital signature including the commitment and the response. Based on the message, the digital signature, and the verification key, the verifier can reproduce the challenge and verify the response, thereby verifying the integrity of the message.
[0004] Lattice-based cryptographic schemes (e.g., those based on learning with errors (LWE) and short integer solution (SIS) problems) are interesting because they are conjectured to be resistant to attacks by adversaries with access to large-scale quantum computers. Thus, lattice-based cryptographic schemes are typically considered to be a subset of post-quantum cryptography.
[0005] Lattice-based cryptographic schemes may be vulnerable to side-channel attacks where an adversary learns side-channel information about the physical execution of the algorithm. Side-channel information can be derived from many sources such as execution time, electromagnetic radiation, energy consumption, and acoustic emissions. Various studies have demonstrated that side-channel information about the execution of lattice-based signature algorithms can potentially be used by an adversary to recover the signature key sk that was used.
[0006] One countermeasure proposed against side-channel attacks is masking, which is based on techniques in the fields of secret sharing and multiparty computation (MPC). Given a confidential value
Number
Number
Number
Number
[0007] Increasing the value of d strengthens the countermeasure against side-channel attacks, but the difficult aspect of masking is that when the value of d is increased, the computational complexity often scales proportionally to a quadratic (or higher) overhead.
Summary of the Invention
[0008] According to a first aspect of the present invention, a computer-implemented method for generating a signature key pair for Fiat-Shamir digital signatures is provided. The method includes sampling a modulo-q base ring and generating a plurality of secret sharings of a secret, each secret sharing being generated by sampling the modulo-q base ring. For each secret sharing, determine the product of the secret sharing and the matrix to generate a modified secret sharing, round the modified secret sharing modulo p (p ≠ q) to generate a plurality of rounded secret sharings. Decode these to generate decoded data. Then, a signature key corresponding to the plurality of secret sharings and a verification key corresponding to the public matrix and the decoded data can be returned. When sampling of the secret sharing from the modulo-q base ring is not restricted (i.e., uniform secret LWE), the signature key and the verification key can be provided in a way that the processing complexity scales linearly with the number d of the plurality of secret sharings. When the secret is restricted to be short (i.e., small secret LWE), the key generation time is quadratic in d.
[0009] According to a second aspect of the present invention, there is provided a computer-implemented method for generating a Fiat-Shamir digital signature according to a signing key and a verification key, where the signing key corresponds to a plurality of secret shares of a secret, each secret share being sampled from a modulo q basis ring, and the verification key corresponds to a public matrix sampled from the modulo q basis ring and the solution data. The method includes generating a plurality of random shares, each random share being generated by sampling a plurality of parameters from the modulo q basis ring, and for each random share, determining a product of the random share and the public matrix to generate a plurality of modified random shares. Each modified random share is rounded modulo p (p≠q) to generate a plurality of rounded random shares, and then decoding the plurality of rounded random shares to generate the commitment data. A hash function is then applied to data including the message and the commitment data to generate a challenge value c, and a plurality of response shares are generated for each secret share by multiplying each secret share by the challenge value c and adding each random share, and the plurality of response shares are decoded to generate the response data. A difference between the product of the response data and a public matrix and the product of the challenge value c and the solution data is calculated to provide the test data, and hint data is determined by rounding the test data modulo p to generate rounded test data and determining the difference between the response data and the rounded test vector. A digital signature including the response data and the hint data can then be returned. In this manner, a digital signature can be provided in a manner such that the processing complexity scales sublinearly with the number of multiple secret shares d, regardless of whether the sampling of the random shares is unconstrained or constrained to be small.
[0010] According to a third aspect of the present invention, there is provided a computer-implemented method for verifying a message using an associated Fiat-Shamir digital signature comprising response data and hint data according to a signing key and a verification key, where the signing key corresponds to a plurality of secret shares of a secret, each secret share being sampled from a modulo q basis ring, and the verification key corresponds to a public matrix sampled from the modulo q basis ring and solution data derived using the public matrix and the plurality of secret shares. A hash function is applied to data comprising the message and commitment data to generate a challenge value c. A difference between the product of the response data and the public matrix and the product of the challenge value c and the solution data is calculated to provide test data, and the test data is rounded modulo p to provide rounded test data. It is then verified that the sum of the rounded test data and the hint data corresponds to the commitment data.
[0011] Further features and advantages of the present invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, made with reference to the accompanying drawings, in which: [Brief description of the drawings]
[0012] [Figure 1] FIG. 1 illustrates a schematic diagram of the main components of an example electronic messaging system using a digital signature scheme. [Diagram 2] FIG. 1 illustrates a schematic diagram of the main components of a device capable of performing key generation, signing and verification operations. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
[0013] The examples described herein relate to electronic messaging systems in which a signer generates a digital signature for an electronic message and a verifier uses the digital signature to verify the electronic message.
[0014] System Overview As shown in FIG. 1, the electronic messaging system includes a signer device 1 that sends a signed message (sig, msg) to a verifier device 3 over a communication channel 5 .
[0015] The signer device 1 is a processing device having a transmitter (not shown in FIG. 1) that transmits a signed message (sig, msg) into a communication channel 5. For example, the signer device 1 may be a server computer, a desktop computer, a laptop computer, a tablet device, or a smartphone. Although FIG. 1 illustrates the case where the signer device 1 receives an unsigned message msg, alternatively, the unsigned message msg may be generated by the signer device 1.
[0016] Similarly, the verifier device 3 is a processing device having a receiver (not shown in FIG. 1) that receives the signed message (sig, msg) from the communication channel 5. For example, the verifier device 3 may be a server computer, a desktop computer, a laptop computer, a tablet device, or a smartphone. Although FIG. 1 illustrates the case where the verifier device 3 outputs the unsigned message msg, alternatively, the unsigned message msg may be processed by the verifier device 3.
[0017] The communication channel 5 may communicate the electronic message over a communication network (e.g., a local area network (LAN), a wide area network (WAN), a public land mobile network (PLMN), a system area network (SAN), etc.). The communication channel 5 may involve the signer device 1 storing the message msg in memory for subsequent retrieval by the verifier device 3.
[0018] The electronic messaging system of Figure 1 has key generation circuitry 11 that generates a signing key pair including a signing key sk and a verification key vk. Both signing key sk and verification key vk are provided to signer device 1, but only the verification key vk (and not the signing key sk) is provided to verifier device 3. Although key generation circuitry 11 is shown in Figure 1 external to signer device 1, it will be understood that key generation circuitry 11 may be provided within signer device 1, and signer device 1 communicates verification key vk to verifier device 3, for example via communication channel 5.
[0019] The signer device 1 includes a message signing circuit 13. The message signing circuit 13 receives an unsigned message msg and outputs a signed message (sig, msg).
[0020] The verifier device 3 includes a message verification circuit 15 that receives a signed message (sig, msg) and outputs an unsigned message msg and an indication of whether the contents of the unsigned message msg have been verified.
[0021] The key generation circuit 11, the message signing circuit 13, and the message verification circuit 15 may be embodied in hardware, software, or a combination of hardware and software. For example, one or more of the key generation circuit 11, the message signing circuit 13, and the message verification circuit 15 may include a cryptographic co-processor that accelerates cryptographic operations in a system-on-chip (SoC) environment on a field programmable gate array (FPGA) or application specific integrated circuit (ASIC).
[0022] Examples of operations performed by the key generation circuit 11, the message signing circuit 13 and the message verification circuit 15 are now described in detail. In this description, the following notation is used: · Vectors are represented by a lowercase bold font (e.g., t). · Matrices are represented by capital bold font (e.g., A). ·R qis a fundamental ring and commutes. It can be seen, for example, that
number
number
number
number
[0023] key generation The manner in which key generation circuit 11 generates a signing key pair may be represented by the following pseudocode:
number
[0024] In row 1, the kxl matrix A is a function of the basis ring R q is sampled from
[0025] In line 2, the dl-dimensional vector is q The order d of the secret s is sampled from
number
[0026] In line 3, we use d shares of secret s.
number
number
[0027] Line 4 applies a function (also called a gadget called OrderSwitch) to vector t to transform shares of t with order d to shares of t with order d', where d' >= d. Pseudocode for the OrderSwitch gadget to transform d shares of a value x to d' shares of a value x is given below:
number
[0028] In effect, we see that some d'~d null vectors are added to generate d' shares, and then a refresh operation is performed to generate d' new shares for x. The refresh operation can be performed in time O(d) (see, e.g., Rivain and Prouff, “Provably secure higher-order masking of AES,” CHES 2010, vol. 6225, LNCS, pp. 413-427, Springer, Heidelberg, August 2010), but a more secure refresh operation may be performed in time O(dlogd) (see, e.g., Battistello et al, “Horizontal side-channel attacks and countermeasures on the ISW masking scheme,” CHES 2016, vol. 9813, LNCS, pp. 23-39, Springer, Heidelberg, August 2016) instead of or in addition to performing the refresh operation in time O(d). By applying it coefficient-wise, OrderSwitch can be trivially generalized to vectors, e.g., shares of t, as well as polynomials and matrices.
[0029] The purpose of the reordering in line 4 of the key generation pseudocode is to act as a countermeasure against an adversary probing the sharing of t before the error term is introduced.
[0030] Line 5 of the key generation pseudocode uses a gadget called ApproxRound to effectively introduce an error term. The pseudocode for the ApproxRound gadget for a shared value x of order d is given below:
number
[0031] It can be seen that each share of a value x is rounded modulo (p≠q)p. This involves, in this example, that each coefficient of each share of a value x is input into the function round(x / p), where round() denotes a rounding operation that maps floating-point values to the nearest integer. The gadget ApproxRound has the effect that the decoded value x is only correct up to an additive term bounded by ±d. By applying coefficient-wise, ApproxRound can be trivially generalized to shares of vectors, e.g., t, as well as to polynomials and matrices.
[0032] Returning to the key generation pseudocode, in line 6, a vector t is determined from the ordered shares d according to the application of the ApproxRound gadget. Finally, in line 7, the key generation pseudocode determines the ordered shares d of the secret s.
number
[0033] All of the operations previously described for key generation can be performed in time O(d), so key generation can be done in time O(d). However, as previously described, to assert stronger security guarantees, an alternative refresh gadget may be utilized, which increases the total execution time to O(dlogd).
[0034] signature The manner in which message signing circuitry 13 generates a signature sig for a message msg using a signing key sk may be represented by the following pseudocode:
number
[0035] In line 1, we define a dl-dimensional vector in the basis ring R qRandomly sample from and share the order d of the temporary randomness vector r
number
[0036] In line 2, we use d shares of the temporary randomness vector r.
number
number
[0037] In line 4, we apply the ApproxRound gadget to u's ordered d' shares to generate ordered d' shares of vector w. Then, in line 5, we decode vector w from the ordered d' shares. Vector w is the commitment computed by the signing device.
[0038] In line 6, we generate a challenge c by applying a hash function to data including the commitment w and the message msg. In line 7, we generate ordered d shares of the response vector z by multiplying the ordered d shares of the secret s by the challenge c, then adding the ordered d shares of the temporary randomness vector r. In line 8, we decode the response vector z from the ordered d shares computed in line 7.
[0039] In line 9, vector y is computed by multiplying response vector z by matrix A of verification key vk and adding c times vector t from verification key vk.
[0040] The obvious effect of rounding the share of the ordering d' of vector u in row 4 is to destroy accuracy, because the noise introduced by that operation is
number
number
[0041] If not constrained, the hint vector h may destroy the soundness of the signature generation. To address this, a soundness check is performed to verify compliance with one or more shortness constraints. In particular, in this example, this includes checking that the Euclidean and infinity norms of the hint vector h do not exceed the respective bounds B2 and B∞ (although other shortness constraints may also be checked), in line 11. If any of the bounds are exceeded, in line 12 the routine returns to line 1 to compute a new temporary randomness vector r. Otherwise, in line 13, it returns a digital signature sig that includes the commitment vector w, the response vector z, and the hint vector h.
[0042] In a nominal implementation of digital signature generation, the infinity norm B∞ is always less than or equal to d. 2 of
number
[0043] basic ring
number
[0044] Note that signature generation does not require rejection sampling or correctness checking, which is common in Schnorr lattice-based signatures. Rejection sampling is eliminated by using the uniform secret LWE, while correctness checking is unnecessary due to the use of the hint h.
[0045] As with key generation, all operations in message signing run in time O(d), and the running time for message signing is O(d). Again, the running time can increase to O(dlogd) if the refresh gadget is applied.
[0046] verification The manner in which the message verification circuit 15 verifies a signature sig on a message msg using a verification key vk may be represented by the following pseudocode:
number
[0047] As shown in line 1, three checks are performed. The first and second checks are whether the Euclidean and infinity norms of the hint vector n are within the respective bounds B 2 and B. ∞ (However, other shortness-constraint based checks are feasible, as discussed above for checking soundness during signing). The third check involves reproducing the challenge c by applying a hash function to data including the commitment vector w and the received message msg, in the same manner as in line 6 of the message signing pseudocode, and then checking whether the difference between the commitment vector w and the hint vector h is equal to the vector formed by multiplying the response vector z from the digital signature sig by the matrix A of the verification key vk, and then adding c times the vector t of the verification key vk, rounded modulo p. If any of the three checks fail, the verification is rejected. Otherwise, the verification is accepted.
[0048] device 2 shows a schematic of the main components of a device 21 that can be used to implement the digital signature scheme described above. The device 21 includes a communication module 23 for wired or wireless communication with other devices participating in the digital signature scheme. The communication module 23 may include, for example, in the case of a mobile communication device such as a smartphone, one or more antennas for communicating via a core network and a radio access network.
[0049] The device 21 further includes a processing circuit 25 and a memory circuit 27. The processing circuit 25 may include one or more processing units, such as a central processing unit (CPU), a specialized processing unit, such as a digital signal processor (DSP), a subscriber identity module (SIM), a hardware integrated trusted execution environment (TEE), and / or one or more application specific integrated circuits (ASICs) or application specific standard products (ASSPs). The memory circuit 27 may include volatile random access memory (RAM), in particular static random access memory (SRAM) and dynamic random access memory (DRAM), as well as non-volatile memory and storage, such as flash memory, an integrated solid state drive (SSD), and an internal hard disk drive (HDD), and / or one or more removable storage devices.
[0050] Memory circuitry 27 holds machine-readable instructions for carrying out the various functions described in this disclosure. In particular, memory circuitry 27 stores a KeyGen routine 29 for generating public / private key pairs as previously described, a signature routine 31 for signing messages as previously described, and a verification routine 33 for verifying digital signatures to ensure the validity of messages as previously described.
[0051] It will be appreciated that a device for use with the described digital signature scheme need not store all of the KeyGen routine 29, the signing routine 31, and the verification routine 33. For example, one device may store the KeyGen routine 29 and the signing routine 31, while another device may store only the verification routine 33.
[0052] Fixes The sampling of the secret shares during key generation and the random shares during signing in the pseudocode presented above is not constrained. In other words, the pseudocode implements a uniform secret LWE. Alternatively, a small secret LWE can be used as follows: During key generation, a representation of s can be generated bit-wise, followed by a Boolean-to-arithmetic conversion. This takes time O(d 2 ) (see, for example, the paper by Coron et al., "High-order table-based conversion algorithms and masking lattice-based encryption," Cryptology ePrint Archive, Report 2021 / 1314). -Random sharing during signing
number
number
[0053] So the drawback of using small secret LWE as mentioned above is that key generation is O(d 2 ), while still allowing the signing time to remain sub-linear.
[0054] Although the pseudocode above uses modulo p to round to the nearest integer, floating-point values can alternatively be converted to integer values using a modulo p truncation function (which divides the modulus by p and rounds the resulting floating-point values to their integer components), or a modulo p ceiling function (which divides the modulus by p and rounds the resulting floating-point values to the next higher integer value), and the phrase "round modulo p" is intended to encompass all such operations.
[0055] As those skilled in the art will appreciate, when setting the moduli p and q, constraints on both security and correctness must be taken into account. In lattice-based cryptography, there are typically two opposing constraints on the modulus q: the need to avoid information leakage via the verification key favors a small q, while improving security against forgery favors a large q. Thus, q should not be too small or too large. Similarly, p should not be too small or too large, since a large p reduces security and a small p increases the size of the hint.
[0056] In pseudocode, the verifier key includes a matrix A. Alternatively, matrix A can be generated from a short, known seed value and a pseudorandom function, in which case the seed value is typically easier to store and transmit than matrix A.
[0057] It will be appreciated that while the digital signature in the above system includes a commitment, the commitment may be replaced by a challenge. In such a case, the third check in message verification is:
number
[0058] It will be appreciated that more than one set of challenge data may be utilized in a manner similar to a five-pass or, more generally, a 2n+1-pass (n is an integer) identification scheme.
[0059] The above-described embodiments should be understood as illustrative examples of the present invention. Further embodiments of the present invention are contemplated. It is to be understood that any feature described in connection with any one of the embodiments may be used alone or in combination with other features described, and may also be used in combination with one or more other features of any of the embodiments, or in any other combination of any of the embodiments. Moreover, equivalents and modifications not described above may be used without departing from the scope of the present invention, which is defined in the appended claims.
Claims
1. 1. A computer-implemented method for generating a Fiat-Shamir digital signature according to a signing key and a verification key, the signing key corresponding to a plurality of secret shares of a secret, each secret share being sampled from a modulo q basis ring, the verification key corresponding to a public matrix and solution data sampled from the modulo q basis ring, the method comprising: generating a plurality of random shares, each random share being generated by sampling a plurality of parameters from the modulo q basis ring; for each random share, determining a product of the random share and the public matrix to generate a plurality of modified random shares; rounding each of the modified random shares modulo p, where p≠q, to generate a plurality of rounded random shares; and decoding the plurality of rounded random shares to generate commitment data. applying a hash function to data including a message and the commitment data to generate a challenge value c; generating a plurality of response shares, the generating of each response share comprising multiplying a respective secret share by the challenge value c and adding a respective random share; decoding the plurality of response data to generate response data; determining test data by determining a difference between the product of the response data and the public matrix and the product of the challenge value c and the solution data; determining hint data by rounding the test data modulo p to generate rounded test data and determining a difference between the response data and the rounded test vector; returning a digital signature including the response data and the hint data; The computer-implemented method comprising:
2. The computer-implemented method of claim 1 , wherein the random sampling is uniform.
3. 3. The computer-implemented method of claim 1 or claim 2, wherein rounding each of the modified random shares modulo p comprises dividing a modulus value of the modified random share by p and rounding to a nearest integer value.
4. 5. A computer-implemented method according to any preceding claim, further comprising checking one or more shortness constraints on the hint data, such as checking that the Euclidean norm does not exceed a bound value and / or that the infinity norm does not exceed a bound value.
5. 10. The computer-implemented method of any preceding claim, further comprising permuting the plurality of modified random shares before rounding each of the modified random shares modulo p.
6. 10. The computer-implemented method of any preceding claim, further comprising refreshing at least one of: i) the plurality of random shares; ii) the plurality of modified random shares; iii) the plurality of rounded random shares; and iv) the plurality of response shares.
7. 13. The computer-implemented method of any preceding claim, wherein the verification key comprises a seed value that enables generation of the public matrix, and / or the solution data, the random shares, and the test data comprise vectors, and / or the digital signature comprises the commitment data.
8. 1. A computer-implemented method for generating a signing key pair for a Fiat-Shamir digital signature, the method comprising: generating a public matrix; generating a plurality of secret shares, each secret share being generated by randomly sampling a plurality of parameters from a modulo q basis ring; multiplying each of the plurality of secret shares with the public matrix A to generate a plurality of multiplied secret shares; rounding each of the multiplied secret shares modulo p to generate a plurality of rounded shares, and decoding the plurality of rounded shares to generate solution data; returning a signing key corresponding to the plurality of secret shares and a verification key corresponding to the public matrix A and the solution data; The computer-implemented method comprising:
9. 9. The computer-implemented method of claim 8, wherein generating the public matrix comprises randomly sampling the modulo q basis ring.
10. 20. The computer-implemented method of claim 8 or claim 19, wherein the random sampling is uniform.
11. 11. The computer-implemented method of claim 8, wherein rounding each of the multiplied random shares modulo p comprises dividing the modulus value of the modified random share by p and rounding to the nearest integer value.
12. 12. The computer-implemented method of claim 8, further comprising permuting the plurality of modified random shares before rounding each of the modified random shares modulo p.
13. 1. A computer-implemented method for verifying a message using an associated Fiat-Shamir digital signature generated according to a signing key and a verification key, the signature key corresponding to a plurality of secret shares of a secret, each secret share being sampled from a modulo q basis ring, the verification key corresponding to a public matrix sampled from the modulo q basis ring and solution data derived using the public matrix and the plurality of secret shares, the method comprising: applying a hash function to data including the message and commitment data to generate a challenge value c; calculating a difference between a product of the response data and the public matrix and a product of the challenge value c and the solution data to provide test data; rounding the test data modulo p to provide rounded test data; verifying that a sum of the rounded test data and the hint data corresponds to the commitment data; The computer-implemented method comprising:
14. A data processing apparatus adapted to carry out a method according to any preceding claim.
15. A computer program product comprising instructions, which when said program is executed by a computer, cause said computer to carry out a method according to any of claims 1 to 13.