Post-quantum signatures from symmetric key assumptions

Abstract

Techniques are disclosed for performing authenticated communication. The techniques include using a public matrix A, a public matrix B, and a vector x that is a private signing key. An MPC in the head protocol may be performed by a prover device. A prover device may communicate with a verifier device to prove that the prover device is in possession of the private key that was used to sign a message that was received by the verifier device.

Description

PATENT Attorney Docket No.079900-1451896-7827WO01 Client Ref. No.7827WO01 POST-QUANTUM SIGNATURES FROM SYMMETRIC KEY ASSUMPTIONS CROSS-REFERENCES TO RELATED APPLICATIONS

[0001] This application is a PCT application which claims priority to U.S. Provisional Application No.63 / 587,922, filed on October 4, 2024, which is herein incorporated by reference in its entirety. BACKGROUND

[0002] Many cryptosystems today, e.g. RSA encryption, are based on problems such as prime factorization or modular exponentiation. These problems are hard for conventional computers, but may not be for quantum computers. Thus new advances in quantum computing may render cryptosystems based on those problems unsecure. There is a need for new cryptosystems based on problems that are hard for both conventional computers and quantum computers.

[0003] Cryptographic primitives such as one-way functions (OWFs), pseudorandom generators (PRGs), and pseudorandom functions (PRFs) that allow efficient evaluation in a distributed setting. Traditionally, instantiations of these basic cryptograohic primitives have taken two approaches. The first is the reductionist approach where the security of the protocol construction can be reduced to a "standard" set of well-studied computational assumptions such as the hardness of factoring, discrete logarithm, or learning with errors (LWE). The second is a direct construction approach where the construction itself is considered to be the computational assumption. Indeed, many of today's most widely used primitives follow the direct approach (e.g., AES, SHA)

[0004] Two-party evaluation of alternating moduli pseudorandom functions (PRFs), can be used as the basis for cryptosystems. Techniques to lower the communication and computation of such cryptosystems are needed.

[0005] Embodiments of the disclosure address this problem and other problems individually and collectively. BRIEF SUMMARY

[0006] One embodiment of the present disclosure includes a method. The method comprises performing authenticated communication of a message, the method comprising performing by a prover computing system: obtaining a public matrix A comprising a first plurality of values, the first plurality of values sampled from a first distribution, wherein the public matrix A has values mod M that is a first prime number; obtaining a public matrix B comprising a second plurality of values, the second plurality of values sampled from a second distribution, wherein the public matrix B has values mod K that is a second prime number different from the first prime number; storing a vector x that is a signing private key; computing a local set of [x] vectors that has values mod M, wherein each vector in the local set of [x] vectors combines to the value of the vector x; computing a local set of [t] vectors that has values mod K, wherein each vector in the local set of [t] vectors combines to the mod K equivalent of a s vector computed using a random seed; computing a set of state vectors, wherein each state vector in the set of state vectors includes a first portion of the s vector, a first local [x] vector included in the local set of [x] vectors, and a first local [t] vector included in a set of local [t] vectors; computing a set of commitments using the set of state vectors; computing a first hash value h using a first hash function and the set of commitments; transmitting, to a verifier computing system, the first hash value h; obtaining a random permutation π; computing a set of local [v] vectors by applying the public matrix A to respective local [x] vectors; computing a set of converted local [v'] vectors by converting respective local [v] vectors from mod M to mod K using the random permutation π; computing a set of local [y] vectors by applying the public matrix B to the set of converted local [v'] vectors; computing a set of message vectors using the set of local [y] vectors, the random permutation π, and the set of local [v] vectors; computing a second hash value h' using a second hash function and the set of message vectors; transmitting, to the verifier computing system, the second hash value h'; receiving, from the verifier computing system, a request for a subset of the set of state vectors; and transmitting the subset of the set of state vectors to the verifier computing system, thereby enabling the verifier computing system to authenticate the prover computing system

[0007] One embodiment of the present disclosure includes a method for performing authenticated communication of a message, the method comprising performing by a verifier computing system: obtaining a public matrix A comprising a first plurality of values, the first plurality of values sampled from a first distribution, wherein the public matrix A has values mod M that is a first prime number; obtaining a public matrix B comprising a second plurality of values, the second plurality of values sampled from a second distribution, wherein the public matrix B has values mod K that is a second prime number different from the first prime number; receiving, from a prover computing system, a first hash value h computed by using a first hash function and a set of commitments generated using a set of state vectors, wherein each state vector in the set of state vectors includes a first portion of a vector s, a first local [x] vector included in a local set of [x] vectors, and a first local [t] vector included in a set of local [t] vectors; receiving, from the prover computing system, a second hash value h' computed using a second hash function and a set of message vectors, the set of message vectors computed using a set of local [y] vectors, a uniformly random permutation π, and a set of local [v] vectors; transmitting, to the prover computing system, a request for a subset of the set of state vectors; receiving, from the prover computing system, the subset of the set of state vectors and a commitment of the state vector not included in the subset of the set of state vectors; computing, for each state vector in the subset of the set of state vectors, the first portion of the vector s, the first local [x] vector included in the local set of [x] vectors, and the first local [t] vector included in the set of local [t] vectors; obtaining a random permutation π; computing the set of commitments using the commitment of the state vector not included in the subset of the set of state vectors and the subset of the state vectors; computing a third hash value using the first hash function and the set of commitments; computing a subset of the set of message vectors, wherein each message vector is generated using a respective local [s] vector generated using a respective portion of a seed, a respective first local [x] vector included in the local set of [x] vectors, and a respective first local [t] vector included in the set of local [t] vectors; computing a message vector corresponding to the commitment of the state vector not included in the subset of the set of state vectors by using a set of local [y] vectors and a public y vector; computing a set of messages using the subset of the message vectors and the message vector; computing a fourth hash value using the second hash function and the set of messages; and authenticating the provercomputing system based on: (i) the first hash value h being equivalent with the third hash value, and (ii) the second hash value h' being equivalent with the fourth hash value.

[0008] These and other embodiments are described in further detail below. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] FIG.1 shows a system diagram of a model digital signature system according to some embodiments.

[0010] FIG.2 illustrates a process for generating a public key, according to certain embodiments of the present disclosure.

[0011] FIG.3 illustrates a process for converting a modulus 3 vector to a modulus 2 vector, according to certain embodiments of the present disclosure.

[0012] FIG.4 illustrates a process for evaluating a oblivious transfer-based weak PRF, according to certain embodiments of the present disclosure.

[0013] FIG.5 illustrates a process for evaluating a oblivious transfer-based weak PRF, according to certain embodiments of the present disclosure.

[0014] FIG.6 illustrates a garbling-based process for evaluating a weak PRF, according to certain embodiments of the present disclosure.

[0015] FIG.7 illustrates a table of metrics for certain embodiments using techniques described herein compared to previous works.

[0016] FIG.8 illustrates a table of metrics for certain embodiments using techniques described herein compared to previous works.

[0017] FIGS.9-10 illustrate a flow diagram for operations performed by a system, according to certain embodiments of the present disclosure.

[0018] FIG.11 illustrates a method performed by a prover computing system during a preprocessing phase, according to certain embodiments of the present disclosure.

[0019] FIG.12 illustrates a method performed by a prover computing system emulating an MPC protocol, according to certain embodiments of the present disclosure.

[0020] FIG.13 illustrates a method performed by a verifier computing system to verify a signature, according to certain embodiments of the present disclosure.

[0021] FIG.14 illustrates a 5-round zero-knowledge proof of knowledge of a preimage of an AM-OWF, according to certain embodiments of the present disclosure.

[0022] FIG.15 illustrates a method performed by a prover computing system, according to certain embodiments of the present disclosure.

[0023] FIG.16 illustrates a method performed by a verifier computing system, according to certain embodiments of the present disclosure.

[0024] FIG.17 illustrates a table of signature sizes using certain techniques described herein compared to previous works.

[0025] FIG.18 illustrates a table of ring signature sizes using certain techniques described herein compared to previous works.

[0026] FIG.19 illustrates a computer system that may be used with embodiments of the present disclosure. TERMS

[0027] Prior to discussing embodiments of the disclosure, some terms can be described in further detail.

[0028] A “user” may include an individual. In some embodiments, a user may be associated with one or more personal accounts and / or mobile devices. The user may also be referred to as an employee, account holder, or consumer in some embodiments.

[0029] “Authentication” or “authenticating” may be the process of proving or verifying certain information, and / or verifying the identity of the source of that information. For example, a user may provide authentication data that is unique or only known to the user to prove the identity of the user. Examples of different types of authentication data may include biometrics (e.g., fingerprint, palm print, face recognition, iris and / or retina recognition, voice recognition, gait, or other human characteristics), passcode, PIN, answers to security question(s), cryptographic response to challenge, human and / or device signature, etc.

[0030] The term “cryptographic key” may include data used in encryption or decryption. Cryptographic keys may be symmetrical, in which case the same key is used for encryption and decryption, or asymmetrical, in which case different keys are used for encryption and decryption. An asymmetric key pair may comprise a public key and a private or secret key. The public key may be made publicly available to any number of entities, while the private key may be distributed only to specific entities. An asymmetric key pair may be used as the basis of a digital signature scheme.

[0031] A “digital signature” may refer to data used to verify the source or authenticity of digital messages. Digital signatures may be implemented using cryptographic keys. A message may be sent to a recipient along with a corresponding digital signature. The digital signature may comprise an encrypted copy of the message (or data derived from the encrypted copy of the message) encrypted using a private key corresponding to the sending device. The recipient can use a corresponding public key to decrypt the encrypted copy of the message, then compare the encrypted copy against the received message. Provided the messages match, and the private key has not been leaked, the digital signature verifies that the message was sent by the sending device and not an imposter.

[0032] A “message” may refer to any data that may be transmitted between two entities. A message may comprise plaintext (unencrypted) data or ciphertext (encrypted) data. A message may comprise alphanumeric sequences (e.g., “hello123”) or any other data (e.g., image or video files). Messages may be transmitted between computers or other entities. A message may be different from a message vector.

[0033] A "one way function" or "OWF" is a function that is easy to compute but is very difficult to compute an inverse function of. For example, having data x, it is easy to calculate f(x), but on the other hand, calculating / knowing the value x is quite difficult if f(x) is known /

[0034] A “hash function” may refer to any function that can be used to map data of arbitrary length or size to data of fixed length or size. A hash function may be used to obscure data by replacing it with its corresponding “hash value.” A hash function may be an example of a one way function.

[0035] The term “signing device” or “signing computing system” may refer to a device or computer system that uses a private key to generate digital signatures. In some cases, a signing device may be a generating device (e.g., the signing device generates digital signatures using a private key it generated itself).

[0036] The term “verifying device” or a “verifying computing system” may refer to a device or computer system that uses a public key to verify digital signatures generated by signing devices. In some cases, a verifying device may be a generating device, i.e., the verifying device verifies digital signatures using a public key it generated itself. The verification can use new techniques for zero-knowledge proofs.

[0037] A “user device” may be any suitable device that is operated by a user. Suitable user devices can be portable and can communicate with external entities such as access devices. Examples of user devices include mobile phones, laptop computers, smartwatches, access cards, smart cards, etc.

[0038] A “memory” may be any suitable device or devices that may store electronic data. A suitable memory may comprise a non-transitory computer readable medium that stores instructions that can be executed by a processor to implement a desired method. Examples of memories may comprise one or more memory chips, disk drives, etc. Such memories may operate using any suitable electrical, optical, and / or magnetic mode of operation.

[0039] A “processor” may refer to any suitable data computation device or devices. A processor may comprise one or more microprocessors working together to accomplish a desired function. The processor may include a CPU that comprises at least one high-speed data processor adequate to execute program components for executing user and / or system-generated requests. The CPU may be a microprocessor such as AMD's Athlon, Duron and / or Opteron; IBM and / or Motorola's PowerPC; IBM's and Sony's Cell processor; Intel's Celeron, Itanium, Pentium, Xeon, and / or XScale; and / or the like processor(s).

[0040] The term “uniform distribution” may refer to a probability distribution (i.e., probability density function or probability mass function) where possible values associated with a random variable are equally possible. A fair dice is an example of a system corresponding to a uniform distribution (in that the probability of any two rolls are equal). The term “non-uniformdistribution” may refer to a probability distribution where all possible values or intervals are not equally possible. A Gaussian distribution is an example of a non-uniform distribution. DETAILED DESCRIPTION

[0041] Embodiments of the present disclosure relate to building cryptographic primitives. Cryptographic primitives can include one-way functions (OWFs) [Lev85], pseudorandom generators (PRGs) [BM82, Yao82], and pseudorandom functions (PRFs) [GGM84] that allow efficient evaluation in a distributed setting. Traditionally, instantiations of these cryptographic primitives have taken two approaches as described in [ABG+14]. The first is the reductionist approach where the security of the construction can be reduced to a “standard” set of well- studied computational assumptions such as the hardness of factoring, discrete logarithm, or learning with errors (LWE). The second is a direct construction approach where the construction itself is considered to be the computational assumption. Many of today’s most widely used primitives follow the direct approach (e.g., AES, SHA).

[0042] The reductionist approach comes with several benefits—it enables an improved theoretical understanding of how various computational hard problems are related and allows the cryptographic community to focus cryptanalytic efforts on a small set of assumptions. With the test of time, newer assumptions become widely accepted and eventually considered standard by the cryptographic community. The benefit of this approach often comes at a large cost to efficiency, often resulting in orders of magnitude worse efficiency compared to the direct construction approach (e.g., consider the efficiency gap between SHA-256 and discrete- logarithm-based hash functions). Moreover, with quantum computers, many of the existing standard assumptions are at risk of becoming insecure. Embodiments disclosed herein address the problems of existing standard assumptions.

[0043] The security of the direct approach or new constructions, while often not reducible to a standard assumption, are often based on a set of principles that are developed and refined as the problem is studied. The canonical example of this is linear and differential cryptanalysis of symmetric-key cryptography. Other examples include early lattice-based constructions such as NTRU [HPS98]. In many cases, these schemes first developed security principles which, in time, were refined into a small set of underlying (e.g., standard) assumptions.

[0044] An additional benefit of direct approach constructions is that they can allow for an added degree of flexibility to conform to a changing set of requirements. Embodiments described herein can configure and use symmetric-key primitives that are efficient to evaluate in a multi- party setting. A further advantage of the direct approach is that this flexibility often allows the construction to implement an algebraic structure that a quantum computer could exploit. In some cases algebraic techniques such as Gro^bner bases can still apply. However, Gro^bner bases still requires exploiting specific structure in the construction which are not always present. On the other hand, traditional assumptions such as factoring or discrete logarithm have a large amount of structure that can be subject to exploitation by a quantum computer.

[0045] With the increased use of secure multi-party computation (MPC) and the looming approach of quantum computers, there has been a need to consider a new set of assumptions that meet a new set of requirements. In particular, primitives such as ring signatures [RST01], oblivious pseudorandom functions (OPRFs) [NR97, FIPR05], verifiable random functions (VRFs) [MRV99], blind signatures [Cha82], and more lack efficient constructions that meet one or more of these requirements. Embodiments described herein can use new symmetric-key techniques and protocol designs to implement the above described applications using MPC, or the zero-knowledge compiler known as MPC-in-the-head [IKOS07].

[0046] Certain embodiments described herein are configured for efficient two-party evaluation of alternating-moduli pseudorandom functions (PRFs), effectively building an oblivious PRF. Certain embodiments include a generalized alternating-moduli PRF construction along with techniques to lower the communication and computation. Embodiments further include several variants of our protocols with different computation and communication tradeoffs for evaluating the PRF. Certain embodiments of protocols herein are in a hybrid model. Certain embodiments of protocols herein are one is based on specialized garbling. Certain embodiments of protocols herein are about three times faster and may use 1.3 times less communication than previously known techniques.

[0047] Certain embodiments described herein enable an efficient evaluation of a OWF ^^^^^^ ൌ^^ ⋅ଷ ^^^ ⋅ ^ൈ^ଶ ^^^ proposed by Dinur et al. (CRYPTO 21) where ^^ ∈ Fଶ , ^^ ∈௧ଷൈ^and ⋅^is multiplication mod ^^. This OWF may be evaluated within MPC by secret sharing respectivelocal^^^^vectors over F ଶ, locally computing respective local^^^^vectors using the followingcomputation: ^^^^ ൌ A ⋅ଶ ^^^^, and performing a modulus switching protocol to F ଷ shares,followed by locally computing the output shares of respective local ^^^^ vectors: ^^^^ ൌ ^^ ⋅ଷ ^^^^.

[0048] Certain embodiments, include techniques for a bespoke MPC-in-the-Head (MPCitH) signature scheme that evaluates the OWF, enabling greater performance compared to previously used techniques. For example, the resulting signature can have a size ranging from 4.0 to 5.5 KB, achieving between two to three times reduction compared to prior works. Techniques described herein can be extended to build very small post-quantum ring signatures for rings of small to medium size, which are competitive with state-of-the-art lattice-based schemes. Embodiments can be more generally applied to set membership in MPCitH. I. SIGNATURE VERIFICATION SYSTEM

[0049] FIG.1 shows a system diagram of a model digital signature system 100 according to some embodiments. The system includes a first user interface 102, a prover computing system 104, a verifier computing system 106, and a second user interface 108. The prover computing system 104 may generate cryptographic keys used to generate digital signatures and verify those digital signatures, including a public verification key, and a private signing key. The prover computing system 104 may use the signing key to sign a message, and send the signed message to the verifying computing system 106. The verifying computing system 106 receives messages and uses the public verification key to verify those messages. Also included in the system are the first user interface 102 and the second user interface 108, which may be user interfaces for the prover computing system 104 and the verifier computing system 106, respectively. The user interfaces may enable the respective computing system to receive user input (e.g., indicating a message to transmit) and generate output (e.g., indicating authentication, indicating a message received).

[0050] As an example, the prover computing system 104 could comprise a user device corresponding to an account holder. The user may want to transfer funds from their account to another account (for example, in order to pay for a good or service, as a gift, etc.). The verifier computing device 106 may be associated with an issuer or issuing bank that maintains an account on behalf of the user. The prover computing system 104 may send a message initiating the transfer of funds between the user and their intended recipient. The prover computing system104 may sign the message in order to indicate that the fund transfer was initiated by the user. In this example, an attacker (e.g., a cybercriminal that wants to generate fraudulent messages and signatures) using fraudulent messages and signatures, may attempt to convince the verifying computing system 106 to approve fraudulent fund transfers (e.g., into an account owned by the attacker). One goal of the system 100 is to insure the security and correctness of generated signatures. That is, insuring that legitimate signatures can be correctly verified by the verifying computing system 106, but cannot be generated by the attacker. II. ONE WAY FUNCTION (OWF)

[0051] FIG.2 illustrates a process 200 for generating a public key, according to certain embodiments of the present disclosure. Process 200 uses a public matrix B 202, a public matrix A 204, and a vector x 206 to generate / compute a vector y 208. Process 200 may be performed by a prover computing system (e.g., prover computing system 104). The vector x 206 may include a private key of the prover computing system. Vector y 208 may include a public key of the prover computing system. Process 200 is an example of a OWF because the computations are configured such that with vector x 206, public matrix B 202, and public matrix A 204, vector y 208 can easily be derived. However, with vector y 208, public matrix B 202, and public matrix A 204, vector x 206 cannot be easily derived.

[0052] We propose a new weak PRF in the alternating-moduli paradigm [BIP+18]. For^^,^^, ^^ ൌ ^^^λ^, our construction is defined as^^^^^, ^^^:ൌ ^^ ⋅ଷ ^^^ ⋅ଶ ^^^ ⊙ଶ ^^^^where ^^,^^ ∈ F^ଶ are the input and key, A ∈ F^ൈ^ଶ is a random matrix, B ∈ Fଷ௧ൈ^is a compressing random matrix, and ⋅^,⊙^are multiplication and component-wisemodulo ^^. Thisdiffers from the prior constructions [BIP+18] which can be defined as ^^^^^, ^^^:ൌ ^^^^^^^^ wherethe matrix A is interpreted as the key. We conjecture that the core hardness of these construction stems from three components. 1. The input and key are non-linearly combined modulo two. 2. Modulo two summations of subsets are taken. 3. Modulus conversion is followed by a public compressing linear map B.

[0053] Observe that both our construction and the construction of [BIP+18] follow these three phases. In particular, the matrix-vector multiplication of [BIP+18] can be viewed as performing (1) component-wise multiplication with each row of the matrix, followed by (2) summation. When viewed this way, observe that the summations in (2) are over disjoint sets, i.e., ∑^^^^^⊙ ^^^^. This is in contrast with our construction where we take random summations over a commoncombined input vector ^^^ ⊙ ^^^. In a sense our construction is reusing the hidden variable of ^^^^^^many times while [BIP+18] uses it in a single term.

[0054] When interpreted in an MPC context, linear operations are essentially free while multiplications require communication between parties. The number of multiplication terms of [BIP+18] is proportional to the size of A, i.e., ^^^λଶ^, and as such, ^^^λଶ^ communication is required. The work of [DGH+21] gave specialized protocols for the wPRF of [BIP+18] which reduced the communication complexity to ^^^^^^ in the amortized setting. In particular, [DGH+21] proposed modifying the key matrix A to be circulant, i.e., each row is a shift of the previous,which allows one efficiently multiply ^^ ⋅ ^^ for many ^^ with an amortized ^^^^^^ communicationoverhead. However, we show that the process of generating the correlated randomness for this multiplication still requires ^^^^^ଶ^ work with relatively high constants.

[0055] In contrast, our construction only performs ^^ ൌ ^^^λ^ multiplications in step (1) andtherefore can completely sidestep expensive correlated randomness. Moreover, we show how the parties can use the fact that the key is typically static to generate reuseable correlatedrandomness (i.e., ^^OTs) to compute shares of ^^^ ⊙ ^^^ for an unbounded number of x. The maincomplexity of our protocols is how shares of ^^^^^ ⊙ ^^^ are converted from modulo 2 to modulo3. We show that this can be done with ^^ ൌ ^^^λ^ communication and ^^OTs which can begenerated with sublinear communication using pseudoradnom correlation generators [BIP+18, RRT23]. Compared to [DGH+21], our techniques may use less correlated randomness. The final setup of our protocol is for the parties to locally apply the Fଷ-linear map B to their Fଷ^secretsharing of ^^^ ⋅ ^^^ ⊙ ^^^^. To improve efficiency, we propose instantiating ^^ and ^^ such thatmultiplication can be done in linear time while maintaining their desired security properties.

[0056] We give two additional variants of this protocol. The first switches the order of themoduli. That is, the wPRF is defined as ^^^^^, ^^^ ൌ ^^ ⋅ଶ ^^^ ⋅ଷ ^^^ ⊙ଷ ^^^^. The resulting protocol isconceptually similar. The primary advantage of this protocol is for MPC applications where theoutput should be in binary secret sharing format [MRR20, BDG+22]. Our second variant is based on a specialized garbling scheme. The main advantage of this protocol is that it may not use any OT correlations when performing modulus conversion. However, it can come at the expense ofusing ^^^λଶ^ communication to compute ^^^ ⊙ ^^^. We believe this construction is interestingwhen only a few evaluations are performed. We also implement our MPC protocols and report their performance in table 700, described below. Overall, we can observe a 3 to 20 times reduction in running time compared to alternatives such as [DGH+21, ARS+15] while substantially reducing the communication overhead. Indeed, compared to the DDH-based OPRF [Mea86], our construction can be an order of magnitude faster with comparable communication.

[0057] Beyond proposing the new wPRF and the associated MPC protocols, we adapt existing techniques to determine parameters for the wPRF. Compared to [BIP+18, DGH+21], we observethat the parameters ^^,^^, ^^ may be increased a moderate amount. However, we give techniques tomitigate this increased parameter size, and in some cases even allow for less communication overhead. Our analysis suggests that the most relevant attack on the construction is a reductionfrom subset sum[DGH+21]. In particular, given an input-output pair ^^^, ^^ ൌ ^^^^^, ^^^^, one candefine the intermediate vector ^^:ൌ ^^^^^ ⊙ ^^^. Viewing A as a linear code and letting P be theassociated parity check matrix, the adversary has the constrains that ^^^^ ൌ 0 and ^^^^ ൌ ^^. Onecan solve for w using subset sum solvers which have running time ^^^2^.ଷଷ^^. For some of our parameters regimes we show that the adversary must consider multiple samples and present a new extension of subset sum to this setting. Section 3(A)(E) includes further details.

[0058] Lastly, we build upon the work of [BIP+18] to show that the hardness of our construction essentially boils down to the hardness of solving sparse multivariate polynomials. In particular, we present an equivalent representation of our wPRF and show that a key recovery attack for the construction directly corresponds to solving a system of sparse multilinear equations over F3. This also leads us to a generalized framework for instantiating alternating- moduli weak PRFs where the distribution of input space can be varied to capture the various constructions.

[0059] Given that the alternating-moduli OWF (AM-OWF) was designed with the efficient evaluation within MPC in mind, i.e., low non-linear depth but high algebraic degree, it is naturalto try to build a signature scheme using the MPC-in-the-head paradigm. In particular, the AM- OWF of [DGH+21] can be defined as ^^^^^^:ൌ ^^ ⋅ଷ ^^^ ⋅ଶ ^^^for some ^^,^^, ^^ ∈ ^^^λ^ where ^^ ∈ F^ଶ are the input, ^^ ∈ Fଷ^ൈ^is an expanding random matrix,B ∈ Fଶ௧ൈ^is a compressing random matrix. The this function stems fromthe non-linearity of changing the modulus between by A and B. One interpretationof this problem is that Be is an LPN instance with correlated noise vector e ൌ ^^^^.

[0060] To build a signature in the MPCitH paradigm, the verification key is the output ^^ ൌ^^^^^^ ൌ ^^^^^^^^ on some uniformly random input ^^, and a signature is simply a proof ofknowledge of a preimage ^^. Indeed, this was the exact approach taken in prior work [DGH+21], where they used the KKW proof system [KKW18] resulting in signatures with sizes rangingfrom 10.3-13.3KB, which are still 2-3 ൈ larger than the best known signatures from symmetric-key assumptions. The issue is that the KKW proof system has a generic way of handling the preprocessing material needed for the MPC, that is oblivious to the function being evaluated. These checks on preprocessed material account for a significant chunk of the overall proof size.

[0061] The MPCitH protocol that we design is very close the KKW proof system, except for the way in which we handle preprocessing checks. Instead of using a cut-and-choose strategy, we use an idea from [CCJ23], that has the prover first commit to the inputs, and (possibly maliciously generated) preprocessing material. The verifier then permutes the preprocessing material and forces the prover to use this ordering when executing the online phase of the MPC protocol. We then show that for any choice of (incorrect) preprocessing material a malicious prover who does not know a valid preimage, has a very low-probability of producing an accepting proof. Although the high level ideas are borrowed from prior work, the concrete hard problem that we consider is very different and hence demands a completely separate, non-trivial analysis. Instead of using a ball-and-bins analysis as done in [CCJ23], we view the problem through the lens of error correcting codes, which enables us to give much cleaner bounds in comparison to the prior work which relied on conjectures that were confirmed for their parameters by explicitly computing them via python scripts (Section II(A)(1)).A. Properties of an AM-OWF

[0062] We now focus on providing some seful properties for the AM-OWF of [DGH+21], which will be helpful for our constrctions in Section VI. Recall that the AM-OWF can be defined as ^^^^^^ ൌ ^^^^^^^^ where ^^ ∈ F^ൈ^ଶ and ^^ ∈ ^^ଷ௧ൈ^are fixed public matrices chosen uniformly at ^^^^ in Fଷ^. Roughly speaking, our core lemmathan the output, the statistical distance between the distribution of the output of the AM-OWF on a uniformly random input and the uniform distribution is negligible. At the same time, we show that a uniformly random value from Fଷ௧lies in the image of the OWF with overwhelming probability. We will then use this lemma to prove the hardness of various problems closely related to the AM-OWF that will allow us to reduce the size of our post-quantum signature scheme. We begin by proving that the family of AM-OWFs is universal.

[0063] Lemma 3.4. Let ^^ ൌ ^ℎ ^ ௧୪୭^ ଷ ^ൈ^ ௧ൈ^^,^: ^0,1^ → ^0,1^ ,|^^ ∈ Fଶ , B ∈ Fଷ ; rank^A^ ൌ ^^^be a family of hash functions such that ℎ^,^^^^^ ൌ B ଷ ^^^ ଶ^^, then H is a universal hash family.

[0064] Proof. Observe that ^A^ ൌ ^^ and hence A is an injective mapping. Define the group ^^as ^^ ൌ ^Fଷ௧,^^ and observe that ℎ^,^^^^^ is basically a subset sum over ^^ group elements ^^^, … , ^^^ where ^^^ denotes the ^^th column of B. Let ^^ ൌ ^^x and ^^′ ൌ ^^y. Since ^^ ് ^^′A is an injective mapping), there is at l ᇱeast one index i such that ^^^ ് ^^ ^.Without loss of generality, let ^^ ൌ 1. Observe thatPr^ℎ ^x^ ൌ ℎ ^y^^ ൌ Pr^∑௧∑௧ ^,^ ^,^ ^ୀ^ ^^^ ⋅ ^^^ ൌ ^ୀ^ ^^′^ ⋅ ^^^^,where the last line follows from the fact that ^^^is distributed uniformly and independently from others, and the proof is complete.

[0065] By appealing to the Leftover Hash Lemma, we have the following corollary. Intuitively, Corollary 3.5 shows that there is a if we swap the output of the AM-OWF with auniformly random string of the same size, even a computationally unbounded adversary fails to distinguish them with some noticeable probability.

[0066] Corollary 3.5 Let ℎ^,^ ←H, as defined in lemma 3.4 and ^^ ^ ^^^^^^^^3 ^ ^^^^^^^^^^^^, thenℎ^,^ is a strong ^^^, negl^^^^ extractor with output length ^^^^^^^^3.

[0067] In addition to being close to the uniform distribution, we will now show that the AM- OWF covers an overwhelming fraction of the output domain Fଷ௧.

[0068] Lemma 3.6 For any ℎ^,^ ←H, let O^ಲ,ా ൌ∈ Fଶ^^ denote the covering of ℎ^,^. Then, with ^1 െnegl(λ).

[0069] Proof. Suppose this was not true, then we would have Δ^ℎ^,^^^^^^,^^௧୪୭^ଷ^ ^1 / ^^^^^^^^^^^^, hence contradicting ^^^^^^ma 3.4. Thus, the output of theOWFcover an overwhelming fraction of the output domain. 1. Variants of the AM-OWF

[0070] We next define three variants of the AM-OWF and show that they are at least as hardas inverting the AM-OWF. Recall that in the OWF game, a challenger samples ^^ ← Fଶ^ൈ^,B← F௧ൈ^ଷ , and ^^ ← F^ଶ and computes an instance ^^^,^^,^^ ൌ ^^^^^^^^^. The adversary is taskedwith finding any ^^ such that ^^^^^^^^ ൌ ^^. The advantage of an adversary in this game is theprobability with which it outputs such an ^^.

[0071] Systematic Form. To improve the efficiency of our protocols using the AM-OWF, wewish to use the AM-OWF in systematic form i.e. the adversary is given ^^^, ^^, ^^^ where allentries are sampled uniformly at random except for the bottom-most ^^ ൈ ^^ entries of A and theright-most ^^ ൈ ^^ entries of B. which are replaced with In and It respectively, We now prove thatthis new game is just as hard the original OWF game.

[0072] Lemma 3.7 Given an adversary A that wins the systOWF game with noticeable advantage, there exists an adversary ^^′ that wins the OWF game with noticeable advantage.

[0073] Proof. Given an instance from the OWF game ^^^,^^, ^^^, let M^, Mଶ be defined as thematrices such that AM^ ൌ ^^ ୍^ ^ and MଶB ൌ ^B^|I௧^. ^^′ then provides the adversary A with^AM^, MଶB, ^^^ ൌ Mଶ^^. M^ and Mଶ are infact the inverses of the bottom-most square and right-most square of A and B respectively, which exist with overwhelming probability as these matrices are full rank with overwhelming probability and and is easy to compute using standardGaussian elimination. Thus, when I responds with ^^^ such that Mଶ^^^AM^^^^^ ൌ ^^^, which happenswith non-negligible probability, ^^′ outputs ^^ ൌ M^^^^.

[0074] Anti-Solution. Due to technical reasons in our protocols, we also argue that it is difficult to find an anti solution. We define another game ^antiOWF^ which is identical to theOWF game, except the adversary needs to output an ^^ such that B^1 ⊕ ^^^^^^^ ൌ ^^ and nowargue that this as hard as the OWF game.

[0075] Lemma 3.8 Given an adversary A that wins the antiOWF game with noticeable advantage, there exists an adversary ^^′ that wins the OWF game with noticeable advantage.

[0076] Proof. Given an instance from the OWF game ^^^,^^, ^^^, provide the adversary A′ with^^^,^^, ^^^ ൌ B^1^^ െ ^^^. With noticeable probability, the new instance is indistinguishable froman honestly sampled instance with due to Corollary 3.5 and Lemma 3.6, as the distribution of the image is close to uniformly random and the AM-OWF covers a noticeable fraction of Fଷ௧. Hence,A outputs ^^ such that B^1 ⊕ ^^^^^ ൌ ^^^ with probability at least ^^^^′. ^^′ then outputs ^^ as thesolution to OWF challenge ^^^, ^^, ^^^. It is easy to see that if B^1 ⊕ ^^^^^ ൌ ^^^, then B^^^^^^ ൌ ^^because the flip operation can be emulated in Fଷ as B^1 െ ^^^^^^ where ^^^^ is first embedded inFଷ.

[0077] Approximate-Solution. We define a final game approxOWF^^^, ^^, ^^^, which is identicalto the OWF game but with a relaxed requirement on the solution where the adversary is given^A, B, ^^^, and must output ^^^, ^^, ^^′^ such that ^^ ൌ ^^^^, ^^ ൌ ^^^^′, and ^^ு^^^, ^^′^ ^ 1. In fact, ourresult holds for any ^^ு^^^, ^^′^ ^ ^^^1^.

[0078] Lemma 3.9 Given an adversary A that wins the approxOWF ^^^, ^^^ 1, ^^^ game withnoticeable advantage, there exists an adversary ^^′ that wins the OWF game with noticeableadvantage, for a slightly smaller OWF^^^, ^^, ^^^ game.

[0079] Proof. Given a OWF challenge ^A, B,^^^, ^^′ first guesses a random position ^^ ∈ ^1,^^ ^1^, hoping this is the position that A′ will cause and edit. A’ then computes an approxOWF ^^^, ^^ ^ 1, ^^^ instance by:1. inserting a random row ^^ ← F^ଶ at the ^^-th position of A to get ^ ^^;2. inserting a random column ^^ ← F௧ଷ at the ^^-th position of B to get B^; and3. ^^^ ← ^^ ^ ^^. ^^′^^^^, where ^^′^^^^ is the ^^-th entry of ^^′ and sampled uniformly at random from Fଷentry.

[0080] Observe that this new instance always has a solution in the approxOWF^^^, ^^ ^ 1, ^^^game, and that the statistical distance from the uniform distribution over Fଷ௧is upperbounded by 1 / poly^λ^ for (Corollary 3.5). Thus A will continue to output a solution with non-negligible probability on this new instance. Suppose ^^′'s guess was correct for the modified entry and let A's output be ^^^, ^^, ^^′^ and ^^^ be identical to ^^, except with the ^^-th entry deleted. Then it is easyto see that ^^^, ^^^^ is a solution to the OWF challenge given to ^^′.1. Combinatorial Analysis

[0081] Similar to [CCJ23], we compute a bound on the success probability of a cheating prover who is free to choose the correlations used in the MPCitH. Although the high-level approach is the same, we can use very different techniques, relying on the properties of error correcting codes.

[0082] Definition 3.10 [Combinatorial bound - informal] A real p ∈ ^0,1^ is a combinatorialbound, if for every incorrect witness ^^, and every pair ^^^, ^^′^ ∈ F^ଶ ൈ Fଷ^, the probability over a random permutation ^^ that ^^ satisfies the following equations: ^^′ ൌ ^^ ⊙ ^1 െ ^^^^^′^^ ^ ^1 െ ^^^ ⊙ ^^^^^′^ with ^^ ൌ ^^^^^^ ⊕ ^^, and ^^ ൌ ^^^^^^^^′ ൌ ^^is upper-bounded by p.

[0083] We begin by making a few observations. As also noted in [CCJ23], for all possiblecombinations of ^^, ^^′, the effect of the share conversion step can be mapped to one of threedifferent actions: Identity ^copy^: vᇱ^ ൌ ^^^, whenever ^^^ ൌ v^ᇱFlip ^flip^: vᇱ^,ൌ 1 ⊕ ^^^, whenever vᇱ^ ∈ ^0,1^ ∧ ^^^ ് v^ᇱConstant 22, whe ᇱnever v^ ൌ 2.

[0084] A malicious adversary who does not use a valid witness ^^ will arrive at a ^^ such thatB^^ ് ^^. Therefore, the only way to satisfy ^^^^′ ൌ ^^ is to modify enough positions of ^^, to makeit Since we permute the randomness used, the actions chosen by the adversary are permuted before being used. Intuitively, the larger the number of flips, the lower the probability that a permutation aligns the flips with the positions that need to be modified.

[0085] We begin with the observation that B can be viewed as the parity-check matrix of a random linear code where instead of checking whether the party is 0, we check that it is ^^.Therefore, ^^^^′ ൌ ^^ if and only if ^^′ a codeword. Because B is a random linear code, it has gooddistance with high probability. Therefore, the possible values of ^^′ are sufficiently spread out. Suppose the minimum number of flip and const2 operations are used to reach a particular word ^^′ from ^^ are ^^^and ^^ଶrespectively. Then the number of permutations that map ^^ to ^^′ is givenby ^^^ െ ^^^ െ ^^ଶ^! ^^^! ^^ଶ! ^ ^^^ െ ^^^! ^^!, where ^^ ൌ ^^^ ^ ^^ଶ. Over the choice of permutations,the probabilityadversary successfully lands on a particular word is upper bounded by 1 / ൫^ఋ ൯. Thus, if we can upper bound the number of codewords, at a distance ^^ from ^^, and take a union bound over all of them, we obtain the adversary's probability of successfully cheating using a configuration with ^^ modifications.

[0086] Few flips ^0 ^ ^^ ^ ^^ / 2^. If the minimum distance of B is ^^, then within any hammingball of radius ^ ^^ / 2, there is at most one codeword. Thus, if the adversary modifies fewer than^^ / 2 positions, there is at most one codeword that satisfies ^^^^′ ൌ ^^.

[0087] Many flips ^^^ / 2 ^ ^^ ^ ^^^. This case is more tricky because there are now(potentially) many codewords on the hamming ball of radius ^^. It is easy to see that the total number of words on the hamming ball is ൫^ఋ ൯. However, any codeword is at least a distance ^^away from any other codeword. Therefore, for every codeword that we try to fit on the hamming ball, there are some number of words adjacent to this codeword that cannot also be a codeword.Formally, this set of adjacent words can be described as ^^ ᇱఋ ൌ ^^^|^^ு^^^ , ^^^ ^ ^^ ∧ ^^ு ^^^, ^^^ ൌ^^^. Without loss of generality, we can choose ^^ to be the origin ^0^^ and ^^′ ൌ^0^^ିఋ||^1^ఋభ||^2^ఋమ, where ^^^ ^ ^^ଶ ൌ ^^. The description of ^^ ఋ can be simplified as ^^ ఋ ൌ^^^|wt^^^^ ൌ ^^ ∧ ^^^^^^^ െ ^^′^ ^ ^^^. We can now compute a lowerbound on |Bఋ| and hence anupperbound on ^^ఋ, the number of codewords at a distance ^^. Observe that we enumerate overwords in ^^ ఋ by first choosing an ^^ ^ min^^^ / 2, ^^,^^ െ ^^^ subset of the 0 positions that will beflipped to either 1 or 2 and then restoring the weight to ^^ by zero-ing out an ^^ sized subset of the 1 / 2 positions. In addition, one can flip the 1 / 2 positions to 2 / 1, in each of the above configurations. |B ୫୧୬^^,ఋ,^ିఋ^୫୧୬^ௗିଶఈ ^ఋ| ^ ∑మ ఈୀ^൫^ିఋ ఈ ൯൫ఋ ఈ൯2ఈ^∑,ఋିఈఋିఈ ఉୀ^^ఉ^,

[0088] of codewords on the hamming ball of radius ^^. To finish the argument, we simply take a union bound over all the codewords on the hamming ball to obtain an upperbound on the probability of successfullylanding on some codeword, p మ ^ ^^ఋ / ൫^ ఋ ൯. By explicitly plotting the combinatorial bound for theparameters of the AM-OWF, we can see that |B^ ఋ| ^ ൫ ఋ൯, in the regime where ^^ ^ ^^ / 2 and ^^ ^^^ െ ^^ / 2.7 In otherwords, a single code word and it's adjacent words are sufficient to cover theentire hamming ball.

[0089] Anti-Solution. Observe that if the adversary found an ^^ such that ^^^1 ⊕ ^^^^^ ൌ ^^, thenthey could chose all operations to be flip,8and succeed every single time. However, from Lemma 3.8 we know that this is as hard as the OWF game itself. Looking ahead, when we build a zero- knowledge proof of knowledge of a pre-image of the AM-OWF, we actually only achieve a weakened notion of knowledge soundness that extracts either a pre-image or an anti-solution. Since we have show that both these problems are hard, it suffices to compile our MPCitH protocol to

[0090] Similar to [CCJ23], if we further relax the soundness notion to an appropriately definedapproximate notion, where the extractor is able to find an ^^ such that ^^^^^^^^ ൌ ^^, and thereexists a ^^′ such that ^^^^′ ൌ ^^ and ^^ு^^^, ^^′^ ^ ^^ for an appropriately chosen ^^. By appealing toLemma 3.9, we know that for ^^ ൌ ^^^1^, this problem is also hard, thus in each parallelrepetition of the MPCitH protocol, the chance of the adversary cheating is smaller, thereby requiring fewer repetitions. B. Preliminaries

[0091] We use ^^^^ to denote the set ^1,2, … ,^^^. The computational and statistical securityparameter is denoted by ^^, ^^ ∈ ^^. A is noticeable if it is not negligible, andoverwhelming if it is equal to 1 െ negl^λ) some negligible function negl ^λ). For a set S, wewrite ^^ ← S to indicate that ^^ is sampled uniformly at random from S. For a random variable D,we write ^^ ← D to indicate that ^^ is sampled according to D. We use ^^^^^^^^, to denote thestatistical distance between two random variables ^^ and ^^ and ^^ு^^^, ^^^ to denote the hammingdistance between two vectors ^^, ^^ ∈ ^0,1^^. For two ensembles of random variables ^D^,^^^∈^,^D^,^^^∈^, we write D^^^^^^to indicate that for all PPT A, it holds that ฬPr ^^^^^^^െ Pr ^^^^^^^ ൌ 1^ฬ ^ௗ← ௗ←^^ଶ^ negl^λ^.

[0092] of ^^ and overload this with arithmetic operations such as multiplication and addition to show operations applied on individual shares by the parties in the MPC. We will also write^^^^^or ^^^^^to denote the share of the ^^-th party. Whenuseful, we will explicitly state the field F^ that is being secret shared over as ^^^^^. We use 〈^^, ^^〉to denote the inner product of two vectors ^^, ^^ ∈ F^^ and ⊙ to denote the Hadamard product.

[0093] Here we recall the definition of universal hash families and the leftover hash lemma. Let ^^^^^^^ denote the min-entropy of a random variable ^^ and ^^^denote the uniform distribution over ^0,1^^.

[0094] Definition 2.1 [Strong Extractors] A function ^^: ^0,1^^ ൈ ^0,1^ௗ → ^0,1^^ is said to bea strong ^^^, ^^^ extractor, with seed length ^^, if for all random variables ^^ on ^0,1^^, independentof ^^ௗ, with ^^^^^^^ ^ ^^,

[0095] Definition 2.2 [Universal Hash Families] A family H of hash functions of size 2ௗfrom^0,1^^ to ^0,1^^ is said to be universal if, for every ^^, ^^ ∈ ^0,1^^ with ^^ ് ^^,P∈rு^ℎ^ ି^^^^^ ൌ ℎ^^^^^ ^ 2 .

[0096] Definition 2.3 [Leftover Hash Lemma [HILL99]]. Let ^^ be a random variable with^^ ^^^^ ^ ^^, and ^^: ^0,1^^ → ^0,1^^ be a u ௗ^ niversal hash family of size 2 . If ^^ ൌ ^^ െ2log ^∈ି^^, then ℎ^^^^ is a strong ^^^, ^^^ extractor, with seed length ^^ and output length ^^.

[0097] Definition 2.4 [^^-ary entropy] For any integer ^^ ^ 2 and real ^^ ∈ ^0,1^, the ^^-aryentropy function is defined as ^^^^^^^ ൌ ^^log^^^^ െ 1^ െ ^^log^^^^^ െ ^1 െ ^^^log^^1 െ ^^^.

[0098] Definition 2.5 [Volume of Hamming Ball [GRS23]] Let ^^ ^ 2 and 0 ^ ^^ / ^^ ^ 1 െ1 / ^^. Then the volume of a Hamming ball of radius ^^ in F^ ு^ is ^^ ^^^ / ^^^ି^^^^ ^ Vol^^^^, ^^^ ^^^ு^^^ / ^^^.

[0099] We refer to Honest-Verifier Zero-Knowledge Argument of Knowledge as HVZKAoK and define it below. Given a two-party interactive protocols between PPT algorithms ^^ with input ^^ and ^^ with input ^^ where only ^^ gets an output, we introduce two random variables: 〈^^^^^^,^^^^^^〉 denotes the output of the protocol, and View^^^^^^^,^^^^^^^ denotes the output of the protocol, and View(A(a), B(b)) denotes the transcript of the protocol.

[0100] Definition 2.6. An HVZKAoK with soundness error ^^ for an NP language L ⊂ ^0,1^∗and corresponding relation ^^^ ⊂ ^0,1^∗ ൈ ^0,1^∗ is a two-party interactive protocol between aprover P and verifier ^^ that satisfies the following properties:Perfect Completeness. For every ^^^, ^^^ ∈ ^^^, the verifier always accepts the interaction with anhonest prover Pr^〈^^^^^,^^^,^^^^^^〉 ൌ 1^ ൌ 1.^^- Soundness. For every PPT algorithm ^^^ such that Pr^〈^^^^^^^,^^^^^^〉 ൌ 1^ ൌ ^^̃ ^ ^^, there existsan extractor algorithm Ext which, given rewindable black-box access to ^^^, outputs a validwitness ^^′ for ^^ in time ^^^, 1 / ^^^̃ െ ^^^^.Honest-Verifier Zero- argument of knowledge is (computationally, statistically,perfectly) HVZK if there exists a PPT simulator Sim such that for every ^^^,^^^ ∈ ^^^, Sim^^^^ ≡View^P^^^, ^^^, V^^^^^, where ≡ denotes computational, statistical, or perfect indistinguishabilitybetween the distributions.

[0101] Gap-HVZK. A gap honest-verifier zero-knowledge argument of knowledge[CKY09,CCJ23] with gap ^^′, where ^^′ ⊆ ^^ is an NP language with relation ^^^, is defined as ahonest-verifier zero-knowledge argument of knowledge, with the following relaxation of ^^-soundness: the extractor Ext is only guaranteed to output a witness ^^′ such that ^^^, ^^′^ ∈ ^^′.

[0102] Weak Pseudorandom Function (wPRF). A function ^^: ^^ ൈ ^^ → ^^ with key space ^^,input spacw ^^ and output space ^^ (implicitly parameterized by security ^^) is said tobe a Weak Pseudorandom Function if for any q= poly(^^) it holds that ^^^^^ , ^^^^^, ^^^^^^∈^^^ ^^ ^^^^^ ,^^^^^^∈^^^where ^^

[0103] Pseudorandom Function (PRF). A function ^^: ^^ ൈ ^^ → ^^ with key space ^^, domain^^ and output space ^^ (implicitly parameterized by security parameter ^^) is said to be a (strong) Pseudorandom Function if for any PPT advesary ^^ we have |^ ^ ^ ^^P←r^^^Aி ^,⋅ ൌ 1^ െ^P←r^^^^^ ⋅ ൌ 1^| ^ negl^^^^,where Ato F(k, ^) and f(^) respectively, and F denotes the set of all functions from X to Y. III. SYMMETRIC-KEY PRIMITIVES FROM ALTERNATING MODULI

[0104] First, to better understand embodiments described herein, prior constructions and their shortcomings are described. Second, an example of how subtle changes to a construction can result in significant security ramifications. Third, design, analysis, and the implementation of certain embodiments are described. A. Prior Constructions and Their Shortcomings

[0105] By understanding the shortcomings of early cryptographic constructions, we can better appreciate the necessity for more robust and adaptive cryptographic solutions in the face of emerging post-quantum computing (PQC) threats.1. Low-MC PRP

[0106] One of the popular constructions has the Low-MC block cipher [ARS+15] which follows a similar structure as standard block ciphers such as AES. Unlike our constructions, Low-MC is a permutation and therefore faces additional constraints that all operations must be invertible given the key. In addition, Low-MC is a PRP which implies that it is a strong PRF and must be secure for adaptively chosen ^^, not just random. For an input ^^ ∈ F^, Low-MC iscomputed iterative using the round function ^^^ା^:ൌ ^^^^^^^ , ^^^^ for ^^ ^^ ^^^^ where ^^^ ൌ^^, and the final output is computed as ^^^^^, ^^^ ^^ ^ The roundfunction ^^^^^^^ , ^^^^ can be computed in three a non- Fଶis applied to the state. In particular, the current state ^^^ ∈ Fଶ^is reinterpreted as ^^^ ∈ G^ G ൌ Fଷଶ, and ^^ ൌ ^^ / 3. Let P be the permutation group over G → G. A constantelement ^^ ∈ P is applied to each G element in ^^^, i.e. ^^′^ᇱ:ൌ ^^ ⋅ ^^^. and ^^′^ᇱ is then reinterpretedas a F^ଶ vector ^^′^ᇱ. Next, a linear and invertible Fଶ transformation is applied, ^^′′^:ൌ ^^^ ⋅ ^^′^ᇱ fora public ^^^ ∈ F^ൈ^ଶ . Finally, the round key ^^^ ∈ Fଶ^is added to the state which defines the output of the round,i.e. ^^^ା^:ൌ ^^′′^ ^ ^^^. When implementing Low-MC, typically addition by ^^ ∈ P isimplemented in MPC as a binary circuit over Fଶଷ. The authors give a specific value of ^^ which can be implemented as ^^^,^^, ^^^ → ^^^ ⊕ ^^^^,^^ ⊕ ^^ ⊕ ^^^^, ^^ ⊕ ^^ ⊕ ^^ ⊕ ^^^^^ using threeparallel AND gates and six "free" XOR gates.

[0107] As with the hardness of alternating moduli paradigm, the security Low-MC stems in part from two operations that are each non-linear with respect to the other, matrix multiplication ⋅: F^ൈ^ ൈ F^ → F^ and the permutation group action ⋅: P ൈ G^ → G^. Unlike the alternating-element ^^ ∈ P is applied to the state as opposed to, for example, amatrix B ∈ P^ൈ^. However, multiplying by such a B appears to necessitate significant work inthe MPC setting sinceit is non-linear over the secret sharing group G . To mitigate the minimal use of operations in P, Low-MC applies many iterations of the round function. The primary shortcoming of Low-MC is the necessity of ^^ ^ 14 invocations of the round function, each ofwhich uses 2 rounds of communication, ^^^^^^ OT correlations, and ^^^^^ଶ^ work. Ideally, this could be reduced to effectivelyperforming the round function once.2. A Weak PRF from [ABG+14]

[0108] Akavia et al. proposed the first weak PRF that follows a similar structure as ours. Theirconstruction defines the key and input to be ^^ ൌ ^^^ ∈ F^, ^^ ∈ F^ൈ^ଶ ^ and the input to be ^^ ∈ Fଶ^. First the matrix-vector product A^^ is computed followed by computing a public disjunctivenormal form (DNF) formula ^^ on the result, i.e. ^^^^^, ^^^ ൌ ^^^^^^^ ⊕ ^^^. A (DNF) formula can becomputed as a layer of OR gates followed by AND gates, i.e. for some public ^^^, ^^, ^^^ such that^^ ൌ poly^^^^, and ^^, ^^ ∈ ^0,1^௧ൈ^, the function can be expressed as ^^^^^^ ൌ∧௧^ୀ^∨^^ୀ^^^^,^^^^^⊕ ^^^,^^. Bogdanov and Rosen [BR17] showed that any DNF formula ^^ as arational function of degree at most ^^^log ^^^ which in turn implies ^^ can in quasi-polynomial time ^^^poly^^^^^2୪୭^^௧^୪୭^^^^^^. While it may be possible to instantiate ^^ to have a large enough ^^ to have exponential security in practice, the concrete efficiency is unlikely to be competitive with alternatives. 3. A weak PRF from [BIP+18]

[0109] Boneh et al. propose a weak PRF with exponential security that can be computed indepth 2 circuits with mixed moduli. In particular, they consider the function ^^^^^, ^^^ ൌ ^^^^^ ⋅ଶ ^^^and ^^^^^^ ൌ ∑^ ^^^ mod 3, and ^^:ൌ ^^ ⋅ଶ ^^ ∈ Fଶ୫is a binary vector that is embedded into Fଷ^component- in the natural way. As discussed later, [BIP+18] proposes to restrict K to be a circulant (or toeplits) matrix. The works of [BIP+18, DGH+21] show that various types of learning algorithms provably cannot learn this function. They additionally show that it can not be approximated by any low degree polynomial. This result follows from the result of [Raz87, Smo87] showing that ^^^^^^^can not be approximated by any low depth mod ^^ circuit, where^^, ^^ are distinct primes. The work of [DGH+21] proceed to give several extension to their coreconstruction. The first is supports for multiple output bits. The function is defined as ^^^^^, ^^^:ൌ^^ ⋅ଷ ^^^ ⋅ଶ ^^^ where K is a square or expanding matrix and B is a compressing matrix. Inparticular, once can view B as a generator matrix for a linear code which has high minimum distance. The best known attacks for this construction attempt to distinguish by detecting a linear bias in the output. However, these attacks scale exponentally in the minimum distance of B [BIP+18]. We note that the structure of this weak PRF is identical to the aforementioned OWF. Indeed, [DGH+21] based the OWF on the weak PRF construction of [BIP+18] where the key K isreplaced with a public random matrix. The work of [DGH+21] also conjectures that that Fଶ, Fଷcan be replaced by any distinct prime fields F^, F^. The core hardness of the problem appearsunaffected with all known attacks performing equally poorly on larger moduli. However, Fଶ, Fଷ(and Fଷ, Fଶ^ appear to the an efficient choice due to them yielding more efficient modulusconversion protocols. The work of [BIP+18] suggests choosing the key ^^ ∈ F^ ^ ^୮ to be a squarecirculant matrix, which in turn allows one to express K in O(λ) space and, as we will see below, enables efficient matrix-vector products in the two-party setting [DGH+21]. With some expetion that we will discuss later, choosing K with this distribution does not appear to degrade securityfor the parameters used by [BIP+18, DGH+21], i.e., ^^ ൌ ^^ ൌ 2^^ ^ 0.6λ.

[0110] For implementing this week PRF in MPC, [BIP+18] and [DGH+21] have considered two settings: honest-majority three party and semi-honest two party. First the F2secret sharedinputs ^^^^ଶ and ^^^^ଶ are multiplied5 together to obtain ^^^^ଶ ≔ ^^^^ଶ^^^^ଶ. The exact methodused to compute this depends on the setting and is discussed below. Once the sharing of w = K^x is computed, the parties perform a modulus switching protocol where the shares ^^^^ଶare converted into ^^^^ଷ. The work of [DGH+21] suggests that once can preproces a random doublesharing ^^^^ଶ, ^^^^ଷ for a uniform ^^ ∈ F ଶ ଶଶ using some protocol and to reveal ^^’ ≔ ^^^^ ^ ^^^^ .Using^^^^ଷ, it is then possible to subtract off r from w’ to obtaing^^^^ଷ. The final step of theprotocol is to locally compute ^^^^^^, ^^^^ଷ ≔ ^^ ∙ଷ ^^^^ଷ. The outline above may use two missingsteps, efficiently computing a sharing of K^x and generating random modulus concersion doublesharings ^^^^ଶ, ^^^^ଷ. Next, we discuss how [DGH+21] suggest this can be done.

[0111] In the honest majority setting, the inner product between two vectors can be computedwith ^^^1^ communication [AFL+16] which implies that ^^^^ଶ ൌ ^^^^ଶ ⋅ ^K^ଶ can be computedwith linear communication overhead, i.e. ^^^^^ ^ ^^^. Similarly, it is possible to have one of theparties generate ^^^^ଶ, ^^^^ଷ locally and then only reveal ^^′ to the other parties, i.e. ^^^^^^communication. The two-party setting the situation is more complicated due to not having a ^^^1^ communication inner product protocol. However, when evaluating the wPRF for a fixedkey K for many inputs, one can amortize this cost. In particular, for bits ^^^, ... , ^^^ ∈ Fଶ and afixed vector Δ ∈ Fଶ^, one can use correlated OT protocols, e.g. IKNP[IKNP03], SoftSpoken OT [Roy22] or silent OT[BCG+19a, RRT23], to generate the secret sharings^^^^Δ^ଶ. Moreover, silent OT can achieve this with an amortized cost of ^^ bits of communication when ^^ issufficiently large. Alternatively, SoftSpoken OT achieves ^^ ∙ ఒ^ communication for any constant^^, e.g. ^^ ൌ 4. In paticular, this corresponds to a subfield VOLE protocol with Fଶ as the subfieldand Fଶ^ as the extension. When K is circulant, one can set Δ:ൌ ^^^ ∈ Fଶ^ and generate sharingsof ^^^^^^ ^^^ ^^^^ ⋅ Δ^ and locally rotate these to obtain ^^^^ ⋅ K^^ and sum them to compute ^K^^ ^ asdesired. We note that [DGH+21] only mentions the technique above in passing and does not implement or report on its performance. Instead, they focus on the setting with (free) preprocessed correlated randomness where ^^ can be computed using other methods (which also leverage the fact that K is cirulant). The work of [DGH+21] does not explicitly state how to generate modulus conversion double sharings and again assumes (free) preprocessing for^^^^ଶ, ^^^^ଷ . A natural choice would be using OT or the more recent work of [IKNZ23]. Lookingforward, we will offer improvements to these technique in at least Section V. 4. A PRF from [BIP+18]

[0112] In addition to the weak PRF construction previously discussed, Boneh et al. proposed an extension for upgrading at their conjectured weak PRF to a strong / plain PRF. First, they show what one can distinguish their weak PRF in the strong / adaptive setting where the adversary can choose the input x. In particular, their adaptive attacks leverage highly correlated inputs such as having small hamming distance. This suggest they use of an error correcting code to ensure that all inputs have high minimum distance. An efficient solution would be to encode the input usingthe same modules as the input to the weak PRF, i.e., ^^^^^, ^^^ ൌ ^^ ^ଷ ^^^ ^ଶ ^^^ ^ଶ ^^^^ where G ishe generator matrix. This could be implemented in MPC with no communication and very little overhead. Unfortunately this approach does not work as this can be viewed as a transformationon only the key, i.e., ^^^^^ᇱ, ^^^ ൌ ^^ ^ଷ ^^^ᇱ ^ଶ ^^^ where ^^ᇱ ൌ ^^ᇱ ^ଶ ^^. Therefore, the same attachapplies to this construction. The work of [BIP+18] also shows that the adaptive attacks on their wPRF can be extended to a relatively large class of multiplicative depth-2 circuits. Given this negative result, [BIP+18] turn their attention to depth-3 circuits. They conjecture that performing the linear code over a different modulus does result in strong security and propose a candidate PRF construction. We refer to [BIP+18] for a detailed discussion.B. Insecure Plus / XOR Construction

[0113] As a starting point we first introduce a candidate construction that is ultimately determined to be insecure. The aim of this example is to demonstrate how subtle changes to the construction can result in significant security ramifications. Moreover, we believe it is instructiveto know what does not work as well as what does. Given the advancements of ^^^^^^ ൌ ^^ ⋅ଷ ^^^ ⋅^^^ being a OWF, a natural question to ask is whether it possible to use ^^ to construct another, more efficient, weak PRF. From the efficiency perspective, such an ^^ can be evaluated in the plain two party setting with linear communication due to the only non-linear step consisting of ^^^^^^ modulus conversion gates since A is now public. Arguably the simplest candidate would be ^^^^^, ^^^ ൌ ^^ ⋅ଷ ^^^ ⋅ଶ ^k ^ ^^^^,where k and x are binary vectors and ^ denotes addition over Fଶ. To attack the candidate above, it is not hard to see that it suffices to provide an attack for the following single-bit output variant ^^^^^, ^^^ ൌ 1௧ ⋅ଷ ^A ⋅ଶ ^k ^ ^^^^where 1௧ denotes the all െ one vector of appropriate dimension. We now show that thisfunction is indeed learnable. It will be useful for us to represent Fଷas the set ^െ1,0,1^ in the natural way. A simple observation is that one can emulate addition over Fଶusing multiplicationover Fଷ by relying on the mapping ^^^^^^ ൌ ^^ ^ 1 (arithmetic in Fଷ), which maps 0 → 1 and1 → െ1. Let ^^ ൌ ^^^^^, ^^^ be an input-output pair from the wPRF candidate above. It follows byinspection that if we use the notation ^̅^^ ൌ ^^^^^^^ and ^ത^^ ൌ ^^^^^^^ for ^^ ∈ ^^^^, we can write thefollowing relation ^^ ൌ ∑^ ^^^∏^^^ത^ ^ ^^ೕ ∑^ ∏^ത ^^ೕ∏^^^ೕ^ୀ^ ^ୀ^ ^ ̅^^^ ^ ൌ ^ୀ^ ^^^^ᇣᇧ ^ᇧୀᇤ^ ᇧ ^^^ᇧᇥ^⋅ ^ᇣᇧ^ᇧୀᇤ^ ᇧ ^̅^^ᇧᇥ^^ wherewPRF game, byplugging in the input values we can compute each ^^^. Moreover, each ^^^ is a monomial over ^^ ൌ^^ത^^, … , ^ത^^^, i.e., ^^^ is simply a subset product of components of ^^ where the subset only dependson A (and is independent of x). We can now recover the key in two steps. First, given that ^^ is a linear function, after gathering enough samples we can use Gaussian elimination to recover each^^^ ∈ ^െ1,1^ for ^^ ∈ ^^^^. In the next step, we use ^^^ to recover the key. To do so, recall that each^^^is a monomial of components of ^^. Because multiplication over Fଷ(for the set ^െ1,1^) is isomorphic to addition over Fଶ, it follows that ^^ ⋅ ^^ ൌ ^^^ି^^^^ ି^ ^ଶ ^^, … , ^^ ^^^^^^ ∈ ^0,1^ .

[0114] can recover k by Gaussian elimination, as desired. We remark that one can rely on a similar argument to show that the following candidate ^^^^^, ^^^ ൌ ^^ ⋅ଷ ^^^ ⋅ଶ ^^^||^^^^,is also insecure, which is obtained by replacing the XOR operation in the plus construction with concatenation (and appropriately modifying the row dimension of the public matrix A). C. An Improved Weak PRF

[0115] Leading up to our main construction (Definition 3.2), let us first reconsider the weakPRF of Boneh et al. [BIP+18] defined as ^^^^^, ^^^:ൌ ^^ ⋅ଷ ^^^ ⋅ଶ ^^^ where ^^ ∈ Fଶ^is the input,^^ ∈ Fଶ^ൈ^is the key (typically square & circulant), and B ∈௧ଷൈ^is a public compressing matrix.Observe that this function can be computed as ^^^^^, ^^^:ൌ ^^ ⋅ଷ ^^^ ⋅ଶ ^^^ ⊙ଶ ^^′^^ where for ^^′:ൌ^^^^, the vectors ^^′, ^^′ ∈ F^ᇱଶ are the appropriately unrolled version of ^^, ^^. In particular, let^^′^^ା^:ൌ ^^^,^ and ^^′:ൌ ^^^^... ^^ be ^^ copies of ^^. Computing the component-wise product ofthese provides all of the terms for computing ^^ ⋅ଶ ^^. All that remains is to performthe summations corresponding to the rows of K. This can be achieved using an appropriatelydefined public matrix ^^ ∈ Fଶ^ൈ^^. In particular, A will be the (compressing) repetition code, or equivalently it will look like a staircase with consecutive runs of ^^ ones in each of the ^^ rows. We argue that this formulation more explicitly describes the construction as it separates theadditive and multiplicative steps. An additional benefit of the explicit formulation is that the ^^′ ൌ^^^^ ൌ ^^^λଶ^ scalar multiplications between secret vectors ^^′, ^^′ are apparent.

[0116] Our Weak PRF. Instead of asking if we can reduce the overhead of the Boneh et al. construction, it will be more instructive to ask if there are any methods for plausibly improvingthe hardness of the function. An option is to remove all structures from ^^′, ^^′,^^. If A is therepetition code of [BIP+18, DGH+21], then ^^^ is the sum ∑^∈^^^ା^^ି^^^ ^^^′^^^ᇱ ൌ ∑^∈^^^ ^^^^^^,^ା^.As demonstrated in Section III(B), the alternating-moduli^^^is not the combination of ^^^^^^ multiplications and additions for each ^^^. As such, choosing a circulant K with dimension ^^^^^^ in some sense appears to be a succinct option while remainingsecure, i.e. each input bit ^^^ for ^^ ∈ ^^^^ is multiplied by each (independent) key bit K^,^, leadingto ^^^^ ൌ ^^^^^ଶ^ terms where the summations are taken over disjoint sets where ^^^^^^,^ eachappear once.

[0117] However, we observe that this is by no means the only option. Let us remove theconstraints on ^^′, ^^′ ∈ F^ᇱ such that they are uniformly distributed and replace ^^ ∈ ^ൈ^ᇱଶ F with acode with high minimum distance, e.g. A is uniform. Observe that each ^^^is now a linearcombination of the ^^′^^^′^ terms. In expectation, each ^^^ will be the summation of ^^′ ൌ ^^^^ ൌ^^^^^ଶ^ terms. In light of the known cryptanalysis, this construction appears overly conservative in that the ^^^terms only need to be a sum of ^^^^^^ terms while at the same time not having smalllinear dependency. We have now defined our new ^Fଶ, Fଷ^-wPRF which is a generalization ofthe Boneh et al. PRF. In particular, we can write the implicit construction above more formally as follows:

[0118] Definition 3.1 Let ^^,^^, ^^ ∈ ℕ, our ^Fଶ, Fଷ^-weak-PRF construction is ^^^k, x^:ൌ^^ ⋅ଷ ^^^ ⋅ଶ ^^^ ⊙ଶ^^^ where ^^, ^^ ∈ F^ଶ and ^^ ∈ F^ൈ^ଶ , ^^ ∈ Fଷ௧ൈ^are uniformly distributed.

[0119] The weak PRF construction of Boneh et al. is then defined by requiring that ^^, ^^, Ahave repetitive structure along with defining ^^ ൌ ^^^^^ଶ^. However, we will argue that theproblem for uniform ^^,^^, ^^ remains hard even when ^^ ൌ ^^^λ^. One interpretation of our resultis that prior works perform ^^^λଶ^ multiplications followed by multiplication with a repetition code while our construction more efficiently amortizes the multiplications by replacing the repetition code with a high minimum distance code. In this way our construction more diligently uses the limited number of multiplications that are available. As with Boneh et al. [BIP+18], one can similarly generalize our construction to any prime fields.

[0120] Definition 3.2 (Generalized Weak PRF) Let ^^, ^^, ^^ ∈ ℕ and let ^^, ^^, be distinct primes.Our ^F , F ^-wPRF is defined as ^^^k, x^:ൌ ^^ ⋅ ൫^^ ⋅ ^^^ ⊙ ^^൧൯w ^^ ^ ^ ^ ^ here x, ^^ ∈ ^^^ and^^ ∈ F^ൈ^ ௧ൈ^^ ,^^ ∈ F^ are uniformly distributed.

[0121] Following the same analysis as [BIP+18], we conjecture that our depth-2 weak PRF can be compiled into a (strong) PRF by first encoding the input using an error correcting code with a different modulus than the key. In particular, we conjecture that Definition 3.3 is a PRF forappropriately chosen ^^,^^, ^^, ^^.

[0122] Definition 3.3 (Generalized Strong PRF) Let ^^, ^^, ^^, ^^ ∈ ℕ and let ^^, ^^, be distinctprimes. Our ^F^ , F^, F^^-PRF is defined for ^^ ∈ ^^^^ as ^^^^^, ^^^:ൌ^^ ⋅ ^^^ ⋅ ^^^ ⊙ ൫^^ ⋅ ^^^, 1^^൧൯ where ^^ ∈ ^^ௗ , and ^^ ∈ F^ൈௗା^, ^^ ^ൈ^ ௧ൈ^^ ^ ^ ^ ^ ^ ∈ F^ , ^^ ∈ F^ are

[0123] The core intuition behind this construction is that known attacks against our weak PRF and the weak PRFs of [BIP+18] in the strong setting heavily rely on PRF evaluations for highly correlated inputs, e.g. having small hamming distance. The work of [BIP+18] proposes a compiler that they define as encoded input. The core idea is to restrict the adversary's choice of inputs to the underlying weak PRF so that highly correlated inputs are not allowed. A natural example of such an encoding is encoding the input using a linear error correcting code, i.e. An efficient option for doing this is to perform the encoding in F^. However, the work of [BIP+18] shows that this does not work as one can recast this encoded input function as a new instance of the underlying weak PRF with a different A matrix. This recasting crucially relies on the fact that A and G are over the same modulus and therefore compose into a new matrix ^^′. Given this observation, tey suggest sampling G over a different modulus and performing an additionalround of modulus conversion of ^^ ⋅^ ^^^, 1^ from F^ to F^ before multiplying it with the key. Toensure that the output remains pseudorandom for all-zero input, 1 is appended to x.

[0124] Embodiments described herein propose a new candidate. Our wPRF may use less communication and effectively a third of the number of oblvious transfers (Ots) when evaluated in MPC. While prior work [DGH+21] propose a protocol with good performance for the main phase, it omitted relatively large cost of generating correlated randomness. The careful design of our new wPRF candidate optimizes the end-to-end cost of the protocols while at the same time achieving better performance in the main phase. Our construction allows one to instantiate it with ^^^^^^ amortized evaluation time while prior works [BIP+18, DGH+21] mandated ^^^^^ଶ^ time. While previous work [BIP+18, DGH+21] has primarily focused on using linearsharing, and dismissed garbling-based approaches, we show that using specialized garbling schemes leads to competitive protocols that offer an interesting trade-off between the computation and communication. D. Improving Efficiency of the Weak PRF in a Two Party System

[0125] We consider two optimizations with the aim of improved efficiency of our wPRF whenevaluated in the two party setting where the key ^^ is fixed for many inputs ^^^^^, ... , ^^^^^. Due tothe generality of our construction, both can be framed as changing the distribution of the key ^^ or input ^^. We provide a description of our protocols in at least Sections IV, V, and VI.

[0126] Structured input ^^. For now, let us focus on the ^F ^^^ଶFଷ^-wPRF where ^^ ,^^ ∈ Fଶ^. Weconsider the general methods for computing ^^^^^ ⊙ ^^, i.e. component-wise multiplication.

[0127] Reusable Key OTs. Given that ^^ is fixed, a natural protocol for computing ^^^ ⋅ ^^^^^^ isto preprocess a random OT for each bit ^^^, .. , ^^^ of the key. These can then later bederandomized using standard technique to generate the sharing ^^^ ⋅ ^^^^^^ using only ^^^^^^communication and minimal computation. The advantage of this approach is that a per evaluation OTs may not be used. When combined with our OT based modulus switching, wewill show we may use only ^^ ൌ 2^^ OTs per evaluation. Alternatively, when combined with ourcustom garbled circuit modulus switching protocols, no per evaluation OTs are used at all.However, we will see that the disadvantage of this approach is that it may use ^^ ൌ 4^^ bits ofcommunication and as a result this approach will have more communication (but fewer OTs)compared to the protocol of [DGH+21] with ^^ ൌ 2^^ bits of communication.

[0128] Nonreusable Input OTs. To bring down the overall communication, we make the observation that the input ^^ can have an smaller "effective" size of just ^^ bits. First we changethe distribution of ^^ such that for some ^^^ ∈ Fఒ, one can express ^^ as ^^ copies of ^^^, i.e. ^^ ൌ^^^^||^^^||... ||^^^^. We will then be able to efficiently multiply each bit of ^^^^ with the ^^ bits of thekey that is corresponds to, i.e. ^^^ , ^^^ା^ / ^, ..., using subfield VOLE. In particular, when usingsilent VOLE in the amortized setting, the communication complexity is essentially independentof ^^. As a result, the total amortized communication for computing ^^ ⊙ ^^ with ^^ ൌ 4 is just ^^ ൌ^^ / ^^ bits, a 4 to 2 times reduction depending on the protocol. However, this change implies that^^ / ^^ ൌ ^^ additional VOLE correlations will be consumed per evaluation. We note that for small^^, these silent VOLE correlations can be packed together such that computing ^^ / ^^ of them can be computed at the effective computational cost of a single random OT. Finally, we note that for [BIP+18, DGH+21], applying a similar optimizations results in their schemes being insecure due to certain weaknesses associated with the use of the circulant key K.

[0129] Structured key ^^ over Fଷ. In the case of ^Fଷ, Fଶ^-wPRF it will be advantageous for usto consider a key to restrict the key ^^ which would typically be in Fଷ^to lay in the binary subset.The operations of multiplying A⋅ଷ ^^^ ⊙ଷ ^^^ will still be performed modulo three. We conjecturethat this variant is as secure given that ^^ is increased to compensate for the loss of entropy in thekey. When combined with the reusable Key OTs optimization above, this enable ^^ ⊙ ^^ to becomputed with half the communication complexity of the original method. E. Security Analysis and Parameter Selection

[0130] Here we show that the plausible security of our weak PRF is connected to the hardness of solving sparse multivariate polynomials over Fଷ. Building on prior works, we proceed to using combinatorial methods to analyze our construction, with a focus on a reduction from subset sum problem.

[0131] Polynomial Representation. The security of our construction is closely related to the hardness of solving sparse multivariate polynomials. Indeed, in Section III(B) we present a weakened variant of our construction that can be broken when viewed as a problem overpolynomials. Recall that for ^^ ൌ 1 our construction can be written as ^^^k, x^ ൌb^ ⋅ଷ ^^^ ⋅ଶ ^k ⊙ଶ x^^. Observe that one can emulate addition over Fଶ using multiplication overFଷ by relying on the mapping ^^^^^^ ൌ ^^ ^ 1 (arithmetic in Fଷ), which maps 0 → 1 and 1 → െ1(we also use the notation ^̅^^ ൌ ^^^^^^^ and ^ത^^ ൌ ^^^^^^^ for ^^ ∈ ^^^^). Then, ^^^^^, ^^^ can be rewrittenas∑^^ୀ^ ^^^ ⋅ ^^ି^^∏^^^ೕ௫ೕ ^^^^ೕ௫ೕ ^^^^ೕ௫ೕ^ୀ^ ^ത^^ ^ ൌ ∑^ୀ^ ^^^ ⋅ ^∏ ^ୀ^ ^ത^^ െ 1^ ൌ ∑^ୀ^ ∏ ^ୀ^ ^ത^^െ

[0132] The term ^^ is public and hence can be computed by the adversary. Thus, the hardnessof our weak PRF construction boils down to the pseudorandomness of the following: ^^′^^^, ^^^ ൌ∑^^ୀ^∏^ ^ୀ^ ^ത^^^ೕ௫ೕ^ ,where operations are done over Fଷ. For any input x, the weak PRF output is simply a sparse multilinear polynomial over Fଷ(where the polynomial is defined by the input and public parameters), so a key recovery attack for the construction directly corresponds to solving a system of sparse multilinear equations over Fଷ.

[0133] A generalized construction. Building upon the idea above, we now describe a simple framework to instantiate new weak PRFs based on the hardness of solving a system of sparse multilinear equations over a finite field of (small) size. First, we fix a finite field F^and two dimensions ^^ and ^^. Let F^∗^ be the key space and let ^^ be a distribution over ^^ ൈ ^^ binarymatrices. The construction can be succinctly described as follows: ^^^^^, X^ ൌ ∑^^ୀ^ ∏^௫^ୀ^^^^^ೕ, where all operations are done over F^. Note that ^^ is the andthe ^^th term in the polynomial simply corresponds to a subset product over the components of the key k according to the ^^th row of the input X. For instance, the preceding construction (with public matrix A) is an instantiation of the framework above with the field Fଷand the distribution^^ is obtained by sampling ^^ ← ^0,1^^ and setting the ^^th row of X as ^^ ^ ⊙ ^^.

[0134] On the Duality of Polynomial Representation. We remark that in the polynomialrepresentation outlined above, one can alternatively put ^̅^^ ൌ ^^^^^^^ in the base and obtain thefollowing representation of ^^′ (a similar representationfor ^^ as well): ^^′^^^, ^^^ ൌ∑^^ୀ^∏^ ^ୀ^^̅^^^^ೕ^ೕ. Note that in this representation, a key recovery attack would correspond to sparse multilinear polynomials. While the connection between AM-based symmetric primitives and the hardness of interpolating sparse multilinear polynomials has already been observed by [BIP+18], neither of [BIP+18] or [DGH+21] considered the dual problem of solving a system of sparse multilinear polynomial equations for their constructions.

[0135] We present several possible parameterizations of our wPRF. The most efficient known attacks [DGH+21] are based on a reduction to subset sum problem [HJ10, BCJ11, BBSS20]. We will review the core reduction which focuses on the AM-OWF. We then discuss how this applies to the wPRF where the key is effectively the AM-OWF input.

[0136] Subset Sum Attack. At a high level, the main idea to attack the AM-OWF can be described in two steps. In the first step, inverting the OWF is reduced to a specialized subset-sum problem. In the second step, modern subset-sum solving algorithms such as [HJ10, BCJ11, BBSS20] are modified in a way that they enable us to solve the resulting specialized subset-sum problem and invert the OWF. We focus on the first step, as the modification can be done via standard algebraic and combinatorial techniques.

[0137] Let ^^ ∈ F௧ଷ be an output of the OWF on an input ^^ ∈ F^ଶ, and let ^^ ൌ ^^ ⋅ଶ ^^ be theintermediary evaluation. Observe that there is an ^^^ െ ^^^ ൈ ^^ parity check matrix P such that^^ ൌ ^^ ⋅ଶ ^^ iff w lies in the kernel of P. So, for any intermediary evaluation w we have ^^ ⋅ଶ w ൌ^^ and ^^ ⋅ଷൌ. We now aim to find w by a reduction to subset sum. Denoting the ^^-th unit vectorby e^, note that if we can find a set of indices ^^ ⊆ ^^^^ such that ൫∑^∈ூ ^^ ⋅ଶ^ ,∑^∈ூ ^^ ⋅ଷ ^^^൯ ൌ^^^, y^, then we can invert the OWF simply be solving ^^ ⋅ଶൌ ∑^∈ூ e ^. Therefore, we have areduction to the subset problem with the target ^^^, y^ ∈ F^ି^ ௧ଶ ൈ Fଷ and ^^ variables ^^^, … ,^^^,where we associate ^^^ ൌ 1 with ^^^ ⋅ଶ^ ,^^ ⋅ଷ^^. We point out that this problem can also be seen asa special case of generalized knapsack problem for the additive group ^F^ି^ଶ ൈ Fଷ௧,^^, for which search-to-decision reductions with different parameter setting have been proposed by [MM11].

[0138] As mentioned in [DGH+21], a slightly modified version of [HJ10] may use 2^.ଷଷ^^time and 2^.ଶହ^^space (ignoring polynomial factors in ^^) to invert the OWF. In addition, the algorithm of [BBSS20] (with slight modification) runs in 2^.ଶ଼ଷ^time and space. Overall, toachieve ^^-bit security one may set ^^ ^ 3.53^^. Thus, a suggested choice of the parameters^^^, ^^, ^^^ in terms of ^^ for the AM-OWF would be ^^^, 3.53^^, ^^ / log 6ଶ3^.

[0139] One-to-One Parameters. We now present a conservative parameter set for our wPRF constructions given the subset sum attack. One can rely on the OWF attack described above tobreak our ^Fଶ, Fଷ^ wPRF. Consider fixing some input-output pair ^^^, ^^ ൌ ^^^^^, ^^^^ and observethat this can be viewed as an instance of the OWF applied to the key . For each ^^^ ൌ 0, it is clearthat ^^^does not have any impact on the output of the wPRF. Thus, on average, one may doublethe key / input size to prevent the subset-sum attacks attack from recovering given a single ^^^, ^^^sample. We propose the following parameter setting for our ^Fଶ, Fଷ^-wPRF to get λ bits ofsecurity: ^^ ൌ 2λ,^^ ൌ 7.06λ, ^^ ൌ 2λ / logଶ3, which is simply doubling the parameters in OWFsetting to thwart the subset-sum attacks. In particular, both key and input will be 2λ-bit strings.For the ^Fଷ, Fଶ^-wPRF we propose ^^ ൌ 2λ / logଶ^3^, ^^ ൌ 7.06 / logଶ^3^, ^^ ൌ 2λ. Indeed, in therestricted single wPRF sample setting, it is not hard to show that the hardness of the OWF implies the hardness of a key recovery attack. Recall that the parameters of the OWF imply that it is approximately one-to-one. As such, for any given we should expect there to be one value for x ⊙ k that is consistent with any given sample. Hence, we denote the parameters above as one- to-one. When generalized beyond the artificial constrain of a single sample, one can view eachsample ^^^^, ^^^^, ... , ^^^^, ^^^^ as defining a related OWF instance, where the OWF input k andparameter A are "subsetted" by ^^^.

[0140] Many-to-One Parameters. Unlike the OWF, recall that given a sample ^^^,^^^, non- invertability is not a requirement of a wPRF with respect to arbitrary key ^^′. Building on this observation we propose to deviate from the OWF parameter regime and consider the settingwhere there are many consistent ^^ ⊙ k for any given ^^^, ^^^. Specifically, we define ^^ ൌ 4λ, ^^ ൌ2λ, ^^ ൌ λ / logଶ^3^ for the ^Fଶ, Fଷ^-wPRF and ^^ ൌ 4λ / logଶ^3^, ^^ ൌ 2λ, ^^ ൌλ for the ^Fଷ, Fଶ^-wPRF. Focusing on the ^Fଶ, Fଷ^-wPRF, observe that for any given sample ^^^, ^^^, there is a set^^௬,^:ൌ ^^^|^^ ൌ ^^ ⋅ ^^^ ⋅ z^ ∧ z ⊙ ^^ ൌ ^^^ representing the valid ^^ ⊙ x preimages. For theparameter regime above, it holds that |^^| ൌ ^^^2ఒ^. Indeed, consider the ^^′, ^^′ where ^^′ consistsof the columns of A indexed by ^^ s.t. ^^^ ൌ 1 and ^^′ consists of ^^^. For the average case of |^^| ൌ2λ, we have ^^′ ∈ F^ൈ^ଶ and therefore the size of ^^ is precisely the size of ^^ ൌ ^^^|^^ ൌ B ⋅ଷ ^^ ∧^^ ∈ F^ଶ ^. That is, ^^ is defined by the binary codewords of a random ^^ ൈ ^^ linear codes(viewing ^^ as the parity check matrix) and therefore we would expect |^^| ^ ^2 / 3^^3^ି௧ ^2^ି^.^௧ ^ 2ఒ. Therefore the adversary has no advantage in recovering k given a single sample.

[0141] ^^ samples ^^^^^^, ^^^^^^, ... , ^^^^^^, ^^^^^^. Let ^^^^^:ൌ ^^ ⋅ ^k ⊙ x^^^^ and observethat given ^^, ^^, ^^^^^, one can compute ^^′ ∈ F ^^ൈ^ ^௧ൈ^^ ^^^ ^^^ଶ ,^^′ ∈ Fଷ such that ^^^ , ... , ^^ ^ ൌ ^^′ ⋅^^ and ^^^^^^, ... ,^^^^^^ ൌ ^^′ ⋅ ^^^^^^, ...large, one can define P as the parity check matrixof ^^′ and solve the following subset sum problem ^∑^∈ூ P^^^ ,∑^∈ூ B′e^^ ൌ ^0,^^^ to recover ^^ ൌ∑ ^^^and therefore k. However, the runningfor this problem with the best-subset sum solver [BBSS201] is ^^^2^.ଷଷ^^^^. Based on the discussion above, ^^ must be at least2 and therefore the running time is at least ^^^2^.ଷଷ^⋅ଶ⋅ଶ^^ ൌ ^^^2^.ଷହ^^.

[0143] Parameters for Optimizations. In Section III(D) we propose two alterations to theconstruction. The first proposes to restrict ^^ to be ^^ copies of ^^^ ∈ Fఒ, i.e. ^^ ൌ ^^^^. The mainattack that this alteration impacts is the potential improved efficiency for sparse polynomial. As with the prior works, our scheme can be framed as the problem of interpolating sparsepolynomials, i.e. ^^′^k, x^ ൌ ∑^^ୀ^ ∏^ ^ୀ^^̅^^^^ೕ^ೕ. The efficiency of these solvers may result in evaluating the polynomial at specific values, e.g. roots of unity. Therefore, one must ensure thatsufficiently few of such points coincide with the random weak PRF inputs, ^^^^^, ... , ^^^^^. Giventhat at most ^^ ൌ 2ସ^ queries are made, we conjecture that such techniques remain exponentialtime. Indeed, [BIP+18] shows that if such attacks are effective, then learning with rounding (LWR)[BPR12] for similar parameters is broken. Should a large bound on ^^ be desired, one can increase ^^ or decrease ^^ accordingly to maintain the security margin between 2^ / ^and ^^.

[0144] We note that similar optimizations should not be applied to the protocol of [DGH+21]with a circulant key. In particular, when the wPRF is defined as ^^^^^, ^^^ ൌ ^^ ⋅ଷ ^^^ ⋅ଶ ^^^ and K iscirculant, the scheme suffers from a vulnerability when ^^ is symmetric, i.e. ^^ ൌ ^^^^||^^^^. Due tothe symmetry of both ^^ and K, the intermediate value ^^ ൌ ^^ ⋅ ^^ will also be symmetric, i.e. ^^ ൌ^^^^||^^^^. Given that ^^ is close to a rate 0.5 matrix, i.e. ^^ / 2 ^ ^^, the attacker can efficiently solvefor ^^^ and thereby recover ^^, rendering the scheme insecure. To prevent this, [DGH+21] mayinclude using a uniform ^^ over ^^ ൌ 2^^ which result in symmetric ^^ occurring with negligibleprobability, unlike the case of ^^ ൌ ^^. The second security-relevant optimization we suggest isthe restriction of the key ^^ ∈ F^ଷ for the ^Fଷ, Fଶ^-wPRF to lie in the binary subset. As discussed,this halves the communication complexity of computing ^^ ⊙ ^^ when implemented usingReuseable Key OTs technique. We are not away of any attacks that can take advantage of this distribution change beyond relatively trivial attacks that partially relay on brute force. Tomitigate the impact of these, we suggest increasing the key length by logଶ^3^, i.e. ^^ ൌ 4^^.

[0145] Other Attacks. Another potential avenue of attack would be utilizing Gröbner basis to solve a system of multilinear polynomial equations. However, in its plain format, the algorithmic cost of such an attack is quite high and it does not seem to impact the security of our wPRFconstructions. Both [BIP+18] and [DGH+21] argued that appropriately designed alternating moduli constructions can not be approximated by low degree polynomials. Moreover, they give conjectures that this extends to relational functions as well. Assuming the equivalent conjecture for our construction holds, it appears implausible that generic algebraic techniques will be effective for our parameters. On the flip side, we are not aware of any other algebraic attack that particularly exploits the extra structure / information provided by the wPRF and hence we suggest setting parameters based on subset sum. Finally, we refer to the analysis in [BIP+18, DGH+21] for additional attacks that leverage some common structure to all of our schemes. For example, one can break the security if B has small minimum distance, if one is able to efficiently enumerate all ^^ for a fixed ^^, if one is able to detect bias in the output bits, or if one can leverage the parity of ^^,^^ along with attacks based on LPN, and connections to learning theory [BIP+18, DGH+21]. However, these attacks are not significantly impacted by our changes and are less efficient that the subset sum attack. IV. PROTOCOLS AND EVALUATION

[0146] We focus on the semi-honest two party setting where the input ^^ and key ^^ are each known to the two parties, respectively. The structure of our weak PRF lends itself to particularly efficient implementation in the setting. However, we note other setting such as where ^^,^^ are secret shared can easily be implemented using similar techniques. Malicious security can of course be achieved but we leave an efficient specification of this to future work. Our protocols will assume that the output should be secret shared. In the case of an OPRF, it is straightforward to reveal the result to the party with ^^. A. Review of Silent OT / VOLE / OLE

[0147] To fully appreciate the design decision of our protocols it is important to understand how silent OT and VOLE protocols work[BCG+19a, BCG+19b, RRT23]. At the root of these protocols is the computational hard problem known as syndrome decoding. For a secret randomsparse vector ^^ ∈ Fఔଶ, and a public error correcting code generator matrix ^^ ∈ ^^ଶ^ൈఔ, thesyndromeassumption state that ^^^, ^^ ⋅ ^^^ is indistinguishable from ^^^, ^^^ for a uniform^^. Note that ^^ ^ ^^, e.g. ^^ ൌ 2^^, and therefore ^^ ⋅ ^^ compresses ^^. Security of this assumptiontypically holds if ^^ has high minimum distance[RRT23].

[0148] The Silent OT / VOLE is a two party protocol with a sender and receiver. In its simplestformulation the goal is for the receiver to hold random vectors ^^ ∈ F^^ଶ, ^^ ∈ Fଶഊand the sender tohold scaler Δ ∈ Fଶഊ and a vector ^^ ∈ F ^ଶഊ such that ^^ ^ ^^ ൌ ^^Δ. One can view ^^, ^^ as a secretsharing of ^^^^ times the scaler Δ. The protocal proceeds by having the receiver samples a sparsevector ^^^ ∈ Fఔଶ while the sender samples a random Δ ∈ Fଶഊ. The parties generate a secret sharingof ^^^ ∈ Fఔଶ times Δ ∈+ଶഊ using a technique known as a punctured PRF technique [BCG19a]. Leveraging the sparsity of ^^^, this only uses ^^^^^log^^^ / ^^^^ communication, where typicalparameters have ^^ ^ 2ଶ^. Let ^^^ , ^^^ ∈ Fఔଶഊdenote the shares of ^^^Δ. The idea is to then compressthese vectors to get ^^ ൌ ^^ ⋅ ^^^,^^ ൌ ^^ ^^^ ,^^ ൌ ^^ ⋅ ^^^. Since multiplication by ^^ is linear, thecorrection ^^ ^ ^^ ൌ ^^Δ still holds. by the syndrome decoding assumption, ^^ will bepseudorandom. This protocol can more generally be referred to a ^^^,^^^-subfield VOLE wherewe have a subfield ^^ and an extension field ^^ ൌ ^^ఙ for some ^^. The correlation ^^ ൌ ^^ ^ ^^Δholds for ^^ ∈ ^^^ and ^^,^^ ∈ ^^^,Δ ∈ ^^. The description above is of course for ^^ ൌଶ and ^^ ൌ ^^.

[0149] As we mentioned before, one can efficiently multiply many scalers ^^^^^, ... , ^^^^^ ∈ ^^by a vector ^^ ∈ ^^^ using subfield VOLE. The parties first generate a ^^^, ^^^^-subfield VOLEcorrelation of size ^^ where Δ ൌ ^^. The receiver can then send the difference ^^ െ ^^ and have thesender update their correlation such that ^^ ^ ^^ ൌ ^^^^. One can obtain random one-out-of-two OTfrom ^Fଶ, Fଶഊ^-subfield VOLE. Random OT refers to the correlation where the sender holdsrandom ^^^,^,^^^,^while the receiver holds a bit ^^^and the string ^^^,^^. This can beachieved by defining sender messages ^^^,^ ൌ ^^^^^^^, ^^^,^ ൌ ^^^^^^ ^ Δ^ where the receiverknows random choice bit ^^^ and message ^^^,^^ ൌ ^^^^^^^. This can be generalized to one-out-of-^^OTs by performing a ^F^, F^^^-subfield VOLE and define ^^^,^ ൌ ^^^^^^ ^ ^^Δ^. While possible toinstantiate with any ^^, the implementation may be mostwhen ^^ is a power of two. In this case ^^^^^^^^ operations can efficiently be implemented. Finally, one can obtain a randombinary OLE correlation from a random OT correlation, where the receiver holds ^^^, ^^^ ∈ Fଶ andthe sender holds ^^^,^^^ ∈ Fଶ such that ^^^ ^ ^^^ ൌ ^^^^^^. From a single random OT^^^^, ^^^^, ^^^, ^^^^, the parties can define ^^^ ൌ ^^, ^^^ ൌ lsb^^^^ ^ ^^^^, ^^^ ൌ ^^^^^^^^^^^, ^^^ ൌ^^^^^^^^^^^.B. Secret Sharing Based ^^ଷ → ^^ଶ Modulus Conversion

[0150] We now describe how to perform modulus conversion from ^^^^^^ଷ ∈ Fଷ^to^^^^^^ଷ ∈ Fଶ, where ^^ ൌ ^^ mod 2. For simplicity, let ^^ ൌ 1 and the inputs of the two parties^^^, ^^^ are shares ^^^^, ^^^^ such that ^^ ൌ ^^^^ଷ^^^. As the sender input in a 1-out-of-3 OT and ^^^will up ^^^^^^,^^^^, using ^^^as the receiver input. Looking ahead, we will actually want the to obtain shares of ^^^^^^,^^^^. To achieve this, ^^^ can simply choose a random ^^ ∈ ^0,1^and uses ^^^^^^, : ^ ⊕ ^^ as its input to the OT. By correctness, ^^^ will receive ^^^^^^, ^^^^ ⊕ ^^. Inparticular, let us assume the parties hold a 1-out-of-3 random bit OT, where ^^^holds randommessage bits ^^^, ^^^, ^^ଶ ∈ Fଶ while ^^^ holds a random choice ^^ ∈ Fଷ and the correspondingmessage ^^^. These will be used to mask the truth table ^^. That is, ^^^will sample mask ^^ andsend ^^ ∈ Fଷଷwhere ^^^ ൌ ^^^ ^ ^^^^^^, 0^ ^ ^^,^^^ ൌ ^^^ ^ ^^^^^^, 1^ ^ ^^,^^ଶ ൌ ^^ଶ ^ ^^^^^^, 2^ ^ ^^.^^^can therefore compute ^^^ ൌ ^^௨భ^ଷ ^^௪భ ൌ ^^^^^^,^^^^^ଷ^^ ൌ ^^^ mod 2^^ଷ^^and ^^^^^^ ⊕ ^^^ ൌ ^^^ mod 2^.

[0151] Reducing the communication. As an optimization, we may not send ^^^. The idea is thatif the receiver want to learn ^^^^^^, 0^, then they can set their share as ^^^. That is,^^^ ൌ if^^^^ ൌ 0^then ^^^ else ^^௨భ^ଷ^^௨భൌ ^^^,^ ⋅ଷ ^^௨భ ^ ^^௨భThe sender can now define ^^^^^^^^, 0^. In the case of ^^^ ൌ 0, wehave ^^^ ൌ ^^^, and ^^^ ൌ ^^ ^ ^^^^^^, 0^, and therefore we get the right result. The other cases arethe same with the randomness of the mask ^^ coming from ^^^.

[0152] Protocol. FIG.3 illustrates a process 300 for converting a modulus 3 vector to a modulus 2 vector, according to certain embodiments of the present disclosure. FIG.3 presentsprotocol in the 1-out-of-^^ OT hybrid, where we assume ^^ ^ 3. Below, we present how toimplement such OTs.

[0153] Theorem 4.1. The protocol Π^௧ିଷ→ଶି^^^௩, securely realizes the Fଷ → Fଶ modulusconversion functionality in the binary OLE hybrid model.

[0154] Proof. The simulation is to send uniformly random values. The case of a corrupt ^^^issimple, ^^^ acts as a one time pad key. Consider a corrupt ^^^. Observe that the ^^^, ^^^ values aremasked by two unknown messages. Since these message values are uniform in the view of ^^^, so are the ^^ values.

[0155] We give two conceptual methods for constructing random 1-out-of-3 OTs for single bit messages. The first is based on standard OT while the second is based on subfield VOLE.

[0156] From 1-out-of-2 OT. The generic method for constructing ^^-out-of-^^^^OTs is togenerate ^^ 1-out-of-2 OTs. The random message corresponding to ^^ ∈ ^^^^^^ will then be the hashof the messages indexed by the bit decomposition of ^^. However, given that only three messages are used by FIG.3, we present an optimized approach without additional hashing.

[0157] We can build a 1-out-of-3 OT for bit messages from binary OLE or equivalently 1-out- of-2 OT. Each 1-out-of-3 OT consumes 2 binary OLE / OT's. Recall that a binary OLE correlation is defined as a pair of tuples ^^^^,^^^^ and ^^^^,^^^^, held by ^^^and ^^^respectively, which satisfy^^^ ⊕ ^^^ ൌ ^^^ ⋅ ^^^. An OLE can be obtained from standard random OT as discussed in SectionIV(A). It is possible to partially derandomize an OLE correlation by allowing ^^^to change their ^^^to be a chosen value, ^^^∗. The parties will now hold correlation ^^^′^ᇱ^^′ᇱ^ᇱ^^′^ᇱ^^^∗^ where^^′^ᇱ, ^^′^ᇱ, ^^′^ᇱ are random and ^^^∗is chosen by ^^^. A random binary OLE correlation can beconverted into a chosen one if ^^^ sends ^^ ൌ ^^^^ ⊕ ^^^∗^, and the parties updates their share as^^′^ᇱ ൌ ^^^ ⊕ ^^^ ⋅ ^^,^^′^ᇱ ൌ ^^^, ^^′^ᇱ ൌ ^^^. We will derandomize two OLEs using ^^^'s ^^^ ∈ Fଷ.This value is represented using two bits ^^^^,^,^^^,^^ such that ^^^ = ^^^,^^ଷ2 ⋅ଷ ^^^,^.us definethe resulting OLEs as ^^^^, ^^^, ^^^,^^^,^^, ^^^′^, ^^′^, ^^′^, ^^^,^^. We will define the random 1-out-of-3OT messages (in this case single bits) as^^^ ൌ ^^^ ⊕ ^^′^ᇱ^^^ ൌ ^^^ ⊕ ^^^ ⊕ ^^′^ᇱ^^ଶ ൌ ^^^ ⊕ ^^′^ᇱ ⊕ ^^′^ᇱ

[0158] From Subfield VOLE. We observe that it is possible to further optimize the modulus conversion protocol by leveraging the capabilities of subfield VOLE. The rational for using binary OLE is that one can efficiently generate this correlation from highly optimized 1-out-of-2 silent OT protocols. However, such protocols can also directly generate 1-out-of-^^ OTs by first constructing a ^^^^^,^^^^^^^ subfield VOLE and then hashing the extension field elements. For ouruse case, a choice would be to set ^^ ൌ ^^ and ^^ such that ^^^^ ^ ^^^^. This would in turn allow thederandomization message of consist of a single ^^^^element, resulting in a total of 3.58 bits of communication instead of 4. However, this comes at a high cost due to using the Silent VOLE protocol using a modulus that is not CPU friendly. One would optimize subfield VOLE using bit decomposition techniques but the computation cost will likely remain high, e.g.5 times slower by our estimates. As such, we do not think this communication optimization is worth the computation pessimization. We suggest an alternatively that essentially halves the computational cost of the already optimized OLE protocol while retaining the same communication overhead of4 bits. The idea is relatively simple, set ^^ ൌ ^^ and ^^ ൌ ^^ / ^^. Since ^^^^ operations naturally mapto CPU instructions (due to it being a power of two), one can naturally implement a ^^^^^,^^^^^^^- subfield VOLE with essentially the same overhead as ^^^^^,^^^^^^^-subfield VOLE used to generate the binary OLEs. By directly using subfield ^^^^to perform ^^ modulus conversions, only ^^ subfield VOLE correlations may be used instead of ^^^^ OTs and therefore the preprocessing cost is halved.

[0159] Concurrent work. We would like to point out the concurrent work [IKNZ23] for constructing Fଷto Fଶconversion protocols in the OT hybrid model. Their optimized construction showed that they can generate a modulus conversion preprocessing pair^^^^^^^ଶ, ^^^^^^ଷ^ using an amortized 1.33 OLEs / OTs and 3.08 bits of communication, or at the costof 18 OLEs / OTs and 2.55 bits. This pair can then be used to derandomized to convert ^^^^^^ଷinto^^^^^^ଶ using an additional 1.58 ൌ logଶ^3^ bits of communication, totaling 4.66 or 4.13 bits permodulus conversion. Our techniques on the other hand may use two OLEs / OTs or one FସVOLE and only 4 bits of communication. Alternatively, one FଷVOLE and just 3.58 bits of communication. Although their construction can allow for fewer OLEs, e.g.1.33 versus 2, the surrounding protocol is more complicated and therefore it is not clear which would be moreefficient in practice. Moreover, our Fସapproach can be more efficient while sending less data. We leave determining the concrete cost of our communication optimized FଷെVOLE approach to future work. C. Secret Sharing Based ^^^ଷ,^^ଶ^-wPRF Protocol

[0160] Given that we aim to have secret shared output and binary sharings are standard, wechoose to begin with our ^Fଷ, Fଶ^-wPRF which outputs a vector over Fଶ. In addition, we willconsider the optimized variant where the key is binary. Following the analysis in Section (III)(E),we increase the input dimension to ^^ ൌ 4λ. In particular, we will evaluate^^^^^, ^^^ ൌ B ⋅ଶ ^A ⋅ଷ ^^^ ⊙ ^^^^where ^^ ∈ F^ ^ ^ൈଶ, ^^ ∈ F ^ଷ, A ∈ Fଷ , B ∈ Fଶ^ൈ௧.

[0101] We consider two primitives for building these protocols, oblivious transfer and garbled circuits. Our first protocol will only make use of the former while the latter will use both. In all cases we choose to optimize the overall overhead of the protocols in terms of computational, communication and round complexity. Where it does not add additional overheads, we will make use of a prepossessing phase. This primarily takes the form of generating oblivious transfer correlations which can later be used in the main protocol.

[0101] Reusable Key Correlations. Our first technique use oblivious transfer to multiply ^^ ⊙ ^^.This can be achieved by having the party holding ^^ act as the OT receiver with ^^^as their choice bit9. This choice allows us to perform these OTs ahead of time, once ^^ is fixed but before ^^ is known, and later reuse them for each input ^^. The OT sender will provide two messages,^^^^ , ^^^^ଷ^^^^, where ^^^ is sampled uniformly at random. Therefore the sender will learn ^^^ ൌ^^^^ଷ^^^^ ⋅ଷ ^^^^. Let us interpret ^^, ^^ as the individual shares of ^^^^^^ଷ where ^^ ൌ ^^ ⊙ଷ ^^. Giventhis F^ଷ sharing of ^^ ⊙ଷ ^^, the parties can locally multiply with the public matrix A ∈ Fଷ୫ൈ୬, i.e.^^^^^^ଷ:ൌ A ⋅ଷ ^^^^ ൌ A ⋅ଷ ^^^ ⊙ଷ ^^^.

[0101] Theorem 4.2. The protocol illustrated by FIG. 4 evaluates the ^Fଷ, Fଶ^-wPRF of Definition3.2 with semi-honest security in the Π୭^ିଷ→ଶିୡ୭୬^hybrid model where ^^^inputs the key k and ^^^inputs x and they receive ^^^^^^^, ^^^^^ as output.

[0101] FIG.4 illustrates a process 400 for evaluating a oblivious transfer-based weak PRF,according to certain embodiments of the present disclosure. Process 400 illustrates a ^Fଷ, Fଶ^-wPRF protocol based on OLE with plaintext inputs and secret-sharing output.

[0101] Proof. Consider a corrupt ^^^. Their view consists of the random OT strings ^^^,^^∈^0,1^ఒ,^^, ^^ ∈ Fଶൈ^ଶ , ^^ ∈ F^^ଷ and their view of Π୭^ିଷ→ଶିୡ୭୬^. The simulation will send uniformly random of these. Recall that ^^^knows either ^^^or ℎ^while the other is uniformly distributed being uniformly distributed. Therefore, over the random choices of^^^,^⊕^^, ^^ is distributed and independent of ^^. we invoke the simulator forNow consider a corrupt ^^^. Their view consists of the OT strings ^^, their view of The proof is complete by nothing that ^^ and Π୭^ିଷ→ଶିୡ୭୬^can be simulated.

[0101] Overheads. Assuming the setup phase is reused, the protocol consumes 2^^ random OT / OLE correlations. When generated using a silent OT protocol[BCG+19a, BCG+19B, RRT23], the amortized cost of the OTs is ^^^λ^ computation and less than one bit of communication. The main phase of the protocol derandomizes the OLEs using two bits ofcommunication and while sending ^^ଶ, ^^ଷ (two bits), totaling to a combined 2^^ ^ ^2^^ ^^^^logଶ^3^ bits. We also note the recent development of OT protocols with constant overhead by Boyle et al. [BCG+23] implies that our share conversion protocol can be evaluated in constantamortized work, independent of the security parameter λ. Moreover, if A, B are implementedusing linear time encodable codes, the overall running amortized time of our protocol is ^^^λ^ work per PRF evaluation. D. OT-Based ^^^ଶ,^^ଷ^-wPRF Protocol

[0161] We present an OT-based protocol in FIG. 5 for our ^Fଶ, Fଷ^-wPRF where the inputs areknown to the respective parties and the output is shared. FIG.5 illustrates a process 500 for evaluating an oblivious transfer-based weak PRF, according to certain embodiments of thepresent disclosure. Process 500 illustrates a ^Fଶ, Fଷ^-wPRF protocol based on OLE with plaintextinputs and secret sharing output.

[0162] This protocol achieves better computational efficiency of other protocols at the expense of having a mod 3 output domain. However, for applications such as an OPRF this has littleimpact. Conceptually, the protocol works in a similar way. First shares of ^^ ⋅ ^^ are computedusing (preprocessed) OTs based on the key. The parties additionally generate ^^ random OTs with strings in Fଷ. These are used to make the Fଶto Fଷmodulus conversion. Since the inputs are already binary, each mod gate may use only one m OT to two OLEs in the previous protocol. Inthe amortized setting, this protocol may use ^^ OTs, two rounds of interaction and 2.6^^ ^ ^^ bitsof communication per evaluation. To convert the secret sharing output protocol to an OPRF, an additional 1.6^^ bits of communication and zero additional rounds may be used / performed.

[0163] Theorem 4.3 The protocol of FIG. 5 evaluates the ^Fଷ, Fଶ^-wPRF of definition 3.2 withtwo-party semi-honest security in the random OLE / OT hybrid model where ^^^inputs the k and^^^ inputs x and they receive ^^^^^^^, ^^^^^ as output.to send uniformly random messages. Considera corrupt ^^^. Their view consists of ^^, ^^. The former is uniformly distributed given that eitherℎ^,^or ℎ^,^is uniformly distributed. The latter is uniformly distributed due to ^^ being uniform. Now consider a corrupt ^^^. Their view consists of ^^, which is uniformly distributed due to either ^^^,^or ^^^,^being uniformly distributed. The simulations of the output distribution trivially follows correctness of the protocol. E. Specialized Garbling

[0165] There are two main categories of concretely efficient MPC protocols, based on garbling (round optimal but large communication overhead) and based on linear secret sharing based (communication efficient but round complexity grows with the depth of the circuit). Garbling- based approaches typically have prohibitively high overheads making them impractical for most applications as also noted in [DGH+21]. Ideally, we want to design primitives that can be evaluated in just one round trip (e.g., a minimum requirement) using protocols based on linear secret sharing.

[0166] There has been a long line of work in this direction, with a focus on modifying existing symmetric key primitives to make them MPC-friendly [ARS+15, GRR+16, DEG+18, AGP+19, DGGK21, GØSW23]. Despite making progress towards MPC-friendliness, these constructions still suffer from a large communication overhead and / or large round complexity [BIP+18]. To understand the reason behind the unsatisfactory progress in constructing MPC-friendlysymmetric-key primitives, it helps to understand the high-level strategy underlying the cryptanalysis of symmetric key primitives. A popular approach is differential cryptanalysis [BS91] for block ciphers which analyses the effect that a change in the input has on the output. By making sufficiently many queries, one may be able to later distinguish the output from a uniformly random string. The depth of the function is correlated with the difficulty of building a distinguisher and low-depth functions are expected to be less secure, conflicting with the goal of MPC-friendliness.

[0167] We now describe a specialized garbling scheme[Yao86] for evaluating our wPRF. Wepresent this protocol only for the ^Fଶ, Fଷ^-wPRF but note that this can be generalized in a naturalway. The core idea is that we can utilize free XORr with specialized unary gates for performing the modulus conversion step. As before, the parties will preprocess OTs using the key as thechoice bit. ^^ ఒ^ will act as the garbler with Δ ← ^0,1^ being the global free-XOR key [KS08].Instead of garbling labels for x and k, ^^ will generate garbled labels ^^ ← ఒ^ ^ ^0,1^ where ^^^ is thezero label for ^^^ ⋅ ^^^. In particular, the parties will use the preprocessed OTs for k with messages^^^^ , ^^^ ⊕ ^^^Δ^. ^^^ will learn ^^′^ ൌ ^^^ ⊕ ^^^^^^^^Δ. ^^^,^^^ can multiply these labels with A torespectively. ^^^a unary gate that maps the zero label to a random^^^ ∈ Fଷ value while one label is mapped to ^^^^ଷ1. Unlike in traditional garbling, we desire theoutput of the mod gate to be a single Fଷelement and as such the garbled table can be much smaller. In particular, with the use of the point-and-permute technique the garbled table can be a single Fଷelement. We will restrict the free-XOR key Δ to have a 1 in its least significant bit. As such, the least significant bits of ^^^,^^′^ᇱwe have ^^^ ൌ ^^^^^^^^^^^ ⊕ ^^^^^^^^^′^ᇱ^ൌ ^^^^^^^^^^^ ⊕ ^^^^^^^^^^ ⊕ ^^^Δ^ൌ ^^^^^^^^^^^ ⊕ ^^^^^^^^^^^ ⊕ ^^^^^^^^^^Δ^

[0168] We wish to translate this secret sharing into an Fଷsharing with the same underlyingvalue. For now, let us assume that ^^^ knows ^^^ ൌ 0. ^^^ can define ^^^ ൌ െ^^^^^^^. If ^^^ has ^^′^ᇱ ൌ^^^, i.e. ^^^ ൌ 0, then they can also derive ^^^ whicha secretHowever, if ^^^holds the one label ^^′^ᇱ ൌ ^^^ ⊕ Δ, then they may need assistance to compute ^^^ ^ 1. This is doneby sending a garbled table containing the difference between ^^^ ^ 1 and ^^^^^′^ᇱ^. Lastly, it isimportant that ^^^does not know the underlying value. However, in the explanation above we assume ^^^can conditionally add the difference based on the underlying value. This can be circumvented using the point-and-permute technique. The full protocol is given in FIG.6.

[0169] FIG.6 illustrates a garbling-based process 600 for evaluating a weak PRF, according tocertain embodiments of the present disclosure. Process 600 illustrates a ^Fଶ, Fଷ^-wPRF protocolbased on garbling with plaintext inputs and secret sharing output.

[0170] The overhead of this protocol is ^^^^ ^ logଶ^3^^^ bits and may use no OTs after theinitial set of OTs for the key. Indeed, this makes conceptually sense due to the garbler not needing OTs for their input, i.e. x. We note that this protocol can easily be extended to the^Fଷ, Fଶ^-wPRF. First the free-XOR can be generalized to work over the Fଷഊ extension field asopposed to Fଶഊ, see [BMR16]. The unary gates can then consist of two 1-bit values.

[0171] Theorem 4.4 The protocol of FIG.6 evaluates the ^^^ଷ,^^ଶ^-wPRF of definition 3.2 with semi-honest security in the random oracle & random OT hybrid model where ^^^inputs the key kand ^^ inputs x and they receive ∗^ ^^^^^^^, ^^^^^ as output. We assume that ^^: ^0,1^ → ^^ଷ is arandom oracle.

[0172] Proof. The simulation of the protocol is to send uniformly random messages. The simulation follows the the standard free-XOR garbling argument. Essentially, a corrupt ^^^canonly distinguish if they query the random oracle at some input ^^′^ᇱ ⊕ Δ. If no such query ismade, the the simulator can replace all such queries with uniformly random values and then simulation follows immediately. Assuming the adversary makes such a query, then they have essentially guessed Δ. However, this can only happen with negligible probability. F. Protocol Evaluation

[0173] We implement our wPRF protocols for the OPRF setting as well as plaintext inputs and secret shared output. The protocols generate all correlated randomness via silenet OT techniques. We compare their performance to the alternating moduli protocol of [DGH+21] and our GMW- based implementation of LowMC [ARS+15]. Our LowMC implemention employs various optimizations such as transposed representation, vectorization, and precomputed key schedule. LowMC offers a variety of parameters that give tradeoffs between computational overhead,round complexity, and number of OTs / OLEs that are used. We parameterize it as^^^, ^^,^^, ^^, ^^^ ∈ ^^256,63,128,128,14^, ^128,3,128,128,88^^. Running times were obtained ona core i7 consumer-grade laptop with 16GB RAM. Each party is executed on a separate thread with network communication being simulated, i.e., minimal communication overhead. Given that our protocol is 2 rounds, one can easily estimate the cost of network communication by dividing the communication by the bandwidth plus network latency.

[0174] Protocols with the Key OT optimization perform a setup phase where OTs for each bit of the key are performed. This reusable correlated randomness allows the parties to computeshares of ^^^ ⊙ ^^^. Alternatively, our Input-OTs protocol for multiplying ^^^ ⊙ ^^^ may use moreOTs but less communication. We implement two version of our modulus conversion protocolΠ୭^ିଷ→ଶିୡ୭୬^ for the ^Fଷ, Fଶ^-wPRF protocol which uses ^^ Fସ-VOLE correlations or 2^^OT / OLE correlations. We refer to each as Fସ-VOLE and Fଶ-OLE respectively. The modulusconversion for ^Fଶ, Fଷ^-wPRF may use just ^^ OT / OLE correlations. The final protocol usesgarbling techniques to implement modulus conversion and may not use any additional OTs beyond the reusable OTs for the key.

[0175] FIG.7 illustrates a table 700 of metrics for certain embodiments using techniques described herein compared to previous works. We summarize comparison of our distributed wPRF protocols against other OPRF protocols. We consider the setting where multiple (adaptive) evaluations for a fixed key are performed. ^^ denotes the round complexity and ^ denotes that additional rounds are used to set up the protocols. Communication reports the end- to-end amortized communication (including any preprocessing) per evaluation in bits

[0176] OPRF. In FIG.7 we report the metrics for our protocol when used as an OPRF in comparison related works. We consider the setting where a succinct setup phase is performed. During this phase, the key is known but the evaluation points, i.e., x, are not. For [DGH+21] andour protocols in FIG. 7, we separate the preprocessing ^^ and online ^^ metrics as ^^ ^ ^^.

[0177] An efficient protocol is our OT base ^Fଶ, Fଷ^-wPRF protocol (e.g., illustrated by FIG.5) with the input-OTs optimization. It may span 7.0 microseconds per amortized evaluation and a total of two rounds, including the preprocessing. Excluding the succinct setup phase (7.0^^^^ & 38bits), the amortized communication cost is 916 ൌ ^^ ^ ^^ ^ ^^^ ^ ^^^logଶ^3^ bits and 0.4^^^^ for^^^, ^^, ^^^ ൌ ^4λ, 2λ, λ / logଶ^3^^ and λൌ 128, see Section III(E). This protocol may use ^^ ^ ^^OLE / OTs per evaluation which form the dominant computational cost, 7.0^^^^ compared to 0.4^^^^ of online time. The prior protocol [DGH+21] based on alternating moduli may use an amortizedtotal of 32.9^^^^ and 1,317 bits of communication, a 3.7 ൈ and 1.4 ൈ improvement. Due to a lackof implementation, for their online time we use their reported plaintext running time of 6.1^^^^ [DGH+21], however, our implementation technique would likely lower this closer to our 0.4^^^^. Regardless, the bulk of the running time improvement comes from our protocol being capable of using fewer OTs. Moreover, our 128 input OTs are of 4 bit strings while [DGH+21] uses 256OTs of 256 bit strings. When properly implemented, this results in an almost 256 / 4 ൌ 64 ൈfaster OT generation due multiplying smaller vectors with the syndrome decoding matrix. The lowest communication OPRF protocol is based on DDH [Mea86]. It is extremely communication-efficient, possibly using just two curve elements to be sent. However, DDH is insecure in the post-quantum setting and, unlike ours, does not lend itself to secret shared output. Moreover, it may use an order of magnitude more time which makes it less attractive when performing many evaluations. However, for a single evaluation DDH [Mea86] remains the bestoption. We also consider our ^Fଷ, Fଶ^-wPRF but observe that the communication overhead areworse than our ^Fଶ, Fଷ^-wPRF while it remains competitive in terms of computation when ସ-VOLE is used. The communication overhead is due to disproportionately larger parameters and the mod operation being less efficient. Finally, we consider the garbling based protocol of FIG. 6. This protocol has the interesting advantage that it only uses OT correlations in the setup phase where the key is set. In particular, one OT per bit of the key is performed. All subsequent evaluations of the protocol can be implemented with only calls to the random oracle. The advantage of this is highlighted when only a small number of evaluations are performed. In this regime the sublinear OT protocols have relatively high computational / communication overheaddue to the hidden constants. The communication overhead of this protocol is 2^ହ ൌ λ^^ ^ ^^^ ^^^^logଶ^3^.

[0104] OPRF with Shared Output. For this analysis we will continue to assume ^^ is known to oneparty while ^^ is known to the other. The parties will receive a secret sharing of ^^^^^, ^^^. Wereport our findings in FIG.8. As above, we divide the running time of the protocol into the time to generate the OT correlations and the online time. As can be seen in FIG.8, the main cost is OT generation, requiring between 15 to 30 times more time than the online phase.

[0178] FIG.8 illustrates a table 800 of metrics for certain embodiments using techniques described herein compared to previous works. FIG.8 includes a comparison of our distributedwPRF protocols with secret shared output against LowMC [ARS+15] when performing ^^ ൌ 2ଶ^concurrent evaluations. r denotes the round complexity excluding a reusable setup. Times reported are amortized per evaluation.றdenotes estimated running time.

[0179] As with the OPRF performance numbers, we observe that our ^Fଶ, Fଷ^-wPRF with theinput-OTs optimization performs the best, may use a total of 7.97^^^^ and just 38 ^ 790 bits ofonline communication, where the 38 bits of communication is for the OT generation. A nextefficient protocol is also our ^Fଶ, Fଷ^-wPRF but with the Key-OT optimization which mayreduce the number of OTs used at the expense of more communication. However, despite bveing capable of using 50% fewer OTs, we observe a minimal decrease in running time. This is because the input-OT optimization makes use of a VOLE correlation for short strings, i.e., 4 bits, while OT / OLE is capable of generation of a VOLE correlation for 128 bit strings. When properlyimplemented, this essentially translates to a 128 / 4 ൌ 32 ൈ improvement in running time for thematrix multiply step in the VOLE protocol, which is the main overhead. As a result, wegenerally suggest only using the Input-OT optimization for the ^Fଶ, Fଷ^-wPRF. However, amajor drawback of the ^Fଶ, Fଷ^-wPRF with secret shared output is that the output shares andvalues are mod 3. This is highly non-standard and if shared output is desired, more post processing may be performed. A more natural (and efficient) option is for the wPRF to naivelyoutput the desired share format, e.g., ^Fଷ, Fଶ^-wPRF. We only implement this protocol with theKey-OT optimization. The protocol may use 0.4^^^^ and between 7 to 14^^^^ of online and OT generation time, respectively. The protocol may use 1,151 bits of online communication and 52 bits for OT generation. One could consider using the Input-OT optimization to lower the communication overhead but this may result in implementing FଷSilent OT / VOLE which hashigher computational cost, approximately 5 ൈ by our estimates. Compared to [DGH+21], ourprotocols perform better in communication, running time, and the number of OTs used. When compared to LowMC [ARS+15], our online phase is between 7 and 13 times faster. When profiling both implementations, we observe that almost all of the time is spent in the matrix- vector multiplication routine. Given that [ARS+15] may perform many more such multiplications, it follows that their running time should be worse. Additionally, their protocolmay use substantially more OTs / OLEs, a factor between 20 and 3 times depending on the parameters used.

[0180] When compared to the prior alternating-moduli wPRF of [DGH+21], our embodiments are capanble of being an order of magnitude faster, due in part to the implementation and the structure of the new wPRF. Compared to commonly used LowMC construction, we observe that our protocols can have far fewer rounds of interaction (2 vs.14 to 88) and are 3 to 20 times faster. Indeed, even compared to DDH-based OPRF protocols, our protocols can be an order of magnitude faster and may perform only slightly more communication. Concretely, our fastest protocol may use just 2 rounds, 7.7 microseconds, and 100 bytes of communication in the amortized setting. V. POST-QUANTUM SIGNATURE

[0181] Embodiments described herein may implement the protocols described with respect to FIGS.9-17. The Embodiments may use a prover computing system and a verifier computing system to authenticate a prover computing system. The protocols may be more secure against attack from a quantum computing system compared to previously known techniques. A. Method for Authenticated Communication

[0182] As described above, a system (e.g., system 100) for performing authenticated communication of a message may include a verifier computing system 106 configured to authenticate a message transmitted by a prover computing system 104. FIGS.9-10 illustrate a flow diagram 900 for operations performed by a system, according to certain embodiments of the present disclosure. Steps S916, S928, and 944 are briefly described, while further descriptions are provided at least with respect to FIGS.11 (Pre-Processing Phase subsection), 12 (MPC protocol subsection), and 13 (Verification by Verifier Computer System Subsection), respectively.

[0183] At step S902, the prover computing system 104 may generate a vector x. Vector x may include binary values. The vector x may be stored by the prover computing system 104 and may remain private and used as a signing private key. The vector x may be used by the provercomputing system 104 to generate digital signatures (e.g., signing messages transmitted to the verifier computing system 106).

[0184] At step S904, the prover computing system 104 may obtain a public matrix A. The public matrix A may be received from memory of the prover computing system 104, received from another computing system (e.g., the verifier computing system 106), or generated by the prover computing system 104. The public matrix A may include a first plurality of elements / values. The first plurality of values may be sampled from a first distribution. The first distribution may include a uniform distribution or a pseudo random distribution. The public matrix A may have values mod M, where M is a first prime number. In certain embodiments, the first prime number is 2 (e.g., the public matrix A may be a matrix of binary values) or 3.

[0185] At step S906, the prover computing system 104 may obtain a public matrix B. The public matrix B may be received from memory of the prover computing system 104, received from another computing system (e.g., the verifier computing system 106), or generated by the prover computing system 104. The public matrix B may include a second plurality of elements / values. The second plurality of values may be sampled from a second distribution. The second distribution may include a uniform distribution or a pseudo random distribution. The public matrix B may have values mod K, where K is a second prime number. In certain embodiments, the second prime number is 2 or 3 (e.g., the public matrix B may be a matrix of ternary values). The second prime number may be a different prime number from the first prime number.

[0186] At step S908, the prover computing system 104 may obtain a public vector y. The public vector y may be received from memory of the prover computing system 104, received from another computing system (e.g., the verifier computing system 106), or generated by the prover computing system 104. Public vector y may have been generated by the prover computing system 104 using the vector x. Public vector y may have been generated using the public matrix A and public matrix B. The product of the public matrix B and the public matrix A may have been used as a one way function with vector x to generate public vector y (e.g., as described above with respect to FIG.2). For example, public vector y may be equivalent to B(Ax).

[0187] At step S910, the verifier computing system 106 may obtain the public matrix A. The public matrix A may be received from memory of the prover computing system 104, receivedfrom another computing system (e.g., the prover computing system 104), or generated by the verifier computing system 106.

[0188] At step S912, the verifier computing system 106 may obtain the public matrix B. The public matrix B may be received from memory of the prover computing system 104, received from another computing system (e.g., the prover computing system 104), or generated by the verifier computing system 106.

[0189] At step S914, the verifier computing system 106 may obtain the public vector y. The public vector y may be received from memory of the verifier computing system 106 or received from another computing system (e.g., the prover computing system 104). The public vector y may have been generated by the prover computing system 104 as described above (e.g., in step S908).

[0190] At step S916, the prover computing system 104 may compute a local set of [x] vectors, a local set of [t] vectors, and a local set of [s] vectors. A number N of vectors in each of the local set of [x], [s], and [t] vectors may be equivalent to a number of parties in an emulated MPC protocol. In certain embodiments the number N of vectors in each of the local set of [x], [s], and [t] vectors may be hundreds or thousands of vectors. The local set of [x] vectors, local set of [t] vectors, and local set of [s] vectors may be computed based on a seed and / or a portion of the seed.

[0191] The local set of [x] vectors may include N [x] vectors that combine to a value of the vector x. Local [x] vectors included in the local set of [x] vectors may include values mod M. The combination may include a concatenation, an XOR, or an addition of the values.

[0192] The local set of [t] vectors may include N [t] vectors that combine to a value of a vector s. Local [t] vectors included in the local set of [t] vectors may include values mod K. The combination may include a concatenation, an XOR, or an addition of the values. Vector s may be a random vector, computed using a random seed, and / or computed using a combination of random vectors.

[0193] The local set of [s] vectors may include N [s] vectors that combine to a value of the vector s. Local [s] vectors included in the local set of [s] vectors may include values mod M. The combination may include a concatenation, an XOR, or an addition of the values.

[0194] The local set of [x] vectors, local set of [t] vectors, and local set of [s] vectors may be computed using a process performed during a preprocessing phase as described with respect to FIG.11.

[0195] At step S918, a first set of state vectors may be computed by the prover computing system 104. The first set of state vectors may include a subset of state vectors and an additional state vector. The subset of state vectors may include N-1 state vectors. A respective state vector included in the subset of state vectors may be equivalent to the value of a seed portion (e.g., a portion of the seed). The seed may include N number of vectors. The additional state vector may be computed to include a local [x] vector value (e.g., an Nth local [x] vector value) that corresponds to the additional state vector, a local [t] vector value (e.g., an Nth local [t] vector value) that corresponds to the additional state vector, and a seed portion that corresponds to a portion (e.g., an Nth portion) of the seed not used to compute the subset of state vectors.

[0196] Respective state vectors in the set of state vectors may be computed using a respective local [s] vector, respective local [x] vector, and respective local [t] vector. A respective state vector (e.g., N-1 state vectors) may be computed to include a respective local seed vector (e.g., a respective portion of the seed vector). An additional state vector (e.g., an Nth state vector) may be computed using N-1 respective local [x] vectors, local [t] vectors, and local [s] vectors, and a Nth local [s] vector generated from a pseudorandom share) The N-1 respective local [x], [s], and [t] vectors may have been computed using the corresponding respective seed portions and a function (e.g., hash function). Generating state vectors is described in more detail herein, such as with respect to FIG.11..

[0197] At step S920, a first set of commitments may be computed by the prover computing system 104. The first set of commitments may be computed using the set of state vectors. Each respective commitment included in the first set of commitments may be generated using a respective (e.g., at a corresponding position) state vector. The commitment may prevent the prover computing system 104 from changing the state vector values. In certain embodiments, the commitment is computed using a hash function that receives the state vector as input. In certain embodiments, some randomness may also be input into the hash function with the state vector to compute the respective commitment in the first set of commitments. Each respective commitment may be of size 2λ bits.

[0198] At step S922, the prover computing system 104 may compute a first hash value h. The first hash value h may be computed using the first set of commitments. The first set of commitments may be used as input to the first hash function to generate the first hash value h. The first hash value h may be of size 2λ bits.

[0199] At step S924, the prover computing system 104 may transmit the first hash value h to the verifier computing system 106. The verifier computing system 106 may store the first hash value h to be used for verification operations (e.g., described below).

[0200] At step S926, the prover computing system 104 may obtain a permutation π. The permutation π may be generated by the prover computing system 104, retrieved from memory of the prover computing system 104, or received from another computing system (e.g., verifier computing system 106). The permutation π may be generated by inputting the first hash value h into a hash function. The hash function may be the same or different hash function as another hash function used herein. The permutation π may be generated by inputting a combination of the first hash value h and a message signed using the vector x into the hash function. The permutation π may be uniformly random.

[0201] In certain embodiments, the verifier computing system 106 obtains the permutation π. The permutation π may be generated by the verifier computing system 106, retrieved from memory of the verifier computing system 106, or received from another computing system (e.g., prover computing system 104). The permutation π may be generated as described above with respect to step S926. The verifier computing system 106 may transmit the permutation π to the prover computing system 104 after generating the permutation π.

[0202] At step S928, the prover computing system 104 may compute a set of message vectors (e.g., intermediate wire / vector values). Computing message vectors may be performed using values obtained (e.g., computed) above. Computing the message vectors can use the permutation π to make it unlikely that the prover computer system can act maliciously. The message vectors may be obtained by emulating execution of an MPC protocol. Computations for computing the set of message vectors is describe below in more detail with respect to FIG.12.

[0203] After the MPC protocol is emulated by the prover computing system 104, the prover computing system 104 may commit to the message vectors. Committing to the message vectorscan increase the likelihood that the prover computing system 104 is not able to act maliciously. At step S930, the prover computing system 104 may commit to the message vectors computed at step S928. The commitment may be performed like the commitment described above. The commitment may be performed by inputting the set of message vectors into a hash function to compute a second hash value h'. The hash function may be a same or different hash function as used in other steps of flow diagram 900.

[0204] At step S932, the prover computing system 104 may transmit the second hash value h' to the verifier computing system 106. The verifier computing system 106 may store the second hash value h' to be used for verification operations (e.g., described below).

[0205] At step S934, the prover computing system 104 may transmit a set of a first portion of local [z] vectors, [z](1), to the verifier computing system 106. The [z](1)vectors may include a portion of respective local [z] vectors (e.g., a portion of the local [z] vectors included in the local [z] vector, a portion of the bits included in vector [z]). The [z](1)vectors may include a first portion of N local [z] vectors. The set of local [z](1)vectors may include a number of entries computed as a function of the dimensions of matrix A and / or matrix B. The set of local [z] vectors may include a portion of the local [z] vector and include C elements. C may be determined as a function of the size of public matrix A and / or public matrix B. C may be equivalent to a first dimension (e.g., a number of rows) of the public matrix A minus a first dimension of public matrix B (e.g., a number of rows).

[0206] The verifier computing system 106 may determine a number (e.g., all but one of N commitments) of commitments to open. Opening a commitment can include the prover computing system 104 transmitting a subset (e.g., all but one) of the state vectors used to generate the first set of commitments to the verifier computing system 106.

[0207] At step S936, the verifier computing system 106 may determine commitments to open (e.g., determine state vectors to request from the prover computing system 104). The verifier may determine the commitments to open by choosing a subset of commitments included in the first set of commitments to open. The subset includes fewer commitments than the number of commitments included in the first set of commitments computed by the prover computing system 104 at step S920. In certain embodiments, the subset includes all but one of the commitments computed by the prover computing system 104 at step S920. The verifier computing system 106may determine a commitment to open by choosing a random number. The number may correspond to a commitment not to open (e.g., an index of the commitment included in the first set of commitment).

[0208] At step S938, the verifier computing system 106 may transmit an indication of the commitment not to open to the prover computing system 104. In certain embodiments, the verifier computing system 106 may transmit to the prover computing system 104 an indication of the subset of commitments to open that are included in the first set of commitments. The indication may include a request for state vectors corresponding to the commitments.

[0209] A person having ordinary skill in the art with the benefit of the present disclosure would recognize other ways in which an index of a commitment to open (e.g., state vectors to receive) can be determined and then indicated to the prover computing system 104.

[0210] The prover computing system 104 may open requested commitments (e.g., transmit the state vectors used to generate the requested commitments to the verifier computing system 106) from the first set of commitments. Further, the prover computing system 104 may transmit an unopened commitment (e.g., hash value of a respective state vector (e.g., including a respective local [x] vector, a respective local [s] vector, and a respective local [t] vector) not included in the state vectors transmitted to the verifier computing system 106) to the verifier computing system 106. By transmitting a subset of the state vectors (e.g., opening a subset of commitments) and a unopened commitment to the verifier computing system 106, the verifier computing system 106 is enabled to authenticate the prover computer system while secrecy of the private x vector is maintained.

[0211] At step S940, after prover computing system 104 receives the indication from the verifier computing system 106 that indicates the commitments to open (e.g., the state vectors to transmit to the verifier computing system 106), the prover computing system 104 may transmit the subset (e.g., including the requested state vectors) of the set of state vectors to the verifier computing system 106.

[0212] At step S942, after prover computing system 104 receives the indication from the verifier computing system 106 that indicates the commitments to not open (e.g., the state vector not to transmit to the verifier computing system 106), the prover computing system 104 maytransmit an unopened commitment as indicated from the set of commitments to the verifier computing system 106.

[0213] At step S944, the verifier computing system 106 may use the public matrix A obtained at step S910, the public matrix B obtained at step S912, the permutation π (e.g., obtained as described above), the public vector y obtained at step S914, the first hash value h received at step S924, the second hash value h' received at step S932, the z(1)vectors received at step S934, the opened commitments (e.g., the state vectors) received at step S940, and the unopened commitment received at step S942, to authenticate the prover computer system. Computations of the verifier computing system 106 are described in further detail herein (e.g., with respect to FIGS.13, 14, and 16). 1. Pre-Processing Phase

[0214] FIG.11 illustrates a method performed by a prover computing system (e.g., prover computing system 104) during a preprocessing phase, according to certain embodiments of the present disclosure. The computations may be used to generate the number N of vectors in each of the local set of [x], [s], and [t] vectors described above (e.g., with respect to FIG.9). Method 1100 corresponds to step S916 performed for FIGS.9 and 10. The computations may be used to compute an additional state vector described above (e.g., with respect to FIG.9).

[0215] At step S1102, a random seed may be sampled. The seed may be sampled from a distribution such as a uniform distribution, a normal distribution, or another distribution.

[0216] At step S1104, the random seed may be used to compute a set of N-1 (e.g., N, as described above with respect to FIG, 9) seed portions. Seed portions may be a portion of the seed or computed using a function with the seed as input. In certain embodiments, seed portions may be computed by using the random seed as a root of a depth-log N GGM-PRF [GGM84]. GGM- PRF can enable a reduced size of a signature generated by the prover computing system.

[0217] At step S1106, for each of the seed portions in the set of seed portions, the respective seed portion may be expanded. Expanding the respective seed portion may be performed by inputting the respective seed portion into a hash function. The output of the hash function may include a local [x] vector, a local [s] vector, and a local [t] vector. The local [x] vector, local [s] vector, and local [t] vector may be portions (e.g., separate portions) of the output of the hashfunction. After generating a respective subset of local [x] vectors, a respective subset of local [s] vectors, and a respective subset of local [t] vectors using the respective seed portions, the number of the respective local [x] vectors, the respective local [s] vectors, and respective local [t] vectors may each be equivalent to the number of seed portions in the set of seed portions.

[0218] At step S1108, an additional local [x] vector, an additional local [s] vector, and an additional local [t] vector may be computed. The additional local [x] vector may be computed such that the additional local [x] vector and each of the subset of local [x] vectors combine (e.g., using an XOR operation) to the x vector. The additional local [s] vector may be a pseudorandom share. The additional local [s] vector may be combined (e.g., using an XOR operation) with each of the subset of local [s] vectors to compute an s vector. The additional local [t] vector may be computed such that the additional local [t] vector equals: the s vector minus the combination of all the subset of local [t] vectors mod K (e.g., 3). The additional state vector may be computed using the additional local [x] vector, the additional local [t] vector, and the seed portion not used to generate the local vectors at step S1106 (e.g., an Nth seed portion).

[0219] At step S1110, after performing steps S1106 and 1108, the local set of [x] vectors may be computed to include the subset of local [x] vectors and the additional local [x] vector. Additionally, the local set of [s] vectors may be computed to include the subset of local [s] vectors and the additional local [s] vector. Further, the local set of [t] vectors may be computed to include the subset of local [t] vectors and the additional [t] vector. The set of state vectors may be computed to include state vectors equivalent to N-1 seed portions and the additional seed portion.

[0220] Each of the local set of [x] vectors, local set of [s] vectors, and local set of [t] vectors may be ordered such that the index / position of each value correspond to the index / position of values in the local sets of vectors generated using the same seed portion. For example, a first seed portion may be used to generate a first local vector [x], first local vector [s], and first local vector [t] and a second seed portion may be used to generate a second local vector [s], second local vector [s], and second local vector [t]. In the example, the first seed portion, first local vector [x], first local vector [s], and first local vector [t] may be at a first index of their respective set of seed portion, local [x] vectors, local [s] vectors, and local [t] vectors, respectively. In the example, the second seed portion, second local vector [x], second local vector [s], and secondlocal vector [t] may be at a second index of their respective set of seed portions, local [x] vectors, local [s] vectors, and local [t] vectors, respectively. 2. MPC Protocol

[0221] FIG.12 illustrates a method 1200 performed by a prover computing system (e.g., prover computing system 104) emulating an MPC protocol, according to certain embodiments of the present disclosure. The computations may be used to generate the set of message vectors. The set of message vectors may include N (e.g., as described above) message vectors. Each message vector in the set of message vectors may include a local [z] vector and a local [y] vector. Vectors computed as part of the MPC protocol may be referred to as intermediate vector / wire values. Method 1200 corresponds to step S928 performed for FIGS.9 and 10.

[0222] Computations 1200 to compute respective local [v] vectors, local [z] vectors, local [v'] vectors, and local [y] vectors may be performed N respective times to compute the N message vectors. For example, using a local [x] vector at a first index of the set of local [x] vectors, a local [t] vector at a second index corresponding to the first index of the set of local [t] vectors, and a local [s] vector at a third index corresponding to the first index of the set of local [s] vectors may be used to compute a local message vector. As a further example, a vector at index zero in the set of local [x] vectors, the set of local [s] vectors, and local [t] vectors may be used to generate a message vector at the index of zero in the set of message vectors. Respective message vectors may be computed for each index in the set of local [x] vectors, the set of local [s] vectors, and local [t] vectors.

[0223] At step S1202, the prover computing system may compute a respective local [v] vector. The respective local [v] vector may be computed by applying the public matrix A to a respective / corresponding local [x] vector. The respective local [v] vector may be equivalent to the result of A[x].

[0224] At step S1204, the prover computing system may compute a respective local [z] vector. The respective local [z] vector may be computed using the respective local [v] vector computed in step S1202, the permutation π, and the respective local [s] vector. The permutation π may be applied to the respective local [s] vector such that the order of bits included in the respective local [s] vector are rearranged according to the permutation π. In certain embodiments, therespective local [z] vector may be equivalent to [v] ⊕ [π(s)]. As described above, step S1204 may be performed N times to compute N respective local [z] vectors using respective local [v] vectors and respective local [s] vectors.

[0225] At step S1206, the N respective local [z] vectors may be combined (e.g., using addition, using XOR operations) by the prover computing system to compute a z vector.

[0226] At step S1208, the prover computing system may compute respective local [v'] vectors. The respective local [v'] vectors may be referred to as respective converted local [v'] vectors because the respective local [v'] vectors can be computed by converting respective local [v] vectors from mod M to mod K using the permutation π. Computing a respective local [v'] vector may include applying the permutation π to the respective local [t] vector. The permutation π may be applied to the respective local [t] vector such that the order of bits included in the respective local [t] vector are rearranged according to the permutation π. The respective local [v'] vector may be equivalent to z + (1 − 2z) ⊙ [π(t)] mod K (e.g., 3).

[0227] At step S1210, the prover computing system may compute respective local [y] vectors. The respective local [y] vectors may be mod K (e.g., 3). Each respective local [y] vector may be computed by applying the public matrix B to the respective (e.g., corresponding) local [v'] vector. Each respective local [y] vector may be equivalent to B[y] mod K.

[0228] At step S1212, the prover computing system may compute each respective message vector. Each respective message vector may use the respective [z] vector and the respective [y] vector. A respective message vector may include the respective [z] vector and the respective [y] vector. For example, the respective [z] vector and the respective [y] vector may be concatenated together to. 3. Verification by Verifier Computing System

[0229] FIG.13 illustrates a method 1300 performed by a verifier computing system (e.g., verifier computing system 106) to verify a signature (e.g., a signature of prover computing system 104), according to certain embodiments of the present disclosure. Method 1300 corresponds to step S944 performed for FIGS.9 and 10.

[0230] At step S1302, the verifier computing system can use the state vectors received from the prover computing system (e.g., at step S940) to compute a second set of commitments. The second set of commitments may be computed using the same hash function that was used by the prover computing system to compute the first set of commitments (e.g., at step S920). Additionally, the second set of commitments may have the unopened commitments received from the prover computing system (e.g., at step S942) added to the second set of commitments so that the second set of commitments includes N commitments (e.g., is the same size as the first set of commitments). The second set of commitments may be ordered the same as the first set of commitments.

[0231] At step S1304, the second set of commitments may be input into the first hash function (e.g., the first hash function used at step S922) to generate a third hash value.

[0232] At step S1306, the verifier computing system can compare the first hash value h to the third hash value generated at step S1302. If the hash values are not equivalent (e.g., do not match), the verifier computing system may determine the prover computing system is not authenticated. If the hash values are equivalent (e.g., match) then the verifier computing system may evaluate other conditions (e.g., described below) to determine whether the prover computing system is authenticated.

[0233] At step S1308, the verifier computing system may obtain respective local [x] vectors, local [s] vectors, and respective local [t] vectors for respective state vectors. For example, each state vector may include a combination (e.g., concatenation) of a respective local [x] vector, local [s] vector, and local [t] vector, thereby enabling the verifier computing system to obtain the respective vectors from the state vector. The verifier may obtain N-1 local [x] vectors, [s] vectors, and [t] vectors from N-1 state vectors.

[0234] At step S1310, steps S1312-1324 may be performed for each respective local [x] vector, local [s] vector, and local [t] vector obtained from a state vector. Steps S1312-1324 may be performed as many times as there are parties in the prover computing system’s emulated MPC. Each time, local vectors corresponding to the parties may be used to perform computations.

[0235] At step S1312, the verifier computing system may compute the local [v] vector. The local [v] vector may be computed using the public matrix A and the local [x] vector. The local [v] vector may be computed by performing A[x]. The local [v] vector may be equivalent to the local [v] vector computed by the prover computing system computed at step S1202.

[0236] At step S1314, the verifier computing system may compute the local [z] vector. The local [z] vector may be computed using the permutation π, the local [v] vector, and the local [s] vector. The local [z] vector may be computed by performing [v] ⊕ [π(s)]. The local [z] vector may be equivalent to the local [z] vector computed by the prover computing system computed at step S1204.

[0237] At step S1316, the verifier computing system may compute a second local [v''] vector. The second local [v''] vector may be computed using the permutation π, the local [t] vector, and at least a portion of the local [z] vector. A first portion of the local [z] vector may be used and may be referred to as a local [z](1)vector. Local [z](1)vectors have been described above. Local [z](1)vectors may include a first portion of a corresponding local [z] vector. The first portion may be of size C (e.g., including the first C entries of the local [z] vector). C may be determined as a function of the size of public matrix A and / or public matrix B. C may be equivalent to a first dimension of the public matrix A (e.g., a number of rows) minus a first dimension of public matrix B (e.g., a number of rows). A first portion of the local [t] vector may be used to compute the second local [v''] vector. The first portion of the local [t] vector (also referred to as local [t](1)vectors) may be of size C (e.g., the first C entries of local [t] vector are included in the first portion of the local [t] vector). The second portion of the local [t] vector may be referred to as local [t](2)vectors. Local [t](2)vectors may include a number of elements equivalent to the first dimensions of public matrix B. Local [t](2)vectors may include elements not included in the respective local [t](1)vectors but that are included in the local [t] vectors (e.g., a last number of elements in the respective local [t] vector not included in the first portion of the local [t] vector). The second local [v''] vector may be computed by performing [z](1)+ (1-2[z](1)) ⊙ [π(t)(1)] mod K (e.g., 3). The second local [v''] vector may include a first portion of a respective local [v] vector. The first portion may be of size C. The first portion of the local [v] vector and a second portion of a local [v] vector may combine (e.g., concatenate) to equal the respective local [v] vector. The first portion of the local [v] vector may be referred to as a local [v](1)vector.

[0238] At step S1318, the verifier computing system may compute a third local [v'''] vector. The third local [v'''] vector may be computed using the public vector y, the second local [v'']vector, and portion of public matrix B, which may be referred to as ^^^. ^^^ may include elementsincluded in the public matrix B. ^^^ may include a number of rows equivalent to the firstdimension of public matrix B (e.g., the number of rows in public matrix B). ^^^ may include anumber of columns equivalent to the first dimension of public matrix A (e.g., a number of rows) minus the first dimension of public matrix B (e.g., a number of rows). The third local [v'''] vector may be computed by performing y – ^^^[v''] mod K (e.g., 3). The third local [v'''] vector may be of a size equivalent to a first dimension of public matrix B (e.g., a number of rows). The third local [v'''] vector may be referred to as the second portion of the local [v] vector or [v](2). The second local [v''] vector and third local [v'''] vector may be used to determine a local [v] vector. The third local [v'''] vector may include a last number of elements from the local [v] vector. The last number of elements may have a count equivalent to the first dimension of the public matrix B (e.g., a number of rows).

[0239] At step S1320, the verifier computing system may compute a [z](2)vector. The [z](2)vector may be computed using the third local [v'''] vector, the permutation π, and the local [t] vector. A second portion of the local [t] vector may be used to compute the local [z](2)vector. The second portion of the local [t] vector may be referred to as [t](2). The second portion of the local [t] vector may be of a size determined as a function of the size of public matrix A and / or public matrix B. The second portion of the local [t] vector may be of a size equivalent to the first dimension (e.g., a number of rows) of public matrix B. The first portion of the local [t] vector and the second portion of the local [t] vector may combine (e.g., using concatenation) to the value of the local [t] vector.. The [z](2)vector may be computed by performing [v'''] – [π(t)(2)]. The local [z](2)vector may be of a size equivalent to the first dimension (e.g., the number of rows) of public matrix B and may be determined using local vector [z]. The local [z](2)vector may include the last number of elements of the local [z] vector. The last number of elements may include a number of elements equivalent to the number of rows in the public matrix B.

[0240] At step S1322, the verifier computing system may compute a local [y] vector. The local [y] vector may be computed using the public matrix B and the local [v] vector. The local [v] vector may be computed by combining (e.g., concatenating) the first portion of the local [v]vector and the second portion of the local [v] vector determined at steps S1316 and S1318, respectively. The local [y] vector may be computed by performing B[v] mod K (e.g., 3).

[0241] At step S1324, the verifier computing system may compute a message vector for a local vector index that corresponds to the opened commitment used to perform the other steps of S1310, described above. The message vector may be computed may computed like message vectors computed by the prover computing system. For example, the message vector may be computed by combining (e.g., concatenating) the N-1 respective local [z] vectors and the respective N-1 local [y] vectors. The message may be a mod K (e.g., 3) value.

[0242] After step S1310 is performed a set of message vectors may have been computed by the verifier computing system. The set of message vectors may correspond to a subset of the message vectors computed by the prover computing system. The set of message vectors may correspond to the state vectors (e.g., opened commitments) received by the verifier computing system.

[0243] At step S1326, the verifier computing system may compute an additional message vector that corresponds to the commitment that remains unopened. The additional message vector may be computed using local [z] vectors, public y vector, and the local [y] vectors computed during step S1310. The additional message vector may be computed by concatenating a z vector and an additional local [y] vector. The local [z] vector may be computed by combining (e.g., using an XOR operation) all the local [z] vectors computed during step S1314. The additional local [y] vector may be computed by subtracting each of the local [y] vectors computed at step S1310 from the public y vector.

[0244] After the additional message vector is computed, the additional message vector may be combined (e.g., concatenated, joined, appended) with the set of message vectors computed at step S1310 (e.g., from each of the steps S1324 performed). The set of combined message vectors may be of size N.

[0245] At step S1328, the set of combined message vectors computed by the verifier computing system may be input into a hash function to compute a fourth hash value. The hash function may be the same hash function as was used by the prover computing system at step S930 to compute the second hash value h'.

[0246] The verifier computing system can compare the second hash value h' (e.g., computed at step S930) to the fourth hash value computed at step S1328. If the hash values are not equivalent (e.g., do not match), the verifier computing system may determine the prover computing system is not authenticated. If the hash values are equivalent (e.g., match) then the verifier computing system may determine the prover computing system is authenticated.

[0247] The processing depicted in FIGS.9-13, and any other FIGS. may be implemented in software (e.g., code, instructions, program) executed by one or more processing units (e.g., processors, cores) of the respective systems, using hardware, or combinations thereof. The software may be stored on a non-transitory storage medium (e.g., on a memory device). The processing presented in FIGS.9-13, and other FIGS. and described herein are intended to be illustrative and non-limiting. Although FIGS.9-13, and other FIGS, depicts the various processing steps occurring in a particular sequence or order, this is not intended to be limiting. In certain alternative embodiments, the processing may be performed in some different order or some steps may also be performed in parallel. It should be appreciated that in alternative embodiments the processing depicted in FIGS.9-13, and other FIGS, may include a greater number or a lesser number of steps than those depicted in the respective FIGS. B. Zero-Knowledge Proof

[0248] FIG.14 illustrates a 5-round zero-knowledge proof 1400 of knowledge of a preimage of an AM-OWF, according to certain embodiments of the present disclosure. The zero- knowledge proof of knowledge of the preimage of the AM-OWF is a proof of an example embodiment described above with respect to FIGS.9-13. Round 1 included in proof 1400 may correspond to S916-S924. Round 2 included in proof 1400 may correspond to S926. Round 3 included in proof 1400 may correspond to S928-S934. Round 4 included in proof 1400 may correspond to S936-S938. Round 5 included in proof 1400 may correspond to S940-S942. The verification included in proof 1400 may correspond to S944.

[0249] In certain embodiments, we use the MPC-in-the-head framework [IKOS07] and instantiate it with the alternating-moduli OWF proposed in [DGH+21], which is in turn based on [BIP+18]. Instead of using a generic compiler such as [KKW18], we aim to compute the samecircuit but use a bespoke MPC protocol, tailored to the AM-OWF, allowing us to shrink the size by 2-3×, when compared to [DGH+21].

[0250] Our MPC protocol proceeds as follows. The N parties start with an additive sharing of x and can locally compute Ax. They then engage in a share conversion procedure to convert sharesof v = Ax to shares of ^^′ ∈ Fଷ^. We do this by using preprocessed randomness of the form^^^^^ଶ, ^^^^ଷ^, where ^^ ∈ Fଶ^. To convert the shares, parties mask shares of x with shares of r inFଶ, reconstruct x+r, and then compute ^^^′^ଷ ൌ ^^ ⊙ ^1 െ ^^^ଷ ^ ^1 െ ^^^ ⊙ ^^^^ଷ. Theparties finish the protocol by computing Bv′ and reconstructing the output. However, the main difficulty is in efficiently compiling this MPC protocol to a publicly verifiable proof of knowledge of a preimage of the AM-OWF. One can of course use generic techniques such as the KKW [KKW18] or ZKB++ [CDG+17] proof systems as done in [DGH+21], and although they produce competitive signature sizes, they are still larger than more recent post-quantum signatures based on symmetric-key assumptions [FJR22,CCJ23,AMGH+23,KZ22,BBdSG+23]. We use a technique similar to [CCJ23] to handle the preprocessing for free and design a bespoke MPCitH protocol for proving knowledge of the preimage of the AM-OWF. The high-level idea is as follows. We allow the prover to freely choose (potentially malicious) correlations^^^^^ଶ, ^^^^ଷ^, but demand that the correlations are permuted using a uniformly randompermutation π that is chosen by the verifier. This allows use to completely avoid any checks on the preprocessed correlations, as we are able to bound the probability with which a prover can cheat for the very specific circuit we are interested in. The rest of the protocol proceeds as described above. The full zero-knowledge proof of knowledge protocol is specified in FIG.14. A signature scheme can then be constructed by applying the Fiat-Shamir heuristic, where the random coins provided by the verifier is replaced by a random oracle hash of the protocol transcript and the message being signed.

[0251] Our security proof proceeds in a manner very similar to that of [CCJ23]. We first note that Kales and Zaverucha [KZ20] showed that there was an attack on signature schemes using Fiat-Shamir heuristic on 5-round MPC-in-the- Head protocol. The core observation is that a malicious prover can cleverly resample verifier challenges in the second and fourth round such that the cost of finding a forgery is reduced tocost ^^:ൌ^ ^୭୰ ఛభ,ఛమ m:ఛభiାnఛమୀఛ ∑ഓ^సഓభ ൫ഓ ^൯୮^^^ି୮^ഓష^ାேమഓwhere p making the combinatorial bound verysmall, allowing us to use (approximately) the same number of repetitions as if this attack did not exist.We now define an analogous ^^-strongly invalid witness and combinatorial bound.

[0252] Definition 5.1 [^^-strongly invalid witness] We say that ^^ ∈ Fଶ^is an ^^-weakly validwitness if there exists ^^′ ∈ F^ଷ such that ^^^^ ൌ ^^, ^^^^′ ൌ ^^, and ^^ு^^^, ^^′^ ^ ^^ or ^^ு^^^ ⊕^^, ^^ᇱ^ ^ ^^. If ^^ is not an ^^-weakly valid witness, then it is an ^^-invalid witness.

[0253] Definition 5.2 [Combinatorial Bound] A combinatorial bound for the zero-knowledgeprotocol of FIG. 14 with parameters ^^^, ^^, ^^^ is a real p ൌ p^^^,^^,^^^ ∈ ^0,1^ such that for any^^-strongly invalid witness ^^ ∈ ^^^ଶ , and for any pair of vectors ^^^, ^^′^ ∈ F^ଶ ൈ Fଷ^, గ^^P ୰r ୫^ ^^^^^′ ൌ ^^|^^ ൌ ^^^^, ^^′ ൌ ^^^^^′^ ^ ^^^ ⊕ ^^^^^^^ ⊙ ^1 െ 2^^^^^′^^^ ^ ^^^, ^^,^^^,where Perm^ denotes the set of all permutations of ^1, … ,^^^.

[0254] The following is a main theorem of soundness for FIG.14, which we prove subsequently. Theorem 5.3. Let Commit be a non-interactive commitment scheme and H be a collision-resistant hash function. Let p be a combinatorial bound for the protocol in FIG.14. Then the protocol in FIG.14 is a gap honest-verifier zero-knowledge argument of knowledge forthe relation R such that ^^^^, ^^, ^^^, ^^^ ^^ ^^ ^^^^^^ ^^^^^^^^ ൌ^^. ^^ℎ^^ ^^^^^^ ^^^^^^^^^^^^^^^^ ^^ᇱ^^^^ ^^^^^^ℎ ^^ℎ^^^^ ^^^^, ^^,^^^, ^^^ ^^ ^^ ^^^^ ^^^^^^^^ ൌ ^^ and x is an f-weekly validwitness. The soundness error of the proof is at most ^^ = p+ 1 / N – p / N.

[0255] Proof. We need to show that the interactive zero-knowledge proof is complete, honest- verifier zero-knowledge, and that the soundness error is at most ^^. Completeness is easy to see from the description of the protocol.

[0256] Honest-Verifier Zero-Knowledge. To prove that the protocol is honest-verifier zero- knowledge we show that the MPC protocol described in FIG.14 is secure against a semi-honestadversary corrupting up to ^^ െ 1 parties. The simulator works as follows:• Sample a uniformly random position ^^∗ ← ^^^^ and a uniformly random permutation ^^ ←Perm^.• Carry out Round 1 of FIG.14 honestly, using a uniformly random value for ^^.• In Round 3, compute shares of ^^ and ^^ for all ^^ ് ^^∗ as described. To compute the message sentby the ^^∗-th party, first sample ^^ ← F^ଶ , and compute ^^^^^∗ ൌ ^^ ⊕^ஷ^∗ ^^^^^, and ^^^^^∗ ൌ ^^ െ∑^ஷ^∗ ^^^^^.see that this is a good simulator, note that the distribution of the ^^, ^^′ and their sharesis identical to that of a real execution. Given any ^^ െ 1 shares of ^^ and ^^, the distribution of ^^ isuniformly random and hence the distribution of ^^ is also identical to a real execution. Next, theshares of ^^ are fully determined given ^^ and the shares of ^^, ^^′, and ^^. Indeed, the ^^∗-th party'sshare of ^^ is not consistent with this but the commitment to the ^^∗-th party's state is never opened. Also note that^∗is indeed consistent with the views that are opened. Finally, due to the hiding property of the commitment scheme, the simulation is computationally indistinguishablefrom a real execution.

[0258] Soundness. Let^P be a malicious prover which manages to generate an accepting proofwith probability ^^̃ ^ ^^. Then there exists an extractor Ext, which when given blackbox access toA with rewinding capabilities, can extract a witness ^^ such that it is a weakly valid witness (Definition 5.1). Let ^^ denote the randomness used by P^to generate the first round commitment ℎ and let ^^ be a possible realization of ^^. Let Succ denote the even that^P succeeds in convincing V. By the hypothesis, we have Pr^ ^ ൌ ^^^ୗ^ୡୡ^ౌ ^̃ ^ ^^ ൌ ^ேെே.

[0259] Fix an arbitrary value ^^ ∈ ^0,1^ such that ^1 െ ^^^^^̃ ^ ^^, which exists since ^^̃ ^ ^^. Wesay that a realization ^^ of the prover randomness is good if Pr^ୗ^ୡୡ^ౌ |^^ ൌ ^^^ ^ ^1 െ ^^^^^̃.

[0260] lemma [PS00], we have Pr^^^ is good | ୗ^ୡୡ^ౌ ^ ^ ^^. Let ^^^be the transcript of a successful execution of the zero-knowledge proof with^P, ^^the random coin used by P^in the first round and ^^^denote the fourth-round message of the verifier. If ^^ is good, then |^^ ൌ ^^^ ^ ^1 െ ^^^^^̃ ^ ^^ ^^which implies that there necessarily exists a second successful transcript ^^^, with a differentfourth round message ^^^ ് ^^^. As we will demonstrate afterwards, given ^^^^, ^^^^, it is possibleto extract a triplet ^^^, ^^, ^^′^ consistent with both transcripts, where ^^ is a weakly valid witness,and ^^^, ^^′^ is the preprocessing material used by the prover. Let ^^^^, ^^^^ and ^^^^,^^^^, with ^^^ ്^^^denote the verifier challenges used in successful transcripts ^^^and ^^^, respectively. Denotethe fifth round messages in these transcripts by ^^state^ ,^^^^^ஷௗబ , commௗబ^ and^^state′^, ^^′^^^ஷௗభ , comௗభ^. Suppose ∃ ^^ ∈ ^^^^\^^^^, ^^^^ such that ^state^, ^^^^ ് ^state′^,^^′^^.Then one of the following must be true: • The committed values are different: com^ ൌ Commit^state^ ,^^^^ ് Commit^state′^,^^′^^ ൌ com′^ ,but since both of these transcripts verify, this implies that the prover has found a collision for ^^. • The commitments are identical: com^ ൌ Commit^state^ ,^^^^ ൌ Commit^state′^,^^′^^ ൌ com′^ ,but this violates the binding property of the commitment scheme.

[0261] Therefore, it must be the case that ^state^ ,^^^^^ஷௗబ,ௗభ ൌ ^state′^, ^^′^^^ஷௗబ,ௗభ.Furthermore, since ^^^ ് ^^^, they jointly define a unique tuple ^state^,^^^^^∈^ே^, from which wecan extract the witness ^^ and the preprocessing material ^^^, ^^′^ used by the prover.

[0262] Finally, we show that if ^^ is a strongly invalid witness, then Pr^ୗ^ୡୡ^ౌ |^^ ൌ ^^^ ^ ^^,contradicting our assumption that ^^ is good. Let us denote BadPerm the event (defined over arandom choice of permutation ^^, and for the fixed value of ^^^, ^^, ^^′^) that ^^^^ ൌ ^^^^ and ^^′ ൌ ^^,where ^^′ ൌ ^^^^^′^ ^ ^^^ ⊕ ^^^^^^^ ⊙ ^1 െ 2^^^^^′^^. By definition of the combinatorial bound(Definition we have Pr^BadPerm^ ^ p. We can rewrite our desired inequality asPr^ୗ^ୡୡ^ౌ |^^ ൌ ^^^ ൌ Pr^ୗ^ୡୡ^ౌ ∧ BadPerm |^^ ൌ ^^^^Pr ^ୗ^ୡୡ^ౌ ∧ ^BadPerm | ^^ ൌ ^^^^ p ^ ^1 െ p^ ⋅ Pr^ୗ^ୡୡ^ౌ |^^ ൌ ^^ ∧ ^BadPerm^.

[0263] If we can show that Pr^ୗ^ୡୡ^ౌ |^^ ൌ ^^ ∧ ^ BadPerm^ ^ 1 / ^^, then we are done. For thesake of contradiction, assume that Pr^ୗ^ୡୡ^ౌ |^^ ൌ ^^ ∧ ^BadPerm^ ^ 1 / ^^. Since Pr^ୗ^ୡୡ^ౌ |^^ ൌ^^^ ^ ^^, using the same argument as earlier, given a successful transcript ^^^^ with fourth roundmessage ^^^^, there must exist a second successful transcript ^^^^ with identical first three roundsbut fourth round message ^^^^ ് ^^^^. Moreover, ^^^^ and ^^^^ must be consistent and uniquely definea tuple ^state^ ,^^^^^^∈^ே^. Since we condition on the same randomness ^^ ൌ ^^, the ℎ^ in the secondround transcripts, ^^^^^,^^^^^ and ^^^^, ^^^^ must be identical and therefore, by the^^, ^sta^te^, ^^^^^^∈^ே^ Now, using ^^^^, we can reconstructthe messages sent by all verifying the transcript to obtain ^ms^g^^^^∈^ே^. Similarly, using we ^^^^ and ^^^^, share the same firstthree rounds, using a similar argument as above ^ms^g^^ ^^∈^ே^\^ௗ^^బ,ௗ^భ^ ൌ ^ms^g^^^∈^ே^\^ௗ^బ,ௗ^భ^. Note that when we recovered ms^g^ௗ^బ , we set ^^^^ௗ^బ ൌ ^^ െ ∑^ஷௗ^బ ^^^^^. Because we started with theassumption that ^^ is a strongly invalidon not using a bad permutation, it must be true that ms^g^ௗ^బ ് ms^g^ௗ^బas otherwise we have actually found a valid witness. But this also means thatdifferent inputs ^ms^g^^^^∈^ே^and ^ms^g^^^^∈^ே^that hash to thesame value, contradicting the collision resistance of ^^. Thus Pr^ୗ^ୡୡ^ౌ |^^ ൌ ^^ ∧ ^BadPerm^ ^1 / ^^ and hence, Pr^ ^^ ୗ^ୡୡ^ౌ ^ p ^ ^1 െ p^ே, when ^^ is a strongly invalid witness. The remaining proof and description of the extractor is identical to that of [FJR22, CCJ23] and we omit it here.

[0264] Proof Size. The prover sends the following to the verifier in the proof of knowledge of the pre-image of the AM-OWF: commitments ℎ and ℎ′ of size 2λ bits each, the co-path of ^^∗ofsize λ log ^^ bits, com^∗ of size 2λ bits, the ^^-th shares of ^^ and ^^ of size ^^^ ^ ^^log3^ bits, ^^ ofsize ^^ െ ^^ bits, and where the ℎ,ℎ′ commitments across all ^^ parallel executions can becombined into one commitment of size 2λ each. ^^^^^^^^ ൌ 4ดλ ^ ^^^λᇣ^ᇧloᇤgᇧ^ᇥ^^ ^ 2ดλ ^ ^ ^^ ^ ^ᇣ^ᇤ െᇥ ^^ ^ ^ᇣ^lᇤogᇥ3^ ^,^ᇱ

[0265] Parameters. In [DGH+21], the authors propose ^^^, ^^, ^^^ ൌ ^λ, 3.53λ, λ / log3^. However,for the relaxed notion of soundness that our zero-knowledge proof achieves, we can actually require that it must be hard to find an ^^-weakly valid witness for the AM-OWF (Definitition 5.1). The parameter ^^ is set such that the combinatorial bound is made as low as possible in order to minimize the impact of the attack from [KZ20] on the signature size. As well will show later, this in turn determines the value of ^^,^^, and ^^. During our search for parameters, we also identified an important metric to pay attention to when introducing any form of additional structure in B.

[0266] We target 128 bit security with the following parameters a) Fast: ^18,193^, b) Balanced: ^13,1723^, and c) Short: ^9,65536^ reported as ^^^,^^^, where ^^ is the number of parties and ^^ is the number of parallel repetitions.

[0267] Using Equation 5.1, we set ^^ ൌ 11, and now determine ^^, ^^, ^^ such that it is still hardto find an ^^-weakly valid witness. To ensure that the covering lemma (Lemma 3.6) still holds wefix ^^ ൌ ^^log3 ^ 10.

[0268] Choosing ^^ and ^^. We choose ^^,^^ such that if we sample a uniformly random value, it is not an ^^-weakly valid witness, with overwhelming probability. The reason we use this strategy is because there does not seem to be a good way to choose inputs such that the output of ^^^^ lies close to the codewords of B. Indeed if there existed a strategy that did better than simply trying at random, then we can extend the approxOWF reduction (Lemma 3.9) to the setting where^^ ^^^, ^^ᇱ^ ^ ^^ and break the AM-OWF for the parameters proposed in [D +ு GH 21]. Thus, whenintroducing any additional structure in B, it must be the case that the codewords must be sufficiently spread out, at least on average.

[0269] Coming back to the choice of ^^ and ^^, a random linear code approaches the GV bound. Therefore, the number of codewords of B is approximately 3^ / ^^ு^^ௗ / ^^^, where ^^ is the minimum distance of B. The fraction of volume occupied by all words within hamming distance ^^ of codewords of B is therefore given by ^^ு^^^ / ^^^ିு^^ௗ / ^^^, which we set to be smaller than 2ି^ଶ଼as this is also the probability withis withing hamming distance ^^ ofa codeword. This gives us ^^ ൌ 135, ^^ ൌ 450 and ^^ ൌ 224C. Prover Implementation

[0270] FIG.15 illustrates a method 1500 performed by a prover computing system (e.g., prover computing system 104), according to certain embodiments of the present disclosure. The prover computing system may perform the method to enable a verifier computing system (e.g., verifier computing system 106) to authenticate the prover computing system.

[0271] At step S1502, the prover computing system may obtain a public matrix A comprising a first plurality of values, the first plurality of values sampled from a first distribution, wherein the public matrix A has values mod M that is a first prime number. Step S1502 may include operations like those described with respect to step S904 described above.

[0272] At step S1504, the prover computing system may obtain a public matrix B comprising a second plurality of values, the second plurality of values sampled from a second distribution, wherein the public matrix B has values mod K that is a second prime number. Step S1504 may include operations like those described with respect to step S906 described above.

[0273] At step S1506, the prover computing system may store a vector x that is a signing private key. Step S1506 may include operations like those described with respect to step S902 described above.

[0274] At step S1508, the prover computing system may compute a local set of [x] vectors that has values mod M, wherein each vector in the local set of [x] vectors combines to the value of the vector x. Step S1508 may include operations like those described with respect to step S916 and method 1100 described above.

[0275] At step S1510, the prover computing system may compute a local set of [t] vectors that has values mod K, wherein each vector in the local set of [t] vectors combines to the mod K equivalent of a s vector computed using a random seed. Step S1510 may include operations like those described with respect to step S916 and method 1100 described above.

[0276] At step S1512, the prover computing system may compute a set of state vectors, wherein each state vector in the set of state vectors includes a portion of a seed or a first portion of the s vector, a first local [x] vector included in the local set of [x] vectors, and a first local [t]vector included in the set of local [t] vectors. Step S1512 may include operations like those described with respect to step S918 described above.

[0277] At step S1514, the prover computing system may compute a set of commitments using the set of state vectors. Step S1514 may include operations like those described with respect to step S920 described above.

[0278] At step S1516, the prover computing system may compute a first hash value h using a first hash function and the set of commitments. Step S1516 may include operations like those described with respect to step S922 described above.

[0279] At step S1518, the prover computing system may transmit, to a verifier computer system, the first hash value h. Step S1518 may include operations like those described with respect to step S924 described above.

[0280] At step S1520, the prover computing system may obtain a random permutation π. Step S1520 may include operations like those described with respect to step S926 described above.

[0281] At step S1522, the prover computing system may compute a set of local [v] vectors by applying the public matrix A to respective local [x] vectors. Step S1522 may include operations like those described with respect to step S928 and method 1200 described above.

[0282] At step S1524, the prover computing system may compute a set of converted local [v'] vectors by converting respective local [v] vectors from mod M to mod K using the permutation π. Step S1524 may include operations like those described with respect to step S928 and method 1200 described above.

[0283] At step S1526, the prover computing system may compute a set of local [y] vectors by applying the public matrix B to the set of converted local [v'] vectors. Step S1526 may include operations like those described with respect to step S928 and method 1200 described above.

[0284] At step S1528, the prover computing system may compute a set of message vectors using the set of local [y] vectors, the uniformly random permutation π, and the set of local [v] vectors. Step S1528 may include operations like those described with respect to step S928 and method 1200 described above.

[0285] At step S1530, the prover computing system may compute a second hash value h' using a second hash function and the set of message vectors. Step S1530 may include operations like those described with respect to step S930 described above.

[0286] At step S1532, the prover computing system may transmit, to the verifier computer system, the second hash value h'. Step S1532 may include operations like those described with respect to step S932 described above.

[0287] At step S1534, the prover computing system may receive, from the verifier computer system, a request for a subset of the set of state vectors. Step S1534 may include operations like those described with respect to step S938 described above.

[0288] At step S1536, the prover computing system may transmit the subset of the set of state vectors to the verifier computer system, thereby enabling the verifier computer system to authenticate the prover computer system. Step S1536 may include operations like those described with respect to step S940 described above. D. Verifier Implementation

[0289] FIG.16 illustrates a method 1600 performed by a verifier computing system (e.g., verifier computing system 106), according to certain embodiments of the present disclosure. The verifier computing system may authenticate a prover computing system (e.g., prover computing system 104).

[0290] At step S1602, the verifier computing system may obtain a public matrix A comprising a first plurality of values, the first plurality of values sampled from a first distribution, wherein the public matrix A has values mod M that is a first prime number. Step S1602 may include operations like those described with respect to step S910 described above.

[0291] At step S1604, the verifier computing system may obtain a public matrix B comprising a second plurality of values, the second plurality of values sampled from a second distribution, wherein the public matrix B has values mod K that is a second prime number. Step S1604 may include operations like those described with respect to step S912 described above.

[0292] At step S1606, the verifier computing system may receive, from a prover computer system, a first hash value h computed by using a first hash function and a set of commitmentsgenerated using a set of state vectors, wherein each state vector in the set of state vectors includes a first portion of a vector s, a first local [x] vector included in a local set of [x] vectors, and a first local [t] vector included in a set of local [t] vectors. Step S1606 may include operations like those described with respect to step S924 described above.

[0293] At step S1608, the verifier computing system may receive, from the prover computer system, a second hash value h' computed using a second hash function and a set of message vectors, the set of set of message vectors computed using a set of local [y] vectors, a uniformly random permutation π, and a set of local [v] vectors. Step S1608 may include operations like those described with respect to step S932 described above.

[0294] At step S1610, the verifier computing system may transmit, to the prover computer system, a request for a subset of the set of state vectors. Step S1610 may include operations like those described with respect to step S938 described above.

[0295] At step S1612, the verifier computing system may receive, from the prover computer system, the subset of the set of state vectors and a commitment of the state vector not included in the subset of the set of state vectors. Step S1612 may include operations like those described with respect to steps S940 and S942 described above.

[0296] At step S1614, the verifier computing system may compute for each state vector in the subset of the set of state vectors, the first portion of the vector s, the first local [x] vector included in the local set of [x] vectors, and the first local [t] vector included in the set of local [t] vectors. Step S1614 may include operations like those described with respect to step S944 and method 1300 described above.

[0297] At step S1616, the verifier computing system may obtain a random permutation π. Step S1616 may include operations like those described with respect to step S926 and method 1300 described above.

[0298] At step S1618, the verifier computing system may compute the set of commitments using the commitment of the state vector not included in the subset of the set of state vectors and the subset of the state vectors. Step S1618 may include operations like those described with respect to step S944 and method 1300 (e.g., step S1302) described above.

[0299] At step S1620, the verifier computing system may compute a third hash value using the first hash function and the set of commitments. Step S1620 may include operations like those described with respect to step S944 and method 1300 (e.g., step S1304) described above.

[0300] At step S1622, the verifier computing system may compute a subset of the message vectors, wherein each message vector is computed using a respective local [s] vector generated using a respective portion of the seed, a respective first local [x] vector included in the local set of [x] vectors, and a respective first local [t] vector included in the set of local [t] vectors. Step S1622 may include operations like those described with respect to step S944 and method 1300 (e.g., step S1310) described above.

[0301] At step S1624, the verifier computing system may compute a message vector corresponding to the commitment of the state vector not included in the subset of the set of state vectors by using a set of local [y] vectors and a public y vector. Step S1624 may include operations like those described with respect to step S944 and method 1300 (e.g., step S1326) described above.

[0302] At step S1626, the verifier computing system may compute a set of messages using the subset of the message vectors and the message vector. Step S1626 may include operations like those described with respect to step S944 and method 1300 described above.

[0303] At step S1628, the verifier computing system may compute a fourth hash value using the second hash function and the set of messages. Step S1628 may include operations like those described with respect to step S944 and method 1300 (e.g., step S1328) described above.

[0304] At step S1630, the verifier computing system may authenticate the prover computer system based on: (i) the first hash value h being equivalent with the third hash value, and (ii) the second hash value h' being equivalent with the fourth hash value. Step S1630 may include operations like those described with respect to step S944 and method 1300 (e.g., step S1328) described above. E. Signature Size

[0305] FIG.17 illustrates a table 1700 of signature sizes using certain techniques described herein compared to previous works. In table 1700 , we report sizes of our signature scheme forthe parameter sets listed below. We expect performance similar to [CCJ23] during signing / verification. We also note that because our MPC-in-the-Head is based on additive secret sharing, the hypercube technique from [AMGH+23] can be used to scale up to a larger number of parties while remaining computationally efficient. Table 1700 includes a comparison of signature sizes against state-of-the-art schemes based on symmetric-key assumptions. For [ARZV+23], we report the maximum signature sizes of the hypercube variant. EM-AES refers to AES in Even- Mansour mode VI. POST-QUANTUM RING SIGNATURES

[0306] Embodiments may extend our digital signature scheme to a ring signature scheme by introducing a simple yet powerful technique to prove disjunctions of the same relation in MPCitH. Our ring signature grows linearly in the size of the ring, but for small to medium-sized rings, we are concretely smaller than the state-of-the-art. For larger rings, most MPCitH-based signatures, including ours, can be combined with the compiler by Goel et al. [GGHAK22] to build ring signatures whose size only grows logarithmically in the ring size A. Ring Signatures

[0307] A ring signature allows a party to sign a message, while remaining anonymous amongst a chosen set of (say) ℓ parties. Given a signature scheme, there is a generic way to construct ring signatures by providing a zero-knowledge proof for the statement: "I know a signature ^^ on themessage ^^ that verifies under a public key pk^ for some ^^ ∈ ^ℓ^."overhead introduced on top ofa single signature, when trying to prove membership of the public key pk^ ∈ ^pk^, … , pkℓ^. Thestate-of-the-art in post-quantum ring signatures are lattice-based schemes [LNS21, ESZ22], which build concretely efficient zero-knowledge proofs for set-membership adapted to the lattice setting.

[0309] The only competing alternative appears to be based on MPCitH [GGHAK22], where the ring signature size grows as ^^^logℓ^ but they are concretely worse than [LNS21, ESZ22]. This can be attributed to two main factors:They use Picnic [CDG+17] as the core signature scheme which is quite large ^ 42 KB wheninstantiated with NIST L5 parameters.3Although the signature size is only ^^^ℓ^, the concrete constants are still quite high for small- medium sized rings.

[0310] The former issue can be handled easily by replacing Picnic with either the signature scheme we propose or another newer, smaller, MPCitH based signature schemes (see FIG.17). This would yield concretely good signatures that are competitive with lattice-based schemes at large ring sizes. However, we observe many practical scenarios small to medium-sized rings are used. For instance, in the ring signatures protocol used by Monero as part of RingCT, the number of public keys used in the anonymity set was only very recently upgraded from 11 to 16.4We close this gap in the literature for small to medium-sized rings using a simple yet powerful idea. When combined with our signature scheme described above, this yields competitive post-quantum ring signatures for rings of size ^ 32.

[0311] At a high-level, our strategy is to interpolate a polynomial ^^^^^^ such that ^^^^^^ ൌ pk^for ^^ ∈ ^ℓ^ and have the prover show that the public key they know ^^^, pk^ ,^^^^^^^ satisfies^^^^^^െpk^ ൌ ^^^^^^^^^ െ ^^^ for some degree ℓ െ 2 polynomial ^^^^^^. The verifier then checksthat this equation holds at a random point ^^ in the field. With overwhelming probability, we are then guaranteed that the claimed polynomial and public key indeed satisfy the relation above.However, this is not sufficient by itself, as the prover has to now show that ^^ ∈ ^ℓ^. We obtainthis for free when the public keys can be interpreted as field elements in GF^^^௧^ for some prime ^^. This is indeed the case for the AM-OWF and other MPCitH signatures based on AES, LowMC, Rainସ, AIM [AES01, ARS+15, DKR+22, KHS+23]. Instead of secret sharing ^^ over GF^^^௧^, the prover shares it over GF^ℓ^, and if ℓ is a power of ^^, the parties in the MPC, can locally embed their shares in GF^^^௧^ by appending 0s. Note that this immediately guarantees that ^^ can be expressed using log^ℓ digits and this also does not leak any information about ^^ as theverifier already knows that any honest prover uses an ^^ ∈ GF^ℓ^.

[0312] An efficient proof of knowledge of the pre image of the AM-OWF also serves as a building block for Ring Signatures [RST01] and Ring CT [Noe 15]. The work of[GGHAK22] introduced generic compilers to lift MPCitH proof for a single NP statement to a disjunction ofmultiple NP statements, where the additional cost on top of a single MPCitH proof only grows logarithmically in the number of statements. Although the compiler is asymptotically very good, we observe that there is an initial startup cost resulting in a larger than necessary overhead when there are a small number of statements. In this section, we provide concretely more efficient protocols in the few statements regime.

[0313] The goal of a ring signature is to convince a verifier that a message was signed by one party out of a set of ℓ parties. Recall that in the case of the AM-OWF based signature scheme, the public keys lie in F௧ଷ . A signer may produce a proof that they know ^^^ such that ^^^ ൌ ^^^^^^^^^lies in some set of public keys ^^^^, ^^ଶ, … , ^^ℓ^. Our strategy is to extend the MPC protocol asfollows. Recall that at the end of the MPC protocol computing the AM-OWF on input ^^^, all parties hold shares of ^^^. All that is left to do is prove that parties hold a secret sharing of some^^ ∈ ^^^ , … , ^^ ^. First interpret the public keys ^^^ , ^^ , … , ௧^ ^ ℓ ^ ଶ ^^ℓ^ as elements in the field GF^3 ^ andinterpolate a degree-^ℓ െ 1^ polynomial ^^^^^^ such that ^^^^^^ ൌ ^^^. ^^^^^^ satisfies the followingproperty for all ^^ ∈ ^ℓ^,^^^^^^ ൌ ^^^ െ ^^^^^^^^^ ^ ^^^ , (5.2)where ^^^^^^ is a polynomial of degree at most ^ℓ െ 2^ and ^^ is interpreted as an element ofGF^3௧^ in a natural sense of ternary decomposition. Observe that ^^^^^^ can be computed by the verifier, ^^^^^^ can be computed by the prover and secret shared with the parties in the first round,and the parties hold shares of ^^^^^^ ൌ ^^^ by the end of round 3.11 In round 4 of the MPC protocolin FIG. 14, we have the verifier send a random point ^^ ← GF^3௧^ and have the parties evaluateEquation 5.2 at this point. Note that the verifier can actually compute all powers of ^^, and thusthe ^^^^^^ can be computed by the verifier. The parties can compute shares of ^^^^^^ and ^^^ െ ^^^through local operations on their shares in verifiable manner. Finally, given access to one Beavertriple, the parties can multiply ^^^^^^ and ^^^ െ ^^^ to obtain shares of the RHS of equation 5.2,which can be revealed to ensure that the reconstructed value matches ^^^^^^. We note that theprobability with which the verifier samples a bad ^^ such that ^^^^^^ െ ^^^ ് ^^^^^^^^^ െ ^^^ but^^^^^^ െ ^^ ൌ ^^^^^^^^^ െ ^^^, is ^ ௧^ ℓ / |Fଷ | as a polynomial of degree ℓ െ 1 has at most ℓ െ 1 roots.

[0314] An astute reader might have observed that we are not done yet, because the provercould have used any ^^ ∈ GF^3௧^ not restricted to ^^ ∈ ^ℓ^. In fact, a prover could use an public key^^∗ by choosing ^^∗ to be a root of the polynomial ^^^^^^ െ ^^ ∗. An naive solution is to demand arange proof on ^^ via the ternary analogue of bit-decomposition where the prover shows that ^^ canbe represented using logଷℓ-many Fଷ elements ^^^^, ^^^, … , ^^୪୭^యℓ^. The parties would be providedwith secret shares of ^^ ௧୪୭^యℓ^^ in GF^3 ^ and they check that a) ^^ ൌ ∑ ^ୀ^ ^^^ ⋅ 3 and b) ^^^ ∈ ^0,1,2^,which may use two additional multiplications to verify െ 1^^^^^ െ 2^ ൌ 0. Instead, wepropose a way to carry out this range check for free, as as of 3.12

[0315] Our main observation is that a verifier already knows that ^^ ∈ ^ℓ^, therefore instead ofsecret sharing ^^ ∈ GF^3௧^, we can share it in ^^^^^ℓ^ without any loss of privacy. Later, whenevaluating Equation 5.2, the parties then locally embed these shares in GF^3௧^ by simplyappending ^^^ െ logଷℓ^ zeros. Thereby, adding just ^^logℓ bits to the final signature size.Although the above construction is simple, it performs surprisingly well (e.g., as shown in FIG. 18) and highlights the advantage of using a flexible framework such as MPCitH. Note that we used powers of 3 due to the structure of the public keys in the AM-OWF. Instead one could use a OWF with binary output such as [KZ22], which has slightly larger signature sizes, but will still have competitive signature sizes in addition to being able to support powers of 2.

[0316] FIG.18 illustrates a table 1800 of ring signature sizes using certain techniques described herein compared to previous works. Table 1800 includes a comparison of ring signature sizes for different ring sizes. The sizes of lattice based ring signatures except for [ESZ22] were obtained from [ESLL19]. The work of [ESZ22] provides benchmarks for different ring sizes, we therefore compare against this work separately. For our work, we use the short parameters and benchmark over the closest powers of 3. B. Size of Ring Signature

[0317] The above technique infact works generically for disjunctions of the same relation in any MPCitH based proof system, by first interpreting the statement being proved as a field element ^^^^^^^௧^ for some prime ^^. Below, we quantify the overhead introduced on top of a single proof.

[0318] In the MPCitH proof, the prover now additionally generates Beaver triples as part of the preprocessing material. This can be done using the sacrifice-based technique from [DPSZ12,DKL+13, LN17]. The communication can further be optimized by using PRG seeds to generatethe shares of Beaver triples. Let ^^^^^, ^^^^, ^^^^^ be the Beaver triple such that ^^. ^^ ൌ ^^, then^^^^, ^^^^ of all ^^ parties can be set to be the output of the PRG as the correlation should indeedbe uniformly random. Similarly,^^^^can also be set to the output of the PRG, but with the shareof ^^-th party ^^^^ே ൌ ^^ െ ∑ேି^ ^ୀ^^^^^, implying that the additional communication in the MPCitH per beaver triple is just one field element. In our protocol, we may use only one Beaver triple per iteration of the MPC proof. Using a sacrifice check for each iteration of the MPCitH requires 2^^ Beaver triples in total and therefore, the communication per iteration in the preprocessing phase is two field elements during the check and two additional field elements as the view of parties inthe MPC. During the online phase, parties hold shares of the coefficients of the ℓ െ 1coefficients of ^^^^^^ from Equation 5.2, each of which adds one field element to thecommunication per iteration of the MPCitH proof. Finally, when parties multiply ^^^^^^ and ^^^ െ^^^, they broadcast two field elements. Thus, the communication overhead of the online phase ofMPCitH is ^ℓ ^ 1^ field elements per iteration. The total proof size grows linearly in ℓ and theincremental cost of adding a statement to the disjunction is ^ ^^^^log3 bits.^^^^^^^^ ൌ |Π^^େ୧^ୌ| ^ ^^log3^^^^ℓᇣᇤ െᇥ 1 ^ ^ 6 ^ ^ lᇣoᇤgଷᇥℓ^ ொ^^^ ^^୪^୧୮୪^ ^

[0319] size, our protocol outperforms state-of-the-art ring signatures but for latger rings the sizes can get very big (e.g., table 1800). However, [GGHAK22] devised a concretely efficient compiler to prove set- membership in various MPCitH proofs which uses Merkle trees in a black-box manner to reducecomputational and communication overhead. Their sizes are roughly 42 ^ 1.5 ൈ logℓ KB for aring of size ℓ, but the 42 KB is is the size of a single signature using LowMC, with the KKW proof system. Since then, there has been tremendous progress in building signatures usingMPCitH, bringing sizes down to ^ 5 KB for a single signature. We expect that using theircompiler with any of the KKW-style proof systems (e.g., from table 1900 described herein) would yield ring signatures that only grow logarithmically in the ring size and are competitive with state-of-the-art lattice based ring signatures.VII. COMPUTER SYSTEM

[0320] Any of the computer systems mentioned herein may utilize any suitable number of subsystems. Examples of such subsystems are shown in FIG.19 in computer system 1900. In some embodiments, a computer system includes a single computer apparatus, where the subsystems can be the components of the computer apparatus. In other embodiments, a computer system can include multiple computer apparatuses, each being a subsystem, with internal components. A computer system can include desktop and laptop computers, tablets, mobile phones, and other mobile devices.

[0321] The subsystems shown in FIG.19 are interconnected via a system bus 1912. Additional subsystems such as a keyboard 1918, storage device(s) 1920, a display 1924 (e.g., a display screen, such as an LED), which is coupled to display adapter 1914, an authentication interface 1910, and others are shown. Peripherals and input / output (I / O) devices, which couple to I / O controller 1902, can be connected to the computer system by any number of means known in the art such as input / output (I / O) port 1916 (e.g., USB, FireWire®). For example, I / O port 1916 or external interface 1922 (e.g., Ethernet, Wi-Fi, etc.) can be used to connect computer system 1900 to a wide area network such as the Internet, a mouse input device, or a scanner. The interconnection via system bus 1912 allows the central processor 1906 to communicate with each subsystem and to control the execution of a plurality of instructions from system memory 1904 or the storage device(s) 1920 (e.g., a fixed disk, such as a hard drive, or optical disk), as well as the exchange of information between subsystems. The system memory 1904 and / or the storage device(s) 1920 may embody a computer readable medium. The authentication interface 1910 may include a camera, microphone, accelerometer, and the like. The authentication interface may be used to obtain authentication information from a user (e.g., of an authenticator device). Any of the data mentioned herein can be output from one component to another component and / or can be output to a user.

[0322] A computer system can include a plurality of the same components or subsystems, e.g., connected together by external interface 1922, by an internal interface, or via removable storage devices that can be connected and removed from one component to another component. In some embodiments, computer systems, subsystem, or apparatuses can communicate over a network. In such instances, one computer can be considered a client and another computer a server, whereeach can be part of a same computer system. A client and a server can each include multiple systems, subsystems, or components. In various embodiments, methods may involve various numbers of clients and / or servers, including at least 10, 20, 50, 100, 200, 500, 1,000, or 10,000 devices. Methods can include various numbers of communication messages between devices, including at least 100, 200, 500, 1,000, 10,000, 50,000, 100,000, 500,00, or one million communication messages. Such communications can involve at least 1 MB, 10 MB, 100 MB, 1 GB, 10 GB, or 100 GB of data.

[0323] Any of the computer systems mentioned herein may utilize any suitable number of subsystems. In some embodiments, a computer system includes a single computer apparatus, where the subsystems can be components of the computer apparatus. In other embodiments, a computer system can include multiple computer apparatuses, each being a subsystem, with internal components.

[0324] A computer system can include a plurality of the components or subsystems, e.g., connected together by external interface or by an internal interface. In some embodiments, computer systems, subsystems, or apparatuses can communicate over a network. In such instances, one computer can be considered a client and another computer a server, where each can be part of a same computer system. A client and a server can each include multiple systems, subsystems, or components.

[0325] It should be understood that any of the embodiments of the present disclosure can be implemented in the form of control logic using hardware (e.g., an application specific integrated circuit or field programmable gate array) and / or using computer software with a generally programmable processor in a modular or integrated manner. As used herein a processor includes a single-core processor, multi-core processor on a same integrated chip, or multiple processing units on a single circuit board or networked. Based on the disclosure and teachings provided herein, a person of ordinary skill in the art will know and appreciate other ways and / or methods to implement embodiments of the present disclosure using hardware and a combination of hardware and software.

[0326] Any of the software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C, C++, C#, Objective-C, Swift, or scripting language suchas Perl or Python using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer readable medium for storage and / or transmission, suitable media include random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a compact disk (CD) or DVD (digital versatile disk), flash memory, and the like. The computer readable medium may be any combination of such storage or transmission devices.

[0327] Such programs may also be encoded and transmitted using carrier signals adapted for transmission via wired, optical, and / or wireless networks conforming to a variety of protocols, including the Internet. As such, a computer readable medium according to an embodiment of the present disclosure may be created using a data signal encoded with such programs. Computer readable media encoded with the program code may be packaged with a compatible device or provided separately from other devices (e.g., via Internet download). Any such computer readable medium may reside on or within a single computer product (e.g., a hard drive, a CD, or an entire computer system), and may be present on or within different computer products within a system or network. A computer system may include a monitor, printer, or other suitable display for providing any of the results mentioned herein to a user.

[0328] Any of the methods described herein may be totally or partially performed with a computer system including one or more processors, which can be configured to perform the steps. Any operations performed with a processor may be performed in real-time. The term “real-time” may refer to computing operations or processes that are completed within a certain time constraint. The time constraint may be 1 minute, 1 hour, 1 day, or 7 days. Thus, embodiments involve computer systems configured to perform the steps of any of the methods described herein, potentially with different components performing a respective steps or a respective group of steps. Although presented as numbered steps, steps of methods herein can be performed at a same time or in a different order. Additionally, portions of these steps may be used with portions of other steps from other methods. Also, all or portions of a step may be optional. Additionally, and of the steps of any of the methods can be performed with modules, circuits, or other means for performing these steps.

[0329] The specific details of particular embodiments may be combined in any suitable manner without departing from the spirit and scope of embodiments of the disclosure. However,other embodiments of the disclosure may involve specific embodiments relating to each individual aspect, or specific combinations of these individual aspects. The above description of exemplary embodiments of the disclosure has been presented for the purpose of illustration and description. It is not intended to be exhaustive or to limit the disclosure to the precise form described, and many modifications and variations are possible in light of the teaching above. The embodiments were chosen and described in order to best explain the principles of the disclosure and its practical applications to thereby enable others skilled in the art to best utilize the disclosure in various embodiments and with various modifications as are suited to the particular use contemplated.

[0330] The above description is illustrative and is not restrictive. Many variations of the disclosure will become apparent to those skilled in the art upon review of the disclosure. The scope of the disclosure should, therefore, be determined not with reference to the above description, but instead should be determined with reference to the pending claims along with their full scope or equivalents.

[0331] One or more features from any embodiment may be combined with one or more features of any other embodiment without departing from the scope of the disclosure.

[0332] A recitation of “a”, “an” or “the” is intended to mean “one or more” unless specifically indicated to the contrary. The use of “or” is intended to mean an “inclusive or,” and not an “exclusive or” unless specifically indicated to the contrary.

[0333] All patents, patent applications, publications, and descriptions mentioned above are herein incorporated by reference in their entirety for all purposes. None is admitted to be prior art. VIII. REFERENCES

[0334] [ABG+14] Adi Akavia, Andrej Bogdanov, Siyao Guo, Akshay Kamath, and Alon Rosen. Candidate weak pseudorandom functions in AC0 o MOD2. In Moni Naor, editor, ITCS 2014, pages 251–260. ACM, January 2014. (Cited on page 3, 10).

[0335] [ADDG24] Martin R. Albrecht, Alex Davidson, Amit Deo, and Daniel Gardham. Crypto dark matter on the torus - oblivious prfs from shallow prfs and TFHE. In Marc Joye andGregor Leander, editors, EUROCRYPT 2024 , Part VI, volume 14656 of LNCS, pages 447–476. Springer, 2024. (Cited on page 28).

[0336] [ADDS21] Martin R. Albrecht, Alex Davidson, Amit Deo, and Nigel P. Smart. Round-optimal verifiable oblivious pseudorandom functions from ideal lattices. In Juan A. Garay, editor, PKC 2021, Part II, volume 12711 of LNCS, pages 261–289. Springer, 2021. (Cited on page 28).

[0337] [AES01] Advanced Encryption Standard (AES). National Institute of Standards and Technology, NIST FIPS PUB 197, U.S. Department of Commerce, November 2001. (Cited on page 7).

[0338] [AFL+16] Toshinori Araki, Jun Furukawa, Yehuda Lindell, Ariel Nof, and Kazuma Ohara. High-throughput semihonest secure three-party computation with an honest majority. In Edgar R. Weippl, Stefan Katzenbeisser, Christopher Kruegel, Andrew C. Myers, and Shai Halevi, editors, ACM CCS 2016, pages 805–817. ACM Press, October 2016. (Cited on page 10).

[0339] [AGP+19] Martin R. Albrecht, Lorenzo Grassi, L´eo Perrin, Sebastian Ramacher, Christian Rechberger, Dragos Rotaru, Arnab Roy, and Markus Schofnegger. Feistel structures for MPC, and more. In Kazue Sako, Steve Schneider, and Peter Y. A. Ryan, editors, ESORICS 2019, Part II, volume 11736 of LNCS, pages 151–171, September 2019. (Cited on page 3).

[0340] [AMGH+23] Carlos Aguilar-Melchor, Nicolas Gama, James Howe, Andreas H¨ulsing, David Joseph, and Dongze Yue. The return of the sdith. In Carmit Hazay and Martijn Stam, editors, EUROCRYPT 2023, Part V, volume 14008 of LNCS, pages 564–596. Springer, 2023. (Cited on page 30, 34).

[0341] [ARS+15] Martin R. Albrecht, Christian Rechberger, Thomas Schneider, Tyge Tiessen, and Michael Zohner. Ciphers for MPC and FHE. In Elisabeth Oswald and Marc Fischlin, editors, EUROCRYPT 2015, Part I, volume 9056 of LNCS, pages 430–454, April 2015. (Cited on page 3, 6, 7, 9, 27, 29).

[0342] [ARZV+23] Gora Adj, Luis Rivera-Zamarripa, Javier Verbel, Emanuele Bellini, Stefano Barbero, Andre Esser, Carlo Sanna, and Floyd Zweydinger. Mirithh. Technical report, National Institute of Standards and Technology, 2023.https: / / csrc.nist.gov / csrc / media / Projects / pqc-dig-sig / documents / round-1 / spec- files / MiRitH_spec-web.pdf. (Cited on page 34).

[0343] [Bas23] Andrea Basso. A post-quantum round-optimal oblivious PRF from isogenies. In Claude Carlet, Kalikinkar Mandal, and Vincent Rijmen, editors, SAC 2023, volume 14201 of LNCS, pages 147–168. Springer, 2023. (Cited on page 28).

[0344] [BBdSG+23] Carsten Baum, Lennart Braun, Cyprien Delpech de Saint Guilhem, Michael Kloos, Emmanuela Orsini, Lawrence Roy, and Peter Scholl. Publicly verifiable zero- knowledge and post-quantum signatures from vole-in-the-head. In Helena Handschuh and Anna Lysyanskaya, editors, CRYPTO 2023, Part V, volume 14085 of LNCS, pages 581–615. Springer, 2023. (Cited on page 30, 34).

[0345] [BBSS20] Xavier Bonnetain, R´emi Bricout, Andr´e Schrottenloher, and Yixin Shen. Improved classical and quantum algorithms for subset-sum. In ASIACRYPT 2020, Part II, LNCS, pages 633–666, December 2020. (Cited on page 15, 16).

[0346] [BCG+19a] Elette Boyle, Geoffroy Couteau, Niv Gilboa, Yuval Ishai, Lisa Kohl, Peter Rindal, and Peter Scholl. Efficient two-round OT extension and silent non-interactive secure computation. In Lorenzo Cavallaro, Johannes Kinder, XiaoFeng Wang, and Jonathan Katz, editors, ACM CCS 2019, pages 291–308. ACM Press, November 2019. (Cited on page 10, 20, 21, 25).

[0347] [BCG+19b] Elette Boyle, Geoffroy Couteau, Niv Gilboa, Yuval Ishai, Lisa Kohl, and Peter Scholl. Efficient pseudorandom correlation generators: Silent OT extension and more. In Alexandra Boldyreva and Daniele Micciancio, editors, CRYPTO 2019, Part III, volume 11694 of LNCS, pages 489–518, August 2019. (Cited on page 6, 20, 25).

[0348] [BCG+23] Elette Boyle, Geoffroy Couteau, Niv Gilboa, Yuval Ishai, Lisa Kohl, Nicolas Resch, and Peter Scholl. Oblivious transfer with constant computational overhead. In Carmit Hazay and Martijn Stam, editors, EUROCRYPT 2023, Part I, volume 14004 of LNCS, pages 271–302. Springer, 2023. (Cited on page 25).

[0349] [BCJ11] Anja Becker, Jean-S´ebastien Coron, and Antoine Joux. Improved generic algorithms for hard knapsacks. In Kenneth G. Paterson, editor, EUROCRYPT 2011, volume 6632 of LNCS, pages 364–385, May 2011. (Cited on page 15).

[0350] [BDG+22] Saikrishna Badrinarayanan, Sourav Das, Gayathri Garimella, Srinivasan Raghuraman, and Peter Rindal. Secret-shared joins with multiplicity from aggregation trees. In Heng Yin, Angelos Stavrou, Cas Cremers, and Elaine Shi, editors, ACM CCS 2022, pages 209– 222. ACM Press, 2022. (Cited on page 6).

[0351] [BIP+18] Dan Boneh, Yuval Ishai, Alain Passel`egue, Amit Sahai, and David J.Wu. Exploring crypto dark matter: New simple PRF candidates and their applications. In Amos Beimel and Stefan Dziembowski, editors, TCC 2018, Part II, volume 11240 of LNCS, pages 699–729, November 2018. (Cited on page 3, 4, 5, 6, 10, 11, 12, 13, 14, 16, 28, 30).

[0352] [BKW20] Dan Boneh, Dmitry Kogan, and KatharineWoo. Oblivious pseudorandom functions from isogenies. In ASIACRYPT 2020, Part II, LNCS, pages 520–550, December 2020. (Cited on page 28).

[0353] [BM82] Manuel Blum and Silvio Micali. How to generate cryptographically strong sequences of pseudo random bits. In 23rd FOCS, pages 112–117. IEEE Computer Society Press, November 1982. (Cited on page 3).

[0354] [BMR16] Marshall Ball, Tal Malkin, and Mike Rosulek. Garbling gadgets for Boolean and arithmetic circuits. In Edgar R. Weippl, Stefan Katzenbeisser, Christopher Kruegel, Andrew C. Myers, and Shai Halevi, editors, ACM CCS 2016, pages 565–577. ACM Press, October 2016. (Cited on page 26).

[0355] [BPR12] Abhishek Banerjee, Chris Peikert, and Alon Rosen. Pseudorandom functions and lattices. In David Pointcheval and Thomas Johansson, editors, EUROCRYPT 2012, volume 7237 of LNCS, pages 719–737, April 2012. (Cited on page 16).

[0356] [BR17] Andrej Bogdanov and Alon Rosen. Pseudorandom Functions: Three Decades Later, pages 79–158. Springer International Publishing, 2017. (Cited on page 10).

[0357] [BS91] Eli Biham and Adi Shamir. Differential cryptanalysis of DES-like cryptosystems. Journal of Cryptology, 4(1):3–72, January 1991. (Cited on page 3).

[0358] [CCJ23] Eliana Carozza, Geoffroy Couteau, and Antoine Joux. Short signatures from regular syndrome decoding in the head. In Carmit Hazay and Martijn Stam, editors, EUROCRYPT 2023, Part V, volume 14008 of LNCS, pages 532–563. Springer, 2023. (Cited on page 6, 7, 9, 18, 20, 30, 33, 34).

[0359] [CCKK21] Jung Hee Cheon, Wonhee Cho, Jeong Han Kim, and Jiseung Kim. Adventures in crypto dark matter: Attacks and fixes for weak pseudorandom functions. In Juan A. Garay, editor, PKC 2021, Part II, volume 12711 of LNCS, pages 739–760. Springer, 2021. (Cited on page 4).

[0360] [CDG+17] Melissa Chase, David Derler, Steven Goldfeder, Claudio Orlandi, Sebastian Ramacher, Christian Rechberger, Daniel Slamanig, and Greg Zaverucha. Post- quantum zero-knowledge and signatures from symmetric-key primitives. In Bhavani M. Thuraisingham, David Evans, Tal Malkin, and Dongyan Xu, editors, ACM CCS 2017, pages 1825–1842. ACM Press, October / November 2017. (Cited on page 7, 30).

[0361] [Cha82] David Chaum. Blind signatures for untraceable payments. In David Chaum, Ronald L. Rivest, and Alan T. Sherman, editors, CRYPTO’82, pages 199–203. Plenum Press, New York, USA, 1982. (Cited on page 3).

[0362] [CKY09] Jan Camenisch, Aggelos Kiayias, and Moti Yung. On the portability of generalized Schnorr proofs. In Antoine Joux, editor, EUROCRYPT 2009, volume 5479 of LNCS, pages 425–442, April 2009. (Cited on page 9).

[0363] [DEG+18] Christoph Dobraunig, Maria Eichlseder, Lorenzo Grassi, Virginie Lallemand, Gregor Leander, Eik List, Florian Mendel, and Christian Rechberger. Rasta: A cipher with low ANDdepth and few ANDs per bit. In Hovav Shacham and Alexandra Boldyreva, editors, CRYPTO 2018, Part I, volume 10991 of LNCS, pages 662–692, August 2018. (Cited on page 3).

[0364] [DGGK21] Christoph Dobraunig, Lorenzo Grassi, Anna Guinet, and Daniel Kuijsters. Ciminion: Symmetric encryption based on toffoli-gates over large finite fields. In Anne Canteaut and Francois-Xavier Standaert, editors, EUROCRYPT 2021, Part II, volume 12697 of LNCS, pages 3–34. Springer, 2021. (Cited on page 3).

[0365] [DGH+21] Itai Dinur, Steven Goldfeder, Tzipora Halevi, Yuval Ishai, Mahimna Kelkar, Vivek Sharma, and Greg Zaverucha. Mpc-friendly symmetric cryptography from alternating moduli: Candidates, protocols, and applications. In Tal Malkin and Chris Peikert, editors, CRYPTO 2021, Part IV, volume 12828 of LNCS, pages 517–547. Springer, 2021. (Cited on page 3, 4, 5, 6, 10, 11, 12, 13, 14, 15, 16, 27, 28, 29, 30, 34, 35).

[0366] [DKL+13] Ivan Damg˚ard, Marcel Keller, Enrique Larraia, Valerio Pastro, Peter Scholl, and Nigel P. Smart. Practical covertly secure MPC for dishonest majority - or: Breaking the SPDZ limits. In Jason Crampton, Sushil Jajodia, and Keith Mayes, editors, ESORICS 2013, volume 8134 of LNCS, pages 1–18, September 2013. (Cited on page 36).

[0367] [DKR+22] Christoph Dobraunig, Daniel Kales, Christian Rechberger, Markus Schofnegger, and Greg Zaverucha. Shorter signatures based on tailor-made minimalist symmetric-key crypto. In Heng Yin, Angelos Stavrou, Cas Cremers, and Elaine Shi, editors, ACM CCS 2022, pages 843–857. ACM Press, 2022. (Cited on page 7).

[0368] [DPSZ12] Ivan Damg˚ard, Valerio Pastro, Nigel P. Smart, and Sarah Zakarias. Multiparty computation from somewhat homomorphic encryption. In Reihaneh Safavi-Naini and Ran Canetti, editors, CRYPTO 2012, volume 7417 of LNCS, pages 643–662. Springer, 2012. (Cited on page 36).

[0369] [ESLL19] Muhammed F. Esgin, Ron Steinfeld, Joseph K. Liu, and Dongxi Liu. Lattice-based zero-knowledge proofs: New techniques for shorter and faster constructions and applications. In Alexandra Boldyreva and Daniele Micciancio, editors, CRYPTO 2019, Part I, volume 11692 of LNCS, pages 115–146, August 2019. (Cited on page 36).

[0370] [ESZ22] Muhammed F. Esgin, Ron Steinfeld, and Raymond K. Zhao. Matrict+: More efficient post-quantum private blockchain payments. In IEEE Symposium on Security and Privacy 2022, pages 1281–1298. IEEE Computer Society, 2022. (Cited on page 7, 36).

[0371] [EZS+19] Muhammed F. Esgin, Raymond K. Zhao, Ron Steinfeld, Joseph K. Liu, and Dongxi Liu. MatRiCT: Efficient, scalable and post-quantum blockchain confidential transactions protocol. In Lorenzo Cavallaro, Johannes Kinder, XiaoFeng Wang, and Jonathan Katz, editors, ACM CCS 2019, pages 567–584. ACM Press, November 2019. (Cited on page 36).

[0372] [FIPR05] Michael J. Freedman, Yuval Ishai, Benny Pinkas, and Omer Reingold. Keyword search and oblivious pseudorandom functions. In Joe Kilian, editor, TCC 2005, volume 3378 of LNCS, pages 303–324, February 2005. (Cited on page 3).

[0373] [FJR22] Thibauld Feneuil, Antoine Joux, and Matthieu Rivain. Syndrome decoding in the head: Shorter signatures from zero-knowledge proofs. In Yevgeniy Dodis and Thomas Shrimpton, editors, CRYPTO 2022, Part II, volume 13508 of LNCS, pages 541–572. Springer, 2022. (Cited on page 30, 33).

[0374] [GGHAK22] Aarushi Goel, Matthew Green, Mathias Hall-Andersen, and Gabriel Kaptchuk. Efficient set membership proofs using MPC-in-the-head. PoPETs, 2022(2):304–324, April 2022. (Cited on page 5, 7, 35, 36, 37).

[0375] [GGM84] Oded Goldreich, Shafi Goldwasser, and Silvio Micali. How to construct random functions (extended abstract). In 25th FOCS, pages 464–479. IEEE Computer Society Press, October 1984. (Cited on page 3, 31).

[0376] [GOSW23] Lorenzo Grassi, Morten Oygarden, Markus Schofnegger, and RomanWalch. From farfalle to megafono via ciminion: The PRF hydra for MPC applications. In Carmit Hazay and Martijn Stam, editors, EUROCRYPT 2023, Part IV, volume 14007 of LNCS, pages 255–286. Springer, 2023. (Cited on page 3).

[0377] [GRR+16] Lorenzo Grassi, Christian Rechberger, Dragos Rotaru, Peter Scholl, and Nigel P. Smart. MPC-friendly symmetric key primitives. In Edgar R. Weippl, Stefan Katzenbeisser, Christopher Kruegel, Andrew C. Myers, and Shai Halevi, editors, ACM CCS 2016, pages 430–443. ACM Press, October 2016. (Cited on page 3).

[0378] [GRS23] Venkatesan Guruswami, Atri Rudra, and Madhu Sudan. Essential coding theory. Draft available at http: / / www.cse.buffalo.edu / faculty / atri / courses / coding-theory / book, 2023. (Cited on page 8).

[0379] [HBD+22] Andreas Hulsing, Daniel J. Bernstein, Christoph Dobraunig, Maria Eichlseder, Scott Fluhrer, Stefan-Lukas Gazdag, Panos Kampanakis, Stefan Kolbl, Tanja Lange, Martin M Lauridsen, Florian Mendel, Ruben Niederhagen, Christian Rechberger, Joost Rijneveld, Peter Schwabe, Jean- Philippe Aumasson, Bas Westerbaan, and Ward Beullens.Sphincs+. Technical report, National Institute of Standards and Technology, 2022. https: / / csrc.nist.gov / Projects / post-quantum-cryptography / selected-algorithms-2022. (Cited on page 34).

[0380] [HHM+24] Lena Heimberger, Tobias Hennerbichler, Fredrik Meisingseth, Sebastian Ramacher, and Christian Rechberger. Oprfs from isogenies: Designs and analysis. In Jianying Zhou, Tony Q. S. Quek, Debin Gao, and Alvaro Cardenas, editors, ASIACCS 2024. ACM Press, 2024. (Cited on page 28).

[0381] [HILL99] Johan H˚astad, Russell Impagliazzo, Leonid A. Levin, and Michael Luby. A pseudorandom generator from any one-way function. SIAM J. Comput., 28(4):1364–1396, 1999. (Cited on page 8).

[0382] [HJ10] Nick Howgrave-Graham and Antoine Joux. New generic algorithms for hard knapsacks. In Henri Gilbert, editor, EUROCRYPT 2010, volume 6110 of LNCS, pages 235–256, May / June 2010. (Cited on page 15).

[0383] [HPS98] Jeffrey Hoffstein, Jill Pipher, and Joseph H. Silverman. NTRU: A ring- based public key cryptosystem. In Joe Buhler, editor, ANTS, volume 1423 of LNCS, pages 267– 288. Springer, 1998. (Cited on page 3).

[0384] [IKNP03] Yuval Ishai, Joe Kilian, Kobbi Nissim, and Erez Petrank. Extending oblivious transfers efficiently. In Dan Boneh, editor, CRYPTO 2003, volume 2729 of LNCS, pages 145–161, August 2003. (Cited on page 10).

[0385] [IKNZ23] Yuval Ishai, Mahimna Kelkar, Varun Narayanan, and Liav Zafar. One- message secure reductions: On the cost of converting correlations. In Helena Handschuh and Anna Lysyanskaya, editors, CRYPTO 2023, Part I, volume 14081 of LNCS, pages 515–547. Springer, 2023. (Cited on page 11, 23).

[0386] [IKOS07] Yuval Ishai, Eyal Kushilevitz, Rafail Ostrovsky, and Amit Sahai. Zero- knowledge from secure multiparty computation. In David S. Johnson and Uriel Feige, editors, 39th ACM STOC, pages 21–30. ACM Press, June 2007. (Cited on page 3, 30).

[0387] [KHS+23] Seongkwang Kim, Jincheol Ha, Mincheol Son, ByeongHak Lee, Dukjae Moon, Joohee Lee, Sangyub Lee, Jihoon Kwon, Jihoon Cho, Hyojin Yoon, and Jooyoung Lee.AIM: symmetric primitive for shorter signatures with stronger security. In Weizhi Meng, Christian Damsgaard Jensen, Cas Cremers, and Engin Kirda, editors, ACM CCS 2023, pages 401–415. ACM Press, 2023. (Cited on page 7, 34).

[0388] [KKW18] Jonathan Katz, Vladimir Kolesnikov, and Xiao Wang. Improved non- interactive zero knowledge with applications to post-quantum signatures. In David Lie, Mohammad Mannan, Michael Backes, and XiaoFeng Wang, editors, ACM CCS 2018, pages 525–537. ACM Press, October 2018. (Cited on page 6, 30).

[0389] [KS08] Vladimir Kolesnikov and Thomas Schneider. Improved garbled circuit: Free XOR gates and applications. In Luca Aceto, Ivan Damg˚ard, Leslie Ann Goldberg, Magn´us M. Halld´orsson, Anna Ing´olfsd´ottir, and Igor Walukiewicz, editors, ICALP 2008, Part II, volume 5126 of LNCS, pages 486–498. Springer, 2008. (Cited on page 26)

[0390] [KZ20] Daniel Kales and Greg Zaverucha. An attack on some signature schemes constructed from five-pass identification schemes. In CANS 20, LNCS, pages 3–22, 2020. (Cited on page 30, 34).

[0391] [KZ22] Daniel Kales and Greg Zaverucha. Efficient lifting for shorter zero- knowledge proofs and post-quantum signatures. Cryptology ePrint Archive, Report 2022 / 588, 2022. https: / / eprint.iacr.org / 2022 / 588. (Cited on page 30, 34, 36).

[0392] [Lev85] Leonid A. Levin. One-way functions and pseudorandom generators. In 17th ACM STOC, pages 363–365. ACM Press, May 1985. (Cited on page 3).

[0393] [LLNW16] Benoˆıt Libert, San Ling, Khoa Nguyen, and Huaxiong Wang. Zero- knowledge arguments for latticebased accumulators: Logarithmic-size ring signatures and group signatures without trapdoors. In Marc Fischlin and Jean-S´ebastien Coron, editors, EUROCRYPT 2016, Part II, volume 9666 of LNCS, pages 1–31, May 2016. (Cited on page 36).

[0394] [LN17] Yehuda Lindell and Ariel Nof. A framework for constructing fast MPC over arithmetic circuits with malicious adversaries and an honest-majority. In Bhavani M. Thuraisingham, David Evans, Tal Malkin, and Dongyan Xu, editors, ACM CCS 2017, pages 259–276. ACM Press, October / November 2017. (Cited on page 36).

[0395] [LNS21] Vadim Lyubashevsky, Ngoc Khanh Nguyen, and Gregor Seiler. SMILE: set membership from ideal lattices with applications to ring signatures and confidential transactions. In Tal Malkin and Chris Peikert, editors, CRYPTO 2021, Part II, volume 12826 of LNCS, pages 611–640. Springer, 2021. (Cited on page 7, 36).

[0396] [Mea86] Catherine A. Meadows. A more efficient cryptographic matchmaking protocol for use in the absence of a continuously available third party. In IEEE Symposium on Security and Privacy 1986, pages 134–137. IEEE Computer Society, 1986. (Cited on page 6, 28, 29).

[0397] [MM11] Daniele Micciancio and Petros Mol. Pseudorandom knapsacks and the sample complexity of LWE search-to-decision reductions. In Phillip Rogaway, editor, CRYPTO 2011, volume 6841 of LNCS, pages 465–484, August 2011. (Cited on page 15).

[0398] [MRR20] Payman Mohassel, Peter Rindal, and Mike Rosulek. Fast database joins and PSI for secret shared data. In ACM CCS 20, pages 1271–1287. ACM Press, 2020. (Cited on page 6).

[0399] [MRV99] Silvio Micali, Michael O. Rabin, and Salil P. Vadhan. Verifiable random functions. In 40th FOCS, pages 120–130. IEEE Computer Society Press, October 1999. (Cited on page 3).

[0400] [Noe15] Shen Noether. Ring signature confidential transactions for monero. Cryptology ePrint Archive, Report 2015 / 1098, 2015. https: / / eprint.iacr.org / 2015 / 1098. (Cited on page 35).

[0401] [NR97] Moni Naor and Omer Reingold. Number-theoretic constructions of efficient pseudo-random functions. In 38th FOCS, pages 458–467. IEEE Computer Society Press, October 1997. (Cited on page 3).

[0402] [PS00] David Pointcheval and Jacques Stern. Security arguments for digital signatures and blind signatures. Journal of Cryptology, 13(3):361–396, June 2000. (Cited on page 32).

[0403] [Raz87] Alexander A Razborov. Lower bounds on the size of bounded depth circuits over a complete basis with logical addition. Mathematical Notes of the Academy of Sciences of the USSR, 41(4):333–338, 1987. (Cited on page 10).

[0404] [Roy22] Lawrence Roy. Softspokenot: Quieter OT extension from small-field silent VOLE in the minicrypt model. In Yevgeniy Dodis and Thomas Shrimpton, editors, CRYPTO 2022, Part I, volume 13507 of LNCS, pages 657–687. Springer, 2022. (Cited on page 10).

[0405] [RR] Peter Rindal and Lawrence Roy. libOTe: an efficient, portable, and easy to use Oblivious Transfer Library. https: / / github.com / osu-crypto / libOTe. (Cited on page 27, 37).

[0406] [RRT23] Srinivasan Raghuraman, Peter Rindal, and Titouan Tanguy. Expand- convolute codes for pseudorandom correlation generators from LPN. In Helena Handschuh and Anna Lysyanskaya, editors, CRYPTO 2023, Part IV, volume 14084 of LNCS, pages 602–632. Springer, 2023. (Cited on page 6, 10, 20, 25).

[0407] [RST01] Ronald L. Rivest, Adi Shamir, and Yael Tauman. How to leak a secret. In Colin Boyd, editor, ASIACRYPT 2001, volume 2248 of LNCS, pages 552–565, December 2001. (Cited on page 3, 35).

[0408] [SHB23] Istv´an Andr´as Seres, M´at´e Horv´ath, and P´eter Burcsi. The legendre pseudorandom function as a multivariate quadratic cryptosystem: security and applications. Applicable Algebra in Engineering, Communication and Computing, pages 1–31, 2023. (Cited on page 28).

[0409] [Smo87] Roman Smolensky. Algebraic methods in the theory of lower bounds for Boolean circuit complexity. In Alfred Aho, editor, 19th ACM STOC, pages 77–82. ACM Press, May 1987. (Cited on page 10).

[0410] [TKS+19] Wilson Abel Alberto Torres, Veronika Kuchta, Ron Steinfeld, Amin Sakzad, Joseph K. Liu, and Jacob Cheng. Lattice RingCT V2.0 with multiple input and multiple output wallets. In Julian Jang-Jaccard and Fuchun Guo, editors, ACISP 19, volume 11547 of LNCS, pages 156–175, July 2019. (Cited on page 36).

[0411] [Yao82] Andrew Chi-Chih Yao. Theory and applications of trapdoor functions (extended abstract). In 23rd FOCS, pages 80–91. IEEE Computer Society Press, November 1982. (Cited on page 3).

[0412] [Yao86] Andrew Chi-Chih Yao. How to generate and exchange secrets (extended abstract). In 27th FOCS, pages 162–167. IEEE Computer Society Press, October 1986. (Cited on page 26).

Claims

WHAT IS CLAIMED IS:

1. A method for performing authenticated communication of a message, the method comprising performing by a prover computing system: obtaining a public matrix A comprising a first plurality of values, the first plurality of values sampled from a first distribution, wherein the public matrix A has values mod M that is a first prime number; obtaining a public matrix B comprising a second plurality of values, the second plurality of values sampled from a second distribution, wherein the public matrix B has values mod K that is a second prime number different from the first prime number; storing a vector x that is a signing private key; computing a local set of [x] vectors that has values mod M, wherein each vector in the local set of [x] vectors combines to the value of the vector x; computing a local set of [t] vectors that has values mod K, wherein each vector in the local set of [t] vectors combines to the mod K equivalent of a s vector computed using a random seed; computing a set of state vectors, wherein each state vector in the set of state vectors includes a portion of a seed or a portion of the seed, a first local [x] vector included in the local set of [x] vectors, and a first local [t] vector included in a set of local [t] vectors; computing a set of commitments using the set of state vectors; computing a first hash value h using a first hash function and the set of commitments; transmitting, to a verifier computing system, the first hash value h; obtaining a random permutation π; computing a set of local [v] vectors by applying the public matrix A to respective local [x] vectors; computing a set of converted local [v'] vectors by converting respective local [v] vectors from mod M to mod K using the random permutation π; computing a set of local [y] vectors by applying the public matrix B to the set of converted local [v'] vectors; computing a set of message vectors using the set of local [y] vectors, the random permutation π, and the set of local [v] vectors;computing a second hash value h' using a second hash function and the set of message vectors; transmitting, to the verifier computing system, the second hash value h'; receiving, from the verifier computing system, a request for a subset of the set of state vectors; and transmitting the subset of the set of state vectors to the verifier computing system, thereby enabling the verifier computing system to authenticate the prover computing system.

2. The method of claim 1, wherein at least one of the first distribution and the second distribution is a uniform distribution or a pseudorandom distribution.

3. The method of claim 1, wherein the random permutation π is generated by the prover computing system and is a third hash value generated by inputting the first hash value h into a third hash function.

4. The method of claim 3, wherein generating the random permutation π further comprises inputting a message to be authenticated into the third hash function.

5. The method of claim 1, wherein the random permutation π is a hash value of a combination of the first hash value h and the message signed using the vector x that is the signing private key.

6. The method of claim 1, wherein the first hash function and the second hash function are different hash functions.

7. The method of claim 1, wherein the request for the subset of the set of state vectors requests all but one of the set of state vectors.

8. The method of claim 1, further comprising transmitting a commitment from the set of commitments generated using the state vector included in the set of state vectors that was not requested.

9. The method of claim 1, wherein a product of the public matrix B, the public matrix A, and the vector x compute a public vector y used by the verifier computing system to authenticate the prover computing system.

10. The method of claim 9, wherein the public vector y is a combination of each of the local [y] vectors in the set of local [y] vectors .

11. The method of claim 1, wherein the vector x is a binary vector and the public matrix A is a binary matrix.

12. The method of claim 1, wherein at least one of the first prime number or the second prime number is 2 or 3.

13. The method of claim 1, further comprising: generating a set of respective local [z] vectors using the respective local [v] vectors, the random permutation π, and the vector s. transmitting, to the verifier computing system, at least a portion of the set of respective local [z] vectors.

14. The method of claim 1, further comprising: computing a subset of the local [s] vectors, first local [x] vectors, and the first local [t] vectors by inputting a portion of the random seed into a third hash function, wherein all the local [s] vectors combine to a value of the s vector.

15. A method for performing authenticated communication of a message, the method comprising performing by a verifier computing system: obtaining a public matrix A comprising a first plurality of values, the first plurality of values sampled from a first distribution, wherein the public matrix A has values mod M that is a first prime number; obtaining a public matrix B comprising a second plurality of values, the second plurality of values sampled from a second distribution, wherein the public matrix B has values mod K that is a second prime number different from the first prime number; receiving, from a prover computing system, a first hash value h computed by using a first hash function and a set of commitments generated using a set of state vectors, wherein each state vector in the set of state vectors includes a respective portion of a seed which can be used to obtain a first portion of vector s, a first local [x] vector included in a local set of [x] vectors, and a first local [t] vector included in a set of local [t] vectors;receiving, from the prover computing system, a second hash value h' computed using a second hash function and a set of message vectors, the set of message vectors computed using a set of local [y] vectors, a uniformly random permutation π, and a set of local [v] vectors; transmitting, to the prover computing system, a request for a subset of the set of state vectors; receiving, from the prover computing system, the subset of the set of state vectors and a commitment of the state vector not included in the subset of the set of state vectors; computing, for each state vector in the subset of the set of state vectors, the first portion of the vector s, the first local [x] vector included in the local set of [x] vectors, and the first local [t] vector included in the set of local [t] vectors; obtaining a random permutation π; computing the set of commitments using the commitment of the state vector not included in the subset of the set of state vectors and the subset of the state vectors; computing a third hash value using the first hash function and the set of commitments; computing a subset of the set of message vectors, wherein each message vector is generated using a respective local [s] vector generated using a respective portion of a seed, a respective first local [x] vector included in the local set of [x] vectors, and a respective first local [t] vector included in the set of local [t] vectors; computing a message vector corresponding to the commitment of the state vector not included in the subset of the set of state vectors by using a set of local [y] vectors and a public y vector; computing a set of messages using the subset of the message vectors and the message vector; computing a fourth hash value using the second hash function and the set of messages; and authenticating the prover computing system based on: (i) the first hash value h being equivalent with the third hash value, and (ii) the second hash value h' being equivalent with the fourth hash value.

16. The method of claim 15, wherein the random permutation π is generated by the prover computing system and is a fifth hash value generated by inputting the first hash value h into a third hash function.

17. The method of claim 16, wherein generating the random permutation π further comprises inputting a message to be authenticated into the third hash function.

18. The method of claim 15, wherein the request for the subset of the set of state vectors requests all but one of the set of state vectors.

19. The method of claim 15, further comprising: receiving at least a portion of a set of respective local [z] vectors from the prover computing system; and computing the message vector corresponding to the commitment of the state vector not included in the subset of the set of state vectors by using at least the portion of the set of respective local [z] vectors.

20. A computer system comprising: a processor; and a non-transitory computer readable medium coupled to the processor, the non-transitory computer readable medium comprising code, executable by the processor for implementing the method of any one of claims 1-19.

Images