Identifiable abort for a cryptographic method

Abstract

A lattice-based threshold cryptographic method is provided. An information processing apparatus receives a plurality of partial contributions in the form of multidimensional vectors from a plurality of participants in the lattice-based threshold cryptographic method. The information processing apparatus generates an overall contribution by adding the partial contributions. For each received contribution a check is made to determine whether a measure of collinearity between the partial contribution and a vector based on the overall contribution is within a first range; wherein, in a case that the measure of collinearity falls within the first range, a protective action is taken.

Description

[0001]IDENTIFIABLE ABORT FOR A CRYPTOGRAPHIC METHOD Technical Field The present invention relates to a lattice-based threshold cryptographic method,an information processing apparatus, and a program. Background Athreshold signature scheme is a specific type of multiparty computationscheme that distributes a signing key across N devices so that any subset of T devicesmay interact to jointly sign a message, but strictly less than T cannot. While there existseveral efficient secure threshold signature scheme constructions based on RSA,ECDSA and Schnorr algorithms, upcoming post quantum standards, Dilithium,SPHINCS+ and Falcon are difficult to thresholdize. Building efficient thresholdsignature schemes based on post-quantum assumptions has remained a largely open problem until recently. In the past couple of years, several lattice-based threshold signature schemes have been proposed which can sometimes achieve a high number of signers. Abaseline security notion for threshold signature schemes is unforgeability ofthe resulting signature. However, this is often not sufficient as distributed protocolsneed to resist a broader class of attacks than non-distributed schemes. For example, malicious parties may sabotage the signing process so that it does not output a valid signature. One solution is to design protocols that can reliably identify such maliciousparties, a property that is referred to as identifiable aborts.Adding identifiable aborts to existing lattice threshold signature schemes isdifficult. For example, signing procedures may rely on the use of one-time masks thatare generated by passing a secret value to a pseudorandom function, a step in whichmisbehaviour is nontrivial to detect without relying on heavy tools such as non-interactive zero knowledge proofs.Accordingly, there is a desire for improved techniques for identifying maliciousbehaviour in lattice-based threshold signature schemes. Summary According to a first aspect of the present invention, there is provided a lattice- based threshold cryptographic method, performed by an information processing apparatus, the method comprising: receiving a plurality of partial contributions in the form of multidimensional vectors from a plurality of participants in the lattice-based threshold cryptographic method; generating an overall contribution by adding the partial contributions; and for each received contribution: applying a check to determine whether a measure of collinearity between the partial contribution and a vector based on the overall contribution is within a first range; wherein, in a case that the measure of collinearity falls within the first range, a protective action is taken. The protective action may be at least one of: rejecting the partial contribution;and aborting the threshold cryptographic method.In some implementations, the participants generate the partial contributionsbased on random values sampled from a Gaussian distribution. The vector based on the overall contribution may be the overall contributionminus the partial contribution being checked. More specifically, the check may beperformed by determining 〈^^ , ^ − ^^〉 / ‖^ − ^^‖, where Xi is the partial contribution,X is the overall contribution, 〈^^, ^ − ^^〉 is a vector product between vectors Xi and Xminus Xi and ‖^ − ^^‖is a length of X minus Xi.In some cases, if it is determined that 〈^^, ^ − ^^〉 / ‖^ − ^^‖ takes a valuegreater than , + ^ the measure of collinearity is determined to fallwithin the first range, where σ is a standard deviation of the Gaussian distribution, κ isa security parameter, and C is a constant that accounts for a non-centred distributionthat takes a value of zero in a case that the distribution is centred. The method may further comprise applying a second check to the length of thepartial contribution. In some such implementations, if a partial contribution does not have a length falling within a second range a protective action is performed. The second range maybe ^√^ (1 − ^) − ^, ^√^ (1 + ^) + ^] where σ is a standard deviation of theGaussian distribution, d is a dimensionality of the partial contribution, τ is a parameter, and C is a constant that accounts for a non-centred distribution that takes a value of zero in a case that the distribution is centred. The second check to the length of the partial contribution may be a check thatthe length of the partial contribution is less than or equal to ^√^(1 + ^) + ^ where σis a standard deviation of the Gaussian distribution, d is a dimensionality of the partialcontribution, τ is a parameter, and C is a constant that accounts for a non-centreddistribution that takes a value of zero in a case that the distribution is centred. The parameter τ may be determined as ^ = ^^^^ (^)^^ where κ is a security parameter. In some implementations, each partial contribution takes the form of Xi = Yi +Si, where Xi is the partial contribution, Yi is a randomness sampled from a distributionand Si is a multiple of a private key that is shorter than the randomness. The distributionmay be a Gaussian distribution.In some methods, the probability of an honest party selecting amultidimensional vector falling within the first range approximately equal to or equal to 2^^. The security parameter κ may be selected to be less than or equal to at least oneof: 128, 256 and 512. The lattice-based threshold cryptographic method may be a threshold signaturescheme and the partial contributions may be partial values for generating a signature.According to a second aspect there is provided information processingapparatus comprising a processor and a storage, wherein the storage stores a program that, when executed by the information processing apparatus, causes the information processing apparatus to perform a method according to the first aspect. According to a third aspect there is provided a program that, when executed bythe information processing apparatus, causes the information processing apparatus to perform a method according to the first aspect. Further features and advantages of the invention will become apparent from the following description of preferred embodiments of the invention, given by way of example only, which is made with reference to the accompanying drawings. Brief Description of the Drawings Figure 1 illustrates collinearity of vectors;Figure 2 illustrates vectors that have been generated by random sampling;Figure 3 is a schematic diagram illustrating a rejection body for rejectingdishonestly generated partial signatures; Figure 4 is a schematic diagram showing components of an informationprocessing apparatus; Figures 5a to 5c illustrate steps of distributed key generation method with shortsecrets; Figure 6 depicts steps of a first round of a threshold signature scheme;Figure 7 depicts steps of a second round of the threshold signature scheme;Figure 8 depicts steps of a third round of the threshold signature scheme;Figure 9 depicts steps of a signature generation process for the thresholdsignature scheme; Figures 10a and 10b depicts steps for verifying a signature generated by thethreshold signature scheme; and Figure 11 is a table showing parameters for use in the threshold signaturescheme. Detailed Description The description below presents an identifiable abort process that uses thegeometry of short shares generated in cryptographic methods, such as threshold signature schemes. The technique makes use of the concentration of Gaussian mass when honestly generating short shares to allow detection of corelations betweenreceived shares which suggests collusion between users when generating the shortshares. An example threshold signature scheme will be described further below. However, the techniques described are applicable to many different schemes.Accordingly, the overall concept will be described more generally first.A lattice-based threshold signature scheme may be modelled as an aggregationof T distributed vectors provided by different signing parties. The vectors may be^ ^^, … , ^^^^ ∈ ℝ and their aggregation may be ^ = ∑^ ^^ . It is expected that, ifparticipants have honestly generated the vectors, that the norms (size of the vector) willbe concentrated around some public constant B associated with manner in which thepartial signatures are generated within the scheme. Accordingly, partial signatures witha norm that is longer than B should be rejected. However, this approach only assuresthat the final signature will have a norm ‖^‖ ≤ ^^.Dishonest participants, however, could collude to produce partial signatures that are highly correlated. This is schematically illustrated in Figure 1 which shows collinearity in two dimensions. It will be appreciated that in practice the partialsignatures will have much higher dimensionality, and that Figure 1 is purely illustrative.The dishonestly generated partial signatures could be constructed to be somewhataligned and hence have a norm close to B. This would allow the dishonest participantsto work towards creating a signature that approaches the worst case bound of T*B whilestill appearing to behave honestly. In contrast, if all participants are honest, the sum Xshould grow as√^^. Figure 2 is a schematic diagram showing randomly oriented vectors in twodimensions. As the vectors point in different directions the overall size of X increasesmore slowly because components cancel out. Hence, if X grows significantly larger than√^^ it is possible to infer that a subset of participants has colluded and introduced acorrelation between the partial signatures. An analysis based on the concentration of Gaussian mass (because the partial signatures are generated by sampling from a Gaussian distribution) suggests that the overall signature should have a norm close to its expected value. Accordingly, the gapbetween the size of √^^ and T*B allows for detection of correlations and introductionof an identifiable abort. Accordingly, a partial signature, Xi, may only be considered tobe valid if it satisfies an inner product test of the form: for a properly chosen α. Here the top term is an inner product between thevector, Xi, representing the partial signature and the overall signature, X, less the partialsignature, Xi. As there should not be collusion, there should be a low correlation (innerproduct) between the partial signature and the remainder of the signatures. This test is illustrated geometrically in Figure 3. The surface of the sphererepresents a sphere that is ‖^‖ from the center of the sphere. The arrow shown is aschematic representation of the vector X less the partial signature, Xi. The portion 30represents a ‘rejection body’, whereby if X falls within that rejection body the partialsignature was too closely correlated with the remainder of the signature, indicating a high likelihood of collusion between participants. A more specific implementation will now be described with reference to Figures 4 to 11. Preliminaries The threshold signature scheme described below may be performed on one ormore information processing apparatus such as a server, computer, and / or mobile device. A central actor will be described below. The central actor may be a separate information processing apparatus, such as a server or cloud service, and other steps of the signature scheme may be performed on user devices associated with different signers in the signature scheme. In one example a group of signers in a group may wishto be able to sign a message as long as a threshold number T of the signers in the groupcontribute to the signature process. The signers may participate in the signature scheme using separate user devices. In other implementations all the processing may be performed on a single information processing apparatus and there may be a single user. For example, a user may have a signing key associated with a cryptographic asset, such as an asset on a blockchain. The user may wish to keep the signing key secure and resistant to loss. Accordingly, the user may generate shares of the signing key and store them on different storage devices. In this case, the user may sign a document using the storage devices as long as the user has access to at least a threshold number of the devices. Similarly, a malicious actor would need access to a threshold number of the storage devices to apply the signature. In some implementations the storage devices may be drives, such as solid- state drives or the like. All steps of the method in this case could be performed on a single information processing apparatus based on information relating to the key shares stored on the storage devices. The description below will describe potential signers. However, the term ‘potential signer’ or ‘signer’ may be used interchangeably with the term ‘secret share’ because as just described, the method could be performed by a single user in respect of each secret share. Accordingly, the term ‘signer’ should not be interpreted as requiring a separate user or a separate information processing apparatus. Figure 4 is a schematic diagram of components of an example informationprocessing apparatus 4 suitable for use in the embodiments described below. Thediagram is illustrative and different hardware configurations for information processing apparatus are possible as is well known in the art. The information processing apparatus includes an I / O interface 40, such a USB port, Thunderbolt port, etc. to which an additional device, such as a storage device, could be connected. The informationprocessing apparatus 4 comprises a processor 41, a storage in the form of memory 42,a network module 43, a display 44, and a user interface 45. The network module mayallow the information processing apparatus 4 to communicate over a network such as aWi-Fi network, a mobile telecommunications network, a local area network etc. The user interface may include components such as a keyboard, mouse, camera, etc. The components of the information processing apparatus may communicate with each other over a bus 46. Further components may be provided but are not shown or described. Any of the steps of the subsequently described methods may be performed by computer-readable instructions of one or more programs stored in a storage and executed by a processor on one or more information processing apparatuses. The program may be stored on a non-transitory computer readable storage medium. Although not shown in the figures, the threshold signature method begins with a key generation method, which will be described below. The method is performed overa uniform matrix, A, over a ring of polynomials, R. R is a ring of polynomials modulod. The Ring, R, is defined for asℤ ^ℛ =[ ]^^ + 1and Rqis defined as: The methods below on the assumption that Hint Module Learning with Errors problem is hard to solve. The problem is defined over For more details, see, for example, Thomas Espitau, Guilhem Niot, and Thomas Prest. Flood and submerse:Distributed key generation and robust threshold signature from lattices. In LeonidReyzin and Douglas Stebila, editors, CRYPTO 2024, Part VII, volume 14926 of LNCS,pages 425–458. Springer, Cham, August 2024. The matrix, ^ ∈ ℛ^×^^ , has dimensions of k by l and each entry in the matrix isa polynomial of Rq. In the description below, a discrete Gaussian distribution is referred to. AGaussian distribution about a point v with a standard deviation of σ is given by: Distributed key generation Adistributed key generation that distributes short secrets is used in the methoddescribed below. The method uses a Keygen protocol between N participants. Themethod generates a public key, vk, an auxiliary key, ak, and a partial private key ski, for each participant, composed of a pool of shares SI. Figure 5a is a flowchart showing steps of a Distributed Key Generation schemethat distributes short secrets. The steps of this scheme are also illustrated in more detailin Figure 5b. In step 50 of Figure 5a and step 1 of Figure 5b, each party samples a seed.The seed, ^^^^^ ← {0,1}^, may be a binary string of length κ, where κ is a securityparameter. Each party then sends to other parties a hashed commitment that is a hashof their sampled seed, cmti ∶= ^^^^(^^^^^).In a second round, at step 51, after each party has committed to their seed, eachparty i reveals their seed, seedi.In a third round, at step 52, each party checks the received seeds against thehashed commitments from the first round. If the seeds match the hashed commitments,each party computes an overall seed, ^^^^ = by hashing or usinganother one-way function on the received seeds. Each party generates (Figure 5b, step2) a public matrix, ^ = ^^^^^^^(^^^^), using a generator function and the overallseed, such as a pseudo-random function. In step 4 of Figure 5b, the parties sample secrets ^^ from a distribution^ for each party in each set of parties I. The sets I are sets of cardinality ^ − ^ + 1.The sets I include all different sets of cardinality ^ − ^ + 1 that it is possible to formwithin the group of N parties. The distribution ^ is selected so that the sampled secretswill be short below a threshold size ^^ with very high likelihood. More specifically,each party samples secrets for each set I of cardinality ^ − ^ + 1 for which that partyis a member of the set and has the largest identity in the set (for an identity i, ^ =max (^)). In other words, a single party in each set of cardinality ^ − ^ + 1 that canbe formed for the group of N users generates secrets for that set.In step 5 of Figure 5b, the party generating the secrets also computes a partialpublic key ^^ = [^^] ∙ ^^ using the public matrix, A, and the secrets, ^^ . Here I is theidentity matrix. In step 53 of Figure 5a, the parties that generate secrets for one or moreset send the secrets sI for the set over a private channel to all parties in the set ^ ∈ ^.The party publishes a commitment of the public key that it generated for the set, ^^^^^∶= ^^^^(^^), for each public key, bI , of each set.Finally, in a fourth round at step 54, all the parties reveal the bI they generatedin the previous round. The parties also verify the consistency of the sI they receivedwith the hashes ^^^^^, in case of inconsistency, they complain against the party that sent the secrets and commitment of the public key, i.e. they reveal the value they receivedso that the inconsistency can be publicly verified. The parties also check the shortnessof the received secrets, which should be assured by sampling from the distribution ^.The results of the short distributed key generation, Figure 5b steps 9 to 11, area key aggregation that consists in choosing as public key ^^ ∶= ^ ^^ , and theauxiliary key, ak, that is the set of all the partial keys ^^ ∶= (^^)^. In case there werecomplaints in the last round, aggregation verifies them and in case they are valid,malicious parties are identified. A Distributed Key Generation secret is a sum of thesecrets across the sets, i.e. ^ = ∑^ ^^ .To understand how this distributed key generation works intuitively, note thatif you have at least T parties, then you must have a party that is a member of every set.Accordingly, a sum can be formed collectively that will be a complete sum of the setsof secrets. On the other hand, if you have fewer than T parties, you do not have enoughparties to have a member of each of the possible sets of cardinality ^ − ^ + 1.Accordingly, with fewer than T parties, it is impossible to reconstruct the DistributedKey Generation secret.Figure 5c illustrates steps of an algorithm: This algorithm provides coefficients for reconstruction of the secret or publickey from individual shares for any given set ‘act’ of at least T parties.Steps 1 to 4 illustrate that for each set I of cardinality ^ − ^ + 1 if a deviceidentity within the group, i, is the largest identity that is both in the set, I, and the groupact of parties performing the threshold method, then the value ^^,^ = 1. Otherwise, asshown in steps 5 and 6, for all other parties, ^^,^ = 0. Intuitively this allows partieswithin the group of parties performing the threshold method, act, to have a coefficientto allow the secret or partial public key from each set to be added only once whenforming a partial secret or partial public key. When threshold method is completed, thepartial secrets or partial public keys should sum to overall key as described above inconnection with Figures 5a and 5b. Accordingly, during the key generation process, each potential signer receivesa pool of secret shares ski associated with the sets that the signer is a member of.Threshold signature method The public key for the threshold signature scheme (which is different from thatof the distributed key generation described above), vk, takes a form of A, As+e. Thematrix, A, and the public key, vk, are made publicly available parameters. The threshold signature method proceeds in three rounds. In someimplementations each round will be time limited such that each of a threshold numberof active signers (hereinafter ‘signers’) of the N potential signers should complete thespecified steps within the time limit. If the threshold number of signers do not completethe required steps for a round within the time limit, the threshold signature method maybe aborted. In a first round, each signer generates and makes available a commitment, cmti. In a second round, each signer makes available an LWE commitment, wi. In athird round, each signer makes available a response zi. A central actor or one of theparticipants can then generate a signed message based on the available information aswill be described in connection with Figure 9. Each round may be completedsequentially to maintain security of the signature scheme. At the end of each round thesigners may check that the round has been completed before initiating steps in the subsequent round. Threshold signature method Figure 6 is a schematic diagram showing steps performed by each signer duringa first round of the threshold signature scheme. The inputs to the first round are a stateof the signer, sti, a session identifier, sid, an identifier of a group of signers, act, and amessage to be signed, msg. In step 2, each signer identified by subscript, i, samples two random vectors,^^ , ^ ^^. The values are sampled from Gaussian distributions ^ over the ring. In step 3,an LWE commitment, wi, is determined as a sum of the second random vector and aproduct of the first random vector and the public matrix, A:^^ ∶= ^. ^^ + ^^ ^In step 4, the session state, sti, at each signer is updated to include the generatedcommitment, wi, and the sampled random values ^^ and ^^^. In step 5 a hash commitment, cmti, is calculated that is a hash (or other one-wayfunction) of the public key, the identity of the signer, i, and the commitment, wi:^^^^ = ^^^^(^^, ^, ^^)The hash commitment is shared with other signers as a public message, pm1, atthe end of the first round. Figure 7 is a schematic diagram showing steps of a second round of thethreshold signature scheme. At the start of the second round each signer should have received thecommitments from public messages, pm1, distributed by the other signers in a signingset at the end of the first round. Each signer reads their previously generated LWEcommitment, wi, from their state and sends the LWE commitment to each other signerin a signing set as a second public message, pm2, at the end of the second round.Figure 8 shows a third round of the threshold signature scheme performed byeach signer in a signing set. Steps 1 and 2 relate to reading the signer state and checkingthat the previous rounds have been completed. In step 3, the received LWEcommitments, wi, are parsed and in steps 4 and 5 the received LWE commitments arechecked against the hash commitments, cmtj, sent in the first round. If the LWEcommitments, wi, don’t match the hash commitments sent in the first round, then themethod is aborted. In step 7, an aggregated commitment w is generated by summing the receivedLWE commitments, wi.In step 8, a challenge value, c, is calculated as a hash of the public key, amessage to be signed and the aggregated commitment, w:^ = ^^(^^, ^^^, ^)Step 9 the coefficients for recovery of the secret, ^^,^ are generated. This step isperformed using the function Recover (Repl.Recover) of the distributed key agreementdiscussed above in connection with Figure 5c.In step 10, an individual response zi is determined as a sum of the first randomvalue, ri, and a product of the coefficients for recovery, ^^,^, and the set of secrets, ^^[^],for each pool of secrets Si. This causes each signer to contribute secrets from the sets Iof which it is a member and has the highest identifier, i. This may be expressed follows:It is noted that the individual response determined above corresponds to thepartial signature, Xi, discussed above and further below in connection with the test forcollinearity. In step 11, each signer distributes their generated individual response as a thirdpublic message, pm3.A signature generation round, Combine, is performed by one or more signerswithin the signing set and is described with reference to Figure 9. In step 1, a signer parses the commitments, wi, and individual responses, zi,received from the second and third public messages during the earlier rounds. In step 2, an overall contribution, w, is determined by summing the receivedcommitments, wi, across the signing set, act.In step 3, an overall challenge, c, is determined by hashing the public key, vk,the message, msg, and the overall contribution, w: ^∶= ^^(^^, ^^^, ^)In steps 4 to 6, a PartialVerify algorithm is performed. The PartialVerifyalgorithm checks the consistency of each individual response, zi, with the correspondingcommitment, wi, and with the partial signing key asexplained in more detail below. The PartialVerify algorithm is shown in Figure 10a . In step 1 the partial keysare retrieved from the auxiliary key, which was made public during the distributed key generation process. In step 2, the coefficients for the parties in the threshold signature set, act, are determined using the Recover algorithm described above. In step 5 a partial overall public key, ^ ^^^^ ^, is calculated for each party in thesigning set, act, as a sum over the product of the partial keys ^^[^] and the recoverycoefficients.In step 6, for each party, the method calculates a partial signature that is aproduct of the public matrix, A, and the individual response, zi, less the less a productof the overall challenge, c, and the partial overall public key, ^^^^^ ^, and less thecommitment, wi . If the size of a vector product of the received partial response, zi. andthe partial signature, yi. is greater than a threshold ^^^^^then the partial signature and partial response are declared invalid Returning to Figure 9, if the PartialVerify check is completed successfully, instep 7 and an aggregated response, z, is generated by summing the received partialresponses, zi. In step 8, an intermediate vector, u, is calculates as follows: ^∶= ^^. ^ − 2^^ . ^. ^⌉^^where ^^ and ^^ are a number of bits dropped and are given in the set ofparameters listed below. These are public parameters. In step 9, a hint, h is determined as the difference between the overallcommitment, w, and the intermediate vector, u. In step 10, an overall signature is returned that is the overall challenge, c, the aggregated response, z, and the hint, h. A method of verifying the signature is illustrated in Figure 10b. In step 1, the signature is parsed. In step 2, the intermediate vector, u, is calculated as before: An overall commitment, w, is calculated as the sum of the intermediate value,u, and the hint, h.The signature is determined to be verified if a hash of the public key, vk, themessage, msg, and the overall commitment, w, is equal to the overall challenge, c. Afurther check is performed to ensure that the norm of an inner product of the aggregatedresponse and the hint is less than a threshold value:‖^, 2^^^‖ < ^^ Parameters for this method are shown in Figure 11. The top two rows in thetables are valid for any 1 ≤ T ≤ N ≤ Nmax. The bottom row of parameters is only validfor N ≤ 16. We recall that ^ ∈ ℛ^×^^ . The value w in Figure 11 indicates the norm of thechallenge value, c. κ is a security parameter, which will be described in more detailbelow. The values σs and σshare are variances of distributions used to sample a secretvalue and secret shares in the distributed key generation. These values may be selectedand determined in dependence upon the key generation scheme used. σr is the varianceof a distributed used to sample random values in the first round of the threshold signature scheme. The above-described method includes partial signatures (individual responseszi) as discussed. As noted at the start of the description, if, due to corrupt behaviour bytwo or more of the signers, there is some positive correlation between the partialsignatures, it would be desirable to detect this and introduce an identifiable abort. Thischeck could be performed as part of the signature generation round (Combine). A testfor corruption includes one or both of the following tests. The first test is: ^^{‖^^‖ ∈ ^} According to this test, if the norm of a partial signature, Xi, does not fall withinthe identified range, I, (this range is different from the sets, I, discussed above) then thepartial signature is expected to have been incorrectly generated. The range, I, is avariance, σ, of the Gaussian distribution used to generate the vector, Xi, multiplied by a dimensionality, d, of the partial contribution defined by the Ring (set out further abovein connection with preliminaries) multiplied by either 1 – τ or 1 + τ to define the range.Due to the high dimensionality of the vectors, the partial signature is expected to passthis test with overwhelming probability.The parameter, τ, is determined by a security parameter, ^, and thedimensionality, d. The security parameter is selectable depending on the implementation. For example, κ may be selected to be less than or equal to at least one of: 128, 256 and 512. In some implementations the lower bound in the interval is not needed. Accordingly, a check that: may be used in place of the first test.The second test is that: As described above, this test checks whether the inner product of a partial signature, Xi, with the remainder of the partial signatures (in other words, the overall signature, X, less the partial signature, Xi) is greater than a threshold Jmax. The inner product is normalized by a norm of the overall signature, X, less the partial signature, Xi. If the inner product exceeds the threshold and there is too high a correlation, thepartial signature is identified as corrupt. ^ is again a security parameter and may beselected according to the implementation. For example, κ may be selected to be lessthan or equal to at least one of: 128, 256 and 512. In a case that the partial signature does not pass one or both of these tests, thepartial contribution may be rejected. In some implementations, the thresholdcryptographic method may be aborted. As the identity of the signer sending theincorrect partial signature can be found, the signer may be excluded from a messaging group or otherwise sanctioned. It may be noted that the partial signature identified in the threshold signature scheme above took the form of: which has two parts rather than being a single vector. In other words, thesignature takes a form ^^ = ^^ + ^^where ^^ ∼ ^ℤ^,^ which is a Gaussian distribution over and Siis somemultiple of a private key share such that for all i, ‖^^‖ ≤ ^ for some constant C. In suchsituations, the random component ^^should be much larger than the private key share being masked for security reasons. The secret part can accordingly be viewed as an offset and, in these cases, the tests described above are carried out in the same way with: or where the length is checked: and, for the second test, The embodiments above have been described with respect to a lattice-based Fiat-Shamir threshold signature scheme. However, the above approach may be appliedmore generally to threshold signatures and multi-signatures. Examples of schemes towhich the tests described above are applicable, include (without limitation):Ivan Damgård, Claudio Orlandi, Akira Takahashi, and Mehdi Tibouchi. Two- round n-out-of-n and multi-signatures and trapdoor commitment from lattices. In Juan Garay, editor, PKC 2021, Part I, volume 12710 of LNCS, pages 99–130. Springer, Cham, May 2021. Ivan Damgård, Claudio Orlandi, Akira Takahashi, and Mehdi Tibouchi. Two- round n-out-of-n and multi-signatures and trapdoor commitment from lattices. Journal of Cryptology, 35(2):14, April 2022. Cecilia Boschini, Akira Takahashi, and Mehdi Tibouchi. MuSig-L: Lattice- based multi-signature with single-round online phase. In Yevgeniy Dodis and Thomas Shrimpton, editors, CRYPTO 2022, Part II, volume 13508 of LNCS, pages 276–305.Springer, Cham, August 2022.Yanbo Chen. DualMS: Efficient lattice-based two-round multi-signature with trapdoor-free simulation. In Helena Handschuh and Anna Lysyanskaya, editors, CRYPTO 2023, Part V, volume 14085 of LNCS, pages 716–747. Springer, Cham, August 2023. Kamil Doruk Gur, Jonathan Katz, and Tjerand Silde. Two-round threshold lattice-based signatures from threshold homomorphic encryption. In Markku-JuhaniSaarinen and Daniel Smith-Tone, editors, Post-Quantum Cryptography - 15thInternational Workshop, PQCrypto 2024, Part II, pages 266–300. Springer, Cham, June 2024. Rutchathon Chairattana-Apirom, Stefano Tessaro, and Chenzhi Zhu. Partially non-interactive two-round lattice-based threshold signatures. Cryptology ePrint Archive, Report 2024 / 467, 2024. Nabil Alkeilani Alkadri, Nico D¨ottling, and Sihang Pu. Practical lattice-based distributed signatures for a small number of signers. In Christina P¨opper and Lejla Batina, editors, ACNS 24International Conference on Applied Cryptography and Network Security, Part I, volume 14583 of LNCS, pages 376–402. Springer, Cham, March 2024. A feature of these methods is that the partial signature generation processesoutput short shares that are subsequently aggregated. As discussed, the methodsintroduce an identifiable abort that checks whether participants in the schemes have been colluding in the generation of their contributions. The above embodiments are to be understood as illustrative examples of the invention. It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. Furthermore, equivalents and modifications not described above may also be employed without departing from the scope of the invention, which is defined in the accompanying claims.

Claims

CLAIMS1. A lattice-based threshold cryptographic method, performed by an informationprocessing apparatus, the method comprising: receiving a plurality of partial contributions in the form of multidimensional vectors from a plurality of participants in the lattice-based threshold cryptographic method; generating an overall contribution by adding the partial contributions; and for each received contribution: applying a check to determine whether a measure of collinearity between the partial contribution and a vector based on the overall contribution is within a first range; wherein, in a case that the measure of collinearity falls within the first range, a protective action is taken.

2. A method according to claim 1, wherein the protective action is at least one of:rejecting the partial contribution; and aborting the threshold cryptographic method.

3. A method according to claim 1 or claim 2, wherein the participants generate thepartial contributions based on random values sampled from a Gaussian distribution.

4. A method according to any preceding claim, wherein the vector based on theoverall contribution is the overall contribution minus the partial contribution being checked.

5. A method according to claim 4, wherein the check is performed by determining,〈^^ ,where Xi is the partial contribution, X is the overallcontribution, 〈^^ , ^ − ^^〉 is a vector product between vectors Xi and X minus Xi and‖^ − ^^‖ is a length of X minus Xi.

6. A method according to claim 5 when dependent upon claim 3, wherein if it isdetermined that 〈^^ , ^ − ^^〉 / ‖^ − ^^‖ takes a value greater than, ^^2(^ + 1)^^2 + ^the measure of collinearity is determined to fall within the first range, where σ is astandard deviation of the Gaussian distribution, κ is a security parameter, and C is aconstant that accounts for a non-centred distribution that takes a value of zero in a case that the distribution is centred.

7. A method according to any preceding claim, further comprising applying asecond check to the length of the partial contribution.

8. A method according to claim 7, wherein if a length of the partial contributiondoes not fall within a second range a protective action is performed.

9. A method according to claim 8 when dependent upon claim 3, wherein thesecond check to the length of the partial contribution checks that the length of the partialcontribution is within the second range of+ ^) + ^] whereσ is a standard deviation of the Gaussian distribution, d is a dimensionality of the partialcontribution, τ is a parameter, and C is a constant that accounts for a non-centreddistribution that takes a value of zero in a case that the distribution is centred.

10. A method according to claim 8 when dependent upon claim 3, wherein thesecond check to the length of the partial contribution checks that the length of the partialcontribution is less than or equal to ^√^(1 + ^) + ^ where σ is a standard deviation ofthe Gaussian distribution, d is a dimensionality of the partial contribution, τ is aparameter, and C is a constant that accounts for a non-centred distribution that takes avalue of zero in a case that the distribution is centred.

11. A method according to claim 9 or claim 10, wherein the parameter τ isdetermined as ^ = ^^^^ (^)^^ where κ is a security parameter.

12. A method according to any preceding claim, wherein each partial contributiontakes the form of Xi= Yi+ Si, where Xiis the partial contribution, Yiis a randomness sampled from a distribution and Siis a multiple of a private key that is shorter than the randomness.

13. A method according to claim 12, wherein the distribution is a Gaussiandistribution.

14. A method according to claim 6 or claim 11, wherein the probability of an honestparty selecting a multidimensional vector falling within the first range approximately equal to or equal to 2^^.

15. A method according to claim 14, wherein the security parameter κ is selected tobe less than or equal to at least one of: 128, 256 and 512.

16. A method according to any preceding claim wherein the lattice-based thresholdcryptographic method is a threshold signature scheme and the partial contributions are partial values for generating a signature.

17. An information processing apparatus comprising a processor and a storage, wherein the storage stores a program that, when executed by the information processing apparatus, causes the information processing apparatus to perform a method according to any of claims 1 to 16.

18. A program that, when executed by the information processing apparatus, causesthe information processing apparatus to perform a method according to any of claims 1 to 16.

Images