GCKSign: Simple and efficient signatures from generalized compact knapsack problems

TL;DR

This paper introduces GCKSign, a more efficient lattice-based digital signature scheme that reduces signature and public key sizes while maintaining security.

Contribution

The paper introduces a new lattice-based assumption called the Module GCK-TMO problem and a more efficient signature scheme that eliminates the need for witness indistinguishability.

Findings

GCKSign achieves 3.4 times shorter signature size compared to prior schemes.

The public key size is reduced by 2.4 times at the same security level.

Security is based on the Module GCK-TMO problem in the random oracle model.

Abstract

In 2009, Lyubashevsky proposed a lattice-based signature scheme using the Schnorr-like identification and the Fiat-Shamir heuristic and proved its security under the collision resistance of a generalized compact knapsack function. However, their security analysis requires the witness indistinguishability property, leading to significant inefficiency and an increase of sizes of public key and signature. To overcome the efficiency issue associated with the WI property, we introduce a new lattice-based assumption, called the target-modified one-wayness problem of the GCK function and show its reduction to well-known lattice-based problems. Additionally, we present a simple and efficient GCK-based signature scheme, GCKSign, whose security is based on the Module GCK-TMO problem in the random oracle model. GCKSign is a natural extension of Lyubashevsky’s scheme in a module setting, but achieves considerable efficiency gains due to eliminating the witness indistinguishability property. As a result, GCKSign achieves approximately 3.4 times shorter signature size and 2.4 times shorter public key size at the same security level.

Figures

Full text

1 Introduction

The generalized compact knapsack (GCK) function [1] is defined with a ring-Short Integer Solution (SIS) instance over a polynomial-based ring Rn,q for some modulus q. Specifically, for a random ring-SIS instance $[eqn]$ , the GCK function $[eqn]$ is computed as $[eqn]$ for a domain element $[eqn]$ with short coefficients. In 2002, Micciancio [1] showed that the function Fa is one-way, assuming the worst-case hardness of some shortest independent vector problems (SIVP) on cyclic lattices in a ring. Furthermore, in 2006, researchers [2, 3] proved that the GCK function Fa is collision-resistant, assuming the worst-case hardness of some shortest vector problems (SVP) for ideal lattices in a ring. Additionally, the GCK function has the linearity property, which states that Fa(c1x1 + c2x2) = c1Fa(x1) + c2Fa(x2) for any ring elements c1, c2 ∈ Rn,q and any domain elements $[eqn]$ .

Based on the aforementioned properties of the GCK function, Lyubashevsky [4] proposed a GCK-based signature scheme in 2009, using the Schnorr-like identification protocol and the Fiat-Shamir transform [5]. The main idea of [4] is to set up a public key as (a, t = Fa(s)) and its corresponding signing key as s, where $[eqn]$ is a vector of short polynomials. The signing procedure begins by sampling a short vector $[eqn]$ (from a suitable distribution) and computing v = ay(= Fa(y)). The signer then computes c = H(v, μ), where H is a hash function and μ is a message, and z = y + s**c. To ensure that the distribution of z is independent of the secret s, preventing any leakage of information about s, the signer employs a rejection rule on z. Following this rejection sampling, a signature (z, c) is generated only when z is sampled from the (predefined z’s) distribution centered at zero, rather than at s**c. Subsequently, the verifier checks whether H(az − t**c, μ) is equal to c, and z is sufficiently small.

Although the GCK-based signature proposed by Lyubashevsky has a similar structure with the previous Schnorr signature, their security proof employed in [4] relies on the concept of witness indistinguishability (WI). This notion is essential for proving the security of [4] under the assumption of collusion resistance of the GCK function. WI refers to the property that when choosing an alternative (or multiple) signing key s′ such that t = Fa(s) = Fa(s′), the signature (z = y + s**c, c) is (statistically) indistinguishable from (z = y + s′c, c). In the security analysis, all signatures are simulated using s, but due to the WI property, the adversary cannot know the exact secret key s. Thus, with high probability, it is expected that the adversary succeeds in forging a signature with the other s′. In such a case, the rewinding technique [6] enables a reductionist to extract a pair of distinct inputs as a collision of Fa. Since breaking the collision resistance of the GCK function implies the ability to solve a ring-SIS problem, the security of the GCK-based signature scheme [4] eventually relies on the hardness of a ring-SIS problem.

However, the WI property results in a significant efficiency drawback in [4]. This stems from the fact that the public key t = Fa(s) and the corresponding secret key s are generated in such a way as to guarantee collisions in Fa. Specifically, s needs to be parametrized so that there exists another valid secret key s′ such that Fa(s) = Fa(s′). This requirement mandates that each coefficient of the secret key s be sampled from a relatively large range, for example, [−2047, 2047], resulting in large size of the signature (z, c). To overcome the efficiency issue associated with the WI property and the large bound on s, Lyubashevsky [7] presented an alternative proof technique based on the decisional ring-SIS problem, where t = Fa(s) with a small bound on s is indistinguishable from a uniformly random t in Rq. Consequently, a (real) GCK-based signature scheme is constructed using s with small coefficients, while a simulated signature scheme in the security proof is provided to the adversary using s′ with large coefficients. Although the WI property with a small bound on s enables a more efficient GCK-based signature scheme, no known quantum reduction exists from worst-case lattice problems to the decisional ring-SIS problem in ideal lattices [7].

Another approach to circumvent the WI property with large coefficients of s is to construct the public key t using the Learning with Errors (LWE) problem. In this approach, t is computed as t = Fa(s) + e, where e is a polynomial sampled from a narrow distribution. Based on the decisional ring-LWE problem, which is to distinguish between a ring-LWE instance and a uniformly random one, the security proof of a ring-LWE-based signature scheme can be established using a similar argument as that of the decisional ring-SIS problem. Importantly, this approach provides improved security against quantum adversaries because there is a reduction from worst-case lattice problems to the decisional ring-LWE problems [8]. Leveraging this idea, Güneysu et al. [9] proposed a ring-LWE-based signature scheme where a signature consists of three components (c, z1, z2), where z1 = y1 + cs and z2 = y2 + ce. Bai and Galbraith [10] reduced the signature size of [9] by omitting z2 and introducing a compression technique to compensate for the correctness error resulted from e. In 2018, Ducas et al. [11] proposed a signature scheme called Dilithium, which can be viewed as a generalization of [10] based on Module-LWE problems. Additionally, [11] presented a distinct proof technique that does not rely on the WI property used previously. They employed two signature forgeries (by rewinding an adversary) to directly solve a ring-SIS problem concerning (A||t||1) rather than (A||1). Many other signatures based on [4] were proposed [12, 13] recently and their security proof also follow the way of Dilithium.

1.1 Our contribution

From what has been shown so far, while significant progress has been made in creating efficient lattice-based signatures, the following question still arises:

Can we prove the security of GCK-based signature without using the WI property?

The goal of this paper is to give a positive answer to the above problem. To achieve this, we define a relaxed version of the one-wayness problem of the GCK function, called the target-modified one-wayness (TMO) problem. In essence, the TMO problem is to solve the one-wayness problem of the GCK function approximately rather than exactly: given $[eqn]$ and t = Fa(s) ∈ Rn,q for some $[eqn]$ , find short polynomials $[eqn]$ such that Fa(x) = ct. To provide confidence in the TMO problem, we show that the TMO problem is reduced to both the one-wayness and the collision-resistance problems of the GCK function.

Instead of proving the original GCK-based signature scheme [4], we present a more efficient GCK-based signature scheme called GCKSign, which is a natural extension of [4] to the Module-GCK function. We adopt a matrix form of $[eqn]$ and $[eqn]$ and define a Module-GCK function as $[eqn]$ . Similar to the TMO problem, we establish a Module GCK-TMO problem, and show its reduction to Module-SIS, LWE problems. Notably, we prove that GCKSign is secure in the random oracle model under the Module GCK-TMO problem without relying on the WI property. By eliminating this property, we achieve significant efficiency improvements. In detail, GCKSign achieves a signature size that is about 3.4 times shorter and a public-key size that is about 2.4 times shorter at the same security level, compared to [4]. In Section 5, we provide a concrete security and efficiency comparison between [4] and GCKSign.

2 Preliminaries

We begin by defining the syntax and security of digital signature. We also define two computational hardness problems related to the GCK function.

2.1 Notation

For a modulus $[eqn]$ , $[eqn]$ denotes a quotient group with respect to addition modulo q. Let Rn and Rn,q respectively be the rings $[eqn]$ and $[eqn]$ , where n is a power of two. Vectors with entries in Rn,q are denoted by bold lowercase letters, for example, $[eqn]$ where a1, …, am ∈ Rn,q for some positive integer m. $[eqn]$ denotes a subset of Rn,q, consisting of polynomials with coefficients of which only a fixed number of h is −1 and 1, and all other coefficients are zero. We notice that $[eqn]$ . For a positive integer x, R[−x,x] denotes a set of Rn,q, consisting of polynomials with coefficients between [−x, x]. The notation ‖⋅‖∞ refers to the infinity norm.

2.2 Digital signature

Definition 1. A digital signature (DS) scheme for a message space $[eqn]$ consists of three algorithms: $[eqn]$ , $[eqn]$ , and $[eqn]$ such that:

KeyGen(λ): The key generation algorithm takes as input a security parameter λ and outputs a pair of keys (pk, sk). These keys are called the public key and the private key.Sign(sk, μ): The signing algorithm takes as input the private key sk and a message $[eqn]$ , and then outputs a signature σ.Verify(pk, μ, σ): The verification algorithm takes as input the public key pk, a message μ and a signature σ, and then outputs 1 if the signature is valid or 0 otherwise.

Definition 2 (Existential unforgeability). Let $[eqn]$ be a digital signature scheme. The existential unforgeability against chosen-message attacks (UF-CMA) is defined via the following experiment $[eqn]$ between a challenger $[eqn]$ and an adversary $[eqn]$ :

$[eqn]$ runs the key generation algorithm to get (pk, sk) and gives pk to $[eqn]$ . $[eqn]$ queries a signing oracle with a message μ. Let $[eqn]$ denote the set of all queries that $[eqn]$ queried.Finally, $[eqn]$ outputs a signature σ* and a message μ*. $[eqn]$ returns 1 if (1) Verify(pk, μ*, σ*) = 1 and (2) $[eqn]$ , and otherwise returns 0 as the output of the game.

The advantage of $[eqn]$ for breaking the UF-CMA security of DS is defined as $[eqn]$ . We say that a DS scheme is UF-CMA secure if for any polynomial-time adversary $[eqn]$ , we have $[eqn]$ , where ϵ is a negligible function for the security parameter λ.

2.3 GCK hardness problems

Definition 3 (GCK Function [1]). For a ring Rn,q, a subset S ⊂ Rn,q, an integer m ≥ 1, and a randomly and independently chosen $[eqn]$ , the GCK function Fa: S^m^ → Rn,q is defined as follows:

$$[eqn]$$

for $[eqn]$ , where $[eqn]$ is computed using the ring multiplication and addition operations.

In this paper, we specify the subset S as S = R[−β,β] for some integer β.

Definition 4 (One-Wayness of GCK function [1]). A GCK function is one-way (OW) if for any probabilistic polynomial-time (PPT) algorithm $[eqn]$ , it is easy to compute, but computationally hard to invert the GCK function: given a pair (a, t = Fa(x)) for a randomly chosen $[eqn]$ and $[eqn]$ , find x in the domain such that Fa(x) = t. For integers $[eqn]$ , we define $[eqn]$ to be the advantage of an algorithm $[eqn]$ in solving the OW problem of a GCK function over the ring Rn,q.

Definition 5 (Collision-Resistance of GCK function [2, 3]). A GCK function is collision-resistant (CR) if for any probabilistic polynomial-time (PPT) algorithm $[eqn]$ , it is computationally hard to find a collision of a GCK function: given a randomly chosen $[eqn]$ , find distinct $[eqn]$ such that Fa(x) = Fa(x′). For integers $[eqn]$ , we define $[eqn]$ to be the advantage of an algorithm $[eqn]$ in solving the CR problem of a GCK function over the ring Rn,q.

3 Main results

3.1 GCK-TMO problem

Now, we define a new GCK-related problem, called TMO problem of the GCK function.

Definition 6 (Target-Modified One-wayness of GCK function). For integers $[eqn]$ , the TMO problem is defined as follows: given $[eqn]$ and t ∈ Rn,q, find $[eqn]$ and c ∈ Rn,q such that ‖c‖∞ ≤ α, ‖x‖∞ ≤ β satisfying

$$[eqn]$$

The TMO problem is a modified OW problem of a GCK function, obtained by changing the original target t into a new ct. The important point is that c ∈ Rq should be short, meaning that ‖c‖∞ ≤ α for a small integer α, and can also be chosen by a solver as desired. Intuitively, the TMO problem becomes trivial if c is chosen freely in Rq, because for a short x such that ‖x‖∞ ≤ β, Fa(x) = t′ is firstly computed and then c is obtained via c = t′t^−1^ (if t^−1^ exists). Also, the OW problem of a GCK function can be viewed as a special case of the TMO problem by issuing (x, c = 1) as a solution. For integers $[eqn]$ , we define $[eqn]$ to be the advantage of an algorithm $[eqn]$ solving the TMO problem over the ring Rn,q.

3.1.1 Computational hardness of the TMO problem

By deriving an upper bound on $[eqn]$ from the following reduction, we demonstrate that the TMO problem is at least as hard as the CR and OW problems of a GCK function. For our reduction, we require a special form of (n, q) that determines a ring $[eqn]$ , in order to guarantee that a short c ∈ Rq has an inverse. More precisely, we require that n and ρ are power-of-2 integers such that n ≥ ρ, and q is a prime such that q ≡ 2ρ + 1 (mod 4ρ). We then use the result [14, Corollary 1.2.] that, for any short c ∈ Rq such that $[eqn]$ , c has an inverse in Rq with probability 1.

Theorem 1. Let n and ρ be power-of-2 integers such that n ≥ ρ, and q is a prime such that q ≡ 2ρ + 1 (mod 4ρ). For integers $[eqn]$ satisfying $[eqn]$ , (2β + 1)^mn^ ≫ q^n^ and nαγ ≤ β, it holds that $[eqn]$ .

Proof. Suppose there is an algorithm $[eqn]$ that solves the TMO problem with advantage $[eqn]$ for any α such that $[eqn]$ . Recall that $[eqn]$ takes (a, t) as input and tries to find a pair (x, c) such that Fa(x) = ct, satisfying the condition that ‖c‖∞ ≤ α, ‖x‖∞ ≤ β. According to [14, Corollary 1.2.], any c ∈ Rn,q that satisfies $[eqn]$ has an inverse in Rn,q. Since α is less than $[eqn]$ , the short polynomial c always has an inverse in Rn,q. With (x, c) that $[eqn]$ outputs, we set z = x**c^−1^ by considering c^−1^ as a scalar. Since the GCK function Fa is linear, we see that Fa(z) = Fa(x**c^−1^) = c^−1^Fa(x) = c^−1^ct = t. For the integer $[eqn]$ satisfying γ ≤ β/nα, we consider two cases as follows:

Case 1: ‖x**c^−1^‖∞ > γ.

Case 2: ‖x**c^−1^‖∞ ≤ γ.

Obviously, $[eqn]$ ’s output (x, c) belongs to either case 1 or case 2. In case 1, we show that an algorithm $[eqn]$ uses $[eqn]$ to solve the CR problem of a GCK function. The assumption that (2β + 1)^mn^ ≫ q^n^ guarantees that it is presumably feasible to find a pair of collision with respect to any element in Rq. Given $[eqn]$ as input, $[eqn]$ does as follows:

Choose a random $[eqn]$ .Compute $[eqn]$ .Run $[eqn]$ on input (a, t) and get (x, c) from $[eqn]$ .Compute x′ = cz′ and output (x, x′) as a solution.

For (x, x′) to be a solution of the CR problem, we need to show that Fa(x) = Fa(x′), ‖x‖∞ ≤ β, ‖x′‖∞ ≤ β, and x ≠ x′. First, since (x, c) is a solution for the TMO problem, it means that Fa(x) = ct. Also, we set t = Fa(z′) in step 2. By the linearity property of GCK function, it holds that ct = cFa(z′) = Fa(cz′) = Fa(x′). Thus, Fa(x) = ct = Fa(x′). Secondly, it holds that ‖x‖∞ ≤ β because x is the solution of the TMO problem, and also ‖x′‖∞ ≤ β because (1) γ ≤ β/nα (by assumption) and (2) ‖x′‖∞ ≤ n × ‖c‖∞ × ‖z′‖∞ ≤ nαγ ≤ β. Lastly, we can see that x ≠ x′. Note that in case 1 where z is computed as x**c^−1^, we see that z ≠ z′ because of the fact that ‖z‖∞ > γ (in case 1) and ‖z′‖∞ ≤ γ (in step 1). This inequality means that x**c^−1^ ≠ x′c^−1^, resulting in x ≠ x′.

Next, in case 2, we show that there is another algorithm $[eqn]$ that uses $[eqn]$ to solve the OW problem of a GCK function. Given (a, t) as input, $[eqn]$ does as follows:

Run $[eqn]$ on input (a, t) and get (x, c) from $[eqn]$ .Output z = c^−1^x as a solution.

The reason why z is a solution for the OW problem is that it holds that Fa(z) = t and ‖z‖ ≤ γ by the condition of case 2.

As a result, the ability for $[eqn]$ to solve the TMO problem is transferred to that of solving the CR or OW problem of a GCK function. We see that $[eqn]$ and $[eqn]$ in case 2. This completes the proof.

3.1.2 Extension to module GCK-TMO problem

The GCK function can be extended to a module setting where FA(x) = A x for $[eqn]$ and $[eqn]$ . Accordingly, the previous OW, CR, and TMO problems of GCK function can each be addressed with similarly defined problems in a module setting. In particular, we define a module version of TMO problem as below.

Definition 7 (Module GCK-TMO Problem). For integers $[eqn]$ , the Module GCK-TMO problem is defined as follows: given $[eqn]$ and $[eqn]$ , find $[eqn]$ such that ‖c‖∞ ≤ α, ‖x‖∞ ≤ β satisfying

$$[eqn]$$

Similarly, we define $[eqn]$ to be the advantage of an algorithm $[eqn]$ solving the TMO problem of Module-GCK function over the ring Rn,q. With two newly defined advantages $[eqn]$ and $[eqn]$ (for some positive integer γ) regarding Module-GCK function, we can prove the following theorem.

Theorem 2. Let n and ρ be power-of-2 integers such that n ≥ ρ, and q is a prime such that q ≡ 2ρ + 1 (mod 4ρ). For integers $[eqn]$ satisfying $[eqn]$ , (2β + 1)^nℓ^ ≫ q^nk^ and nαγ ≤ β, it holds that $[eqn]$ .

The proof can be done by the same argument as in the proof of Theorem 1 so we omit the proof in this paper.

3.2 Proposed GCKSign scheme

3.2.1 Construction

For the security parameter λ, GCKSign generates the public parameters, params, as follows: choose an integer n such that n = 2^a^ for an integer $[eqn]$ (indeed, we set n = 256 for all parameter sets), and choose a prime modulus q and positive integers k, ℓ, B, h, Ls and η. Then, params is given by (n, q, k, ℓ, B, h, Ls, η). Also, GCKSign requires a hash functions $[eqn]$ and an encoding function $[eqn]$ . It is assumed that params and two functions (H, Encode) are used for all algorithms in GCKSign.

The key generation, signing, and verification algorithms of GCKSign are described as follows:

KeyGen. This algorithm first chooses random 256-bit seeds seed_A_ and seed_s. It samples public polynomials A uniformly at random over $[eqn]$ by expanding seedA_ and secret polynomials s1, …, sℓ uniformly at random over R[−η,η] by expanding seed_s. Next, it computes a polynomial t = FA(s) = A ⋅ s). Finally, it outputs a public key pk = (t, seedA) and a secret key sk = (s, seedA_).

Algorithm 1: KeyGen

Input :security parameter λ

Output: public key pk = (t, seed_A), and secret key sk = (s, seedA_)

1 seed_A, seeds_ ← {0, 1}^256^;

2 $[eqn]$ ;

3 $[eqn]$ ;

4 $[eqn]$ ;

5 pk ← (t, seed_A_);

6 sk ← (s, seed_A_);

7 return (pk, sk);

Sign. This algorithms first regenerates the public polynomials A from seed_A. It chooses a random 256-bit seed seedy. It samples polynomials y uniformly at random over $[eqn]$ by using seedy_. Next, it computes $[eqn]$ . It obtains $[eqn]$ by computing the hash function H(v, μ) together with the message μ. It obtains a sparse polynomial $[eqn]$ by running $[eqn]$ and computes z = y + c ⋅ s. If $[eqn]$ , then it goes to the step that samples y and repeats the subsequent steps. Finally, it outputs a signature $[eqn]$ .

Algorithm 2: Sign

Input : message μ, and secret key sk = (s, seed_A_)

Output: signature $[eqn]$

1 $[eqn]$

2 seed_y_ ← {0, 1}^256^;

3 $[eqn]$ ;

4 $[eqn]$ ;

5 $[eqn]$ ;

6 $[eqn]$ ;

7 z ← y + s ⋅ c;

8 if $[eqn]$ then

9  goto step 2;

10 end if

11 return $[eqn]$ ;

Verify. This algorithm first derives a polynomial c from $[eqn]$ in the signature. It regenerates the public polynomials A from the seed seed_A_. Next, it computes $[eqn]$ . The value v is used to compute the hash value H(v, μ) together with the message μ. It accepts the signature if the hash value matches the signature $[eqn]$ and $[eqn]$ .

Algorithm 3: Verify

Input : messasge μ, signature $[eqn]$ , and public key pk = (t, seed_A_)

Output: {1, 0} // accept or reject signature

1 $[eqn]$ ;

2 $[eqn]$ ;

3 $[eqn]$ ;

4 if $[eqn]$ then

5  return 0;

6 end if

7 return 1;

3.2.2 Correctness

The way that GCKSign works is almost the same as Schnorr signature scheme, except for (1) rejection sampling in the Sign algorithm and (2) the usage of the encoding function. For a correctly generated $[eqn]$ , the first condition such that ‖z‖∞ < B − Ls holds, because it is the same as in the Sign algorithm, and the second condition is also guaranteed by the following equation

$$[eqn]$$

3.3 Security proof

Theorem 3. Assume that ‖cs‖∞ ≤ Ls and H is modeled as a random oracle. GCKSign is UF-CMA secure in the random oracle model if the TMO problem of the Module-GCK function is hard. That is, for any PPT adversary $[eqn]$ with $[eqn]$ , making at most qh hash queries and at most qs signature queries, there exists a PPT algorithm $[eqn]$ that solves the TMO problem with $[eqn]$ , where

$$[eqn]$$

Proof. In order to prove the security of GCKSign, we define a sequence of hybrid games G0, G1, G2, where G0 is the original UF-CMA security game defined in Chapter 2.2 and G2 is the final game in which the success probability of $[eqn]$ can be easily bounded by the hardness of the TMO problem. For each game Gi, we define an event δi where $[eqn]$ successfully outputs a forgery in the game Gi.

Game G0. In this game, a challenger $[eqn]$ runs the key generation algorithm to get (pk, sk) and gives pk to $[eqn]$ . Whenever $[eqn]$ asks a hash query (v, μ), $[eqn]$ gives the same answer to $[eqn]$ if the query has been asked before. If not, $[eqn]$ chooses a random $[eqn]$ and gives it to $[eqn]$ . Whenever $[eqn]$ asks a signature query μ, $[eqn]$ runs the signing algorithm to get a signature σ and gives $[eqn]$ to $[eqn]$ . Finally, $[eqn]$ outputs (μ*, σ*) with the condition that μ* was not queried. $[eqn]$ returns Verify(pk, μ*, σ*) as the output of the experiment. Thus, we get $[eqn]$ .

Game G1. G1 is the same as G0 except that the signing queries are replaced by the MidSign algorithm (see Algorithm 4 below). Since two games G0 and G1 are the same except that the random hash value $[eqn]$ is programmed before receiving the input (v, μ). $[eqn]$ can not tell if the signing oracle was answered by the Sign algorithm or the MidSign algorithm.

Algorithm 4: MidSign

Input : message μ, public key (A, t)

Output: signature $[eqn]$

1 Choose y uniformly at random from $[eqn]$ ;

2 Choose $[eqn]$ uniformly at random;

3 Compute $[eqn]$ ;

4 Compute z = y + cs. If ‖z‖∞ > B − Ls, then

5  retry at step 1;

6 Compute v = Ay;

7 Re-program the hash oracle H(⋅) so that

8   $[eqn]$ ;

9 Return $[eqn]$ ;

Let inconsistency be the event that any $[eqn]$ is previously assigned to an input value (v, μ) queried by $[eqn]$ . This event occurs when v (computed by $[eqn]$ ) becomes one of values queried by $[eqn]$ , assuming that μ is the same message. Since $[eqn]$ and y is chosen uniformly at random from $[eqn]$ , the total number of v is (2B + 1)^nℓ^. For qh number of hash queries, the probability that any $[eqn]$ becomes one of queried v values is at most qh/(2B + 1)^nℓ^. Also, since $[eqn]$ issues at most qs number of signature queries, the probability that inconsistency happens is at most qhqs/(2B + 1)^nℓ^. Obviously, unless inconsistency happens, G1 is the same as G0. Thus, we see that |Pr[δ1] − Pr[δ0]| ≤ qhqs/(2B + 1)^nℓ^.

Game G2. G2 is the same as G1 except that the signature queries are replaced by the SimSign algorithm (see Algorithm 5 below). G2 is the same as G1 except the way that z and v are generated. Though $[eqn]$ is generated in G2 without using sk = s, it is infeasible for $[eqn]$ to differentiate between G1 and G2 because of the zero-knowledge property of the relevant identification protocol.

Algorithm 5: SimSign

Input : message μ, public key (A, t)

Output: signature $[eqn]$

1 Choose z uniformly at random from $[eqn]$ ;

2 Choose $[eqn]$ uniformly at random;

3 Compute $[eqn]$ ;

4 Compute v = Az − ct;

5 Re-program the hash oracle H(⋅) so that

6   $[eqn]$ ;

7 Return $[eqn]$ ;

The remaining part is to check if $[eqn]$ can distinguish between the two distributions of $[eqn]$ in G1 and G2, especially in terms of v. In G1, v is computed as v = Ay for some $[eqn]$ , whereas in G2 v is computed as v = Az − ct for some $[eqn]$ . what needs to be checked here is that v = Az − ct in G2 can be expressed as v = Ar for some (unknown) $[eqn]$ . If so, the two distribution of $[eqn]$ in G1 and G2 are identical from the $[eqn]$ ’s point of view. To guarantee this, we can set r = z − cs for some (unknown) secret key $[eqn]$ such that t = As. Then, we see that Ar = A(z − cs) = Az − ct = v. Since ‖cs‖∞ ≤ Ls (by assumption) and ‖z‖∞ ≤ B − Ls (by choosing z), we get ‖r‖∞ ≤ ‖z‖∞ + ‖cs‖∞ ≤ B − Ls + Ls = B, which is the same distribution as G1. As a result, we have that Pr[δ2] = Pr[δ1].

We now apply the generalized forking lemma of Bellare and Neven [6] to G2. With the probability at least $[eqn]$ where Pr[δ2] = ϵ′, we obtain two signatures $[eqn]$ and $[eqn]$ for $[eqn]$ such that

$$[eqn]$$

$[eqn]$ then simply sets x = z ‒ z′, $[eqn]$ , and outputs $[eqn]$ as the solution of the TMO problem, satisfying $[eqn]$ . We can check that ‖x‖∞ ≤ 2(B − Ls) and $[eqn]$ . Thus, we have that $[eqn]$ , which is further simplified as $[eqn]$ . This completes the proof.

3.4 Parameter settings

Table 1 presents several conditions necessary for choosing the parameters for GCKSign. The proof of Theorem 3 indicates that the TMO problem of the Module-GCK function is specified by the parameters as α = 2 and β = 2(B − Ls). Also, because the number of non-zero coefficients of c is h, for any $[eqn]$ , it holds that ‖cs‖∞ ≤ hη, allowing for setting Ls = hη. Based on these requirements, Table 2 proposes three sets of parameters for GCKSign. We set η = 1 as the bound for the secret key polynomial s, and set ρ = 8 for all parameter sets in order to choose q that meets the requirement (2) in Table 1.

Table 1: Requirements for parameter selection.

Table 2: Parameter sets for GCKSign.

3.5 Concrete security analysis

As shown above, the security of GCKSign relies on the TMO problem of Module-GCK function relative to $[eqn]$ . By Theorem 2, the security is further reduced to the CR and OW problems of Module-GCK function relative to $[eqn]$ and $[eqn]$ where γ is determined by the requirement (3) γ ≤ β/(nα) in Table 1. Also, we use the fact the CR problem of Module-GCK function is reduced to Module-SIS problem relative to $[eqn]$ , and (using the Hermite normal form) the OW problem of Module-GCK function is reduced to Module-LWE problem relative to $[eqn]$ . Strictly speaking, 4(B − Ls) is more correct than 2(B − Ls), but we follow the same analysis as Dilithium [11] to analyze the security of Module-SIS. Regarding the choice of γ, especially, γ can be chosen from any positive integer satisfying γ ≤ 2(B − Ls)/(2^8^ × 2), but we set γ = 1 for the Module-LWE problem. This is because a smaller ratio of q/γ (i.e., modulus-to-noise) generally provides stronger concrete security against known lattice attacks [15], and thus decreasing γ is more advantageous for an adversary solving Module-LWE problem when q is fixed. Eventually, the concrete security of GCKSign is estimated by the best-known lattice attacks against Module- {SIS, LWE} problems relative to $[eqn]$ and $[eqn]$ , respectively. The existence of a solution with respect to γ = 1 is guaranteed by the key generation such that t = As with A ∈ R^k×ℓ^ and $[eqn]$ .

To analyze the concrete security of the above Module- {SIS, LWE} problems, we use the BKZ lattice reduction algorithm [16] as the best-known lattice attacks. There are a variety of approaches to measure the running time of BKZ [16–18]. In general, an SVP (Shortest Vector Problem) solver is the main building block of the BKZ algorithm. Regarding the number of SVP oracle calls that the BKZ algorithm makes, the Core-SVP model [18] assumes that an SVP oracle is required only once in a conservative model. The best known classical SVP solver runs in time ≈ 2^0.292×b^ and the best known quantum SVP solver runs in time ≈ 2^0.265×b^. Therefore, we decide to adopt the BKZ cost model of 0.292b for the classical model and the BKZ cost model of 0.265b for the quantum model where b is the BKZ block size. Table 2 shows the concrete security level of GCKSign, according to each parameter set. To estimate the hardness of the parametrized Module- {SIS, LWE} problems, we make use of the SIS and LWE estimators in [11] that reflect the above-mentioned BKZ algorithm.

4 Discussion

4.1 Comparison

Table 3 presents the comparison between the two GCK-based signatures, [4] and GCKSign. In terms of security, [4] is based on the collision-resistance of GCK function, whereas GCKSign is based on the TMO problem of Module-GCK function. Because of the collision resistance in [4], their GCK function must be set to guarantee the WI property, which requires to satisfy the condition (at least) (2η + 1)^nℓ^ ≥ q^nk^ × 2^128^ for the coefficient bound η of a secret key polynomial. [4] sets η = 2047, which turns out to increase the sizes of public/secret keys and signatures. On the other hand, GCKSign removes the WI property by proving their security under the TMO problem of GCK function, and importantly is able to relax to the condition (at least) (2β + 1)^nℓ^ ≥ q^nk^ × 2^128^ for β = 2(B − Ls). Because of this relaxation, GCKSign can set much smaller values of q and η, and obtain a significant increase in efficiency compared to [4]. For instance, Table 3 shows that at the (almost) same 132-bit security level, the signature size of GCKSign is about 3.4 (≈ 14875/4384) times shorter and the public-key size of GCKSign is about 2.4 (≈ 6125/2528) times shorter, compared to [4].

Table 3: Comparison between GCK-based signatures.

However, the sizes of public key and signature of GCKSign are about 1.8 (≈ 2528/1312) times and 1.9 (≈ 4384/2420) times larger, compared to [11] at the (almost) same 132-bit security level. This is caused by the key recovery attack. An adversary may try to recover the secret key s from the public key pk = (A, t), where t = As in case of GCKSign. Because s is sampled from $[eqn]$ and η = 1, this amounts to solving the OW problem of Module-GCK function, which is reduced to the Module-LWE problem relative to $[eqn]$ , and the dimension is reduced to ℓ − k instead of ℓ itself. Therefore, We need to increase the dimension for our scheme by k to maintain the security level which the LWE-based signature sets like Dilithium [11], and this leads to increase of the sizes of public key and signature at the end.

4.2 Performance analysis

In Table 2, we evaluate the performance of our implementations on a 3.7GHz Intel Core i7-8700k running Ubuntu 20.04 LTS. The table shows the key generation, signing, and verification algorithms of our scheme. Our implementation codes are publicly available at https://github.com/KU-Cryptographic-Protocol-Lab/GCKS.

A polynomial multiplication is the most costly operation in implementing a cryptosystem. We choose the modulus q satisfying the condition q ≡ 2ρ + 1 mod 4ρ for some ρ|n to satisfy the security requirement. As a result, we can not use the “fully-splitting” NTT algorithm for the multiplication operation. Instead, we choose to follow the approach of [14], using “partially-splitting” NTT algorithm with a Karatsuba multiplication [19] and Toom-Cook polynomial multiplication method [20] to efficiently multiply in a partially-splitting ring.

5 Conclusion

In this paper, we have addressed the challenge of proving the security of GCK-based signature schemes without relying on the WI property. By introducing the TMO problem and showing its reduction to the one-wayness and collision-resistance problems of the GCK function, we have provided a solution to overcome the limitations imposed by the WI property in GCK-based signatures. Additionally, we have presented a more efficient GCK-based signature scheme, GCKSign, which extends the original scheme [4] by incorporating the Module-GCK function. Through the analysis of the Module GCK-TMO problem and its reduction to Module-{SIS, LWE} problems, we prove the security of GCKSign in the random oracle model without relying on the WI property.

One notable result of our work is the significant reduction in signature size and public key size compared to Lyubashevsky’s signature scheme [4]. GCKSign achieves approximately 3.4 times shorter signature size and 2.4 times shorter public key size at the same security level. This efficiency improvement directly stems from the elimination of the WI property.

Even though our scheme still has larger sizes than Dilithium [11], our findings not only contribute to the advancement of GCK-based signature scheme [4] but also provide insights into the design and analysis of cryptographic primitives based on structured lattice problems. The TMO problem introduces a novel perspective on approximate one-wayness, and its connections to existing hardness assumptions offer new avenues for future research. In future work, it would be interesting to explore the applicability of the TMO problem in other cryptographic protocols and settings.