Code-based Signature Scheme Research Articles

A new key recovery attack on a code-based signature from the Lyubashevsky framework

In this paper, we present a new key recovery attack on a Hamming-metric code-based signature scheme proposed by Song, Huang, Mu, Wu, and Wang (SHMWW). Our attack extends the statistical part of the attack proposed by Aragon, Baldi, Deneuville, Khathuria, Persichetti, and Santini (ABDKPS). In addition to classifying the columns of the secret matrix, we also completely determine the entries of the identity columns of this matrix via statistical method. While we need to collect more signatures, our attack has better time complexity as it requires less than 232 and 235 operations to perform the attack for Para-1 and Para-2 respectively. This gives a tradeoff between the number of required signatures and the running time of the attack. From the simulation using a proof-of-concept Sagemath implementation, a total of no more than 1500 signatures is needed to launch the attack, which can completely recover the secret key in under 45 minutes. When performed in parallel, the attack may recover the secret key in less than 5 seconds.

Designing a Practical Code-Based Signature Scheme from Zero-Knowledge Proofs with Trusted Setup

This paper defines a new practical construction for a code-based signature scheme. We introduce a new protocol that is designed to follow the recent paradigm known as “Sigma protocol with helper”, and prove that the protocol’s security reduces directly to the Syndrome Decoding Problem. The protocol is then converted to a full-fledged signature scheme via a sequence of generic steps that include: removing the role of the helper; incorporating a variety of protocol optimizations (using e.g., Merkle trees); applying the Fiat–Shamir transformation. The resulting signature scheme is EUF-CMA secure in the QROM, with the following advantages: (a) Security relies on only minimal assumptions and is backed by a long-studied NP-complete problem; (b) the trusted setup structure allows for obtaining an arbitrarily small soundness error. This minimizes the required number of repetitions, thus alleviating a major bottleneck associated with Fiat–Shamir schemes. We outline an initial performance estimation to confirm that our scheme is competitive with respect to existing solutions of similar type.

Post-Quantum Two-Party Adaptor Signature Based on Coding Theory

An adaptor signature can be viewed as a signature concealed with a secret value and, by design, any two of the trio yield the other. In a multiparty setting, an initial adaptor signature allows each party to create additional adaptor signatures without the original secret. Adaptor signatures help address scalability and interoperability issues in blockchain. They can also bring some important advantages to cryptocurrencies, such as low on-chain cost, improved transaction fungibility, and fewer limitations of a blockchain’s scripting language. In this paper, we propose a new two-party adaptor signature scheme that relies on quantum-safe hard problems in coding theory. The proposed scheme uses a hash-and-sign code-based signature scheme introduced by Debris-Alazard et al. and a code-based hard relation defined from the well-known syndrome decoding problem. To achieve all the basic properties of adaptor signatures formalized by Aumayr et al., we introduce further modifications to the aforementioned signature scheme. We also give a security analysis of our scheme and its application to the atomic swap. After providing a set of parameters for our scheme, we show that it has the smallest pre-signature size compared to existing post-quantum adaptor signatures.

Cryptanalysis of a Code-Based Signature Scheme Based on the Schnorr-Lyubashevsky Framework

We propose an attack on the recent attempt by Li, Xing and Yeo to produce a code-based signature scheme using the Schnorr-Lyubashevsky approach in the Hamming metric, and verify its effectiveness through numerical simulations. Differently from other (unsuccessful) proposals, this new scheme exploits rejection sampling along with dense noise vectors to hide the secret key structure in produced signatures. We show that these measures, besides yielding very slow signing times and rather long signatures, do not succeed in protecting the secret key. We are indeed able to prove the existence of a strong correlation between produced signatures, which ultimately leaks information about the secret key. To support this claim, we use both theoretical arguments and numerical evidences. Finally, we employ such a weakness to mount a full key recovery attack, which is able to recover the secret key after the observation of a bunch of signatures. Our results show that the considered scheme may be secure only for one-time usage.

Cryptanalysis of a code-based full-time signature

We present an attack against a code-based signature scheme based on the Lyubashevsky protocol that was recently proposed by Song, Huang, Mu, Wu and Wang (SHMWW). The private key in the SHMWW scheme contains columns coming in part from an identity matrix and in part from a random matrix. The existence of two types of columns leads to a strong bias in the distribution of set bits in produced signatures. Our attack exploits such a bias to recover the private key from a bunch of collected signatures. We provide a theoretical analysis of the attack along with experimental evaluations, and we show that as few as 10 signatures are enough to be collected for successfully recovering the private key. As for previous attempts of adapting Lyubashevsky’s protocol to the case of code-based cryptography, the SHMWW scheme is thus proved unable to provide acceptable security. This confirms that devising secure code-based signature schemes with efficiency comparable to that of other post-quantum solutions (e.g., based on lattices) is still a challenging task.

A New Code-Based Blind Signature Scheme

Abstract Blind signature is an important cryptographic primitive with widespread applications in secure e-commerce, for example to guarantee participants’ anonymity. Existing blind signature schemes are mostly based on number-theoretic hard problems, which have been shown to be solvable with quantum computers. The National Institute of Standards and Technology (NIST) began in 2017 to specify a new standard for digital signatures by selecting one or more additional signature algorithms, designed to be secure against attacks carried out using quantum computers. However, none of the third-round candidate algorithms are code-based, despite the potential of code-based signature algorithms in resisting quantum computing attacks. In this paper, we construct a new code-based blind signature (CBBS) scheme as an alternative to traditional number-theoretic based schemes. Specifically, we first extend Santoso and Yamaguchi’s three pass identification scheme to a concatenated version (abbreviated as the CSY scheme). Then, we construct our CBBS scheme from the CSY scheme. The security of our CBBS scheme relies on hardness of the syndrome decoding problem in coding theory, which has been shown to be NP-complete and secure against quantum attacks. Unlike Blazy et al.’s CBBS scheme which is based on a zero-knowledge protocol with cheating probability $2/3$, our CBBS scheme is based on a zero-knowledge protocol with cheating probability $1/2$. The lower cheating probability would reduce the interaction rounds under the same security level and thus leads to a higher efficiency. For example, to achieve security level $2^{-82}$, the signature size in our CBBS scheme is $1.63$ MB compared to $3.1$ MB in Blazy et al.’s scheme.

PolarSig: An efficient digital signature based on polar codes

Code-based digital signatures suffer from two main drawbacks: large public key size and slow signature generation. Large public key size is inherent in almost all the code-based cryptosystems and other post-quantum alternatives; however, slow signature generation is due to their specific structure. Most of the current code-based signature schemes are constructed based on Courtois, Finiasz, and Sendrier (CFS) signature. CFS uses a counter to produce decodable syndromes or the complete decoding technique that imposes some extra computational cost to the signing algorithm for many choices of codes. In this study, the authors propose an efficient digital signature, PolarSig, which can reduce both public key size and signing time simultaneously. PolarSig uses some specific instances of polar codes that enable us to decode every random syndrome. Moreover, they apply puncturing and randomised omitting of frozen bits to protect the authors’ scheme from commonplace attacks targeting former cryptosystems based on polar codes. Besides, they prove that their signature is existentially unforgeable under a chosen message attack secure in the random oracle model.

Compact Code-Based Signature for Reconfigurable Devices With Side Channel Resilience

In this paper, we present a compact design for the code based signature called LEDAsig with side channel resistance. Existing implementations concentrate on the high-speed feature while few of them have considerations on area or power efficiency which are particularly decisive for low-cost or power constrained IoT applications. We propose an area-efficient FPGA architecture for systematically rotating the QC-LDGM codes amongst the block RAMs with read-first mode. Additionally, the side channel vulnerability of LEDAsig is carefully examined, and protective masking schemes are introduced accordingly to safeguard our design from power analysis attacks. Effectiveness of these schemes is verified on SAKURA-G FPGA board. Up till now, the design presented in this work is the most compact one and also the first side-channel secure one addressing first-order and (univariate) second-order differential power analysis for the code based signature schemes in the open literature. We show for instance that our first-order (second-order) protected implementation can sign a signature in 117 (203) ms on a Xilinx Spartan-6 FPGA, occupying only 622 (1142) slices, and therefore is a prospective candidate for post-quantum signature schemes in low-resource settings.

A code-based signature scheme from the Lyubashevsky framework

We propose a new method to construct code-based signature scheme following the Lyubashevsky's lattice-based framework. Our technique ensures that the Hamming weight of each row of the private key matrix is below the GV bound instead of fixed weight. Our scheme can generate signatures whose maximum Hamming weight is below the GV bound of random linear codes with the public key matrix as parity-check matrix. We argue that our scheme can resist existing attacks on code-based signatures. We provide a detailed security analysis and prove that our scheme is existentially unforgeable under adaptive chosen-message attacks (EUF-CMA) in the random oracle model through exploiting and expanding code-based complex problems. Our scheme enjoys the shorter signature size than the Durandal signature scheme (EUROCRYPT 2019) and the Wave signature scheme (ASIACRYPT 2019) for security level of 128 bits. We also show that there is a generic method to construct Weight Restricted Hash (WRH) functions which can produce hash value with a given Hamming weight.

Cryptanalysis of a code-based one-time signature

We present an attack against a code-based signature scheme based on the Lyubashevsky protocol that was recently proposed by Song, Huang, Mu, Wu and Wang (SHMWW). The private key in the SHMWW scheme contains columns coming in part from an identity matrix and in part from a random matrix. The existence of two types of columns leads to a strong bias in the distribution of set bits in produced signatures. Our attack exploits such a bias to recover the private key from a bunch of collected signatures. We provide a theoretical analysis of the attack along with experimental evaluations, and we show that as few as 10 signatures are enough to be collected for successfully recovering the private key. As for previous attempts of adapting Lyubashevsky’s protocol to the case of code-based cryptography, the SHMWW scheme is thus proved unable to provide acceptable security. This confirms that devising secure code-based signature schemes with efficiency comparable to that of other post-quantum solutions (e.g., based on lattices) is still a challenging task.

An improved Durandal signature scheme

Constructing secure and effective code-based signature schemes has been an open problem. In this paper, we efficiently reduce the key size of the Durandal signature scheme introduced by Aragon et al. (EUROCRYPT 2019). We prove that the improved scheme is EUF-CMA secure by reducing its security to the advanced product spaces subspaces indistinguishability ($\rm{PSSI}^+$) problem, the decisional rank syndrome decoding (DRSD) problem, and the affine rank syndrome decoding (ARSD) problem under the random oracle model. Furthermore, our signature scheme is more secure than the Durandal scheme because recovering key attacks are equivalent to solving the rank syndrome decoding (RSD) problem, instead of the rank support learning (RSL) problem in the original Durandal scheme. Our signature scheme takes less time to generate a signature owing to the fact that our signature scheme enjoys smaller security parameters in comparison to the Duradual scheme. We compare the new scheme with existing code-based signature schemes and find that our signature scheme has advantages in terms of the public key size.

Modified pqsigRM: RM Code-Based Signature Scheme

We present a novel code-based signature scheme called modified pqsigRM. This scheme is based on a modified Reed–Muller (RM) code, which reduces the signing complexity and key size compared with existing code-based signature schemes. In fact, it strengthens pqsigRM submitted to NIST for post-quantum cryptography standardization. The proposed scheme has the advantage of the pqsigRM decoder and uses public codes that are more difficult to distinguish from random codes. We use $(U,U+V)$ -codes with the high-dimensional hull to overcome the disadvantages of code-based schemes. The proposed decoder samples from coset elements with small Hamming weight for any given syndrome and efficiently finds such an element. Using a modified RM code, the proposed signature scheme resists various known attacks on RM-code-based cryptography. For 128 bits of classical security, the signature size is 4096 bits, and the public key size is less than 1 MB.

НОВИЙ ПІДХІД ДО ПОБУДОВИ ПОСТ-КВАНТОВОЇ СХЕМИ ЕЛЕКТРОННОГО ЦИФРОВОГО ПІДПИСУ

Cryptographic information security techniques are essential in building a modern cybersecurity infrastructure. Recently, there have been new challenges and threats to cryptographic transformation. In particular, the emergence and rapid development of the latest quantum computing technologies necessitates the urgent need for the development and research of new methods of post-quantum cryptographic transformations, that is, those that will be sustainable even if quantum cryptanalysis is possible. This article is devoted to the analysis of possibilities of implementation of digital signature schemes based on using error-correcting codes. This approach allows cryptographers to build schemes that are resistant to both classic cryptanalysis and cryptanalysis which uses quantum computing. The article describes the principles of the classic digital signature scheme which is named CFS and built using a Niederreiter-like transform, and also we propose a new approach that enables an implementation of signature according to the McEliece transformations. This approach preserves the advantages of its predecessor and provides additional protection against special attacks. Also, a comparative analysis and characterization of the considered schemes according to the criteria of resistance to classic and quantum cryptanalysis, complexity of necessary transformations and length of generated signatures are made. The results show that reliable and secure cryptographic transformations can be built, in particular, electronic digital signature algorithms that are code-based and secure even in the case of quantum cryptanalysis. However, it should be noted that the drawback of code-based signature schemes is the large amount of key data required by the algorithm, as well as the difficulty in creating a signature due to the need for multiple decryption of the syndrome, which remains a topical topic and needs further research

A Secure and Efficient Code-Based Signature Scheme

The McEliece public key cryptosystem and the Niederreiter public key cryptosystem are the two major branches of the code-based public key cryptosystem. It has been found that the difficult problems relied by these two systems are different from the syndrome decoding problem stated by Berlekamp et al. The Hamming weight of the error vector is fixed and known to the attackers in these two systems, which leading to the disclosure of information, and through which the attacker can implement an effective attack. In this paper, an improved vision of the McEliece public key cryptosystem was given, and a new code-based signature scheme is designed based on the new cryptosystem. As a result, we achieve a more secure variant of McEliece public key cryptosystem and a more secure code-based signature scheme with high security and fast signing speed.

Efficient One-Time Signatures from Quasi-Cyclic Codes: A Full Treatment

The design of a practical code-based signature scheme is an open problem in post-quantum cryptography. This paper is the full version of a work appeared at SIN’18 as a short paper, which introduced a simple and efficient one-time secure signature scheme based on quasi-cyclic codes. As such, this paper features, in a fully self-contained way, an accurate description of the scheme setting and related previous work, a detailed security analysis, and an extensive comparison and performance discussion.

An Efficient Code-Based Threshold Ring Signature Scheme with a Leader-Participant Model

Digital signature schemes with additional properties have broad applications, such as in protecting the identity of signers allowing a signer to anonymously sign a message in a group of signers (also known as a ring). While these number-theoretic problems are still secure at the time of this research, the situation could change with advances in quantum computing. There is a pressing need to design PKC schemes that are secure against quantum attacks. In this paper, we propose a novel code-based threshold ring signature scheme with a leader-participant model. A leader is appointed, who chooses some shared parameters for other signers to participate in the signing process. This leader-participant model enhances the performance because every participant including the leader could execute the decoding algorithm (as a part of signing process) upon receiving the shared parameters from the leader. The time complexity of our scheme is close to Courtois et al.’s (2001) scheme. The latter is often used as a basis to construct other types of code-based signature schemes. Moreover, as a threshold ring signature scheme, our scheme is as efficient as the normal code-based ring signature.

Code-based authentication with designated verifier

The public key encryption scheme based on the bounded decoding problem was first introduced by McEliece in 1978. Since then, several code-based signature schemes have been designed. Most of them have been analysed and proven secure against different types of adversaries. However, researchers have given less attention to the code-based strong Designated Verifier Signature DVS scheme. In this paper, we introduce a new strong DVS scheme. It is based on CFS signature and Stern's identification scheme, whose security depends on syndrome decoding problem and bounded decoding problem. The proposed scheme is the first code-based strong DVS, and also satisfies the strong designated verifier, unforgeability and non-delegatability properties which are the security requirements for a strong DVS.