Discrete Gaussian Distribution Research Articles

Probabilistic aspects of Jacobi theta functions

In this note we deduce well-known modular identities for Jacobi theta functions using the spectral representations associated with the real valued Brownian motion taking values on $[-1,+1]$. We consider two cases: (i) reflection at $-1$ and $+1$, (ii) killing at $-1$ and $+1$. It is seen that these two representations give, in a sense, most compact forms of the modular theta-function identities. We study also discrete Gaussian distributions generated by theta functions, and derive, in particular, addition formulas for discrete Gaussian variables.

Discrete trapping levels of localized states in amorphous silicon nitride

The spectrum of localized hole states (traps) in amorphous silicon nitride, a-Si3N4, is experimentally studied using the method of thermally stimulated depolarization. The experiment is compared with theoretical calculations using three models of the energy spectrum of traps: discrete spectrum (monoenergetic trap), continuous spectrum, and Gaussian trap distribution. The experiment is quantitatively described by a model of a discrete spectrum of traps with an energy of 1.15 eV and a width of no more than 0.01 eV. In the case of a continuous and Gaussian spectrum of traps, the contribution to depolarization is made by the deepest traps. The blurring of the trap energy level in a-Si3N4 due to the absence of long-range order (fluctuations in the Si–N bond length and fluctuations in the N–Si–N and Si–N–Si angles) does not exceed 0.01 eV.

The Second and Fourth Moments of Discrete Gaussian Distributions over Lattices

Let Λ be an n-dimensional lattice. For any n-dimensional vector c and positive real number s, let Ds,c and DΛ,s,c denote the continuous Gaussian distribution and the discrete Gaussian distribution over Λ, respectively. In this paper, we establish the exact relationship between the second and fourth moments centered around c of the discrete Gaussian distribution DΛ,s,c and those of the continuous Gaussian distribution Ds,c, respectively. This provides a quantization form of the result obtained by Micciancio and Regev on the second and fourth moments of discrete Gaussian distribution. Using the relationship, we also derive an uncertainty principle for Gaussian functions, which extend the result of Zheng, Zhao, and Xu. Our proof is based on combination of the idea of Micciancio and Regev and the idea of Zheng, Zhao, and Xu, where the main tool is high-dimensional Fourier transform.

Rotated Object Detection with Circular Gaussian Distribution

Rotated object detection is a challenging task due to the difficulties of locating the rotated objects and separating them effectively from the background. For rotated object prediction, researchers have explored numerous regression-based and classification-based approaches to predict a rotation angle. However, both paradigms are constrained by some flaws that make it difficult to accurately predict angles, such as multi-solution and boundary issues, which limits the performance upper bound of detectors. To address these issues, we propose a circular Gaussian distribution (CGD)-based method for angular prediction. We convert the labeled angle into a discrete circular Gaussian distribution spanning a single minimal positive period, and let the model predict the distribution parameters instead of directly regressing or classifying the angle. To improve the overall efficiency of the detection model, we also design a rotated object detector based on CenterNet. Experimental results on various public datasets demonstrated the effectiveness and superior performances of our method. In particular, our approach achieves better results than state-of-the-art competitors, with improvements of 1.92% and 1.04% in terms of AP points on the HRSC2016 and DOTA datasets, respectively.

On the Rejection Rate of Exact Sampling Algorithm for Discrete Gaussian Distributions over the Integers

On the Rejection Rate of Exact Sampling Algorithm for Discrete Gaussian Distributions over the Integers

Quantum Misuse Attack on Frodo

Research on the security of lattice-based public-key encryption schemes against misuse attacks is an important part of the cryptographic assessment of the National Institute of Standards and Technology (NIST) post-quantum cryptography (PQC) standardization process. In particular, many NIST-PQC cryptosystems follow the same meta-cryptosystem. At EUROCRYPT 2019, Betu et al. mounted a classical key recovery under plaintext checking attacks (KR-PCA) and a quantum key recovery under chosen ciphertext attacks (KR-CCA). They analyzed the security of the weak version of nine submissions to NIST. In this paper, we focus on learning with error (LWE)-based FrodoPKE, whose IND-CPA security is tightly related to the hardness of plain LWE problems. We first review the meta-cryptosystem and quantum algorithm for solving quantum LWE problems. Then, we consider the case where the noise follows a discrete Gaussian distribution and recompute the success probability for quantum LWE by using Hoeffding bound. Finally, we give a quantum key recovery algorithm based on LWE under CCA attack and analyze the security of Frodo. Compared with the existing work of Betu et al., our method reduces the number of queries from to 1 with the same success probability.

A novel identity-based multi-signature scheme over NTRU lattices

Multi-signature is an important technology to compress multiple signatures on the common message into a compact one, thereby reducing the consumption of storage space and transmission bandwidth. Such a cryptographic primitive is widely used in financial applications such as blockchain which requires multiple keys to authorize a transaction. With the advent of quantum computers, traditional multi-signature schemes may no longer be secure as their underlying security assumptions (e.g. RSA or discrete logarithm problems) may not hold anymore. In this paper, we propose a novel identity-based multi-signature (IBMS) scheme over NTRU lattices, which is secure against the attacks of quantum computers. To the best of our knowledge, it is the first lattice-based IBMS scheme. We show that our scheme is provably secure in the random oracle model based on the ring version of the short integer solution assumption (Ring-SIS). Compared with the closely related works in the literature, our scheme enables the signer to select its system identity (such as email address, physical IP address, and etc.) as the public key, which effectively alleviates the certificate management problem in the PKI setting, and takes the advantage of discrete Gaussian distribution instead of uniform distribution to generate secret signing keys and multi-signatures. Besides, our scheme does not require all the system users to setup a trusted common string, which further simplifies the deployment of our scheme in practice.

A More Accurate and Robust Binary Ring-LWE Decryption Scheme and Its Hardware Implementation for IoT Devices

Learning with error (LWE) over the ring based on binary distribution (ring-BinLWE) has become a potential Internet-of-Things (IoT) confidentiality solution with its anti-quantum attack properties and uncomplicated calculations. Compared with ring-LWE based on discrete Gaussian distribution, the decryption scheme of ring-LWE based on binary distribution needs to be re- determined due to the asymmetry of the error distribution. The direct application of the ring-LWE decryption function based on discrete Gaussian distribution can cause serious misjudgment. In this article, we propose a more accurate and robust decryption scheme for ring-BinLWE based on 2’s complement ring. Compared with the previous decryption function, the re- derived decryption function significantly improves the decoding rate by 50%. Furthermore, based on the proposed decryption function, high-performance, and lightweight hardware architectures for terminal devices in IoT are, respectively, proposed, which are scalable and can be easily adapted to ring-BinLWE hardware deployment with other parameter sets. When the parameter set is <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$n\,\,=$ </tex-math></inline-formula> 256, <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$q\,\,=$ </tex-math></inline-formula> 256, the high-performance implementation consumes 7.6k LUTs, 6.2k FFs, and 2.3k SLICEs on Spartan 6 field-programmable gate array (FPGA) platform. Compared with the previous implementation, our resource overhead increases by only 23% while the decryption accuracy is significantly improved by 50%. The lightweight implementation for parameter set <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$n\,\,=$ </tex-math></inline-formula> 256, <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$q\,\,=$ </tex-math></inline-formula> 256 consumes only 230 LUTs, 338 FFs, and 84 SLICEs on the Spartan 6 FPGA platform. Compared with the previous work, the area <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\times $ </tex-math></inline-formula> time (AT) is reduced by 47.8%, which is more suitable for deployment on resource-constrained IoT nodes.

Comparison of the quality of sampling algorithms from discrete normal distribution on NTRU lattices

Post-quantum cryptography is a field of research that studies cryptographic transformations protected against attacks using quantum computers. For many years, lattice-based cryptography has become one of the most promising solutions to protect against the threat of quantum computing. An important feature of the post-quantum period in cryptography is the significant uncertainty about the source data for cryptanalysis and countermeasures in the capabilities of quantum computers, their mathematical support and software, as well as the application of quantum cryptanalysis to existing cryptocurrencies and cryptoprotocol. The main methods are mathematical methods of electronic signature, which have undergone significant analysis and justification in the process of extensive research by cryptologists and mathematicians at the highest level. The security of signature schemes depends strongly on the standard deviation of the discrete Gaussian distribution, which has a sampling algorithm. In this paper, the most common variants of sampling algorithms were considered and analyzed, because the quality of all algorithms depends significantly on the structure of the lattice for which sampling takes place. A comparison of the quality of lattice sampling algorithms is highlighted. In particular, the paper considers Klein's algorithms (its modification is the Thomas Prest and Dukas algorithm), Peikert's algorithm and the floating-point sampling algorithm. Klein's sampling algorithm, in particular its modification, namely, the Dukas-Prest algorithm, gives the smallest vectors. Theoretically, it is much better than Klein's algorithm on NTRU lattices, but it requires the use of floating-point arithmetic, which complicates greatly the analysis of its security and tocreation of software or hardware implementation.

A constant-time sampling algorithm for binary Gaussian distribution over the integers

Discrete Gaussian sampling over the integers is one of fundamental operations in lattice-based cryptography. The binary Gaussian distribution DZ+,σ2 is a special discrete Gaussian distribution with σ2=1/(2ln⁡2) and μ=0 over the set of non-negative integers Z+, and a sampling algorithm for DZ+,σ2 can be used as the base sampler in a generic algorithm based on rejection sampling for any discrete Gaussian distribution over the integers. We present a constant-time algorithm for sampling from the binary Gaussian distribution DZ+,σ2. It requires no precomputation storage and mainly relies on bitwise operations, which could be more hardware-friendly. Its computational complexity is lower than that of the algorithm based on the full-tree Knuth-Yao method, and its entropy consumption is smaller than that of the full-table access algorithm based on a cumulative distribution table. The Rényi-divergence based security analysis of our constant-time algorithm can also be simplified.

Lattice‐based hash‐and‐sign signatures using approximate trapdoor, revisited

For the purpose of improving the efficiency of the cryptosystems built upon lattice trapdoors, Chen, Genise and Mukherjee at ASIACRYPT 2019 modified the gadget trapdoor (G-trapdoor) to an approximate trapdoor, which enables one to sample short preimages approximately from a discrete Gaussian distribution. The implementation shows that the sizes of the hash-and-sign signature scheme can be reduced to 3.67 kB for an estimation of 81.67-bit security, and 9.97 kB for an estimation of 168.81-bit security. In this study, the spherical sampling method is adapted to the non-spherical setting, without leaking any information about the trapdoor. Due to the fact that the signature size and the concrete security are closely related to the Gaussian parameter of the sampling algorithm, this technique provides a tradeoff between them. Specifically, two modes of parameters were set up for different goals. (a) Mode 1 admits to achieve the ‘win–win’ scenario, that is, gain concrete security and simultaneously reduce the signature size. Our proof-of-concept implementation shows that for an estimation of 94.5- and 185.88-bit security, the signature sizes can be reduced to 3.3 and 6.98 kB. (b) Mode 2 aims mainly to further reduce the signature sizes, without a decrease in the security level. The implementation shows that the signature size can be reduced to 2.35 kB for an estimation of 81.67-bit security, and 5.75 kB for an estimation of 168.82-bit security.

Rejection Sampling Revisit: How to Choose Parameters in Lattice-Based Signature

Rejection sampling technology is a core tool in the design of lattice-based signatures with ‘Fiat–Shamir with Aborts’ structure, and it is related to signing efficiency and signature, size as well as security. In the rejection sampling theorem proposed by Lyubashevsky, the masking vector of rejection sampling is chosen from discrete Gaussian distribution. However, in practical designs, the masking vector is more likely to be chosen from bounded uniform distribution due to better efficiency and simpler implementation. Besides, as one of the third-round candidate signatures in the NIST postquantum cryptography standardization process, the 3rd round version of CRYSTALS-Dilithium has proposed a new method to decrease the rejection probability in order to achieve better efficiency and smaller signature size by decreasing the number of nonzero coefficients of the challenge polynomial according to the security levels. However, it is seen that small entropies in this new method may lead to higher risk of forgery attack compared with former schemes proposed in its 2nd version. Thus, in this paper, we first analyze the complexity of forgery attack for small entropies and then introduce a new method to decrease the rejection probability without loss of security including the security against forgery attack. This method is achieved by introducing a new rejection sampling theorem with tighter bound by utilizing Rényi divergence where masking vector follows uniform distribution. By observing large gaps between the security claim and actual security bound in CRYSTALS-Dilithium, we propose two series of adapted parameters for CRYSTALS-Dilithium. The first set can improve the efficiency of the signing process in CRYSTALS-Dilithium by factors of 61.7 % and 41.7 % , according to the security levels, and ensure the security against known attacks, including forgery attack. And, the second set can reduce the signature size by a factor of 14.09 % with small improvements in efficiency at the same security level.

Emotion Label Enhancement via Emotion Wheel and Lexicon

Emotion Distribution Learning (EDL) is a recently proposed multiemotion analysis paradigm, which identifies basic emotions with different degrees of expression in a sentence. Different from traditional methods, EDL quantitatively models the expression degree of the corresponding emotion on the given instance in an emotion distribution. However, emotion labels are crisp in most existing emotion datasets. To utilize traditional emotion datasets in EDL, label enhancement aims to convert logical emotion labels into emotion distributions. This paper proposed a novel label enhancement method, called Emotion Wheel and Lexicon-based emotion distribution Label Enhancement (EWLLE), utilizing the affective words’ linguistic emotional information and the psychological knowledge of Plutchik’s emotion wheel. The EWLLE method generates separate discrete Gaussian distributions for the emotion label of sentence and the emotion labels of sentiment words based on the psychological emotion distance and combines the two types of information into a unified emotion distribution by superposition of the distributions. The extensive experiments on 4 commonly used text emotion datasets showed that the proposed EWLLE method has a distinct advantage over the existing EDL label enhancement methods in the emotion classification task.

Improved Bernoulli Sampling for Discrete Gaussian Distributions over the Integers

Discrete Gaussian sampling is one of the fundamental mathematical tools for lattice-based cryptography. In this paper, we revisit the Bernoulli(-type) sampling for centered discrete Gaussian distributions over the integers, which was proposed by Ducas et al. in 2013. Combining the idea of Karney’s algorithm for sampling from the Bernoulli distribution Be−1/2, we present an improved Bernoulli sampling algorithm. It does not require the use of floating-point arithmetic to generate a precomputed table, as the original Bernoulli sampling algorithm did. It only needs a fixed look-up table of very small size (e.g., 128 bits) that stores the binary expansion of ln2. We also propose a noncentered version of Bernoulli sampling algorithm for discrete Gaussian distributions with varying centers over the integers. It requires no floating-point arithmetic and can support centers of precision up to 52 bits. The experimental results show that our proposed algorithms have a significant improvement in the sampling efficiency as compared to other rejection algorithms.

GMM-HMM-Based Medium- and Long-Term Multi-Wind Farm Correlated Power Output Time Series Generation Method

Medium- and long-term wind power output time series are required in stochastic programming model for power system planning. Hidden Markov model (HMM) is a common method to generate wind power output time series, which can simultaneously consider the temporal and spatial correlation of multiple wind farms. However, the existing HMM methods use discrete matrix or Gaussian distribution to describe the output distribution of multiple wind farms, which usually leads to a relatively large error in statistical indices between the generated time series and the historical time series. Therefore, this paper proposes a method for generating medium- and long-term correlated output time series of multiple wind farms based on the Gaussians mixture model-Hidden Markov model (GMM-HMM). The discrete state variable in the hidden Markov model is used to describe the meteorological state. The Markov chain between discrete state variables is used to describe the temporal correlation of wind power output. The wind power output vector of multiple wind farms is used as the observation variable, and the mixed Gaussian probability distribution mapping relationship between the state variable and the multidimensional wind power output vector is established. Based on the Monte Carlo sampling method, the multi-wind farm output series satisfying the spatiotemporal correlation of historical output series are generated monthly. In the calculation example, the monthly wind power output series generated by five wind farms in Jilin Province are analyzed. The results show that the main statistical characteristics of the multi-wind power output time series generated by the proposed method are generally superior to those obtained with the traditional wind power output modeling method, which proves the superiority of the proposed method.

Expectation Propagation-Based Sampling Decoding: Enhancement and Optimization

In this paper, the paradigm of expectation propagation (EP) algorithm in large-scale MIMO detection is extended by the sampling decoding in an Markov chain Monte Carlo way to boost the approximation of the target posterior distribution. The proposed EP-based sampling decoding scheme not only theoretically addresses the inherent convergence problem of EP, but also is able to achieve the near-optimal decoding performance with the increment of Markov moves. Specifically, the EP-based independent Metropolis-Hastings (MH) is proposed to guarantee the exponential convergence to the target posterior distribution, thus bridging the EP detector and the sampling decoding as a whole. Meanwhile, the output yielded by the EP detector also provides a good initial setup for the sampling decoding, which results in a better convergence performance in the approximation. To further improve the convergence performance and the decoding efficiency, the EP-based Gibbs sampling is given, where the choice of the standard deviation of the discrete Gaussian distribution in the Markov mixing is also studied for a better decoding performance. Moreover, we extend the proposed EP-based Gibbs sampling decoding to the soft-output decoding in MIMO bit-interleaved coded modulation (BICM) systems, which enjoys a flexible decoding trade-off between performance and complexity by the number of Markov moves.

Towards a Ring Analogue of the Leftover Hash Lemma

Abstract The leftover hash lemma (LHL) is used in the analysis of various lattice-based cryptosystems, such as the Regev and Dual-Regev encryption schemes as well as their leakage-resilient counterparts. The LHL does not hold in the ring setting, when the ring is far from a field, which is typical for efficient cryptosystems. Lyubashevsky et al. (Eurocrypt ’13) proved a “regularity lemma,” which can be used instead of the LHL, but applies only for Gaussian inputs. This is in contrast to the LHL, which applies when the input is drawn from any high min-entropy distribution. Our work presents an approach for generalizing the “regularity lemma” of Lyubashevsky et al. to certain conditional distributions. We assume the input was sampled from a discrete Gaussian distribution and consider the induced distribution, given side-channel leakage on the input. We present three instantiations of our approach, proving that the regularity lemma holds for three natural conditional distributions.

Efficient Software Implementation of Ring-LWE Encryption on IoT Processors

Embedded processors have been widely used for building up Internet of Things (IoT) platforms, in which the security issue is becoming critical. This paper studies efficient techniques of lattice-based cryptography on these processors and presents the first implementation of ring-LWE encryption on ARM NEON and MSP430 architectures. For ARM NEON architecture, we propose a vectorized version of Iterative Number Theoretic Transform (NTT) for high-speed computation of polynomial multiplication on ARM NEON platforms and a 32-bit variant of SAMS2 technique for fast reduction. For MSP430 architecture, we propose an optimized SWAMS2 reduction technique, which consists of five different basic operations, including Shifting, Swapping, Addition, and two Multiplication-Subtractions. Regarding of the sampling from the discrete Gaussian distribution, we adopt Knuth-Yao sampler, accompanied with optimized methods such as Look-Up Table (LUT) and byte-scanning. Subsequently, a full-fledged implementation of Ring-LWE is presented by both taking advantage of our proposed method and previous optimization techniques re-designed for desired platforms. Our ring-LWE implementation of encryption/decryption at a classical security level of 128 bits requires only $149.4k/32.8k$ 149 . 4 k / 32 . 8 k clock cycles on ARM NEON, and $2126.3k/244.5k$ 2126 . 3 k / 244 . 5 k clock cycles on MSP430. These results are roughly 7 times faster than the fastest ECC implementation on desired platforms with same security level.

High-Performance Constant-Time Discrete Gaussian Sampling

Discrete Gaussian distribution plays an essential role in lattice cryptography whereas naive implementations suffer from timing attacks. Unfortunately, conversion to secure constant-time variant incurs severe deterioration in performance. In Knuth-Yao sampling, we demonstrate several properties of the discrete distribution generation tree involving structural features and finite node height. Accordingly we propose a generic method independent of standard deviations, which focuses on minimizing the Boolean expressions for the mapping from input bit strings to output sample values, along with an in-depth efficiency analysis. Two optimization techniques are devised to further propel the minimization by replacing and adjusting nodes. To strike the balance of computational overhead and closeness to optimum, heuristic strategies are introduced. Finally, performance evaluation is conducted both in software and hardware. Running on a 3.4GHz Intel Core i7-6700 processor, our method improves sampling rate by up to 29.5 percent compared to the latest technique. Targeting hardware FPGA devices, our approach can be 2.7 times faster and achieves 57.3 percent resource reduction than the original constant-time Knuth-Yao sampling. Compared to the Cumulative Distribution Table algorithm with fixed step binary search, our sampler can be at least 12.6 times faster and gains 79/61 percent better area-time product than its counterpart without/with BRAM.

Learning from discrete Gaussian label distribution and spatial channel-aware residual attention for head pose estimation

Recent head pose estimation techniques are advanced by performing bin classification, where the predicted result is compared against a one-hot classification vector. We argue that the head poses may better be modelled by discrete distribution sampled from a smooth continuous curve rather than one-hot coding or some other kinds of binned classification vector, since pose angles in practice are arbitrary. In this paper, we propose a deep head pose estimation scheme by regressing between predicted probabilistic labels and discrete Gaussian distribution. Such Gaussian distribution aims at modelling the arbitrary state of true head poses and supervises the deep network through maximum mean discrepancy loss. Besides, we also propose a spatial channel-aware residual attention structure for enhancing intrinsic pose features to further improve the prediction accuracy and speed up training convergence. Experiments on two public datasets AFLW2000 and BIWI show the proposed method outperforms all previous methods, and its individual components yield substantial improvements.