Lattice Assumptions Research Articles

Linkable ring signature scheme with stronger security guarantees

Ring signatures enable a user to sign messages on behalf of an arbitrary set of users, called the ring. The signer-anonymity property guarantees that the signature does not reveal which member of the ring signed the message. The notion of linkable ring signatures (LRS) is an extension of the concept of ring signatures such that there is a public way of determining whether two signatures have been produced by the same signer. However, the existing LRS schemes may not be competent in some scenarios since they exhibit a gap to bridge as reflected on the security guarantees such as the absence of quantum-resistance, inadequate security notions, and a reliance on the random oracle heuristic.In this paper, we present a framework for LRS that provides stronger security guarantees. We instantiate the framework from standard lattice assumptions and prove the security in the standard model. Furthermore, we implement our scheme and conduct experimental evaluations, which demonstrate that the performances are practical for typical settings.

Post-Quantum Secure Identity-Based Signature Scheme with Lattice Assumption for Internet of Things Networks.

The Internet of Things (IoT) plays an essential role in people's daily lives, such as healthcare, home, traffic, industry, and so on. With the increase in IoT devices, there emerge many security issues of data loss, privacy leakage, and information temper in IoT network applications. Even with the development of quantum computing, most current information systems are weak to quantum attacks with traditional cryptographic algorithms. This paper first establishes a general security model for these IoT network applications, which comprises the blockchain and a post-quantum secure identity-based signature (PQ-IDS) scheme. This model divides these IoT networks into three layers: perceptual, network, and application, which can protect data security and user privacy in the whole data-sharing process. The proposed PQ-IDS scheme is based on lattice cryptography. Bimodal Gaussian distribution and the discrete Gaussian sample algorithm are applied to construct the fundamental difficulty problem of lattice assumption. This assumption can help resist the quantum attack for information exchange among IoT devices. Meanwhile, the signature mechanism with IoT devices' identity can guarantee non-repudiation of information signatures. Then, the security proof shows that the proposed PQ-IDS can obtain the security properties of unforgeability, non-repudiation, and non-transferability. The efficiency comparisons and performance evaluations show that the proposed PQ-IDS has good efficiency and practice in IoT network applications.

A new lattice-based online/offline signatures framework for low-power devices

Lattice-based online/offline signature scheme enjoys the advantage of resisting quantum feature besides the short online response time. The existing Fiat-Shamir with aborts paradigm candidates do not have perfect online/offline property, and the hash-sign-switch ones usually increase the signature sizes. In this paper we mainly address its online time and the length of signature issues, and propose a new and efficient paradigm of its construction for lattice assumptions over rings. In this paradigm the signer tries to sign for a random string and the message respectively. Specifically, we first discuss the generic construction of Fiat-Shamir lattice-based signatures. Then for a large class of lattice-based relations over rings, we propose an improved framework designed for low-power devices. This new framework allows the signer to extract a part of the signature only for a random string chosen in offline time, and thus can obtain the whole signature by less online time. In addition, the resulting scheme slightly reduces the signature size compared to the Fiat-Shamir counterparts. The performance analysis shows that our construction is efficient.

Quantum Secure Undeniable Signature for Blockchain-Enabled Cold-Chain Logistics System

Data security and user privacy are two main security concerns in the cold-chain logistics system (CCLS). Many security issues exist in traditional CCLS, destroying data security and user privacy. The digital signature can provide data verification and identity authentication based on the mathematical difficulty problem for logistics data sharing in CCLS. This paper first established a blockchain-enabled cold-chain logistics system (BCCLS) based on union blockchain technology, which can provide secure data sharing among different logistics nodes and guarantee logistics data security with the untampered blockchain ledger. Meanwhile, a lattice-based undeniable signature scheme is designed to strengthen the security of logistics data and user privacy against quantum attacks. This scheme is based on the lattice assumption, which can provide anti-quantum security for BCCLS in the future quantum computer age. It also establishes the undeniable mechanism that guarantees that the actual signer cannot deny a valid signature. Then, security proof shows that this undeniable signature scheme is correct and safe, and an efficiency comparison shows that it is more efficient than other schemes in similar literature. The performance evaluations of transaction throughput and latency show that the proposed BCCLS is efficient and practical. This work can improve the security and efficiency of logistics data management and promote the reform and development of the logistics industry.

Lattice-Based Group Signatures With Time-Bound Keys via Redactable Signatures

Group signatures are active cryptographic topics where group members are granted right to sign messages anonymously on behalf of their group. However, in practical applications, such rights are not permanent in most cases and are usually limited to some time periods. This means that the signing right of each group member needs to be associated with time periods such that it can be automatically changed with the latter. Among the known approaches, verifier local revocation (VLR) seems to be the feasible one to implement the above functionality, but it will cause an inefficient verification process when the group size is large. In this paper, we describe a group signature scheme with time-bound keys, based on the hardness of lattice assumption, which implements the limitation of the signing right to any time period by constructing a lattice-based redactable signature scheme. Our scheme still adds VLR mechanism for some members who need to revoke prematurely, but the time-bound keys function ensures such members are only a small fraction that do not incur excessive cost for revocation check. We give implementation for our scheme under 93-bit and 207-bit security respectively to demonstrate the practicability – all costs are independent of the group size and achieve a relatively efficient level.

Smooth Projective Hash Function From Codes and its Applications

Nowadays, Smooth Projective Hash Functions (SPHFs) play an important role in constructing cryptographic tools such as secure Password-based Authenticated Key Exchange (PAKE) protocol in the standard model, oblivious transfer, and zero-knowledge proofs. Specifically, in this article, we focus on constructing PAKE protocol; that is, a kind of key exchange protocol which needs only a low entropy password to produce a cryptographically strong shared session key. In spite of relatively good progress of SPHFs in applications, it seems there has been little effort to build them upon quantum-resistant assumptions such as lattice-based cryptography and code-based cryptography to make them secure against quantum computer attacks. More precisely, there are two proposals based on lattice assumptions that utilize the SPHFs to construct PAKE secured in standard model. Considering quantum-resistant assumptions is less than straightforward and needs some relaxations. In this article, we introduce two new Approximate SPHF (ASPHFs) from error-correcting codes. Upon designing ASPHF, we can construct two efficient PAKE protocols. The security of our protocols could be proved based on the hardness of bounded decoding (BD) problem and learning with parity (LPN) problem in the standard model.

A constant-size lattice-based partially-dynamic group signature scheme in quantum random oracle model

A group signature allows a group member who signs the message on behalf of the other group members. Any recipient also verifies the signature without knowing the signer. However, it is possible to reveal the signer’s identity since the group signatures have the tracing mechanism. In general, the group signature size increases the number of group members. However, the schemes are also proposed with the constant signature size. On the other hand, the security of some schemes are based on the discrete logarithm and factorization problems while some schemes which are secure against quantum attacks are proposed. To the best of our knowledge, the signature scheme in the group concept has not been proposed on lattices in quantum oracles. In this paper, we propose a new constant-size and partially-dynamic group signature scheme on lattice assumptions. We combine the Dilithium signature scheme, a Stern-like zero-knowledge scheme and Regev’s encryption scheme. We give a zero-knowledge argument system for our proposed scheme and security analysis in the quantum random oracle model. According to the comparison results, the proposed scheme has better size complexity in asymptotic concept.

Adaptively Secure Distributed PRFs from $$\textsf {LWE}$$

In distributed pseudorandom functions (DPRFs), a PRF secret key SK is secret shared among N servers so that each server can locally compute a partial evaluation of the PRF on some input X. A combiner that collects t partial evaluations can then reconstruct the evaluation F(SK, X) of the PRF under the initial secret key. So far, all non-interactive constructions in the standard model are based on lattice assumptions. One caveat is that they are only known to be secure in the static corruption setting, where the adversary chooses the servers to corrupt at the very beginning of the game, before any evaluation query. In this work, we construct the first fully non-interactive adaptively secure DPRF in the standard model. Our construction is proved secure under the \(\textsf {LWE}\) assumption against adversaries that may adaptively decide which servers they want to corrupt. We also extend our construction in order to achieve robustness against malicious adversaries.

Watermarking Cryptographic Functionalities from Standard Lattice Assumptions

A software watermarking scheme allows one to embed a “mark” into a program without significantly altering the behavior of the program. Moreover, it should be difficult to remove the watermark without destroying the functionality of the program. Recently, Cohen et al. (STOC 2016) and Boneh et al. (PKC 2017) showed how to watermark cryptographic functions such as PRFs using indistinguishability obfuscation. Notably, in their constructions, the watermark remains intact even against arbitrary removal strategies. A natural question is whether we can build watermarking schemes from standard assumptions that achieve this strong mark-unremovability property.

Data Anonymous Authentication for BIoMT with Proxy Group Signature

Along with the increase of wearable medical device, the privacy leakage problem in the process of transmission between these edge medical devices. The blockchain-enabled Internet of Medical Things (BIoMT) has been developed to reform traditional centralized medical system in recent years. This paper first introduces a data anonymous authentication model to protect user privacy and medical data in BIoMT. Then, a proxy group signature (PGS) scheme has been proposed based on lattice assumption. This scheme can well satisfy the anonymous authentication demand for the proposed model, and provide anti-quantum attack security for BIoMT in the future general quantum computer age. Moreover, the security analysis shows this PGS scheme is secure against the dynamical-almostfull anonymous and traceability. The efficiency comparison shows the proposed model and PGS scheme is more efficient and practical.

An efficient anti-quantum lattice-based blind signature for blockchain-enabled systems

Blockchain technology has a tendency to make revolutionary changes for all walks of life with its public, distributed, decentration and unforgeable characteristics. However, with the rapid development of the quantum computer, many extant cryptographic algorithms applied in blockchain-enabled systems are vulnerable to the quantum attacks. In this paper, an anti-quantum blind signature scheme based on the lattice assumption has been proposed. As lattice cryptography is the main candidate algorithm in post-quantum cryptosystems and the blind signature scheme is widely used in e-cash and voting for creating untraceable payment system, which are more suitable for privacy preserving in blockchain-enabled systems. In the proposed scheme, the bimodal Gaussian distribution, Reject sampling and other technologies have been used to improve the security and efficiency. Then, the proposed blind signature can satisfy the properties of blindness and one-more unforgeability, and it also can prove to be safe in the random oracle model. Moreover, the efficiency analysis and comparison results show that the proposed scheme is more efficient than the similar literatures and has a more stabilized signature size than other cryptosystems.

Lattice-based group signature scheme without random oracle

ABSTRACT Group signature is a cryptographic primitive where any member can anonymously sign a message on behalf of the population they belong to. Several group signatures were proposed based on number-theoretic assumptions. All these schemes are insecure in the presence of quantum computers. Group signatures based on lattice assumptions are believed to be quantum-resistant. In the past few years, group signatures based on lattice assumptions have been proposed and most of them are proved to be secure in random-oracle model. This paper presents a lattice-based group signature scheme without using random-oracle. Our scheme is based on correlation-intractable function ensembles for all evasive relations which are constructed recently based on well-defined assumptions. Security of our scheme is proved based on correlation-intractable function ensembles and hardness of Short Integer Solution and Learning With Errors problem.

A New Constant-Size Group Signature Scheme From Lattices

A lattice-based group signature scheme (LGSS) is an active cryptographic primitive, where each group member can sign messages anonymously in the name of the entire group and each valid signature should be traced to some group member on the lattice. In each LGSS, the size of the group signature usually depends on the number of group members and the security parameter. Thus, designing a constant-size LGSS is an interesting problem. At PKC 2018, Ling, Nguyen, Wang and Xu presented the first constant-size group signature scheme under lattice assumptions. Its design is based on a zero-knowledge argument of the knowledge of a valid message-signature pair for the Ducas-Micciancio signature scheme, which follows the sign-then-encrypt-then-prove protocol. In contrast to this work, we construct a new constant-size LGSS. The scheme adopts the sign-hybrid-encrypt approach and makes use of the Lyubashevsky signature scheme. Our work is efficient in the signing algorithm, more precise on the open algorithm and shorter in public key, secret key and signature size than previous studies. Furthermore, we prove that the scheme has full anonymity and full traceability under the Ring Learning With Errors and Ring Short Integer Solution assumptions in the random oracle model.

Multi-theorem Preprocessing NIZKs from Lattices

Non-interactive zero-knowledge (NIZK) proofs are fundamental to modern cryptography. Numerous NIZK constructions are known in both the random oracle and the common reference string (CRS) models. In the CRS model, there exist constructions from several classes of cryptographic assumptions such as trapdoor permutations, pairings, and indistinguishability obfuscation. However, at the time of the initial publication of this work, we did not have constructions of NIZKs from standard lattice assumptions. In this work, we take an initial step toward constructing multi-theorem NIZKs for general $$\mathsf {NP}$$ languages from standard lattice assumptions by considering a relaxation to the preprocessing model and a new model we call the designated-prover model. In the preprocessing model, a setup algorithm generates secret proving and verification keys for the prover and the verifier, respectively. In the designated-prover model, the proving key is secret, but the verification key is public. In both settings, the proving key is used to construct proofs and the verification key is used to check proofs. Finally, in the multi-theorem setting, both the proving and verification keys should be reusable for an unbounded number of theorems without compromising soundness or zero-knowledge. Previous constructions of NIZKs in the preprocessing model that rely on weaker assumptions like one-way functions or oblivious transfer are only secure in a single-theorem setting. Thus, constructing multi-theorem NIZKs in these relaxed models does not seem to be inherently easier than constructing them in the CRS model. In this work, we first construct a multi-theorem preprocessing NIZK argument from context-hiding homomorphic signatures. In fact, the construction is a designated-prover NIZK. We also show that using homomorphic commitments, we can get statistically sound proofs in the preprocessing and designated-prover models. Together with lattice-based instantiations of homomorphic signatures and commitments, we obtain the first multi-theorem NIZKs in the preprocessing and designated-prover models from standard lattice assumptions. Finally, we show how to generalize our construction to obtain a universally composable NIZK (UC-NIZK) in the preprocessing model from standard lattice assumptions. Our UC-NIZK relies on a simple preprocessing protocol based on a new primitive we call blind homomorphic signatures.

Zero-knowledge arguments for matrix–vector relations and lattice-based group encryption

Group encryption (GE) is the natural encryption analogue of group signatures in that it allows verifiably encrypting messages for some anonymous member of a group while providing evidence that the receiver is a properly certified group member. Should the need arise, an opening authority is capable of identifying the receiver of any ciphertext. As introduced by Kiayias, Tsiounis and Yung (Asiacrypt'07), GE is motivated by applications in the context of oblivious retriever storage systems, anonymous third parties and hierarchical group signatures. This paper provides the first realization of group encryption under lattice assumptions. Our construction is proved secure in the standard model (assuming interaction in the proving phase) under the Learning-With-Errors (LWE) and Short-Integer-Solution (SIS) assumptions. As a crucial component of our system, we describe a new zero-knowledge argument system allowing to demonstrate that a given ciphertext is a valid encryption under some hidden but certified public key, which incurs to prove quadratic statements about LWE relations. Specifically, our protocol allows arguing knowledge of witnesses consisting of X∈Zqm×n, s∈Zqn and a small-norm e∈Zm which underlie a public vector b=X⋅s+e∈Zqm while simultaneously proving that the matrix X∈Zqm×n has been correctly certified. We believe our proof system to be useful in other applications involving zero-knowledge proofs in the lattice setting.

An Efficient Strong Designated Verifier Signature Based on <inline-formula> <tex-math notation="LaTeX">$\mathcal{R}-$ </tex-math> </inline-formula>SIS Assumption

The designated verifier signature (DVS), introduced by Jakobsson et al. , has the property that only the designated verifier can verify the generated signature. In order to prevent an eavesdropper to get the signature on-line before the designated verifier receives it, they also proposed strong designated verifier signature (SDVS). In this paper, according to an efficient SDVS proposed by Saeednia et al. , we present a post-quantum SDVS in the random oracle model based on lattice assumption. The unforgeability is based on the hardness of the average-case hard problem $\mathcal {R}-$ SIS $_{q,n,m,\beta }$ , which is at least as hard as worst-case SVP $_{\gamma }$ over ideal lattices. In addition, compared with existing lattice-based SDVS schemes, our scheme cuts by more than 50 percent repetitions and the size of signature is shorter with 256 bits security.

FS-PEKS: Lattice-based Forward Secure Public-key Encryption with Keyword Search for Cloud-assisted Industrial Internet of Things

Cloud-assisted Industrial Internet of Things (IIoT) relies on cloud computing to provide massive data storage services. To ensure the confidentiality, sensitive industrial data need to be encrypted before being outsourced to cloud storage server. Public-key encryption with keyword search (PEKS) enables users to search target encrypted data by keywords. However, most existing PEKS schemes are based on conventional hardness assumptions, which are vulnerable to adversaries equipped with quantum computers in the near future. Moreover, they suffer from key exposure, and thus the security would be broken once the keys are compromised. In this paper, we propose a forward secure PEKS scheme (FS-PEKS) based on lattice assumptions for cloud-assisted IIoT, which is post-quantum secure. We integrate a lattice-based delegation mechanism into FS-PEKS to achieve forward security, such that the security of the system is still guaranteed even the keys are compromised by the adversaries. We define the first formal security model on forward security of PEKS, and prove the security of FS-PEKS under the model. As the keywords of industrial data are with inherently low entropy, we further extend FS-PEKS to resist insider keyword guessing attacks (IKGA). The comprehensive performance evaluation demonstrates that FS-PEKS is practical for cloud-assisted IIoT.

Identity-based key-exposure resilient cloud storage public auditing scheme from lattices

With the rapid development of cloud auditing services, key exposure has been highlighted as a serious security issue. Using the exposed private key of a client, cloud servers can forge previous auditing proofs to cheat auditors. To date, a few pairing-based cloud storage auditing schemes addressing key exposure have been proposed. However, they are not secure from quantum attacks, and they rely on public key infrastructure (PKI), which involves complex certificate management. In this paper, we propose an efficient identity-based key-exposure resilient public auditing scheme from lattice assumptions in cloud storage. Our scheme is not only quantum-resistant, but eliminates the need to establish a PKI. We employ lattice basis delegation technique to update a client’s private key flexibly, keeping the private key size constant. Based on the hardness of lattice assumptions, we prove the forward security of storage correctness guarantee against malicious cloud servers in detail, and that the proposed scheme preserves privacy against curious auditors. Furthermore, we conduct a performance comparison to demonstrate that our scheme is much more efficient and practical for post-quantum secure cloud storage.

Lattice-based deniable ring signatures

In cryptography, a ring signature is anonymous as it hides the signer’s identity among other users. When generating the signature, the users are arranged as a ring. Compared with group signatures, a ring signature scheme needs no group manager or special setup and supports flexibility of group choice. However, the anonymity provided by ring signatures can be used to conceal a malicious signer and put other ring members under suspicion. At the other extreme, it does not allow the actual signer to prove their identity and gain recognition for their actions. A deniable ring signature is designed to overcome these disadvantages. It can initially protect the signer, but if necessary, it enables other ring members to deny their involvement, and allows the real signer to prove who made the signed action. Many real-world applications can benefit from such signatures. Inspired by the requirement for them to remain viable in the post-quantum age, this work proposes a new non-interactive deniable ring signature scheme based on lattice assumptions. Our scheme is proved to be anonymous, traceable and non-frameable under quantum attacks.

D-NTRU: More efficient and average-case IND-CPA secure NTRU variant

NTRU is a fast public key cryptosystem remaining unbroken. However, there is no known worst-to-average reduction for the original NTRU cryptosystem. Several provably secure NTRU modifications such as NAEP, pNE and NTRUCCA were proposed in the literature at the cost of inefficiency in encryption/decryption and enlarged ciphertext expansion. NAEP completes the IND-CCA security of the original NTRU under the average-case NTRU one-wayness intractability assumption. Both pNE and NTRUCCA obtain provable security goals under worst-case lattice assumptions. In this paper, a general framework for NTRU is considered, and a new PKC called D-NTRU is proposed. It is shown that the D-NTRU cryptosystem reduces the ciphertext expansion of the NTRU algorithm, and the encryption and decryption algorithms of D-NTRU perform even asymptotically faster than the NTRU algorithm only at the cost of slightly enlarged secret and public keys. The security of D-NTRU is proven in the standard model and under the average-case NTRU one-wayness assumption. The proof of the IND-CPA security of D-NTRU is completed by introducing another NTRU variant called C-NTRU as a bridge, defining some problems, and then proving the equivalence of these problems. So the proposed D-NTRU algorithm is more advantageous than the original NTRU algorithm, and much more efficient than all the provably secure variants of NTRU.