Post-quantum Signature Schemes Research Articles

Syrga2: Post-Quantum Hash-Based Signature Scheme

This paper proposes a new post-quantum signature scheme, Syrga2, based on hash functions. As known, existing post-quantum algorithms are classified based on their structures. The proposed Syrga2 scheme belongs to the class of multi-use signatures with state retention. A distinctive feature of state-retaining signatures is achieving a compromise between performance and signature size. This scheme enables the creation of a secure signature for r messages using a single pair of secret and public keys. The strength of signature algorithms based on hash functions depends on the properties of the hash function used in their structure. Additionally, for such algorithms, it is possible to specify the security level precisely. In the proposed scheme, the HBC-256 algorithm developed at the Institute of Information and Computational Technologies (IICT) is used as the hash function. The security of the HBC-256 algorithm has been thoroughly studied in other works by the authors. In contrast to the Syrga1 scheme presented in previous works by the authors, the Syrga2 scheme provides for the definition of different security levels determined by the parameter τ. This paper experimentally demonstrates the impossibility of breaking the proposed scheme using a chosen-plaintext attack. Additionally, the scheme’s performance is evaluated for signature creation, signing, and message verification.

Secure authentication framework for IoT applications using a hash-based post-quantum signature scheme

Secure authentication framework for IoT applications using a hash-based post-quantum signature scheme

On the Suitability of Post-Quantum Signature Schemes for Internet of Things

On the Suitability of Post-Quantum Signature Schemes for Internet of Things

Development of a New Post-Quantum Digital Signature Algorithm: Syrga-1

The distinguishing feature of hash-based algorithms is their high confidence in security. When designing electronic signature schemes, proofs of security reduction to certain properties of cryptographic hash functions are used. This means that if the scheme is compromised, then one of these properties will be violated. It is important to note that the properties of cryptographic hash functions have been studied for many years, but if a specific hash function used in a protocol turns out to be insecure, it can simply be replaced with another one while keeping the overall construction unchanged. This article describes a new post-quantum signature algorithm, Syrga-1, based on a hash function. This algorithm is designed to sign r messages with a single secret key. One of the key primitives of the signature algorithm is a cryptographic hash function. The proposed algorithm uses the HAS01 hashing algorithm developed by researchers from the Information Security Laboratory of the Institute of Information and Computational Technologies. The security and efficiency of the specified hash algorithm have been demonstrated in other articles by its authors. Hash-based signature schemes are attractive as post-quantum signature schemes because their security can be quantified, and their security has been proven.

Threshold/Multi Adaptor Signature and Their Applications in Blockchains

Adaptor signature is a variant of digital signatures and useful for fair excheng in financial applications such as cryptocurrencies, to name a few, off-chain transaction protocols, atomic swaps and other privacy-enhancing mechanisms. However, similar to normal digital signatures, an adaptor signature also suffers from the loss of the secret key and single-point failure, which is insufficient in practice. In this paper, we address this constraint by introducing two new concepts as enhancements: multi-adaptor signatures and threshold adaptor signatures. First, we propose the formal security models for multi-adaptor signature and threshold adaptor signature. Then, we present specific schemes for these two primitives based on the commonly used blockchain signature scheme Schnorr and the post-quantum signature scheme Dilithium, respectively. Furthermore, we provide security proofs for these four schemes. Finally, we demonstrate interesting applications for blockchains, such as oracle-based conditional payment and n to n atomic swap.

DESIGN OF TECHNOLOGY FOR SECURE FILE STORAGE BASED ON HYBRID CRYPTOGRAPHY METHODS: SHORT OVERVIEW

In the era of pervasive digital data, ensuring secure file storage has become a paramount concern. This paper explores the significance of hybrid cryptography in the development of information technology for secure file storage. Hybrid cryptography, combining symmetric and asymmetric encryption, offers robust protection against unauthorized access, tampering, and data loss. The article reviews recent cryptography literature, highlighting the importance of secure file storage in today's interconnected world and examining the benefits of hybrid cryptography. The analysis of articles on cryptography reveals emerging trends and challenges. Post-quantum cryptography addresses concerns about quantum threats, while blockchain-based cryptography enhances security in IoT data sharing. Homomorphic encryption enables computations on encrypted data, and privacy-preserving cryptographic protocols facilitate secure multi-party computation. Machine learning's intersection with cryptanalysis introduces efficiency but raises ethical considerations. The paper further discusses advancements and trends in cryptography techniques, including post-quantum cryptography, homomorphic encryption, zero-knowledge proofs, post-quantum key exchange, secure multi-party computation, and post-quantum signature schemes. These developments aim to ensure long-term security against quantum attacks, enable privacy-preserving computations, and enhance the confidentiality, integrity, and authentication of digital communication and data storage. In conclusion, the paper advocates for the adoption of hybrid cryptography in secure file storage systems. Its combination of symmetric and asymmetric encryption, along with its adaptability to evolving security landscapes, positions hybrid cryptography as a formidable approach to data protection. By embracing hybrid cryptography and staying informed about the latest advancements, organizations can navigate the digital age with confidence, ensuring the confidentiality, integrity, and availability of stored files.

Algebraic Attacks on RAIN and AIM Using Equivalent Representations

Designing novel symmetric-key primitives for advanced protocols like secure multiparty computation (MPC), fully homomorphic encryption (FHE) and zero-knowledge proof systems (ZK), has been an important research topic in recent years. Many such existing primitives adopt quite different design strategies from conventional block ciphers. Notable features include that many of these ciphers are defined over a large finite field, and that a power map is commonly used to construct the nonlinear component due to its efficiency in these applications as well as its strong resistance against the differential and linear cryptanalysis. In this paper, we target the MPC-friendly ciphers AIM and RAIN used for the post-quantum signature schemes AIMer (CCS 2023 and NIST PQC Round 1 Additional Signatures) and Rainier (CCS 2022), respectively. Specifically, we can find equivalent representations of 2-round RAIN and full-round AIM, respectively, which make them vulnerable to either the polynomial method, or the crossbred algorithm, or the fast exhaustive search attack. Consequently, we can break 2-round RAIN with the 128/192/256-bit key in only 2111/2170/2225 bit operations. For full-round AIM with the 128/192/256-bit key, we could break them in 2136.2/2200.7/2265 bit operations, which are equivalent to about 2115/2178/2241 calls of the underlying primitives. In particular, our analysis indicates that AIM does not reach the required security levels by the NIST competition.

Improved Gadgets for the High-Order Masking of Dilithium

We present novel and improved high-order masking gadgets for Dilithium, a post-quantum signature scheme that has been standardized by the National Institute of Standards and Technologies (NIST). Our proposed gadgets include the ShiftMod gadget, which is used for efficient arithmetic shifts and serves as a component in other masking gadgets. Additionally, we propose a new algorithm for Boolean-to-arithmetic masking conversion of a μ-bit integer x modulo any integer q, with a complexity that is independent of both μ and q. This algorithm is used in Dilithium to mask the generation of the random variable y modulo q. Moreover, we describe improved techniques for masking the Decompose function in Dilithium. Our new gadgets are proven to be secure in the t-probing model.We demonstrate the effectiveness of our countermeasures by presenting a complete high-order masked implementation of Dilithium that utilizes the improved gadgets described above. We provide practical results obtained from a C implementation and compare the performance improvements provided by our new gadgets with those of previous work.

Post-Quantum Signature Scheme Based on the Root Extraction Problem over Mihailova Subgroups of Braid Groups

In this paper, by introducing an isomorphism from the Mihailova subgroup of F2×F2 to the Mihailova subgroups of a braid group, we give an explicit presentation of Mihailova subgroups of a braid group. Hence, in a braid group, there are some Mihailova subgroups experiencing unsolvable subgroup membership problem. Based on this, we propose a post-quantum signature scheme of the Wang–Hu scheme, and we show that the signature scheme is free of quantum computational attack.

Building Applications and Developing Digital Signature Devices based on the Falcon Post-Quantum Digital Signature Scheme

Falcon is an efficient and secure postquantum signature scheme for services based on quantum computing. It employs the hash-and-sign approach in conjunction with the Gentry, Peikert, and Vaikuntanathan (GPV) framework on Number Theory Research Unit (NTRU) lattices. This study evaluated the operation procedure and the capacity to run the Falcon scheme using a key length of 1024 bits on different hardware and software platforms, such as personal computers and Raspberry Pi 4 and Windows, Ubuntu, and Android operating systems. The following results were obtained: file sizes ranged from 30 to 5449268 KB, digital signature times ranged from 50 to 19500ms, and signature verification times ranged from 14 to 19000ms. The results show that the Falcon post-quantum signature scheme works stably and ensures execution speed on different platforms, similar to current digital signature schemes.

A new type of digital signature algorithms with a hidden group

The known designs of digital signature schemes with a hidden group, which use finite non-commutative algebras as algebraic support, are based on the computational complexity of the so-called hidden discrete logarithm problem. A similar design, used to develop a signature algorithm based on the difficulty of solving a system of many quadratic equations in many variables, is introduced. The significant advantage of the proposed method compared with multivariate-cryptography signature algorithms is that the said system of equations, which occurs as the result of performing the exponentiation operations in the hidden group, has a random look and is specified in a finite field of a higher order. This provides the ability to develop post-quantum signature schemes with significantly smaller public-key sizes at a given level of security.

On the security of multivariate-based ring signature and other related primitives

The multivariate public-key cryptography (MPKC) provides a promising class of post-quantum signature schemes. Its theoretical security comes from the intractability of the multivariate quadratic problem (MQ problem), which is an NP-hard problem [1]. Nevertheless, not every instance of MQ-problem is hard [2–6] while the problem itself is NP-hard. Thus, it is important to understand and analyze the nature of the quadratic systems used in existing MPKC so that the security of the multivariate schemes can be properly assessed. Herein, we present a detailed cryptanalysis of the multivariate based ‘ring’ signature scheme presented by Wang et al. [7]. We utilize the attacks on the underdetermined system of multivariate quadratic equations. We prove both theoretically and experimentally that the scheme (Wang et al. [7]) can be broken in polynomial time even for rings of small size. Additionally, we observed that the attack strategy we proposed in this work is not only limited to [7], but can also be applied to break the unforgeability of other multivariate based schemes such as verifiable ring signature scheme [8], multivariate group signature scheme [9], and Gui and GeMSS based ring signature scheme [10,11].

Post-quantum signature algorithms on noncommutative algebras, using difficulty of solving systems of quadratic equations

A recently proposed new concept for constructing algebraic signature schemes with a hidden group is used to develop two new post-quantum signature algorithms on four-dimensional and six-dimensional finite noncommutative associative algebras. As in the case of the post-quantum signature schemes of multivariate cryptography, the security of the introduced algorithms is based on the computational difficulty of solving systems of many quadratic equations (44 and 42) with many unknowns (40 and 36). The signature represents a pair of a natural number e and a vector S. The latter enters three times in the verification equation used, providing resistance to the forging signature attacks by using the value S as a fitting parameter. A public key is generated in the form of a set of vectors, each of which is calculated as the product of triples of secret vectors. With a special choice of these triples, a signer has the possibility of calculating a signature that satisfies the verification equation. The developed post-quantum signature algorithms are practical, having sufficiently small signatures (97 and 109 bytes), public keys (387 and 291 bytes), and secret keys (315 and 451 bytes). A significant difference from the public-key algorithms of multivariate cryptography is that in the developed signature schemes, the system of quadratic equations is derived from the formulas for generating the public-key elements in the form of a set of vectors of m-dimensional finite noncommutative algebra with an associative vector multiplication operation. The formulas define the system of n quadratic vector equations, which reduces to the system of m quadratic equations over a finite field.

New Low-Memory Algebraic Attacks on LowMC in the Picnic Setting

The security of the post-quantum signature scheme Picnic is highly related to the difficulty of recovering the secret key of LowMC from a single plaintext-ciphertext pair. Since Picnic is one of the alternate third-round candidates in NIST post-quantum cryptography standardization process, it has become urgent and important to evaluate the security of LowMC in the Picnic setting. The best attacks on LowMC with full S-box layers used in Picnic3 were achieved with Dinur’s algorithm. For LowMC with partial nonlinear layers, e.g. 10 S-boxes per round adopted in Picnic2, the best attacks on LowMC were published by Banik et al. with the meet-in-the-middle (MITM) method.In this paper, we improve the attacks on LowMC in a model where memory consumption is costly. First, a new attack on 3-round LowMC with full S-box layers with negligible memory complexity is found, which can outperform Bouillaguet et al.’s fast exhaustive search attack and can achieve better time-memory tradeoffs than Dinur’s algorithm. Second, we extend the 3-round attack to 4 rounds to significantly reduce the memory complexity of Dinur’s algorithm at the sacrifice of a small factor of time complexity. For LowMC instances with 1 S-box per round, our attacks are shown to be much faster than the MITM attacks. For LowMC instances with 10 S-boxes per round, we can reduce the memory complexity from 32GB (238 bits) to only 256KB (221 bits) using our new algebraic attacks rather than the MITM attacks, while the time complexity of our attacks is about 23.2 ∼ 25 times higher than that of the MITM attacks. A notable feature of our new attacks (apart from the 4-round attack) is their simplicity. Specifically, only some basic linear algebra is required to understand them and they can be easily implemented.

A Survey on Post-Quantum Public-Key Signature Schemes for Secure Vehicular Communications

Basic security requirements such as confidentiality, user authentication and data integrity, are assured by using public-key cryptography (PKC). In particular, public-key signature schemes provide non-repudiation, integrity of transmitted messages and authentication. The presence of a large scale quantum computer would be a real threat to break the most widely used public-key cryptographic algorithms in practice, RSA, DSA, ECDSA signature schemes and Diffie-Hellman key exchange. Thus, all security protocols and applications where these public-key cryptographic algorithms are used are vulnerable to quantum-computer attacks. There are five directions of cryptographic primitives secure against a quantum computer: multivariate quadratic equation-based, hash-based, lattice-based, code-based and supersingular isogeny-based cryptography. These primitives could serve as replacements for current public-key cryptographic algorithms to prepare for post-quantum era. It is important to prioritize the fields to be replaced by post-quantum cryptography (PQC) since it is hard to replace the currently deployed PKC with PQC at the same time. The fields directly connected to human life such as vehicular communications should be the primary targets of PQC applications. This survey is dedicated to providing guidelines for adapting the most suitable post-quantum candidates to the requirements of various devices and suggesting efficient and physically secure implementations that can be built into existing embedded applications as easily as traditional PKC. It focuses on the five types of post-quantum signature schemes and investigates their theoretical backgrounds, structures, state-of-the-art constructions and implementation aspects on various platforms raging from resource constrained IoT devices to powerful servers connected to the devices for secure communications in post-quantum era. It offers appropriate solutions to find tradeoffs between key sizes, signature lengths, performance, and security for practical applications.

Split logarithm problem and a candidate for a post-quantum signature scheme

A new form of the hidden discrete logarithm problem, called split logarithm problem, is introduced as primitive of practical post-quantum digital signature schemes, which is characterized in using two non-permutable elements $A$ and $B$ of a finite non-commutative associative algebra, which are used to compute generators $Q=AB$ and $G=BQ$ of two finite cyclic groups of prime order $q$. The public key is calculated as a triple of vectors $(Y,Z,T)$: $Y=Q^x$, $Z=G^w$, and $T=Q^aB^{-1}G^b$, where $x$, $w$, $a$, and $b$ are random integers. Security of the signature scheme is defined by the computational difficulty of finding the pair of integers $(x,w)$, although, using a quantum computer, one can easily find the ratio $x/w\bmod q$.

A novel version of the hidden logarithm problem for post-quantum signature algorithms

In the article we propose a novel version of the hidden logarithm problem (HLP), the peculiarity of which is using the local units instead of the global unit in the HLP proposed earlier for designing post-quantum signature schemes. Two different 4-dimensional finite associative algebras with non-commutative multiplication operation are proposed as carriers of the introduced version of the HLP. One of the proposed algebras contains the global two-sided unit. The second algebra contains only local units (single-sided and two-sided ones). In the first algebra, every non-invertible element, which is not a zero-divisor, defines many local single-sided (the right-sided and the left-sided) and many local two-sided units. The both types of the single-sided units play an important role for defining the HLP of the proposed version. Formulas describing the local units of different types are derived and used to generate the public key of a developed HLP-based signature algorithm that is resistant to quantum attacks. Design criterion and security discussion of the introduced signature scheme are presented.

A Novel Method for Developing Post-quantum Digital Signature Algorithms on Non-commutative Associative Algebras

Introduction: Development of practical post-quantum signature algorithms is a current challenge in the area of cryptography. Recently, several candidates on post-quantum signature schemes, in which the exponentiation operations in a hidden commutative group contained in a non-commutative algebra is used, were proposed. Search for new mechanisms of using a hidden group, while developing signature schemes resistant to quantum attacks, is of significant practical interest. Purpose: Development of a new method for designing post-quantum signature algorithms on finite non-commutative associative algebras. Results: A novel method for developing digital signature algorithms on non-commutative algebras. A new four-dimensional finite non-commutative associative algebra set over the ground field GF(p) have been proposed as algebraic support of the signature algorithms. To provide a higher performance of the algorithm, in the introduced algebra the vector multiplication is defined by a sparse basis vector multiplication table. Study of the algebra structure has shown that it can be represented as a set of commutative subalgebras of three different types, which intersect exactly in the set of scalar vectors. Using the proposed method and introduced algebra, a new post-quantum signature scheme has been designed. The introduced method is characterized in using one of the elements of the signature (e, S) in form of the four-dimensional vector S that is computed as a masked product of two exponentiated elements G and H of a hidden commutative group: S = B-1GnHmC-1, where non-permutable vectors B and C are masking multipliers; the natural numbers n and m are calculated depending on the signed document M and public key. The pair <G, H> composes a minimum generator systems of the hidden group. The signature verification equation has the form R = (Y1SZ1)e(Y2SZ2)e2, where pairwise non-permutable vectors Y1, Z1, Y2, and Z2 are element of the public key and natural number e that is computed depending on the value M and the vector R. Practical relevance: Due to sufficiently small size of public key and signature and high, the developed digital signature scheme represents interest as a practical post-quantum signature algorithm. The introduced method is very attractive to develop a post-quantum digital signature standard.

Efficient Hardware Implementations of Legendre Symbol Suitable for MPC Applications

Multi-party computation (MPC) allows each peer to take part in the execution of a common function with their private share of data without the need to expose it to other participants. The Legendre symbol is a pseudo-random function (PRF) that is suitable for MPC protocols due to their efficient evaluation process compared to other symmetric primitives. Recently, Legendre-based PRFs have also been employed in the construction of a post-quantum signature scheme, namely LegRoast. In this paper, we propose, to the best of our knowledge, the first hardware implementations for the Legendre symbol by three approaches: 1) low-area, 2) high-speed, and 3) high-frequency. The high-speed architecture outperforms state-of-the-art software implementations, which run on Intel’s Core-i5. Our evaluation results on FPGA show that this architecture reduces the Legendre calculation time by <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2.56\times $ </tex-math></inline-formula> compared to software implementations on Core-i5. On the other hand, the low-area architecture consumes only 5489 slices on the Artix-7 FPGA and is suitable for resource-constrained devices. Moreover, our ASIC implementation results indicate that the low-area architecture consumes 97.56K gates to implement and requires <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$4.01~mW$ </tex-math></inline-formula> to operate on 50 MHz. The high-frequency architecture increases the frequency by <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$1.72\times $ </tex-math></inline-formula> over the high-speed architecture and achieves 200 MHz frequency on FPGA.

Improving Bitcoin’s Post-Quantum Transaction Efficiency With a Novel Lattice-Based Aggregate Signature Scheme Based on CRYSTALS-Dilithium and a STARK Protocol

This paper proposes a novel lattice-based aggregate signature (LAS) scheme that bring post-quantum security to the Bitcoin system without sacrificing its transaction efficiency. Bitcoin currently employs Elliptic Curve Digital Signature Algorithm (ECDSA), which is insecure against the emerging quantum technology, so post-quantum signature schemes like the proposed LAS will become necessary in the near future. However, most of the post-quantum signatures schemes have large signature sizes which decrease Bitcoin’s efficiency while our proposed scheme does not have this negative side effect. Our LAS scheme is based on CRYSTALS-Dilithium and a zero-knowledge Scalable Transparent Arguments of Knowledge (STARK) protocol. CRYSTALS-Dilithium is the most prominent algorithm chosen by the National Institute of Standards and Technology (NIST), yet it still has an adverse limitation: it would cause Bitcoin’s transaction efficiency to fall by 17 times due to its relatively large signature size. On the other hand, the proposed LAS scheme takes full advantage of signature aggregation using the STARK protocol and Dilithium’s easy and fast implementation, thus generating signatures with post-quantum security and small signature sizes which are critical to transaction efficiency. Our proofs convey the correctness, compactness, and post-quantum security of our construction in the quantum random oracle model, and our implementation conveyed that the proposed scheme would only decrease Bitcoin’s transaction efficiency by 3 times, a significant improvement from using Dilithium and other lattice-based aggregate signature schemes. Our proposed scheme has many advantages over the existing schemes and may become very valuable to Bitcoin.