Biscuit: New MPCitH Signature Scheme from Structured Multivariate Polynomials

Abstract

This paper describes Biscuit, a new multivariate-based signature scheme derived using the MPCitH approach. The security of Biscuit is related to the problem of solving a set of quadratic structured systems of algebraic equations. These equations are highly compact and can be evaluated using very few multiplications. The core of Biscuit is a rather simple MPC protocol which consists of the parallel execution of a few secure multiplications using standard optimized multiplicative triples. This paper also includes several improvements with respect to Biscuit submission to the last NIST PQC standardization process for additional signature schemes. Notably, we introduce a new hypercube variant of Biscuit, refine the security analysis with recent third-party attacks, and present a new avx2 implementation of Biscuit.

Preliminary Cryptanalysis of the Biscuit Signature Scheme

“…The designers of Biscuit updated the specification of their scheme following preliminary versions of our findings, and gave improved parameters in [BKPV24], that we find to be secure.…”

“…We refer to it as "Biscuit v1". An improved version appears in [BKPV24] with different parameters and we refer to it as "Biscuit v2". Biscuit has two sets of parameters for each security level: the "short" one produces the shortest possible signatures and the "fast" one yields faster signing and verification.…”

“…Biscuit is designed around an efficient MPC protocol Π that enables the parties to check whether f (x) = 0 (in this case, the parties "accept" x). It is shown in [BKPV24, Proposition 1] that if f (x) ̸ = 0, then the parties accept x with probability q −u if x is the solution of a subset of size exactly m − u of the polynomials. This probability is taken over the randomness used in the protocol: the parties need m common random elements of F q .…”

“…These systems are slightly overdetermined, so that using BiscuitZero is Table 4: Key-recovery attacks on Biscuit. v1 denotes the version of Biscuit in [BKPV23] and v2 is in [BKPV24]. The "Hybrid method" is the algorithm of [BFP12].…”

“…Biscuit is a multivariate digital signature scheme recently designed by Bettale, Kahrobaei, Perret and Verbel [BKPV23,BKPV24]. It has been submitted in July 2023 to the competition organised by NIST in order to standardize additional "post-quantum" signature schemes not based on lattices.…”