Practical, Round-Optimal Lattice-Based Blind Signatures

Agrawal, Shweta; Kirshanova, Elena; Stehlé, Damien; Yadav, Anshu

doi:10.1145/3548606.3560650

Cited by 30 publications

(8 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This reduction also requires a specific choice of parameters, and again Hawk makes more aggressive choices. This problem is similar to the recently introduced one more inhomogenous short integer solution problem [1] used to design blind signature schemes from lattices. We also propose efficient encodings for the public key and signatures of our scheme.…”

Section: Introductionmentioning

confidence: 92%

“…First h is sampled (left), then B is applied, a short lattice point x is sampled from a discrete Gaussian on Z 2n + 1 2 B • h (right). Finally B −1 applied to x is subtracted from 1 2 h to obtain a lattice point s close to h/2 in • Q . We then add h − 2s to ensure we satisfy sym-break(h 1 − 2s 1 ).…”

Section: Uncompressed Hawkmentioning

confidence: 99%

“…We consider the general problem of forging a signature for some unsigned message. Specifically, given a target 1 2 h for some h ∈ {0, 1} 2n , return…”

Section: Signature Forgerymentioning

confidence: 99%

“…Although the computation here uses less precision than the AVX2 version, the precision errors before rounding in (1) are so small that rounding to an incorrect s 0 is highly unlikely. By the parameters in Section 5.1, it is extremely unlikely (probability less than 2 −105 ) that s 0 is recovered incorrectly with (1). By small adaptations to this analysis, it can be shown that heuristically for a fixed key pair in Hawk-512 with probability at least 1−2 −100 , all the coefficients in (1) lie in Z + (−0.49, 0.49) before being rounded to the nearest integer.…”

Section: C3 Signature Verificationmentioning

confidence: 99%

“…Our constant-time C implementation and auxiliary scripts are open source. 1 Included is a SageMath implementation of Hawk.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Hawk: Module LIP Makes Lattice Signatures Fast, Compact and Simple

Ducas

Postlethwaite

Pulles

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We propose the signature scheme Hawk, a concrete instantiation of proposals to use the Lattice Isomorphism Problem (LIP) as a foundation for cryptography that focuses on simplicity. This simplicity stems from LIP, which allows the use of lattices such as Z n , leading to signature algorithms with no floats, no rejection sampling, and compact precomputed distributions. Such design features are desirable for constrained devices, and when computing signatures inside FHE or MPC. The most significant change from recent LIP proposals is the use of module lattices, reusing algorithms and ideas from NTRUSign and Falcon. Its simplicity makes Hawk competitive. We provide cryptanalysis with experimental evidence for the design of Hawk and implement two parameter sets, Hawk-512 and Hawk-1024. Signing using Hawk-512 and Hawk-1024 is four times faster than Falcon on x86 architectures, produces signatures that are about 15% more compact, and is slightly more secure against forgeries by lattice reduction attacks. When floating-points are unavailable, Hawk signs 15 times faster than Falcon. We provide a worst case to average case reduction for module LIP. For certain parametrisations of Hawk this applies to secret key recovery and we reduce signature forgery in the random oracle model to a new problem called the one more short vector problem.

show abstract

Section: Introductionmentioning

confidence: 92%

Section: Uncompressed Hawkmentioning

confidence: 99%

“…We consider the general problem of forging a signature for some unsigned message. Specifically, given a target 1 2 h for some h ∈ {0, 1} 2n , return…”

Section: Signature Forgerymentioning

confidence: 99%

Section: C3 Signature Verificationmentioning

confidence: 99%

“…Our constant-time C implementation and auxiliary scripts are open source. 1 Included is a SageMath implementation of Hawk.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations