Provably Secure Group Signature Schemes From Code-Based Assumptions

Abstract

We solve an open question in code-based cryptography by introducing two provably secure group signature schemes from code-based assumptions. Our basic scheme satisfies the CPA-anonymity and traceability requirements in the random oracle model, assuming the hardness of the McEliece problem, the Learning Parity with Noise problem, and a variant of the Syndrome Decoding problem. The construction produces smaller key and signature sizes than the previous group signature schemes from lattices, as long as the cardinality of the underlying group does not exceed 2 24 , which is roughly comparable to the current population of the Netherlands. We develop the basic scheme further to achieve the strongest anonymity notion, i.e., CCA-anonymity, with a small overhead in terms of efficiency. The feasibility of two proposed schemes is supported by implementation results. Our two schemes are the first in their respective classes of provably secure groups signature schemes. Additionally, the techniques introduced in this work might be of independent interest. These are a new verifiable encryption protocol for the randomized McEliece encryption and a novel approach to design formal security reductions from the Syndrome Decoding problem.Index Terms-code-based group signature, zero-knowledge protocol, McEliece encryption, syndrome decoding. I. INTRODUCTION A. Background and MotivationGroup signature [1] is a fundamental cryptographic primitive with two intriguing features. The first one is anonymity. It allows users of a group to anonymously sign documents on behalf of the whole group. The second one is traceability. There exists a tracing authority that can tie a given signature to the signer's identity should the need arise. These two properties make group signatures highly useful in various

Fuzzy Matching Template Attacks on Multivariate Cryptography: A Case Study

“…QUAD (2,160,160) is a practical version with the security level of at least 2 80 , which is strongly recommended in [10]. QUAD (2, 160, 160) has 160 variables over GF (2), which outputs 160 bits per round, resulting in a set of 320 multivariate quadratic equations.…”

“…From a perspective of implementation, operations over GF (2) are more efficient than those over larger fields. Moreover, the monomial forms x i • x i and x i are equal over GF (2); therefore, α ij x i x j and β i x i can be computed together. In the case of randomly generated α ij and c, equations of QUAD over GF (2) can be simplified as…”

“…Since Shor's discovery, the theory of post-quantum cryptography has developed significantly. Many cryptographic schemes proposed in the literature, such as codebased cryptography [2] and lattice-based cryptography [3],…”

“…Because of the low signal-to-noise ratio, classic template attack and templateattack DPA attack cannot exactly match the templates to achieve a satisfactory success rate. To tackle this issue, we have proposed template-based least-square power analysis on serial QUAD (2,160,160). e main contributions of our paper can be highlighted as follows:…”

Fundamentals of Physical Layer Anonymous Communications: Sender Detection and Anonymous Precoding

“…Anonymous authentication and encryption schemes have been proposed for cellular networks [11], wireless body area networks [12], wireless local area networks [13], device-to-device (D2D) communications [14], Radio Frequency Identification [15], vehicle-to-infrastructure communications [16] and prototype design [17]. The design principle is to use group signature, ring signature [18], or anonymous account index [12] for authentication and encryption. Since the users' real IDs are not exposed during the authentication and encryption processes, potential adversaries are unable to leverage the users' real IDs to unmask the communication participants.…”