Quasi-Cyclic Stern Proof of Knowledge

Abstract

The 1993 Stern authentication protocol is a code-based zeroknowledge protocol with cheating probability equal to 2/3 based on the syndrome decoding problem which permits to obtain a proof of knowledge of a small weight vector. This protocol was improved a few years later by Véron, who proposed a variation of the scheme based on the general syndrome decoding problem which leads to better results in term of communication. A few years later, the AGS protocol introduced a variation of the Véron protocol based on quasi-cyclic matrices. The AGS protocol permits to obtain an asymptotic cheating probability of 1/2 and a strong improvement in term of communications. In the present paper we propose two new contributions. First, a Quasi-Cyclic Stern proof of knowledge construction which constitutes an adaptation of the AGS scheme in a syndrome decoding context. The main interest of this adaptation is that at the difference of the regular (non quasi-cyclic) case, the Quasi-Cyclic Stern protocol is better in terms of communication than its Véron counterpart (the AGS protocol, which can be seen as a Quasi-Cyclic Véron protocol). The difference comes from the fact that a seed related optimization is better for QC-Stern than for QC-Véron. Secondly, we also propose a general new optimization to handle random seeds in this type of protocol. Overall, the two new optimizations we propose permit to gain about 17.5% in the length of communication compared to the previous best approach for this type of protocols. Such optimizations are of great matter in the ongoing context where a new signature call for proposals has been announced by the NIST and for which such zeroknowledge approaches are a real alternative, as it was shown in the first signature call for proposals of the NIST. At last, the paper also sums up the different known optimizations for such protocols and explain how our new approach can be adapted to other metrics.

Code-based Signatures from New Proofs of Knowledge for the Syndrome Decoding Problem

“…Over the years, 5-round code-based PoK reducing the soundness error to 1/2 (hence providing smaller communication costs) have been proposed. Such protocols either rely on the SD problem over F q [CVE11] or leverage the structured QCGSD and QCSD problems over F 2 [AGS11,BGS21]. Hereafter, we introduce a PoK for the SD problem over F 2 with soundness error equal to 1/2.…”

“…Hereafter, we introduce a PoK for the SD problem over F 2 with soundness error equal to 1/2. Our new protocol (denoted PoK 1) can be either seen as (i) a modification of the initial Stern protocol leveraging the MPC-in-the-head paradigm along with several optimizations from [BGS21] or as (ii) the BGS protocol [BGS21] in which the quasi-cyclicity is replaced by the use of the MPC-in-head technique.…”

“…Sig 1 (3-round) and Sig 1 (5-round) both outperforms the Stern [Ste93], [Vér97] and [AGS11] schemes with respect to signature size for comparable settings at the cost of a small performance overhead. In addition, they achieve similar performances to [BGS21] while relying on more conservative security assumptions. Sig 2 and Sig 3 are constructed from 3-round PoK 2 and 3-round PoK 3 respectively and feature even smaller signature size however at the cost of a bigger performance overhead.…”

“…A zero-knowledge issue impacting GSD based protocols (Véron and AGS) was identified in [JKPT12] and fixed in [BBBG21]. In addition, the AGS protocol have been improved by the BGS proposal by using an optimization specifically tailored to the QCSD problem [BGS21]. Furthermore, it has been shown recently (see related work section bellow for additional details) that one can design a protocol achieving an arbitrarily small soundness error in [GPS21] and [FJR21].…”

“…Soundness SD/GSD over F 2 QC-SD/GSD over F 2 SD/GSD over F q 2/3 [Ste93] [Vér97], [BBBG21] 1/2 PoK 1 (Section 3) [AGS11], [BBBG21] [CVE11] [BGS21] PoK 1 (Section 3) 1/N [FJR21] [FJR21]…”