Skip to main content
SpringerLink
Log in

Secure Stern Signatures in Quantum Random Oracle Model

  • Conference paper
  • First Online:
Information Security (ISC 2019)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 11723))

Included in the following conference series:

Abstract

The Stern signatures are a class of lattice-based signatures constructed from Stern protocols, a special class of sigma protocols, admitting diverse functionalities with good asymptotic efficiency. However, the post-quantum security of existing Stern signatures is unclear, since they are built via the Fiat-Shamir transformation, which has not been proved to be secure in the quantum random oracle model (QROM). The goal of this paper is to find an alternative transformation for constructing post-quantum secure Stern signatures.

The Unruh transformation (Eurocrypt 2015) is an alternative that can build secure signatures in QROM from post-quantum secure sigma protocols. Unfortunately, its proof relies on the 2-special soundness of the underlying sigma protocol, while Stern protocols are 3-special sound. We fill this gap by providing an extended proof for the Unruh transformation. Specifically, we prove that it is still secure in the QROM even if the underlying sigma protocols are k-special sound, where \(k>2\) could be an arbitrary integer. Observing that Stern protocols are post-quantum secure sigma protocols with 3-special soundness, our proof implies a generic method to obtain secure Stern signatures in the QROM.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Ajtai, M.: Generating hard instances of lattice problems (extended abstract). In: the 28th ACM STOC, pp. 99–108. ACM (1996)

    Google Scholar 

  2. Ambainis, A., Rosmanis, A., Unruh, D.: Quantum attacks on classical proof systems: the hardness of quantum rewinding. In: FOCS 2014, pp. 474–483. IEEE Computer Society (2014)

    Google Scholar 

  3. Ben-Or, M.: Probabilistic algorithms in finite fields. In: FOCS 1981, pp. 394–398 (1981)

    Google Scholar 

  4. Boneh, D., Dagdelen, Ö., Fischlin, M., Lehmann, A., Schaffner, C., Zhandry, M.: Random oracles in a quantum world. In: Lee, D.H., Wang, X. (eds.) ASIACRYPT 2011. LNCS, vol. 7073, pp. 41–69. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-25385-0_3

    Chapter  MATH  Google Scholar 

  5. Brakerski, Z., Kalai, Y.T.: A framework for efficient signatures, ring signatures and identity based encryption in the standard model. IACR Cryptology ePrint Archive 2010, 86 (2010)

    Google Scholar 

  6. Ciampi, M., Persiano, G., Scafuro, A., Siniscalchi, L., Visconti, I.: Improved OR-composition of sigma-protocols. In: Kushilevitz, E., Malkin, T. (eds.) TCC 2016. LNCS, vol. 9563, pp. 112–141. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49099-0_5

    Chapter  MATH  Google Scholar 

  7. Ciampi, M., Persiano, G., Siniscalchi, L., Visconti, I.: A transform for NIZK almost as efficient and general as the Fiat-Shamir transform without programmable random oracles. In: Kushilevitz, E., Malkin, T. (eds.) TCC 2016. LNCS, vol. 9563, pp. 83–111. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49099-0_4

    Chapter  MATH  Google Scholar 

  8. Cramer, R., Damgård, I., Schoenmakers, B.: Proofs of partial knowledge and simplified design of witness hiding protocols. In: Desmedt, Y.G. (ed.) CRYPTO 1994. LNCS, vol. 839, pp. 174–187. Springer, Heidelberg (1994). https://doi.org/10.1007/3-540-48658-5_19

    Chapter  Google Scholar 

  9. Fiat, A., Shamir, A.: How to prove yourself: practical solutions to identification and signature problems. In: Odlyzko, A.M. (ed.) CRYPTO 1986. LNCS, vol. 263, pp. 186–194. Springer, Heidelberg (1987). https://doi.org/10.1007/3-540-47721-7_12

    Chapter  Google Scholar 

  10. Gordon, S.D., Katz, J., Vaikuntanathan, V.: A group signature scheme from lattice assumptions. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 395–412. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-17373-8_23

    Chapter  Google Scholar 

  11. Groth, J.: Evaluating security of voting schemes in the universal composability framework. In: Jakobsson, M., Yung, M., Zhou, J. (eds.) ACNS 2004. LNCS, vol. 3089, pp. 46–60. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-24852-1_4

    Chapter  MATH  Google Scholar 

  12. Groth, J., Kohlweiss, M.: One-out-of-many proofs: or how to leak a secret and spend a coin. In: Oswald, E., Fischlin, M. (eds.) EUROCRYPT 2015. LNCS, vol. 9057, pp. 253–280. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46803-6_9

    Chapter  Google Scholar 

  13. Kawachi, A., Tanaka, K., Xagawa, K.: Concurrently secure identification schemes based on the worst-case hardness of lattice problems. In: Pieprzyk, J. (ed.) ASIACRYPT 2008. LNCS, vol. 5350, pp. 372–389. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-89255-7_23

    Chapter  Google Scholar 

  14. Kiltz, E., Lyubashevsky, V., Schaffner, C.: A concrete treatment of Fiat-Shamir signatures in the quantum random-oracle model. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018. LNCS, vol. 10822, pp. 552–586. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-78372-7_18

    Chapter  MATH  Google Scholar 

  15. Langlois, A., Ling, S., Nguyen, K., Wang, H.: Lattice-based group signature scheme with verifier-local revocation. In: Krawczyk, H. (ed.) PKC 2014. LNCS, vol. 8383, pp. 345–361. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-642-54631-0_20

    Chapter  Google Scholar 

  16. Libert, B., Ling, S., Mouhartem, F., Nguyen, K., Wang, H.: Signature schemes with efficient protocols and dynamic group signatures from lattice assumptions. In: Cheon, J.H., Takagi, T. (eds.) ASIACRYPT 2016. LNCS, vol. 10032, pp. 373–403. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53890-6_13

    Chapter  Google Scholar 

  17. Libert, B., Ling, S., Mouhartem, F., Nguyen, K., Wang, H.: Zero-knowledge arguments for matrix-vector relations and lattice-based group encryption. In: Cheon, J.H., Takagi, T. (eds.) ASIACRYPT 2016. LNCS, vol. 10032, pp. 101–131. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53890-6_4

    Chapter  Google Scholar 

  18. Libert, B., Ling, S., Nguyen, K., Wang, H.: Zero-knowledge arguments for lattice-based accumulators: logarithmic-size ring signatures and group signatures without trapdoors. In: Fischlin, M., Coron, J.-S. (eds.) EUROCRYPT 2016. LNCS, vol. 9666, pp. 1–31. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49896-5_1

    Chapter  Google Scholar 

  19. Libert, B., Ling, S., Nguyen, K., Wang, H.: Zero-knowledge arguments for lattice-based PRFs and applications to e-cash. In: Takagi, T., Peyrin, T. (eds.) ASIACRYPT 2017. LNCS, vol. 10626, pp. 304–335. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-70700-6_11

    Chapter  Google Scholar 

  20. Ling, S., Nguyen, K., Stehlé, D., Wang, H.: Improved zero-knowledge proofs of knowledge for the ISIS problem, and applications. In: Kurosawa, K., Hanaoka, G. (eds.) PKC 2013. LNCS, vol. 7778, pp. 107–124. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-36362-7_8

    Chapter  Google Scholar 

  21. Ling, S., Nguyen, K., Wang, H., Xu, Y.: Lattice-based group signatures: achieving full dynamicity with ease. In: Gollmann, D., Miyaji, A., Kikuchi, H. (eds.) ACNS 2017. LNCS, vol. 10355, pp. 293–312. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-61204-1_15

    Chapter  Google Scholar 

  22. Ling, S., Nguyen, K., Wang, H., Xu, Y.: Constant-size group signatures from lattices. In: Abdalla, M., Dahab, R. (eds.) PKC 2018. LNCS, vol. 10770, pp. 58–88. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-76581-5_3

    Chapter  Google Scholar 

  23. Ling, S., Nguyen, K., Wang, H., Xu, Y.: Forward-secure group signatures from lattices. CoRR abs/1801.08323 (2018)

    Google Scholar 

  24. Liu, Q., Zhandry, M.: Revisiting post-quantum Fiat-Shamir. IACR Cryptology ePrint Archive 2019, 262 (2019)

    Google Scholar 

  25. Stern, J.: A new paradigm for public key identification. IEEE Trans. Inf. Theory 42(6), 1757–1768 (1996)

    Article  MathSciNet  Google Scholar 

  26. Unruh, D.: Non-interactive zero-knowledge proofs in the quantum random oracle model. In: Oswald, E., Fischlin, M. (eds.) EUROCRYPT 2015. LNCS, vol. 9057, pp. 755–784. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46803-6_25

    Chapter  MATH  Google Scholar 

  27. Unruh, D.: Post-quantum security of Fiat-Shamir. In: Takagi, T., Peyrin, T. (eds.) ASIACRYPT 2017. LNCS, vol. 10624, pp. 65–95. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-70694-8_3

    Chapter  Google Scholar 

  28. Yang, R., Au, M.H., Lai, J., Xu, Q., Yu, Z.: Lattice-based techniques for accountable anonymity: composition of abstract Stern’s protocols and weak PRF with efficient protocols from LWR. IACR Cryptology ePrint Archive 2017, 781 (2017)

    Google Scholar 

  29. Zhandry, M.: Secure identity-based encryption in the quantum random oracle model. In: Safavi-Naini, R., Canetti, R. (eds.) CRYPTO 2012. LNCS, vol. 7417, pp. 758–775. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-32009-5_44

    Chapter  MATH  Google Scholar 

Download references

Acknowledgment

This paper is supported by the National Key Research and Development Program of China through project 2017YFB0802502, by the National Cryptography Development Fund through project MMJJ20170106, by the National Natural Science Foundation of China through projects 61672083, 61532021, 61472429, 61402029, 61702028 and 61571024, by the Beijing Natural Science Foundation through project 4132056.

Author information

Authors and Affiliations

  1. School of Cyber Science and Technology, Beihang University, Beijing, China

    Hanwen Feng, Jianwei Liu & Qianhong Wu

Authors
  1. Hanwen Feng
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jianwei Liu
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Qianhong Wu
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Qianhong Wu .

Editor information

Editors and Affiliations

  1. The Ohio State University, Columbus, OH, USA

    Zhiqiang Lin

  2. University of Maryland, College Park, MD, USA

    Charalampos Papamanthou

  3. Stony Brook University, Stony Brook, NY, USA

    Michalis Polychronakis

A Stern Protocols

A Stern Protocols

Let \(\text {COM}\) be the string commitment scheme from [13], which is statistically hiding and computational binding and based on the SIS assumptions [1]. Assuming there is an ESP \(\mathbb {E}_S=\{\varPhi _{\varphi }|\varphi \in \mathbb {S}\}\) for the set \(\mathbb {V}\) of the Stern relation \(R_{S}\), there is a sigma protocol as in Fig. 3 for \(R_{S}\).

Fig. 3.
figure 3

The general Stern protocol

Full size image

In a high level, this protocol is derived by two main techniques, permutation and masking.

  • permutation: to prove the witness \(\mathbf {x}\in \mathbb {V}\), the prover randomly samples \(\varphi \leftarrow \mathbb {S}\) that is associated with a permutation \(\varPhi _{\varphi }\), and computes \(\varPhi _{\varphi }(\mathbf {x})\). The prover can convince the verifier that \(\mathbf {x}\in \mathbb {V}\) in zero-knowledge by leaking \(\varPhi _{\varphi }(\mathbf {x})\), since from the properties of \(\varPhi _{\varphi }\) as in Definition 8, we have

    $$\begin{aligned} \varPhi _{\varphi }(\mathbf {x})\in \mathbb {V}\Longleftrightarrow \mathbf {x}\in \mathbb {V}. \end{aligned}$$

  • masking: to prove the knowledge of \(\mathbf {x}\) s.t. \(\mathbf {M}\cdot \mathbf {x}=\mathbf {v}\bmod q\), the prover samples \(\mathbf {r}\leftarrow \mathbb {Z}_{q}^{d}\), and demonstrates \(\mathbf {M}\cdot (\mathbf {r}+\mathbf {x})=\mathbf {M}\cdot \mathbf {r}+\mathbf {v}\bmod q\) instead.

The two techniques give an intuitive reason why the Stern protocol has HVZK property. The 3-special soundness can be easily checked by computing a witness from three tuples with the same commitment. We refer interested readers to [19] for a detailed proof.

Rights and permissions

Reprints and permissions

Copyright information

© 2019 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Feng, H., Liu, J., Wu, Q. (2019). Secure Stern Signatures in Quantum Random Oracle Model. In: Lin, Z., Papamanthou, C., Polychronakis, M. (eds) Information Security. ISC 2019. Lecture Notes in Computer Science(), vol 11723. Springer, Cham. https://doi.org/10.1007/978-3-030-30215-3_21

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-30215-3_21

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-30214-6

  • Online ISBN: 978-3-030-30215-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation