A code-based group signature scheme

Abstract

In this work we propose the first code-based group signature. As it will be described below, its security is based on a relaxation of the model of Bellare, Shi and Zhang [3] (BSZ model) verifying the properties of anonymity, traceability and non-frameability. Furthermore, it has numerous advantages over all existing post-quantum constructions and even competes (in terms of properties) with pairing based constructions: it allows to dynamically add new members and signature and public key sizes are constant with respect to the number of group members. Last but not least, our scheme can be extended into a traceable signature according to the definition of Kiayias, Tsiounis and Yung [19] (KTY model) and handles membership revocation. The main idea of our scheme consists in building a collision of two syndromes associated to two different matrices: a random one which enables to build a random syndrome from a chosen small weight vector; and a trapdoor matrix for the syndrome decoding problem, which permits to find a small weight preimage of the previous random syndrome. These two small weight vectors will constitute the group member's secret signing key whose knowledge will be proved thanks to a variation of Stern's authentication protocol. For applications, we consider the case of the code-based CFS signature scheme [11] of Courtois, Finiasz and Sendrier.

Improved Veron Identification and Signature Schemes in the Rank Metric

“…Remark: notice that Stern-like schemes as usually presented are only weaktestable zero knowledge (see [6,Sect. 3.2]).…”

“…Sect. 6 shows a comparison of the parameters of our proposal and other well-known code-based signature schemes, and Sect. 8 draws the conclusions.…”

A code-based blind signature

“…For given n and k and for almost all codes a wbounded decoder fails for a proportion ≈ exp(−V n (w)/q n−k ) of the instances. If we choose an integer w > b GV , a wbounded decoder almost never fails 1 . We will speak of a complete 2 decoder.…”

“…2. The CFS problem 1 most of the time w = b GV is enough, exceptionally w = b GV + 1 2 the word complete is used here for convenience, the decoder may fail but for a negligible proportion of the instances 2) Security of CFS. : Parity check matrices of high rate Goppa codes can be distinguished from random matrices [6].…”

“…In this section we introduce a (new) Concatenated Stern authentication protocol. This protocol is a simple randomized generalization of a non-randomized concatenated protocol given in [1]. We refer to [1] for a discussion on the notion of information leaking and testability of the Stern protocol for a non-randomized version of the protocol makes sense.…”