An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes

Kales, Daniel; Zaverucha, Greg

doi:10.1007/978-3-030-65411-5_1

Cited by 32 publications

(14 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Prover(x, w) Prover(x, w) Verifier(x) Removing the helper from PoK 2 and PoK 3. For our PoK 2 and PoK 3 (see Section 4.1), we will only consider the 3-round transformation as it leads to smaller signatures when taking account the attack from [KZ20]. We defer the reader to Appendices G and J for the description of the protocols.…”

Section: Pok Without Trusted Helpermentioning

confidence: 99%

“…Attack against 5-round protocols. An attack exploiting the structure of 5round PoK has been identified in [KZ20]. The main idea is to split the attacker work in two phases: (i) initially it tries to guess the first challenge for several repetitions and then (ii) to guess the second challenge for the remaining repetitions.…”

Section: Parameters Choicementioning

confidence: 99%

“…The main idea is to split the attacker work in two phases: (i) initially it tries to guess the first challenge for several repetitions and then (ii) to guess the second challenge for the remaining repetitions. Our schemes feature the capability for early abort described in [KZ20] therefore the cost of the attack is equal to…”

Section: Parameters Choicementioning

confidence: 99%

“…Using 5-round PoK lead to smaller signature sizes however the security proof of the Fiat-Shamir heuristic is less tight in this case. In practice, this means that one have to take into account attacks such as the one from [KZ20]. We consider both transformations for our PoK 1 and denote the resulting PoK without helper by 3-round PoK 1 and 5-round PoK 1 respectively.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Code-based Signatures from New Proofs of Knowledge for the Syndrome Decoding Problem

Bidoux¹,

Gaborit²,

Kulkarni³

et al. 2022

Preprint

View full text Add to dashboard Cite

In this paper, we study code-based signatures constructed from Proof of Knowledge (PoK). This line of work can be traced back to Stern who introduces the first efficient PoK for the syndrome decoding problem in 1993 [Ste93]. Afterward, different variations were proposed in order to reduce signature's size. In practice, obtaining a smaller signature size relies on the interaction of two main considerations: (i) the underlying protocol and its soundness error and (ii) the type of optimizations which are compatible with a given protocol. In particular, optimizations related to the possibility to use random seeds instead of mere vectors have a great impact on the final signature length. Over the years, different variations were proposed to improve the Stern scheme such as the Veron scheme (with public key a noisy codeword rather than a syndrome) [Vér97], the AGS scheme which is a 5-pass protocol with cheating probability asymptotically equal to 1/2 [AGS11] and more recently the FJR approach which permits to decrease the cheating probability to 1/N but induces a performance overhead [FJR21]. Overall the length of the signature depends on a trade-off between: the scheme in itself, the possible optimizations and the cost of the implementation. For instance, depending on the application one may prefer a 30% shorter signature at the cost a ten times slower implementation rather than a longer signature but a faster implementation. The recent approaches which increase the cost of the implementation opens the door to many different type of trade-offs.In this paper we propose three new schemes and different trade-offs, which are all interesting in themselves, since depending on potential future optimizations a scheme may eventually become more efficient than another. All the schemes we propose use a trusted helper: a first scheme permits to get a 1/2 cheating probability, a second scheme permits to decrease the cheating probability in 1/N but with a different approach than the recent FJR scheme and at last a third scheme propose a Veron-like adaptation of the FJR scheme in which the public key is a noisy codeword rather than a syndrome. We provide an extensive comparison table which lists various trade-offs between our schemes and previous ones. The table shows the interest of our constructions for certain type of trade-offs.

show abstract

Section: Pok Without Trusted Helpermentioning

confidence: 99%

Section: Parameters Choicementioning

confidence: 99%

Section: Parameters Choicementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Code-based Signatures from New Proofs of Knowledge for the Syndrome Decoding Problem

Bidoux¹,

Gaborit²,

Kulkarni³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Mitigation of an attack against 5-rounds protocols [13]. An attack against 5-rounds identification schemes that rely on parallel repetitions was recently described in [27]. Although it is targeting the MQDSS scheme, this attack is also relevant for both AGS and our construction.…”

Section: Existing Improvements and New Optimizationsmentioning

confidence: 99%

Quasi-Cyclic Stern Proof of Knowledge

Bidoux¹,

Gaborit²,

Kulkarni³

et al. 2021

Preprint

View full text Add to dashboard Cite

The 1993 Stern authentication protocol is a code-based zeroknowledge protocol with cheating probability equal to 2/3 based on the syndrome decoding problem which permits to obtain a proof of knowledge of a small weight vector. This protocol was improved a few years later by Véron, who proposed a variation of the scheme based on the general syndrome decoding problem which leads to better results in term of communication. A few years later, the AGS protocol introduced a variation of the Véron protocol based on quasi-cyclic matrices. The AGS protocol permits to obtain an asymptotic cheating probability of 1/2 and a strong improvement in term of communications. In the present paper we propose two new contributions. First, a Quasi-Cyclic Stern proof of knowledge construction which constitutes an adaptation of the AGS scheme in a syndrome decoding context. The main interest of this adaptation is that at the difference of the regular (non quasi-cyclic) case, the Quasi-Cyclic Stern protocol is better in terms of communication than its Véron counterpart (the AGS protocol, which can be seen as a Quasi-Cyclic Véron protocol). The difference comes from the fact that a seed related optimization is better for QC-Stern than for QC-Véron. Secondly, we also propose a general new optimization to handle random seeds in this type of protocol. Overall, the two new optimizations we propose permit to gain about 17.5% in the length of communication compared to the previous best approach for this type of protocols. Such optimizations are of great matter in the ongoing context where a new signature call for proposals has been announced by the NIST and for which such zeroknowledge approaches are a real alternative, as it was shown in the first signature call for proposals of the NIST. At last, the paper also sums up the different known optimizations for such protocols and explain how our new approach can be adapted to other metrics.

show abstract