Improved Zero-Knowledge Identification with Lattices

An efficient statistical zero-knowledge authentication protocol for smart cards

“…Using the notations of [22], the communication complexity is 256 · t + |G m | + |D c | ≈ 7 KB. • Cayrel et al [7]: The public parameter and the prover's public and private keys are exactly like those in [18]; we therefore use the same parameters. The soundness error of the base protocol is almost 1/2, and hence it must be repeated t = 30 times to achieve the 2 −30 soundness error.…”

“…Silva et al [35] followed [7], and built a similar authentication protocol based on the hardness of the SIS problem. The authentication protocol consists of the repetition of a 5-pass base zero-knowledge protocol with soundness error close to 1 2 .…”

“…The base protocol has a soundness error of 2 3 , and should be repeated super-logarithmically. Cayrel et al [7] introduced another authentication protocol, based on the code-based authentication protocol of Cayrel and Véron [6], which in turn is based on Stern's protocol [36]. The assumption used here is the hardness of the SIS problem (as in [18]), which is milder than the assumption of Lyubashevsky [22].…”

Extended security arguments for signature schemes

“…Many zero-knowledge identification schemes have been proposed, whose conversion to signature schemes does not lead to generic signature schemes according to the definition of Pointcheval and Stern [21]. Examples of such schemes are those based on the Permuted Kernel Problem [17,24], the Permuted Perceptron Problem [19,20], the Constrained Linear Equations [27], the five-pass variant of SD problem [2,26], the q-SD problem [8], the SIS problem [7,25] and the MQ-problem [23]. Fortunately, their conversion to signature schemes belong to the class of n-generic signature schemes.…”

“…We are then obliged to prove the security of those signatures schemes from scratch. Examples of schemes falling outside the Pointcheval-Stern framework can be found in [7,8,17,19,20,[24][25][26][27]. The authors must provide direct proofs for the signature schemes in these works deriving from their 5-pass identification protocols.…”