Improving the Performance of the Picnic Signature Scheme

Abstract

Picnic is a digital signature algorithm designed to provide security against attacks by quantum computers. The design uses only symmetric-key primitives, and is an efficient instantiation of the MPC-in-the-head paradigm. In this work, we explore the Picnic design in great detail. We investigate and benchmark different parameter choices and show that there exist better parameter choices than those in the current specification. We also present improvements to the MPC protocol that shorten signatures and reduce signing time. The proposed MPC changes tailor the protocol to the circuit of interest in Picnic, but may also be of independent interest. Taken together, these changes give a new instantiation of Picnic that signs messages 7.9 to 13.9 times faster, and verifies signatures 4.5 to 5.5 times faster than the existing “Picnic2” design, while having nearly the same signature sizes.

Efficient Set Membership Proofs using MPC-in-the-Head

“…We use our modified version of Reverie to implement post-quantum ring signatures. Our ring signatures, based on the postquantum signatures presented in [15,34,35], are the smallest known post-quantum ring signatures from symmetric key assumptions, and can be nearly an order of magnitude smaller than those based on the same assumptions generated in [35].…”

Side-Channel Protections for Picnic Signatures

“…Katz, Kolesnikov, and Wang [KKW18] extended the paradigm to MPCitH-PP and corresponding version, Picnic2, was added during Round 2. Kales and Zaverucha [KZ20] further optimized Picnic2 from various implementation aspects and accordingly proposed Picnic3. Although our masked implementation focuses on Picnic3, which is instantiated with KKW and the LowMC circuit [ARS + 15], our generic approach in Section 4 also applies to BBQ (KKW instantiated with the AES circuit) [dDOS19] and Baum and Nof's variant of KKW (instantiated over an arithmetic circuit for proving SIS instances) [BN20].…”

“…MPC in the preprocessing model. Following [GMO16, CDG + 17], Katz, Kolesnikov, and Wang [KKW18] showed that a particular communication-efficient MPC protocol in the preprocessing model is well suited to MPCitH proofs, and variants of their protocol appear in subsequent work [BN20,Beu20,dDOS19,KZ20]. The core idea of MPC in the preprocessing model is to split the protocol Π C into an offline phase Π off C and an online phase Π on C .…”

“…Here we provide a rough estimate of the overhead introduced by masking the SHAKE calls in Picnic3, which will have a high impact on the cost of signing since hashing is a large portion of the signing time (e.g., at L1 it is about 57% of the signing time on x64 [KZ20], and for our ARM M4 implementation it is about 71%).…”

“…To the best of our knowledge, no previous work explored the possibility of masking the newer MPC-in-the-head with preprocessing (MPCitH-PP) paradigm of Katz, Kolesnikov, and Wang (KKW, [KKW18]), which produces much more compact proofs (and shorter signatures in turn). KKW is used in the latest version of Picnic, Picnic3 [KZ20], and in a similar signature scheme BBQ [dDOS19]. The preprocessing phase is independent of the witness, and is used by the parties to establish correlated random values, such as multiplication triples, that they can use during the MPC protocol to improve efficiency.…”