Improving the Security of the DRS Scheme with Uniformly Chosen Random Noise

Abstract

At PKC 2008, Plantard et al. published a theoretical framework for a lattice-based signature scheme. Recently, after ten years, a new signature scheme dubbed as the Diagonal Reduction Signature (DRS) scheme was presented in the NIST PQC Standardization as a concrete instantiation of the initial work. Unfortunately, the initial submission was challenged by Yu and Ducas using the structure that is present on the secret key noise. In this paper, we are proposing a new method to generate random noise in the DRS scheme to elimite the aforementioned attack, and all subsequent potential variants.

Using Freivalds’ Algorithm to Accelerate Lattice-Based Signature Verifications

“…Our work provides an alternative to verify lattice signatures if the need arises, showing an interesting trade-off between pre-computation time for signature verification time and memory storage. In this work, we show that by adopting our approach to the proposed DRS parameters [27], we gain a factor of 20 on the verification speed. We also provide another approach on an attack specifically to our modification as the security of our public key remains unchanged.…”

“…The original idea behind DRS stemmed from when Plantard, Susilo and Win [22] suggested to use a diagonal dominant matrix to reduce large message vectors to short signatures within a known hypercube as a countermeasure against parallelogram detection attacks [18]. The security of the scheme has been shown to be reduced by a machine learning method [28] and since then it has been modified to resist against this attack at the cost of a slower secret key generation [27]. We will briefly describe both keys, the signature and the verification, the latter being the only part affected by this work.…”

“…We will briefly describe both keys, the signature and the verification, the latter being the only part affected by this work. The secret diagonal dominant matrix (as defined in [7]) S key is generated using the work in [27]). The public key P key is generated by the multiplication of P key = S key × U with U unimodular and randomly taken such that P key ∞ < 2 63 .…”

Fast verification and public key storage optimization for unstructured lattice-based signatures

“…Notice that our generator parameters scale very well when we aim to increase combination security: jumping from λ = 128-bits of security to λ = 256 often requires less than doubling the amount d of vectors. In practice, recommended lattice dimensions tend to change with λ so a reevaluation of optimal parameters (d, k) is d, k) compared to the prime approach of [44] for [43], leading to smaller memory requirements for [43], less precomputations and faster verification:…”

A Noise Study of the PSW Signature Family: Patching DRS with Uniform Distribution †

“…It is possible that the leak found by Yu and Ducas can be patched by modifying the signing algorithm without modifying the noise as we did. As of November 2019, an extended version of [16] available in [16] reduces the security of our original contribution [44]. While the updated attack is clearly not as strong as the previous attack, it still provides further motivation to deepen the research.…”