Isochronous Gaussian Sampling: From Inception to Implementation

Howe, James; Prest, Thomas; Ricosset, Thomas; Rossi, Mélissa

doi:10.1007/978-3-030-44223-1_4

Cited by 20 publications

(22 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It is well-known that this can be addressed using the polynomial approximation techniques used e.g. in [47,4,24], but full precision estimates for the required functions are left as future work. 14 It will soon be available on a public repository.…”

Section: Implementation Resultsmentioning

confidence: 99%

“…First, our signature scheme can be easily made isochronous. According to [24], isochrony ensures independence between the running time of the algorithm and the secret values. For our signature, the absence of conditional branches implies that one can implement our signature isochronously using standard techniques.…”

Section: Side-channel Countermeasurementioning

confidence: 99%

“…However, DLP does so at the cost of a slow signing algorithm, whereas FALCON, while fast, suffers from a very complex signing algorithm that is hard to implement, poorly suited for parallelization and difficult to protect against side-channel attacks. On the last point, both schemes have been shown to suffer from potential vulnerabilities with respect to side-channel leakage [18,27], and even though the most recent implementation of FALCON appears to be protected against timing attacks [40,24], countermeasures against stronger side-channel attacks like DPA seem difficult to achieve. FALCON is also limited to NTRU lattices over power-of-two cyclotomic fields, which limits its flexibility in terms of parameter selection.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Mitaka: A Simpler, Parallelizable, Maskable Variant of Falcon

Espitau

Fouque

Gérard

et al. 2022

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

This work describes the MITAKA signature scheme: a new hash-and-sign signature scheme over NTRU lattices which can be seen as a variant of NIST finalist FALCON. It achieves comparable efficiency but is considerably simpler, online/offline, and easier to parallelize and protect against sidechannels, thus offering significant advantages from an implementation standpoint. It is also much more versatile in terms of parameter selection.We obtain this signature scheme by replacing the FFO lattice Gaussian sampler in FALCON by the "hybrid" sampler of Ducas and Prest, for which we carry out a detailed and corrected security analysis. In principle, such a change can result in a substantial security loss, but we show that this loss can be largely mitigated using new techniques in key generation that allow us to construct much higher quality lattice trapdoors for the hybrid sampler relatively cheaply. This new approach can also be instantiated on a wide variety of base fields, in contrast with FALCON's restriction to power-of-two cyclotomics.We also introduce a new lattice Gaussian sampler with the same quality and efficiency, but which is moreover compatible with the integral matrix Gram root technique of Ducas et al., allowing us to avoid floating point arithmetic. This makes it possible to realize the same signature scheme as MITAKA efficiently on platforms with poor support for floating point numbers.Finally, we describe a provably secure masking of MITAKA. More precisely, we introduce novel gadgets that allow provable masking at any order at much lower cost than previous masking techniques for Gaussian sampling-based signature schemes, for cheap and dependable side-channel protection.7 Sometimes, this is also seen as a bounded distance decoding problem, BDD, but with large enough decoding bound that there are exponentially many solutions, instead of a unique one as is typically the case in the traditional formulation of BDD. 8 Other techniques have been proposed that avoid Gaussian distributions, as in [34], but they tend not to be competitive. Authors Suppressed Due to Excessive LengthAlgorithm 5: Integer arithmetic ring Gaussian sampler Input: a matrix B ∈ R 2×2 such that BU û = B = BUu, where û = [u]p ∈ 1 p R, a center c ∈ R 2 , and parameters r, s > 0. Result: z with distribution negligibly far from D L (B),c,rs . 1 Precomputed: Σp = s 2 I − B B t and A ← IntGram(p 2 (Σp − I)) / * AA t = p 2 (Σp − I) * / 2 p ← Algorithm 6(p, A) / * p ∼ D R 2 ,r 2 Σp * / 3 ĉ ← B −1 (c − p) 4 z ← Algorithm 4(û, ĉ, s) / * z ∼ D L (U û),ĉ,s * / 5 return z = Bz Algorithm 6: Offline sampler Input: An integer p > 0, a matrix A ∈ R 2×m . Result: p ∈ R 2 with distribution negligibly far from D R 2 ,r 2 Σ , where Σ = 1 p 2 AA t + I.1 Precomputed: integers r > ηε(R 2 ) and L such that Lr ηε(Λ(A) ⊥ ). 2 x ← ( 0 Lr ) m 3 p ← 1 pL Ax 4 p ← p r 5 return p.

show abstract

Section: Implementation Resultsmentioning

confidence: 99%

Section: Side-channel Countermeasurementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Mitaka: A Simpler, Parallelizable, Maskable Variant of Falcon

Espitau

Fouque

Gérard

et al. 2022

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…Earlier works with embedded and original DGS strategies are [Alkim et al 2019], presenting the qTESLA digital signature scheme, [Alkim et al 2020], presenting the FrodoKEM key encapsulation scheme, and [Howe et al 2019], presenting the FALCON digital signature scheme. All of these have joined the NIST competition [CSRC 2022].…”

Section: Related Workmentioning

confidence: 99%

“…Assumption DGS strategy DiGS (ours) RLWE CLT and FWHT BLISS [Ducas et al 2013] SIS Inversion and rejection FALCON [Howe et al 2019] NTRU CDT and rejection FrodoKEM [Alkim et al 2020] LWE CDT qTESLA [Alkim et al 2019 Additionally, comprehensive web pages listing DGS works in lattice-based cryptography can be found on [Micciancio 2022, Bernstein et al 2022. As for DGS isochronous implementation, [Reparaz et al 2016] presents an assessment tool, available in the public domain.…”

Section: Samplermentioning

confidence: 99%

Efficient Gaussian sampling for RLWE-based cryptography through a fast Fourier transform

Júnior

2022

Anais Do XXII Simpósio Brasileiro De Segurança Da Informação E De Sistemas Computacionais (SBSeg 2022)

View full text Add to dashboard Cite

Quantum computing threatens classical cryptography, leading to the search for stronger alternatives. The cryptographic approach based on lattices is considered as a viable option. Schemes with that approach use Gaussian sampling, a design which brings along two concerns: efficiency and information leakage. This work adresses those concerns in the RLWE formulation, for digital signatures. Efficiency mitigation uses the central limit theorem, and the Walsh–Hadamard transform, whereas the information leakage risk is reduced via isochronous implementation. Up to 223 samples are queried, and the results are compared against those of a cumulative distribution table sampler. Statistical metrics show the suitability of the presented sampler in a number of contexts.

show abstract

Arbitrary-Centered Discrete Gaussian Sampling over the Integers

Fan

Wei

2020

Information Security and Privacy

View full text Add to dashboard Cite

Isochronous Gaussian Sampling: From Inception to Implementation

Cited by 20 publications

References 39 publications

Mitaka: A Simpler, Parallelizable, Maskable Variant of Falcon

Mitaka: A Simpler, Parallelizable, Maskable Variant of Falcon

Efficient Gaussian sampling for RLWE-based cryptography through a fast Fourier transform

Arbitrary-Centered Discrete Gaussian Sampling over the Integers

Contact Info

Product

Resources

About