Mitaka: A Simpler, Parallelizable, Maskable Variant of Falcon

Abstract

This work describes the MITAKA signature scheme: a new hash-and-sign signature scheme over NTRU lattices which can be seen as a variant of NIST finalist FALCON. It achieves comparable efficiency but is considerably simpler, online/offline, and easier to parallelize and protect against sidechannels, thus offering significant advantages from an implementation standpoint. It is also much more versatile in terms of parameter selection.We obtain this signature scheme by replacing the FFO lattice Gaussian sampler in FALCON by the "hybrid" sampler of Ducas and Prest, for which we carry out a detailed and corrected security analysis. In principle, such a change can result in a substantial security loss, but we show that this loss can be largely mitigated using new techniques in key generation that allow us to construct much higher quality lattice trapdoors for the hybrid sampler relatively cheaply. This new approach can also be instantiated on a wide variety of base fields, in contrast with FALCON's restriction to power-of-two cyclotomics.We also introduce a new lattice Gaussian sampler with the same quality and efficiency, but which is moreover compatible with the integral matrix Gram root technique of Ducas et al., allowing us to avoid floating point arithmetic. This makes it possible to realize the same signature scheme as MITAKA efficiently on platforms with poor support for floating point numbers.Finally, we describe a provably secure masking of MITAKA. More precisely, we introduce novel gadgets that allow provable masking at any order at much lower cost than previous masking techniques for Gaussian sampling-based signature schemes, for cheap and dependable side-channel protection.7 Sometimes, this is also seen as a bounded distance decoding problem, BDD, but with large enough decoding bound that there are exponentially many solutions, instead of a unique one as is typically the case in the traditional formulation of BDD. 8 Other techniques have been proposed that avoid Gaussian distributions, as in [34], but they tend not to be competitive. Authors Suppressed Due to Excessive LengthAlgorithm 5: Integer arithmetic ring Gaussian sampler Input: a matrix B ∈ R 2×2 such that BU û = B = BUu, where û = [u]p ∈ 1 p R, a center c ∈ R 2 , and parameters r, s > 0. Result: z with distribution negligibly far from D L (B),c,rs . 1 Precomputed: Σp = s 2 I − B B t and A ← IntGram(p 2 (Σp − I)) / * AA t = p 2 (Σp − I) * / 2 p ← Algorithm 6(p, A) / * p ∼ D R 2 ,r 2 Σp * / 3 ĉ ← B −1 (c − p) 4 z ← Algorithm 4(û, ĉ, s) / * z ∼ D L (U û),ĉ,s * / 5 return z = Bz Algorithm 6: Offline sampler Input: An integer p > 0, a matrix A ∈ R 2×m . Result: p ∈ R 2 with distribution negligibly far from D R 2 ,r 2 Σ , where Σ = 1 p 2 AA t + I.1 Precomputed: integers r > ηε(R 2 ) and L such that Lr ηε(Λ(A) ⊥ ). 2 x ← ( 0 Lr ) m 3 p ← 1 pL Ax 4 p ← p r 5 return p.

Lattice‐based cryptosystems in standardisation processes: A survey

“…In the third NIST PQC Standardisation Conference, two independent Falcon variants, that is, Mitaka [112] by Espitau et al and Zalcon [113] by Fouque et al, were proposed to overcome the issues of Falcon implementations. They replaced Falcon sampler with simpler ones: Mitaka used the hybrid sampler [114] while Zalcon used a variant of Peikert sampler [115] based on approximate Gram-Schmidt orthogonalisation and integral Gram decomposition [116].…”

“…Two works also refined the trapdoor generation to achieve higher security and gave provable masked implementations. Very recently, they are merged into [117]. In addition, Chuengsatiansup et al studied the optimal trapdoor construction over Module-NTRU of larger module ranks in ref.…”

“…In the third NIST PQC Standardisation Conference, two independent Falcon variants, that is, Mitaka [112] by Espitau et al. and Zalcon [113] by Fouque et al., were proposed to overcome the issues of Falcon implementations.…”

Hawk: Module LIP Makes Lattice Signatures Fast, Compact and Simple

“…The recent variant of Falcon named Mitaka [23] also aims to make the signing procedure simpler and free from floating-point arithmetic. They achieve this with some loss in the signing quality compared to Falcon which makes signature forgeries somewhat easier, but their floating-point implementation signs twice as fast.…”

“…In fact, we hope that Hawk or a variant of Hawk may be simple enough to be implemented within a Fully Homomorphic Encryption scheme for applications such as blind or threshold signatures [2]. It might also be easier to mask against side-channel attacks, similarly to how the lack of floatingpoints in the sampler simplifies the masking of Mitaka Z [23,Sec. 7.3].…”