Post-Quantum Adaptor Signatures and Payment Channel Networks

Abstract

Adaptor signatures, also known as scriptless scripts, have recently become an important tool in addressing the scalability and interoperability issues of blockchain applications such as cryptocurrencies. An adaptor signature extends a digital signature in a way that a complete signature reveals a secret based on a cryptographic condition. It brings about various advantages such as (i) low on-chain cost, (ii) improved fungibility of transactions, and (iii) advanced functionality beyond the limitation of the blockchain's scripting language. In this work, we introduce the first post-quantum adaptor signature, named LAS. Our construction relies on the standard lattice assumptions, namely Module-SIS and Module-LWE. There are certain challenges specific to the lattice setting, arising mainly from the so-called knowledge gap in lattice-based proof systems, that makes the realization of an adaptor signature and its applications difficult. We show how to overcome these technical difficulties without introducing additional on-chain costs. Our evaluation demonstrates that LAS is essentially as efficient as an ordinary lattice-based signature in terms of both communication and computation. We further show how to achieve post-quantum atomic swaps and payment channel networks using LAS.

Two-Party Adaptor Signatures from Identification Schemes

“…Two works [17,46] have recently introduced post-quantum secure adaptor signature schemes, i.e., schemes that remain secure even in presence of an adversary having access to a quantum computer. In order to achieve post-quantum security, [17] based its scheme on standard and well-studied lattice assumptions, namely Module-SIS and Module-LWE, while the scheme in [46] is based on lesser known assumptions for isogenies. Both works additionally show how to construct post-quantum secure PCNs from their respective adaptor signature schemes.…”

Post-Quantum Two-party Adaptor Signature Based on Coding Theory

“…On the other hand, the signature size of 299 the proposed scheme is 1.03x and 1.5x lager than those of [5] and [10], respectively. 300 Post-quantum adaptor signature Pre-signature Signature Paper [10] 18327 ≤ | σ| ≤ 19944 263 ≤ |σ| ≤ 1880 Paper [5] | ). It then runs the adaptor algorithm Adapt to compute 342 the signature σ 1 = Adapt( σ1 , x ′ ).…”

“…Specifically, for the parameter values in Table 1, the pre-signature size of the scheme described in Figure 4 is more than 16x and 2.8x 298 smaller than those in [10] and [5], respectively. On the other hand, the signature size of 299 the proposed scheme is 1.03x and 1.5x lager than those of [5] and [10], respectively. 300 Post-quantum adaptor signature Pre-signature Signature Paper [10] 18327 ≤ | σ| ≤ 19944 263 ≤ |σ| ≤ 1880 Paper [5] | ).…”

Post-Quantum Two-party Adaptor Signature Based on Coding Theory

“…Therefore, the rest of the proof corresponds to the second part of the proof of Theorem 1: Parameters setting of our scheme [11] Using the above-mentioned parameter values, we give in Table 2 a numerical 294 comparison of the pre-signature and signature sizes of our scheme with those of [5,10].…”

“…In the table, we see that for these parameter values our scheme has a shorter pre-signature 296 size but a slightly larger signature size. Specifically, for the parameter values in Table 1, the pre-signature size of the scheme described in Figure 4 is more than 16x and 2.8x 298 smaller than those in [10] and [5], respectively. On the other hand, the signature size of 299 the proposed scheme is 1.03x and 1.5x lager than those of [5] and [10], respectively.…”