Revisiting TESLA in the Quantum Random Oracle Model

Alkım, Erdem; Bindel, Nina; Buchmann, Johannes; Dagdelen, Özgür; Eaton, Edward; Gutoski, Gus; Krämer, Juliane; Pawlega, Filip

doi:10.1007/978-3-319-59879-6_9

Cited by 41 publications

(17 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To tackle enumeration, we add basic tools such as binary tree conversion and dichotomy: we obtain that if a lattice enumeration (with or without cylinder pruning) searches over a tree with T nodes, the best solution can be found by a quantum algorithm using roughly √ T poly-time operations, where there is a polynomial overhead, which can be decreased if one is only interested in finding one solution. This formalizes earlier brief remarks of [8,19,7], and applies to both SVP and CVP.…”

Section: Introductionsupporting

confidence: 80%

“…This can easily be adapted to Babai's partition, because it also relies on boxes. Following (7), it suffices to evaluate:…”

Section: Noise Distributions In the Unique Settingmentioning

confidence: 99%

“…9.1] noticed that quantum search algorithms do not apply to enumeration: indeed, Grover's algorithm assumes that the possible solutions in the search space can be indexed and that one can find the i-th possible solution efficiently, whereas lattice enumeration explores a search tree of an unknown structure which can only be explored locally. Three recent papers [8,19,7] mention in a short paragraph that Montanaro's quantum backtracking algorithm [34] can speed up enumeration, by decreasing the number T of operations to √ T . However, no formal statement nor details are given in [8,19,7].…”

Section: Introductionmentioning

confidence: 99%

“…Three recent papers [8,19,7] mention in a short paragraph that Montanaro's quantum backtracking algorithm [34] can speed up enumeration, by decreasing the number T of operations to √ T . However, no formal statement nor details are given in [8,19,7]. Furthermore, none of the lattice-based submissions to NIST cite Montanaro's algorithm [34]: the only submission that mentions enumeration in a quantum setting is NTRU-HSS-KEM [24], where it is speculated that enumeration might have a √ T quantum variant.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Quantum Lattice Enumeration and Tweaking Discrete Pruning

Aono

Nguyêñ

Shen

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Enumeration is a fundamental lattice algorithm. We show how to speed up enumeration on a quantum computer, which affects the security estimates of several lattice-based submissions to NIST: if T is the number of operations of enumeration, our quantum enumeration runs in roughly √ T operations. This applies to the two most efficient forms of enumeration known in the extreme pruning setting: cylinder pruning but also discrete pruning introduced at Eurocrypt '17. Our results are based on recent quantum tree algorithms by Montanaro and Ambainis-Kokainis. The discrete pruning case requires a crucial tweak: we modify the preprocessing so that the running time can be rigorously proved to be essentially optimal, which was the main open problem in discrete pruning. We also introduce another tweak to solve the more general problem of finding close lattice vectors.

show abstract

Section: Introductionsupporting

confidence: 80%

“…This can easily be adapted to Babai's partition, because it also relies on boxes. Following (7), it suffices to evaluate:…”

Section: Noise Distributions In the Unique Settingmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Quantum Lattice Enumeration and Tweaking Discrete Pruning

Aono

Nguyêñ

Shen

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…We consider the quantum random oracle. As far as we know, in existing lattice-based signature schemes, only TESLA [26] has proved its security in the quantum random oracle. Hence, our further work is to use their method to give a proper proof in the quantum random oracle for our scheme.…”

Section: Conclusion and Further Workmentioning

confidence: 99%

ID-Based Strong Designated Verifier Signature over R-SIS Assumption

Cai

Han

Zhang

et al. 2019

Security and Communication Networks

View full text Add to dashboard Cite

In this paper, we propose an ID-based strong designated verifier signature (SDVS) over R-SIS assumption in the random model. We remove pre-image sampling function and Bonsai trees such complex structures used in previous lattice-based SDVS schemes. We only utilize simple rejection sampling to protect the security of our scheme. Hence, we will show our design has the shortest signature size comparing with existing lattice-based ID-based SDVS schemes. In addition, our scheme satisfies anonymity (privacy of signer’s identity) proved in existing schemes rarely, and it can resist side-channel attacks with uniform sampling.

show abstract