Rounded Gaussians

Abstract

This paper suggests to use rounded Gaussians in place of discrete Gaussians in rejection-sampling-based lattice signature schemes like BLISS. We show that this distribution can efficiently be sampled from while additionally making it easy to sample in constant time, systematically avoiding recent timing-based side-channel attacks on lattice-based signatures. We show the effectiveness of the new sampler by applying it to BLISS, prove analogues of the security proofs for BLISS, and present an implementation that runs in constant time. Our implementation needs no precomputed tables and is twice as fast as the variable-time CDT sampler posted by the BLISS authors with precomputed tables.

Vectorized Discrete Gaussian Sampling with SIMD Support

“…The impact on the whole lattice-based cryptography, especially on some advanced cryptographic applications of lattices, still needs to be assessed. For example, it is suggested to replace discrete Gaussians with rounded Gaussians, which can be sampled very efficiently by using Box-Muller transform and rounding to the nearest integer, but the security analysis of rounded Gaussians is only confined to the Bliss signature [14]. Moreover, the VCL is also suggested to be used in the rounded Gaussians to get a constant-time and efficient implementation.…”

“…According to the implementation detail of the VCL, most of arithmetic operators and mathematical functions in VCL have constant runtime, including multiplication, division, square and the exponential function, i.e. there is no timing difference dependent on the input [14]. This makes the VCL ideal for constant-time implementations, so we can see that PopGPVPool() is time independent.…”

“…We select these two algorithms, since the GPV algorithm supports varying parameters (including parameter σ > 0 and center c ∈ ℝ), while inversion sampling is widely used as a base sampler with a fixed and relatively small σ [2,3]. Furthermore, the VCL is a simple tool for constant-time implementations [14]. One can see that the two algorithms we implemented in this paper are constant-time or at least time-independent, helping mitigate the information leakage caused by the timing attacks on sampling operations.…”

Survey on Fully Homomorphic Encryption, Theory, and Applications

“…Note that in the majority of the FHE literature χ is defined as a discrete Gaussian distribution on Z with centre zero and width parameter αq, denoted by D Z,αq . The discrete Gaussian distribution D Z,αq over the integers is defined by assigning a weight proportional to exp(−πx 2 /(αq) 2 ) to all x ∈ Z. Namely, [27] for any x ∈ Z,…”