Paper 2022/1249

On Rejection Sampling in Lyubashevsky's Signature Scheme

Julien Devevey, École Normale Supérieure de Lyon
Omar Fawzi, French Institute for Research in Computer Science and Automation, École Normale Supérieure de Lyon
Alain Passelègue, French Institute for Research in Computer Science and Automation, École Normale Supérieure de Lyon
Damien Stehlé, École Normale Supérieure de Lyon
Abstract

Lyubashevsky’s signatures are based on the Fiat-Shamir with aborts paradigm, whose central ingredient is the use of rejection sampling to transform secret-dependent signature samples into samples from (or close to) a secret-independent target distribution. Several choices for the underlying distributions and for the rejection sampling strategy can be considered. In this work, we study Lyubashevsky’s signatures through the lens of rejection sampling, and aim to minimize signature size given signing runtime requirements. Several of our results concern rejection sampling itself and could have other applications. We prove lower bounds for compactness of signatures given signing run- time requirements, and for expected runtime of perfect rejection sampling strategies. We also propose a Rényi-divergence-based analysis of Lyuba- shevsky’s signatures which allows for larger deviations from the target distribution, and show hyperball uniforms to be a good choice of distri- butions: they asymptotically reach our compactness lower bounds and offer interesting features for practical deployment. Finally, we propose a different rejection sampling strategy which circumvents the expected runtime lower bound and provides a worst-case runtime guarantee.

Metadata
Available format(s)
PDF
Category
Public-key cryptography
Publication info
A major revision of an IACR publication in ASIACRYPT 2022
Keywords
Lattice-based signature signature Fiat-Shamir aborts rejection sampling
Contact author(s)
julien devevey @ ens-lyon fr
omar fawzi @ ens-lyon fr
alain passelegue @ ens-lyon fr
damien stehle @ ens-lyon fr
History
2022-09-26: approved
2022-09-20: received
See all versions
Short URL
https://ia.cr/2022/1249
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2022/1249,
      author = {Julien Devevey and Omar Fawzi and Alain Passelègue and Damien Stehlé},
      title = {On Rejection Sampling in Lyubashevsky's Signature Scheme},
      howpublished = {Cryptology ePrint Archive, Paper 2022/1249},
      year = {2022},
      note = {\url{https://eprint.iacr.org/2022/1249}},
      url = {https://eprint.iacr.org/2022/1249}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.