Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3133956.3133997acmconferencesArticle/Chapter ViewAbstractPublication PagesccsConference Proceedingsconference-collections
research-article
Public Access

Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives

Published: 30 October 2017 Publication History
  • Get Citation Alerts
  • Abstract

    We propose a new class of post-quantum digital signature schemes that: (a) derive their security entirely from the security of symmetric-key primitives, believed to be quantum-secure, and (b) have extremely small keypairs, and, (c) are highly parameterizable.
    In our signature constructions, the public key is an image y=f(x) of a one-way function f and secret key x. A signature is a non-interactive zero-knowledge proof of x, that incorporates a message to be signed. For this proof, we leverage recent progress of Giacomelli et al. (USENIX'16) in constructing an efficient Σ-protocol for statements over general circuits. We improve this Σ-protocol to reduce proof sizes by a factor of two, at no additional computational cost. While this is of independent interest as it yields more compact proofs for any circuit, it also decreases our signature sizes.
    We consider two possibilities to make the proof non-interactive: the Fiat-Shamir transform and Unruh's transform (EUROCRYPT'12, '15,'16). The former has smaller signatures, while the latter has a security analysis in the quantum-accessible random oracle model. By customizing Unruh's transform to our application, the overhead is reduced to 1.6x when compared to the Fiat-Shamir transform, which does not have a rigorous post-quantum security analysis.
    We implement and benchmark both approaches and explore the possible choice of f, taking advantage of the recent trend to strive for practical symmetric ciphers with a particularly low number of multiplications and end up using Low MC (EUROCRYPT'15).

    Supplemental Material

    MP4 File

    References

    [1]
    Abdalla, M., An, J. H., Bellare, M., and Namprempre, C. From identification to signatures via the fiat-shamir transform: Minimizing assumptions for security and forward-security. In EUROCRYPT (2002).
    [2]
    Abdalla, M., Fouque, P., Lyubashevsky, V., and Tibouchi, M. Tightly-secure signatures from lossy identification schemes. In EUROCRYPT (2012).
    [3]
    Akleylek, S., Bindel, N., Buchmann, J. A., Krämer, J., and Marson, G. A. An efficient lattice-based signature scheme with provably secure instantiation. In AFRICACRYPT (2016).
    [4]
    Albrecht, M., Rechberger, C., Schneider, T., Tiessen, T., and Zohner, M. Ciphers for MPC and FHE. Cryptology ePrint Archive, Report 2016/687, 2016.
    [5]
    Albrecht, M. R., Grassi, L., Rechberger, C., Roy, A., and Tiessen, T. MiMC: Efficient encryption and cryptographic hashing with minimal multiplicative complexity. In ASIACRYPT (2016), pp. 191--219.
    [6]
    Albrecht, M. R., Rechberger, C., Schneider, T., Tiessen, T., and Zohner, M. Ciphers for MPC and FHE. In EUROCRYPT (2015).
    [7]
    Alkim, E., Bindel, N., Buchmann, J., Dagdelen, Ö., and Schwabe, P. Tesla: Tightly-secure efficient signatures from standard lattices. Cryptology ePrint Archive, Report 2015/755, 2015.
    [8]
    Alkim, E., Bindel, N., Buchmann, J. A., Dagdelen, Ö., Eaton, E., Gutoski, G., Kräamer, J., and Pawlega, F. Revisiting TESLA in the quantum random oracle model. In PQCrypto 2017 (2017), pp. 143--162.
    [9]
    Bai, S., and Galbraith, S. D. An improved compression technique for signatures based on learning with errors. In CT-RSA (2014).
    [10]
    Bansarkhani, R. E., and Buchmann, J. A. Improvement and efficient implementation of a lattice-based signature scheme. In SAC (2013).
    [11]
    Barreto, P. S. L. M., Longa, P., Naehrig, M., Ricardini, J. E., and Zanon, G. Sharper ring-lwe signatures. IACR Cryptology ePrint Archive 2016 (2016), 1026.
    [12]
    Bellare, M., Poettering, B., and Stebila, D. From identification to signatures, tightly: A framework and generic transforms. In ASIACRYPT (2016).
    [13]
    Bellare, M., and Rogaway, P. Random oracles are practical: A paradigm for designing efficient protocols. In ACM CCS (1993).
    [14]
    Ben-Sasson, E., Chiesa, A., Garman, C., Green, M., Miers, I., Tromer, E., and Virza, M. Zerocash: Decentralized anonymous payments from bitcoin. In IEEE SP (2014).
    [15]
    Ben-Sasson, E., Chiesa, A., Genkin, D., Tromer, E., and Virza, M. Snarks for C: verifying program executions succinctly and in zero knowledge. In CRYPTO (2013).
    [16]
    Bernstein, D. J. Cost analysis of hash collisions: Will quantum computers make SHARCS obsolete? http://cr.yp.to/hash/collisioncost-20090823.pdf.
    [17]
    Bernstein, D. J., Hopwood, D., Hülsing, A., Lange, T., Niederhagen, R., Papachristodoulou, L., Schneider, M., Schwabe, P., and Wilcox-O'Hearn, Z. SPHINCS: practical stateless hash-based signatures. In EUROCRYPT (2015).
    [18]
    Boneh, D., Dagdelen, Ö., Fischlin, M., Lehmann, A., Schaffner, C., and Zhandry, M. Random oracles in a quantum world. In ASIACRYPT (2011).
    [19]
    Borghoff, J., Canteaut, A., Güneysu, T., Kavun, E. B., Knezevic, M., Knudsen, L. R., Leander, G., Nikov, V., Paar, C., Rechberger, C., Rombouts, P., Thomsen, S. S., and Yalccin, T. PRINCE - a low-latency block cipher for pervasive computing applications - extended abstract. In ASIACRYPT (2012).
    [20]
    Boyar, J., Matthews, P., and Peralta, R. Logic minimization techniques with applications to cryptology. Journal of Cryptology 26, 2 (2013), 280--312.
    [21]
    Brassard, G., Høyer, P., and Tapp, A. Quantum cryptanalysis of hash and claw-free functions. In LATIN 1998 (Apr. 1998), C. L. Lucchesi and A. V. Moura, Eds., vol. 1380 of LNCS, Springer, Heidelberg, pp. 163--169.
    [22]
    Buchmann, J. A., Dahmen, E., and Hülsing, A. XMSS - A practical forward secure signature scheme based on minimal security assumptions. In PQCrypto (2011).
    [23]
    Campanelli, M., Gennaro, R., Goldfeder, S., and Nizzardo, L. Zero-knowledge contingent payments revisited: Attacks and payments for services. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (2017), ACM.
    [24]
    Canteaut, A., Carpov, S., Fontaine, C., Lepoint, T., Naya-Plasencia, M., Paillier, P., and Sirdey, R. Stream ciphers: A practical solution for efficient homomorphic-ciphertext compression. In FSE (2016).
    [25]
    Carlet, C., Goubin, L., Prouff, E., Quisquater, M., and Rivain, M. Higher-order masking schemes for s-boxes. In FSE (2012).
    [26]
    Costello, C., Fournet, C., Howell, J., Kohlweiss, M., Kreuter, B., Naehrig, M., Parno, B., and Zahur, S. Geppetto: Versatile verifiable computation. In IEEE SP (2015).
    [27]
    Courtois, N., Finiasz, M., and Sendrier, N. How to achieve a mceliece-based digital signature scheme. In ASIACRYPT (2001).
    [28]
    Cramer, R., Damgård, I., and Schoenmakers, B. Proofs of partial knowledge and simplified design of witness hiding protocols. In CRYPTO (1994).
    [29]
    Daemen, J., Peeters, M., Van Assche, G., and Rijmen, V. Nessie proposal: Noekeon. In First Open NESSIE Workshop (2000).
    [30]
    Dagdelen, Ö., Bansarkhani, R. E., Göpfert, F., Güneysu, T., Oder, T., Pöppelmann, T., Sánchez, A. H., and Schwabe, P. High-speed signatures from standard lattices. In LATINCRYPT (2014).
    [31]
    Dagdelen, Ö., Fischlin, M., and Gagliardoni, T. The fiat-shamir transformation in a quantum world. In ASIACRYPT (2013).
    [32]
    Dagdelen, Ö., Galindo, D., Véron, P., Alaoui, S. M. E. Y., and Cayrel, P. Extended security arguments for signature schemes. Des. Codes Cryptography 78, 2 (2016), 441--461.
    [33]
    De Cannière, C., and Preneel, B. Trivium. In New Stream Cipher Designs - The eSTREAM Finalists. 2008.
    [34]
    Derler, D., Orlandi, C., Ramacher, S., Rechberger, C., and Slamanig, D. Digital signatures from symmetric-key primitives. Cryptology ePrint Archive, Report 2016/1085, 2016. http://eprint.iacr.org/2016/1085.
    [35]
    Ducas, L. Accelerating bliss: the geometry of ternary polynomials. IACR Cryptology ePrint Archive 2014 (2014).
    [36]
    Ducas, L., Durmus, A., Lepoint, T., and Lyubashevsky, V. Lattice signatures and bimodal gaussians. In CRYPTO (2013).
    [37]
    Ezerman, M. F., Lee, H. T., Ling, S., Nguyen, K., and Wang, H. A provably secure group signature scheme from code-based assumptions. In Advances in Cryptology - ASIACRYPT (2015), pp. 260--285.
    [38]
    Faugère, J., Gauthier-Uma na, V., Otmani, A., Perret, L., and Tillich, J. A distinguisher for high-rate mceliece cryptosystems. IEEE Trans. Information Theory 59, 10 (2013), 6830--6844.
    [39]
    Feo, L. D., Jao, D., and Plût, J. Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. J. Mathematical Cryptology 8, 3 (2014), 209--247.
    [40]
    Fiat, A., and Shamir, A. How to prove yourself: Practical solutions to identification and signature problems. In CRYPTO (1986), pp. 186--194.
    [41]
    Galbraith, S. D., Petit, C., and Silva, J. Signature schemes based on supersingular isogeny problems. IACR Cryptology ePrint Archive 2016 (2016), 1154.
    [42]
    Gennaro, R., Gentry, C., Parno, B., and Raykova, M. Quadratic span programs and succinct nizks without pcps. In EUROCRYPT (2013).
    [43]
    Gentry, C., Peikert, C., and Vaikuntanathan, V. Trapdoors for hard lattices and new cryptographic constructions. In STOC (2008).
    [44]
    Giacomelli, I., Madsen, J., and Orlandi, C. ZKBoo: Faster zero-knowledge for boolean circuits. In USENIX Security (2016).
    [45]
    Giacomelli, I., Madsen, J., and Orlandi, C. ZKBoo: Faster zero-knowledge for boolean circuits. Cryptology ePrint Archive, Report 2016/163, 2016. http://eprint.iacr.org/2016/163.
    [46]
    Goldfeder, S., Chase, M., and Zaverucha, G. Efficient post-quantum zero-knowledge and signatures. Cryptology ePrint Archive, Report 2016/1110, 2016. http://eprint.iacr.org/2016/1110.
    [47]
    Goldreich, O. Two remarks concerning the goldwasser-micali-rivest signature scheme. In CRYPTO (1986).
    [48]
    Goldreich, O., Micali, S., and Wigderson, A. How to prove all np-statements in zero-knowledge, and a methodology of cryptographic protocol design. In CRYPTO (1986).
    [49]
    Goldwasser, S., Micali, S., and Rackoff, C. The knowledge complexity of interactive proof-systems (extended abstract). In STOC (1985).
    [50]
    Grosso, V., Leurent, G., Standaert, F., and Varici, K. Ls-designs: Bitslice encryption for efficient masked software implementations. In FSE (2014).
    [51]
    Groth, J., and Sahai, A. Efficient Non-interactive Proof Systems for Bilinear Groups. In EUROCRYPT (2008).
    [52]
    Grover, L. K. A fast quantum mechanical algorithm for database search. In STOC (1996).
    [53]
    Güneysu, T., Lyubashevsky, V., and Pöppelmann, T. Practical lattice-based cryptography: A signature scheme for embedded systems. In CHES (2012).
    [54]
    Hellman, M. A cryptanalytic time-memory trade-off. IEEE transactions on Information Theory 26, 4 (1980), 401--406.
    [55]
    Hu, Z., Mohassel, P., and Rosulek, M. Efficient zero-knowledge proofs of non-algebraic statements with sublinear amortized cost. In CRYPTO (2015).
    [56]
    Hülsing, A., Rijneveld, J., Samardjiska, S., and Schwabe, P. From 5-pass mq-based identification to mq-based signatures. In Cryptology ePrint Archive, Report 2016/708, to appear in Asiacrypt 2016 (2016).
    [57]
    Ishai, Y., Kushilevitz, E., Ostrovsky, R., and Sahai, A. Zero-knowledge proofs from secure multiparty computation. SIAM Journal on Computing 39, 3 (2009), 1121--1152.
    [58]
    Jawurek, M., Kerschbaum, F., and Orlandi, C. Zero-knowledge using garbled circuits: how to prove non-algebraic statements efficiently. In ACM CCS (2013).
    [59]
    Kaplan, M., Leurent, G., Leverrier, A., and Naya-Plasencia, M. Quantum Differential and Linear Cryptanalysis. ArXiv e-prints (Oct. 2015).
    [60]
    Kaplan, M., Leurent, G., Leverrier, A., and Naya-Plasencia, M. Breaking symmetric cryptosystems using quantum period finding. In CRYPTO (2016).
    [61]
    Katz, J. Digital Signatures. Springer, 2010.
    [62]
    Kiltz, E., Masny, D., and Pan, J. Optimal security proofs for signatures from identification schemes. In CRYPTO (2016).
    [63]
    Lamport, L. Constructing digital signatures from one-way functions. Tech. Rep. SRI-CSL-98, SRI Intl. Computer Science Laboratory, 1979.
    [64]
    Landais, G., and Sendrier, N. Cfs software implementation. Cryptology ePrint Archive, Report 2012/132, 2012.
    [65]
    Lyubashevsky, V. Fiat-shamir with aborts: Applications to lattice and factoring-based signatures. In ASIACRYPT (2009).
    [66]
    Lyubashevsky, V. Lattice signatures without trapdoors. In EUROCRYPT (2012).
    [67]
    McEliece, R. J. A public-key cryptosystem based on algebraic coding theory. Tech. Rep. DSN PR 42--44, 1978.
    [68]
    McGrew, D. A., Kampanakis, P., Fluhrer, S. R., Gazdag, S., Butin, D., and Buchmann, J. A. State management for hash-based signatures. In Security Standardisation Research (2016).
    [69]
    Méaux, P., Journault, A., Standaert, F., and Carlet, C. Towards stream ciphers for efficient FHE with low-noise ciphertexts. In EUROCRYPT (2016).
    [70]
    Melchor, C. A., Gaborit, P., and Schrek, J. A new zero-knowledge code based identification scheme with reduced communication. In ITW (2011).
    [71]
    Merkle, R. C. A certified digital signature. In CRYPTO (1989).
    [72]
    Niederreiter, H. Knapsack-type cryptosystems and algebraic coding theory. Problems of Control and Information Theory (1986).
    [73]
    Ohta, K., and Okamoto, T. On concrete security treatment of signatures derived from identification. In CRYPTO (1998).
    [74]
    Patarin, J., Courtois, N., and Goubin, L. Quartz, 128-bit long digital signatures. In CT-RSA (2001).
    [75]
    Peikert, C. A decade of lattice cryptography. Foundations and Trends in Theoretical Computer Science 10, 4 (2016).
    [76]
    Petzoldt, A., Chen, M., Yang, B., Tao, C., and Ding, J. Design principles for hfev- based multivariate signature schemes. In ASIACRYPT (2015).
    [77]
    Pointcheval, D., and Stern, J. Security proofs for signature schemes. In EUROCRYPT (1996).
    [78]
    S. Ames, C. Hazay, Y. I., and Venkitasubramaniam, M. Ligero: Lightweight sublinear arguments without a trusted setup. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (2017), ACM.
    [79]
    Sakumoto, K., Shirai, T., and Hiwatari, H. Public-key identification schemes based on multivariate quadratic polynomials. In CRYPTO (2011).
    [80]
    Schnorr, C. Efficient signature generation by smart cards. J. Cryptology 4, 3 (1991).
    [81]
    Shor, P. W. Polynominal time algorithms for discrete logarithms and factoring on a quantum computer. In ANTS-I (1994).
    [82]
    Stern, J. A new identification scheme based on syndrome decoding. In CRYPTO (1993).
    [83]
    Unruh, D. Quantum proofs of knowledge. In EUROCRYPT 2012 (Apr. 2012), D. Pointcheval and T. Johansson, Eds., vol. 7237 of LNCS, Springer, Heidelberg, pp. 135--152.
    [84]
    Unruh, D. Non-interactive zero-knowledge proofs in the quantum random oracle model. In EUROCRYPT 2015, Part II (Apr. 2015), E. Oswald and M. Fischlin, Eds., vol. 9057 of LNCS, Springer, Heidelberg, pp. 755--784.
    [85]
    Unruh, D. Computationally binding quantum commitments. In EUROCRYPT (2016).
    [86]
    Véron, P. Improved identification schemes based on error-correcting codes. Appl. Algebra Eng. Commun. Comput. 8, 1 (1996).
    [87]
    Yoo, Y., Azarderakhsh, R., Jalali, A., Jao, D., and Soukharev, V. A post-quantum digital signature scheme based on supersingular isogenies. Cryptology ePrint Archive, Report 2017/186, 2017. http://eprint.iacr.org/2017/186.

    Cited By

    View all
    • (2024)Verifiable Encryption from MPC-in-the-HeadIACR Communications in Cryptology10.62056/a3wa3zl7sOnline publication date: 9-Apr-2024
    • (2024)A survey on lattice-based digital signatureCybersecurity10.1186/s42400-023-00198-17:1Online publication date: 1-Apr-2024
    • (2024)Towards Post-Quantum Verifiable CredentialsProceedings of the 19th International Conference on Availability, Reliability and Security10.1145/3664476.3669932(1-10)Online publication date: 30-Jul-2024
    • Show More Cited By

    Recommendations

    Comments

    Information & Contributors

    Information

    Published In

    cover image ACM Conferences
    CCS '17: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security
    October 2017
    2682 pages
    ISBN:9781450349468
    DOI:10.1145/3133956
    Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

    Sponsors

    Publisher

    Association for Computing Machinery

    New York, NY, United States

    Publication History

    Published: 30 October 2017

    Permissions

    Request permissions for this article.

    Check for updates

    Author Tags

    1. block cipher
    2. post-quantum cryptography
    3. signatures
    4. zero-knowledge

    Qualifiers

    • Research-article

    Funding Sources

    Conference

    CCS '17
    Sponsor:

    Acceptance Rates

    CCS '17 Paper Acceptance Rate 151 of 836 submissions, 18%;
    Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

    Upcoming Conference

    CCS '24
    ACM SIGSAC Conference on Computer and Communications Security
    October 14 - 18, 2024
    Salt Lake City , UT , USA

    Contributors

    Other Metrics

    Bibliometrics & Citations

    Bibliometrics

    Article Metrics

    • Downloads (Last 12 months)390
    • Downloads (Last 6 weeks)30
    Reflects downloads up to 06 Aug 2024

    Other Metrics

    Citations

    Cited By

    View all
    • (2024)Verifiable Encryption from MPC-in-the-HeadIACR Communications in Cryptology10.62056/a3wa3zl7sOnline publication date: 9-Apr-2024
    • (2024)A survey on lattice-based digital signatureCybersecurity10.1186/s42400-023-00198-17:1Online publication date: 1-Apr-2024
    • (2024)Towards Post-Quantum Verifiable CredentialsProceedings of the 19th International Conference on Availability, Reliability and Security10.1145/3664476.3669932(1-10)Online publication date: 30-Jul-2024
    • (2024)Funder: Future-Proof Unbiased Decentralized RandomnessIEEE Internet of Things Journal10.1109/JIOT.2023.332773311:6(10352-10367)Online publication date: 15-Mar-2024
    • (2024)Cryptographic primitives based on compact knapsack problemJournal of Information Security and Applications10.1016/j.jisa.2024.10378183(103781)Online publication date: Jun-2024
    • (2024)A New Hash-Based Enhanced Privacy ID Signature SchemePost-Quantum Cryptography10.1007/978-3-031-62743-9_2(37-71)Online publication date: 12-Jun-2024
    • (2024)Fully Dynamic Attribute-Based Signatures for Circuits from CodesPublic-Key Cryptography – PKC 202410.1007/978-3-031-57718-5_2(37-73)Online publication date: 15-Apr-2024
    • (2024)Biscuit: New MPCitH Signature Scheme from Structured Multivariate PolynomialsApplied Cryptography and Network Security10.1007/978-3-031-54770-6_18(457-486)Online publication date: 5-Mar-2024
    • (2023)DubheProceedings of the 32nd USENIX Conference on Security Symposium10.5555/3620237.3620482(4373-4390)Online publication date: 9-Aug-2023
    • (2023)Privacy-preserving cryptographic algorithms and protocols: a survey on designs and applicationsSCIENTIA SINICA Informationis10.1360/SSI-2022-043453:9(1688)Online publication date: 6-Sep-2023
    • Show More Cited By

    View Options

    View options

    PDF

    View or Download as a PDF file.

    PDF

    eReader

    View online with eReader.

    eReader

    Get Access

    Login options

    Media

    Figures

    Other

    Tables

    Share

    Share

    Share this Publication link

    Share on social media