Based on the NTRU trapdoor used in NIST's Falcon, a signcryption scheme following the sign-then-encrypt paradigm is constructed. The existing partitioning technique based on Waters hash over the lattice can not complete the security reduction in the standard model for the signature part due to the "partiality" of the pre-image generated with the NTRU trapdoor. To address this, a variant of Waters hash over small integers is proposed and, the probability of the successful reduction is analyzed. The resulting signcryption achieves existential unforgeability under the adaptive chosen-message attacks. By utilizing the uniqueness of the secret and the noise in an NTRU instance, the tag used in encryption is eliminated. Furthermore, a method to construct tamper-sensitive lattice public key encryption is proposed. This approach implants the ciphertext-sensitive information into the lattice public key encryption and binds it to the encrypted information. The malleability to the public key ciphertext triggers the change of the message-signature pair so that the IND-CCA2 security of the entire ciphertext can be guaranteed by the signature for the message. Thanks to the rational design and the efficiency of the NTRU trapdoor, the computational overhead of the proposed scheme is reduced significantly compared to the existing lattice-based signcryption scheme, reaching orders of magnitude improvement in efficiency. The experiment shows that the proposed scheme is efficient.
Based on the NTRU trapdoor used in NIST's Falcon, a signcryption scheme following the sign-then-encrypt paradigm is constructed. The existing partitioning technique based on Waters hash over the lattice can not complete the security reduction in the standard model for the signature part due to the "partiality" of the pre-image generated with the NTRU trapdoor. To address this, a variant of Waters hash over small integers is proposed and, the probability of the successful reduction is analyzed. The resulting signcryption achieves existential unforgeability under the adaptive chosen-message attacks. By utilizing the uniqueness of the secret and the noise in an NTRU instance, the tag used in encryption is eliminated. Furthermore, a method to construct tamper-sensitive lattice public key encryption is proposed. This approach implants the ciphertext-sensitive information into the lattice public key encryption and binds it to the encrypted information. The malleability to the public key ciphertext triggers the change of the message-signature pair so that the IND-CCA2 security of the entire ciphertext can be guaranteed by the signature for the message. Thanks to the rational design and the efficiency of the NTRU trapdoor, the computational overhead of the proposed scheme is reduced significantly compared to the existing lattice-based signcryption scheme, reaching orders of magnitude improvement in efficiency. The experiment shows that the proposed scheme is efficient.
Signcryption is a basic cryptographic primitive that simultaneously captures the functions of encryption and signature. To realize comprehensive information security against quantum computing attacks, lattice-based signcryption schemes have been successively proposed. However, the performance of signcryption schemes should be improved in the lattice setting. An efficient lattice-based signcryption scheme in the standard model is proposed in this paper. Under the ring learning with errors (RLWE) assumption and the ideal short integer solution (ISIS) assumption, the proposed signcryption scheme achieves indistinguishability against adaptive chosen ciphertext attacks (IND-CCA2) and existential unforgeability under an adaptive chosen-message attack (EUF-ACMA). Our scheme not only reduces the communication and computational overhead but also realizes a new design that combines the partitioning technique with the idea of tag-based key encapsulation. The performance analysis results show that our scheme is more efficient than previous lattice-based signcryption schemes in the standard model.
The existing lattice-based signcryption schemes are based on trapdoor generation algorithm and preimage sample algorithm. However, both algorithms are complex, require a lot of time to run, and affect the efficiency of latticed-based signcryption schemes deeply. To solve this problem, the first lattice-based signcryption scheme without trapdoor generation algorithm and preimage sample algorithm is proposed, with the help of the technique of lattice signatures without trapdoors and the associated signature compression technique, as well as the encryption method based on the learning with errors assumption. The scheme achieves indistinguishability against adaptive chosen ciphertext attacks under the learning with errors assumption. It also achieves existential unforgeability against adaptive chosen message attacks under the small integer solution assumption. The proposed scheme is not only quantum resistant, but also efficient.
Although the current lattice-based ring signcryption scheme resists quantum attacks,it has large key storage and high encryption/decryption time.The linkable lattice ring signcryption scheme not only can protect signer anonymity,but also can determine whether two signatures are generated by the same signer.Thus,based on the compact Gaussian sampling algorithm and rejection sampling technique,the identity-based linkable ring signcryption scheme is constructed on the NTRU lattice.Firstly,the system master key is generated using the trapdoor generation algorithm on the NTRU lattice.Then private keys of ring members are obtained based on the compact Gaussian sampling algorithm.Finally,the user signature is generated using rejection sampling,and the key encapsulation mechanism encrypts the signature.Security proof in the random oracle model (ROM) that DRLWE and NTRU small integer solutions are difficult to solve ensures confidentiality,unforgeability,unconditional anonymity,and linkability.Performance analysis shows that compared to the lattice-based ring signcryption and linkable ring signature schemes on NTRU,the proposed scheme has a smaller public key and lower encryption/decryption cost,greatly improving efficiency.
A signcryption scheme provides both the function of digital signature and encryption scheme at the same time. Additionally, it has lower cost than traditional sign-then-encrypt or encrypt-then-sign approaches. Many useful applications have been found where confidentiality and non-repudiation are both required. On the other hand, with the current development of rapid quantum computing, currently schemes based on traditional numerical assumptions (e.g., decisional Diffie-Hellman assumption) are more likely to be attacked by quantum computers. Therefore, lattice-based signcryption schemes have been extensively studied in recent years. However, most of them are either inefficient or secure-proved under the assumptions of random oracles. Although some of them are proved in the standard model, they are not practical in low-cost devices. Since the security is based on "Learning with Errors" (LWE) or "Short Integer Solution" problems, it will result in extremely large size of keys. In this paper, we propose an efficient NTRU-based signcryption scheme, which is inspired from Pion et al.'s key encapsulation mechanism. We provide rigorous security proofs for the confidentiality and unforgeability under NTRU-based assumptions in the standard model. Compared with other schemes, we conclude that our scheme is more efficient and secure.
We present BAT – an IND-CCA secure key encapsulation mechanism (KEM) that is based on NTRU but follows an encryption/decryption paradigm distinct from classical NTRU KEMs. It demonstrates a new approach of decrypting NTRU ciphertext since its introduction 25 years ago. Instead of introducing an artificial masking parameter p to decrypt the ciphertext, we use 2 linear equations in 2 unknowns to recover the message and the error. The encryption process is therefore close to the GGH scheme. However, since the secret key is now a short basis (not a vector), we need to modify the decryption algorithm and we present a new NTRU decoder. Thanks to the improved decoder, our scheme works with a smaller modulus and yields shorter ciphertexts, smaller than RSA-4096 for 128-bit classical security with comparable public-key size and much faster than RSA or even ECC. Meanwhile, the encryption and decryption are still simple and fast in spite of the complicated key generation. Overall, our KEM has more compact parameters than all current lattice-based schemes and a practical efficiency. Moreover, due to the similar key pair structure, BAT can be of special interest in some applications using Falcon signature that is also the most compact signature in the round 3 of the NIST post-quantum cryptography standardization. However, different from Falcon, our KEM does not rely on floating-point arithmetic and can be fully implemented over the integers.
Signcryption is a cryptographic primitive that can provide valid solution for authentication and confidentiality.In this paper, an efficient identity-based signcryption scheme from lattice was proposed.Our scheme based on Macciancio and Piekert's trapdoor generation method and delegate algorithm for lattice.Our main idea is that establish the identity-based system master key via trapdoor generation method for lattice, and extract user's key by trapdoor delegate algorithm.With the aid of random oracle, we prove that the proposed scheme has CCA security under the learning with errors (LWE) assumption and unforgeability against adaptive chosen messages attacks under the small integer solution (SIS) assumption.Comparison with signature-then-encryption approach shows that our scheme is efficient.