4

I have been working on the post-quantum safe ID/signature-schemes of Vadim Lyubashevsky (https://www.iacr.org/archive/asiacrypt2009/59120596/59120596.pdf).

I am in particular studying the security proof, and wanting to structure this in a game based fashion. Any ideas on how to approach this in terms of sUf-CMA security?

Also, replay attacks in term of rewinding is used in the security proof. How can this be safe in a post-quantum setting? Or am I just getting confused with post-quantum and quantum oracle model QROM?

In advance, thank you :)

Rory
  • 353
  • 2
  • 12

1 Answers1

2

In general, a good place to look for something like this is a "polished" version of the scheme. For post-quantum signatures, the "polished" schemes are most easily found in supporting documentation for the NIST PQC competition. In particular, the signature scheme CRYSTALS-DILITHIUM has been selected to be standardized, and is a "Fiat Shamir with Aborts" scheme (coauthored by Lybushavesky). You can find a writeup on this here. In particular, section 4.2 should be relevant to your question.

For your question regarding the rewinding, my understanding is that this is (roughly) the same as the forking lemma. From page 14 of the linked paper, we have that

A standard forking lemma argument can be used to show that an adversary solving the $[\mathsf{SelfTargetMSIS}]$ in the (standard) random oracle model can be used to solve the $\mathsf{MSIS}$ problem. While giving a reduction using the forking lemma is a good “sanity check”, it is not particularly useful for setting parameters due to its lack of tightness.

This is to say that, while one in principle could base things on $\mathsf{MSIS}$, due to (classical!) non-tightness of the reduction, they instead base the scheme on $\mathsf{SelfTargetMSIS}$. While that particular writeup does not mention QROM security proofs, this paper they link does. This may be a better place to start --- it additionally contains a simplified/unoptimized version of Dilithium which might be more approachable to understand initially.

Mark Schultz-Wu
  • 15,089
  • 1
  • 22
  • 53