SETLA: Signature and Encryption from Lattices

Abstract

In data security, the main objectives one tries to achieve are confidentiality, data integrity and authentication. In a public-key setting, confidentiality is reached through asymmetric encryption and both data integrity and authentication through signature. Meeting all the security objectives for data exchange requires to use a concatenation of those primitives in an encrypt-then-sign or sign-then-encrypt fashion. Signcryption aims at providing all the security requirements in one single primitive at a lower cost than using encryption and signature together. Most existing signcryption schemes are using ElGamal-based or pairing-based techniques and thus rely on the decisional Diffie-Hellman assumption. With the current growth of a quantum threat, we seek for post-quantum counterparts to a vast majority of public-key primitives. In this work, we propose a lattice-based signcryption scheme in the random oracle model inspired from a construction of Malone-Lee. It comes in two flavors, one integrating the usual lattice-based key exchange into the signature and the other merging the scheme with a RLWE encryption. Our instantiation is based on a ring version of the scheme of Bai and Galbraith as was done in ring-TESLA and TESLA$\sharp$. It targets 128 bits of classical security and offers a save in bandwidth over a naive concatenation of state-of-the-art key exchanges and signatures from the literature. Another lightweight instantiation derived from GLP is feasible but raises long-term security concerns since the base scheme is somewhat outdated.

Appendices

A Security Games for the KEM Version

Fig. 4.

Sequence of games for the KEM version

Game 0 $\rightarrow$ Game 1: Rejection sampling

Game 1 $\rightarrow$ Game 2: Decisional Compact Knapsack/RLWE

Game 2 $\rightarrow$ Game 3: Decisional Compact Knapsack/RLWE

B Publicly Verifiable Signature from Signcryptext

An interesting feature of Malone-Lee’s signcryption scheme is that the receiver Bob can himself create a fully valid publicly verifiable signature under Alice’s secret key on the message he unsigncrypted. Even if we chose to start from this scheme for its similarity with Schnorr signature (and thus, lattice-based signature), this really helpful feature carries to our construction. Below are the algorithms for the KEX version but the same technique can trivially be applied to the KEM version.

SETLA-KEX SignExtract. (Algorithm 6) To extract a publicly verifiable signature $\sigma (m)$ from a signcryptext, Bob will use the fact that the output of KEX-Signcrypt is essentially equivalent to a TESLA$\sharp$ signature on m with a nonce depending on $K, \mathbf {pk}_a$ and $\mathbf {pk}_b$ queried to the random oracle. Since a verifier should obviously know the message to validate the signature, the confidentiality of the key K is not required anymore. Thus, KEX-SignExctract will output m and K together with the signature and anyone will be able to perform the verification.

PublicVerif. (Algorithm 7) The public verification is the same as in usual lattice-based signatures, except that the hash function also takes as input $K, \mathbf {pk}_a$ and $\mathbf {pk}_b$.