Skip to main content

Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions

  • Conference paper
  • First Online:
Advances in Cryptology – EUROCRYPT 2024 (EUROCRYPT 2024)

Abstract

Threshold signatures improve both availability and security of digital signatures by splitting the signing key into N shares handed out to different parties. Later on, any subset of at least T parties can cooperate to produce a signature on a given message. While threshold signatures have been extensively studied in the pre-quantum setting, they remain sparse from quantum-resilient assumptions.

We present the first efficient lattice-based threshold signatures with signature size 13 KiB and communication cost 40 KiB per user, supporting a threshold size as large as 1024 signers. We provide an accompanying high performance implementation. The security of the scheme is based on the same assumptions as Dilithium, a signature recently selected by NIST for standardisation which, as far as we know, cannot easily be made threshold efficiently.

All operations used during signing are due to symmetric primitives and simple lattice operations; in particular our scheme does not need heavy tools such as threshold fully homomorphic encryption or homomorphic trapdoor commitments as in prior constructions. The key technical idea is to use one-time additive masks to mitigate the leakage of the partial signing keys through partial signatures.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    More precisely, we rely on the recent \(\mathsf {Hint\text {-}MLWE}_{}\) problem by Kim et al. [44] and the \(\textsf{SelfTargetMSIS}_{}\) problem underlying the security of Dilithium [43]. Both problems are known to be as hard as the \(\textsf{MLWE}_{}\) and \(\textsf{MSIS}_{}\) problems, respectively.

  2. 2.

    We choose not to do so yet as the parameters of both schemes are still subject to improvements.

  3. 3.

    This is an upper limit of the “large” requirements of NIST preliminary call for threshold [57]. Note that our parameters support any \(1 \le T \le N \le 1024\).

  4. 4.

    From a security proof perspective, a proof with rejection sampling requires slightly more work due to subtle issues [7, 32].

  5. 5.

    This step prevents the adversary from maliciously generating its commitment after learning all the honest users commitments (see for instance [9]).

  6. 6.

    See Fig. 1 for why we call it row and column masks.

  7. 7.

    This is not to be confused with [59], having the same signature name \(\textsf{Raccoon}\). While [59] also considers a variant of the Lyubashevsky’s signature scheme without rejection sampling, [58] can be viewed as a major simplification and refinement of it.

  8. 8.

    Strictly speaking, the underlying signature scheme is not \(\textsf{Raccoon}\) as we use discrete Gaussians instead of sum of uniforms. However, we attribute \(\textsf{Raccoon}\) as the core features (i.e., removing rejection sampling and optimisations) are the same.

  9. 9.

    The Threshold Raccoon implementation used to generate these benchmarking results is available to reviewers: https://anonymous.4open.science/r/ec24-thrc-F64C.

References

  1. Abram, D., Nof, A., Orlandi, C., Scholl, P., Shlomovits, O.: Low-bandwidth threshold ECDSA via pseudorandom correlation generators. In: 2022 IEEE Symposium on Security and Privacy, pp. 2554–2572. IEEE Computer Society Press (2022). https://doi.org/10.1109/SP46214.2022.9833559

  2. Agrawal, S., Boyen, X., Vaikuntanathan, V., Voulgaris, P., Wee, H.: Functional encryption for threshold functions (or fuzzy ibe) from lattices. In: Fischlin, M., Buchmann, J., Manulis, M. (eds.) PKC 2012. LNCS, vol. 7293, pp. 280–297. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-30057-8_17

    Chapter  Google Scholar 

  3. Agrawal, S., Stehlé, D., Yadav, A.: Round-optimal lattice-based threshold signatures, revisited. In: Bojanczyk, M., Merelli, E., Woodruff, D.P. (eds.) ICALP 2022. LIPIcs, vol. 229, pp. 8:1–8:20. Schloss Dagstuhl (2022). https://doi.org/10.4230/LIPIcs.ICALP.2022.8

  4. Alagic, G., et al.: Nistir 8413 – status report on the third round of the nist post-quantum cryptography standardization process (2022). https://doi.org/10.6028/NIST.IR.8413

  5. Albrecht, M.R., Player, R., Scott, S.: On the concrete hardness of learning with errors. J. Math. Cryptol. 9(3), 169–203 (2015). https://doi.org/10.1515/jmc-2015-0016

    Article  MathSciNet  Google Scholar 

  6. Alkim, E., Ducas, L., Pöppelmann, T., Schwabe, P.: Post-quantum key exchange - a new hope. In: Holz, T., Savage, S. (eds.) USENIX Security 2016, pp. 327–343. USENIX Association (2016)

    Google Scholar 

  7. Barbosa, M., et al.: Fixing and mechanizing the security proof of fiat-shamir with aborts and dilithium. In: Handschuh, H., Lysyanskaya, A. (eds.) CRYPTO 2023, Part V. LNCS, vol. 14085, pp. 358–389. Springer, Heidelberg (2023). https://doi.org/10.1007/978-3-031-38554-4_12

  8. Bellare, M., Crites, E.C., Komlo, C., Maller, M., Tessaro, S., Zhu, C.: Better than advertised security for non-interactive threshold signatures. In: Dodis, Y., Shrimpton, T. (eds.) CRYPTO 2022, Part IV. LNCS, vol. 13510, pp. 517–550. Springer, Heidelberg (2022). https://doi.org/10.1007/978-3-031-15985-5_18

  9. Bellare, M., Neven, G.: Multi-signatures in the plain public-key model and a general forking lemma. In: Juels, A., Wright, R.N., De Capitani di Vimercati, S. (eds.) ACM CCS 2006, pp. 390–399. ACM Press (2006). https://doi.org/10.1145/1180405.1180453

  10. Bernstein, D.J., Lange, T., Martindale, C., Panny, L.: Quantum circuits for the CSIDH: Optimizing quantum evaluation of isogenies. In: Ishai, Y., Rijmen, V. (eds.) EUROCRYPT 2019, Part II. LNCS, vol. 11477, pp. 409–441. Springer, Heidelberg (2019). https://doi.org/10.1007/978-3-030-17656-3_15

  11. Beullens, W., Kleinjung, T., Vercauteren, F.: CSI-FiSh: efficient isogeny based signatures through class group computations. In: Galbraith, S.D., Moriai, S. (eds.) ASIACRYPT 2019, Part I. LNCS, vol. 11921, pp. 227–247. Springer, Heidelberg (2019). https://doi.org/10.1007/978-3-030-34578-5_9

  12. Boldyreva, A.: Threshold signatures, multisignatures and blind signatures based on the gap-Diffie-Hellman-group signature scheme. In: Desmedt, Y. (ed.) PKC 2003. LNCS, vol. 2567, pp. 31–46. Springer, Heidelberg (2003). https://doi.org/10.1007/3-540-36288-6_3

  13. Boneh, D., et al.: Threshold cryptosystems from threshold fully homomorphic encryption. In: Shacham, H., Boldyreva, A. (eds.) CRYPTO 2018, Part I. LNCS, vol. 10991, pp. 565–596. Springer, Heidelberg (2018). https://doi.org/10.1007/978-3-319-96884-1_19

  14. Boneh, D., Lewi, K., Montgomery, H.W., Raghunathan, A.: Key homomorphic PRFs and their applications. In: Canetti, R., Garay, J.A. (eds.) CRYPTO 2013, Part I. LNCS, vol. 8042, pp. 410–428. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-40041-4_23

  15. Boneh, D., Lynn, B., Shacham, H.: Short signatures from the Weil pairing. In: Boyd, C. (ed.) ASIACRYPT 2001. LNCS, vol. 2248, pp. 514–532. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45682-1_30

  16. Bonnetain, X., Schrottenloher, A.: Quantum security analysis of CSIDH. In: Canteaut, A., Ishai, Y. (eds.) EUROCRYPT 2020, Part II. LNCS, vol. 12106, pp. 493–522. Springer, Heidelberg (2020). https://doi.org/10.1007/978-3-030-45724-2_17

  17. Boschini, C., Takahashi, A., Tibouchi, M.: MuSig-L: lattice-based multi-signature with single-round online phase. In: Dodis, Y., Shrimpton, T. (eds.) CRYPTO 2022, Part II. LNCS, vol. 13508, pp. 276–305. Springer, Heidelberg (2022). https://doi.org/10.1007/978-3-031-15979-4_10

  18. Chávez-Saab, J., Chi-Domínguez, J.J., Jaques, S., Rodríguez-Henríquez, F.: The SQALE of CSIDH: sublinear Vélu quantum-resistant isogeny action with low exponents. J. Cryptogr. Eng. 12(3), 349–368 (2022). https://doi.org/10.1007/s13389-021-00271-w

    Article  Google Scholar 

  19. Chen, Y.: DualMS: efficient lattice-based two-round multi-signature with trapdoor-free simulation. Cryptology ePrint Archive, Report 2023/263 (2023). https://eprint.iacr.org/2023/263

  20. Chen, Y.: Dualms: efficient lattice-based two-round multi-signature with trapdoor-free simulation. Cryptology ePrint Archive, Paper 2023/263 (2023). https://eprint.iacr.org/2023/263

  21. Cheon, J.H., Cho, W., Kim, J.: Improved universal thresholdizer from threshold fully homomorphic encryption. Cryptology ePrint Archive, Paper 2023/545 (2023). https://eprint.iacr.org/2023/545

  22. Chowdhury, S., et al.: Efficient threshold FHE with application to real-time systems. Cryptology ePrint Archive, Report 2022/1625 (2022). https://eprint.iacr.org/2022/1625

  23. Chuengsatiansup, C., Prest, T., Stehlé, D., Wallet, A., Xagawa, K.: ModFalcon: compact signatures based on module-NTRU lattices. In: Sun, H.M., Shieh, S.P., Gu, G., Ateniese, G. (eds.) ASIACCS 20. pp. 853–866. ACM Press (2020). https://doi.org/10.1145/3320269.3384758

  24. Cooper, D., Apon, D., Dang, Q., Davidson, M., Dworkin, M., Miller, C.: Recommendation for stateful hash-based signature schemes. National Institute of Standards and Technology (2020). https://doi.org/10.6028/NIST.SP.800-208

  25. Cozzo, D., Smart, N.P.: Sashimi: cutting up CSI-FiSh secret keys to produce an actively secure distributed signing protocol. In: Ding, J., Tillich, J.P. (eds.) Post-Quantum Cryptography - 11th International Conference, PQCrypto 2020, pp. 169–186. Springer, Heidelberg (2020). https://doi.org/10.1007/978-3-030-44223-1_10

  26. Crites, E., Komlo, C., Maller, M.: How to prove schnorr assuming schnorr: security of multi- and threshold signatures. Cryptology ePrint Archive, Report 2021/1375 (2021). https://eprint.iacr.org/2021/1375

  27. Damgård, I., Orlandi, C., Takahashi, A., Tibouchi, M.: Two-round n-out-of-n and multi-signatures and trapdoor commitment from lattices. In: Garay, J. (ed.) PKC 2021, Part I. LNCS, vol. 12710, pp. 99–130. Springer, Heidelberg (2021). https://doi.org/10.1007/978-3-030-75245-3_5

  28. Damgård, I., Orlandi, C., Takahashi, A., Tibouchi, M.: Two-round n-out-of-n and multi-signatures and trapdoor commitment from lattices. J. Cryptol. 35(2), 14 (2022). https://doi.org/10.1007/s00145-022-09425-3

    Article  MathSciNet  Google Scholar 

  29. De Feo, L., Meyer, M.: Threshold schemes from isogeny assumptions. In: Kiayias, A., Kohlweiss, M., Wallden, P., Zikas, V. (eds.) PKC 2020, Part II. LNCS, vol. 12111, pp. 187–212. Springer, Heidelberg (2020). https://doi.org/10.1007/978-3-030-45388-6_7

  30. Desmedt, Y.: Abuses in cryptography and how to fight them. In: Goldwasser, S. (ed.) CRYPTO’88. LNCS, vol. 403, pp. 375–389. Springer, Heidelberg (1990). https://doi.org/10.1007/0-387-34799-2_29

  31. Desmedt, Y., Frankel, Y.: Threshold cryptosystems. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 307–315. Springer, Heidelberg (1990). https://doi.org/10.1007/0-387-34805-0_28

  32. Devevey, J., Fallahpour, P., Passelègue, A., Stehlé, D.: A detailed analysis of fiat-shamir with aborts. In: Handschuh, H., Lysyanskaya, A. (eds.) CRYPTO 2023, Part V. LNCS, vol. 14085, pp. 327–357. Springer, Heidelberg (2023). https://doi.org/10.1007/978-3-031-38554-4_11

  33. Devevey, J., Libert, B., Nguyen, K., Peters, T., Yung, M.: Non-interactive CCA2-secure threshold cryptosystems: Achieving adaptive security in the standard model without pairings. In: Garay, J. (ed.) PKC 2021, Part I. LNCS, vol. 12710, pp. 659–690. Springer, Heidelberg (2021). https://doi.org/10.1007/978-3-030-75245-3_24

  34. Ducas, L.: Shortest vector from lattice sieving: A few dimensions for free. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018, Part I. LNCS, vol. 10820, pp. 125–145. Springer, Heidelberg (2018). https://doi.org/10.1007/978-3-319-78381-9_5

  35. Ducas, L., et al.: CRYSTALS-dilithium: a lattice-based digital signature scheme. IACR TCHES 2018(1), 238–268 (2018). https://doi.org/10.13154/tches.v2018.i1.238-268. https://tches.iacr.org/index.php/TCHES/article/view/839

  36. Espitau, T., Joux, A., Kharchenko, N.: On a dual/hybrid approach to small secret LWE - a dual/enumeration technique for learning with errors and application to security estimates of FHE schemes. In: Bhargavan, K., Oswald, E., Prabhakaran, M. (eds.) INDOCRYPT 2020. LNCS, vol. 12578, pp. 440–462. Springer, Heidelberg (2020). https://doi.org/10.1007/978-3-030-65277-7_20

  37. Fleischhacker, N., Simkin, M., Zhang, Z.: Squirrel: efficient synchronized multi-signatures from lattices. In: Yin, H., Stavrou, A., Cremers, C., Shi, E. (eds.) ACM CCS 2022, pp. 1109–1123. ACM Press (2022). https://doi.org/10.1145/3548606.3560655

  38. Goldwasser, S., Kalai, Y.T., Peikert, C., Vaikuntanathan, V.: Robustness of the learning with errors assumption. In: Innovations in Computer Science - ICS 2010, Tsinghua University, Beijing, China, 5–7 January 2010. Proceedings, pp. 230–240. Tsinghua University Press (2010)

    Google Scholar 

  39. Gur, K.D., Katz, J., Silde, T.: Two-round threshold lattice signatures from threshold homomorphic encryption. Cryptology ePrint Archive, Paper 2023/1318 (2023). https://eprint.iacr.org/2023/1318

  40. Hülsing, A., Lange, T., Smeets, K.: Rounded Gaussians - fast and secure constant-time sampling for lattice-based crypto. In: Abdalla, M., Dahab, R. (eds.) PKC 2018, Part II. LNCS, vol. 10770, pp. 728–757. Springer, Heidelberg (2018). https://doi.org/10.1007/978-3-319-76581-5_25

  41. Katz, J., Yung, M.: Threshold cryptosystems based on factoring. In: Zheng, Y. (ed.) ASIACRYPT 2002. LNCS, vol. 2501, pp. 192–205. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-36178-2_12

  42. Khaburzaniya, I., Chalkias, K., Lewi, K., Malvai, H.: Aggregating and thresholdizing hash-based signatures using STARKs. In: Suga, Y., Sakurai, K., Ding, X., Sako, K. (eds.) ASIACCS 2022, pp. 393–407. ACM Press (2022). https://doi.org/10.1145/3488932.3524128

  43. Kiltz, E., Lyubashevsky, V., Schaffner, C.: A concrete treatment of Fiat-Shamir signatures in the quantum random-oracle model. In: Nielsen, J.B., Rijmen, V. (eds.) EUROCRYPT 2018, Part III. LNCS, vol. 10822, pp. 552–586. Springer, Heidelberg (2018). https://doi.org/10.1007/978-3-319-78372-7_18

  44. Kim, D., Lee, D., Seo, J., Song, Y.: Toward practical lattice-based proof of knowledge from hint-mlwe. In: Handschuh, H., Lysyanskaya, A. (eds.) CRYPTO 2023. LNCS, pp. 549–580. Springer, Cham (2023). https://doi.org/10.1007/978-3-031-38554-4_18

    Chapter  Google Scholar 

  45. Komlo, C., Goldberg, I.: FROST: flexible round-optimized Schnorr threshold signatures. In: Dunkelman, O., Jr., M.J.J., O’Flynn, C. (eds.) SAC 2020. LNCS, vol. 12804, pp. 34–65. Springer, Heidelberg (2020). https://doi.org/10.1007/978-3-030-81652-0_2

  46. Libert, B., Joye, M., Yung, M.: Born and raised distributively: fully distributed non-interactive adaptively-secure threshold signatures with short shares. In: Halldórsson, M.M., Dolev, S. (eds.) 33rd ACM PODC, pp. 303–312. ACM (2014). https://doi.org/10.1145/2611462.2611498

  47. Libert, B., Stehlé, D., Titiu, R.: Adaptively secure distributed PRFs from \(\sf LWE\). In: Beimel, A., Dziembowski, S. (eds.) TCC 2018, Part II. LNCS, vol. 11240, pp. 391–421. Springer, Heidelberg (2018). https://doi.org/10.1007/978-3-030-03810-6_15

  48. Lindell, Y.: Simple three-round multiparty schnorr signing with full simulatability. Cryptology ePrint Archive, Report 2022/374 (2022). https://eprint.iacr.org/2022/374

  49. Lyubashevsky, V.: Fiat-Shamir with aborts: applications to lattice and factoring-based signatures. In: Matsui, M. (ed.) ASIACRYPT 2009. LNCS, vol. 5912, pp. 598–616. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-10366-7_35

  50. Lyubashevsky, V.: Lattice signatures without trapdoors. In: Pointcheval, D., Johansson, T. (eds.) EUROCRYPT 2012. LNCS, vol. 7237, pp. 738–755. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-29011-4_43

  51. Lyubashevsky, V., et al.: Crystals-dilithium. Technical report, National Institute of Standards and Technology (2022). https://csrc.nist.gov/Projects/post-quantum-cryptography/selected-algorithms-2022

  52. Marsaglia, G., Bray, T.A.: A convenient method for generating normal variables. SIAM Rev. 6(3), 260–264 (1964). https://doi.org/10.1137/1006063

    Article  MathSciNet  Google Scholar 

  53. NIST: SHA-3 standard: Permutation-based hash and extendable-output functions. Federal Information Processing Standards Publication FIPS 202 (2015). https://doi.org/10.6028/NIST.FIPS.202

  54. NIST: Call for additional digital signature schemes for the post-quantum cryptography standardization process (2022). https://csrc.nist.gov/csrc/media/Projects/pqc-dig-sig/documents/call-for-proposals-dig-sig-sept-2022.pdf

  55. NIST: Module-Lattice-Based Digital Signature Standard. Federal Information Processing Standards Publication FIPS 204 (Draft) (2023). https://doi.org/10.6028/NIST.FIPS.204.ipd

  56. Peikert, C.: He gives C-sieves on the CSIDH. In: Canteaut, A., Ishai, Y. (eds.) EUROCRYPT 2020, Part II. LNCS, vol. 12106, pp. 463–492. Springer, Heidelberg (2020). https://doi.org/10.1007/978-3-030-45724-2_16

  57. Peralta, R., Brandão, L.T.: Nist first call for multi-party threshold schemes. National Institute of Standards and Technology (2023). https://doi.org/10.6028/NIST.IR.8214C.ipd, https://doi.org/10.6028/NIST.IR.8214C.ipd

  58. del Pino, R., et al.: Raccoon. Technical report, National Institute of Standards and Technology (2023). https://csrc.nist.gov/Projects/pqc-dig-sig/round-1-additional-signatures

  59. del Pino, R., Prest, T., Rossi, M., Saarinen, M.J.O.: High-order masking of lattice signatures in quasilinear time. In: 44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, 22–25 May 2023, pp. 1168–1185. IEEE (2023). https://doi.org/10.1109/SP46215.2023.10179342

  60. Rényi, A.: On measures of entropy and information. In: Proceedings of the Fourth Berkeley Symposium on Mathematical Statistics and Probability, Volume 1: Contributions to the Theory of Statistics, pp. 547–561. University of California Press, Berkeley (1961). http://projecteuclid.org/euclid.bsmsp/1200512181

  61. Ruffing, T., Ronge, V., Jin, E., Schneider-Bensch, J., Schröder, D.: ROAST: robust asynchronous schnorr threshold signatures. In: Yin, H., Stavrou, A., Cremers, C., Shi, E. (eds.) ACM CCS 2022, pp. 2551–2564. ACM Press (2022). https://doi.org/10.1145/3548606.3560583

  62. Schnorr, C.P.: Efficient identification and signatures for smart cards. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 239–252. Springer, Heidelberg (1990). https://doi.org/10.1007/0-387-34805-0_22

  63. Schnorr, C.P.: Efficient signature generation by smart cards. J. Cryptol. 4(3), 161–174 (1991). https://doi.org/10.1007/BF00196725

    Article  MathSciNet  Google Scholar 

  64. Shamir, A.: How to share a secret. Commun. ACM 22(11), 612–613 (1979)

    Article  MathSciNet  Google Scholar 

  65. Shamir, A.: How to share a secret. Commun. Assoc. Comput. Mach. 22(11), 612–613 (1979). https://doi.org/10.1145/359168.359176

    Article  MathSciNet  Google Scholar 

  66. Shoup, V.: Practical threshold signatures. In: Preneel, B. (ed.) EUROCRYPT 2000. LNCS, vol. 1807, pp. 207–220. Springer, Heidelberg (2000). https://doi.org/10.1007/3-540-45539-6_15

Download references

Acknowledgement

This work has been supported in part by JSPS KAKENHI Grant Numbers JP23KJ0548 and JPMJCR22M1.

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Rafael del Pino .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and permissions

Copyright information

© 2024 International Association for Cryptologic Research

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

del Pino, R., Katsumata, S., Maller, M., Mouhartem, F., Prest, T., Saarinen, MJ. (2024). Threshold Raccoon: Practical Threshold Signatures from Standard Lattice Assumptions. In: Joye, M., Leander, G. (eds) Advances in Cryptology – EUROCRYPT 2024. EUROCRYPT 2024. Lecture Notes in Computer Science, vol 14652. Springer, Cham. https://doi.org/10.1007/978-3-031-58723-8_8

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-58723-8_8

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-58722-1

  • Online ISBN: 978-3-031-58723-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics