Policy-based signature scheme from lattices

Abstract

Policy-based signature, introduced by Bellare and Fuchsbauer at PKC 2014, is a new type of digital signature in which a signer is only allowed to sign messages satisfying certain policy specified by the authority, but the signatures should not reveal the underlying policy. Having these features, policy-based signatures are attractive from both theoretical and practical aspects. In their pioneering paper, Bellare and Fuchsbauer have provided generic constructions of policy-based signatures, and a concrete instantiation based on pairings. In this work, we develop the recent techniques in lattice-based cryptography to construct a (delegatable) policy-based signature scheme from lattice assumptions. Specifically, we adapt Langlois et al.’s zero-knowledge argument system (PKC 2014) for the Bonsai tree signature scheme (Eurocrypt 2010) to enable the prover to convince the verifier that its secret witness satisfies an additional condition. Making the protocol non-interactive via the Fiat-Shamir transformation, we obtain a policy-based signature scheme supporting polynomially many policies, which satisfies the two security requirements (simulatability and extractability) in the random oracle model. Furthermore, our construction can be efficiently extended to a delegatable policy-based signature, thanks to the hierarchical structure of the Bonsai tree. Our contribution is twofold. On the one hand, we enrich the scope of policy-based signatures by providing the first quantum-resistant instantiation. On the other hand, our technical approach can potentially be applied to design a wide variety of privacy-enhanced lattice-based cryptographic constructions.

Appendices

Appendix 1: Proof of Lemma 6

The simulator $\mathcal {S}im$ begins by selecting a random $\overline{{\textsf {Ch}}}\in \{1,2,3\}$, and a random tape $r'$ of $\widetilde{V}$.

• Case $\overline{{\textsf {Ch}}}=1$: The simulator works as follows:

  • 1. Compute $\mathbf {z}_1',\cdots ,\mathbf {z}_k'\in {\mathbb {Z}}_q^{(2\ell +1)\cdot 3m}$ such that ${\mathbf {A}}^*\cdot \left( \sum _{i=1}^k\beta _i \mathbf {z}_i'\right) ={\mathbf {u}}\ \mathrm {mod}\ q$.

  • 2. Compute $\overline{{\mathbf {p}}}\in \{0,1\}^\ell$ and $\overline{{\mathbf {w}}}^*\in {\mathbb {Z}}_2^{2d}$ such that $\mathbf{G}_1\cdot \overline{{\mathbf {p}}}+\mathbf{G}_2^*\cdot \overline{{\mathbf {w}}}^*=\mathbf{M}\ \mathrm {mod}\ 2$. As we set parameter d satisfies $d+\ell >n$, it is feasible to compute $\overline{{\mathbf {p}}}$ and $\overline{{\mathbf {w}}}^*$. Then set $\overline{{\mathbf {p}}}^*={\textsf {PolicyExt}}(\overline{{\mathbf {p}}})$.

  • 3. Sample

    $$\begin{aligned} {\left\{ \begin{array}{ll} \rho _1',\rho _2',\rho _3'\xleftarrow {\$}\{0,1\}^n;\,{\mathbf {e}}\xleftarrow {\$}\{0,1\}^\ell ;\,{\mathbf {r}}_{{\mathbf {p}}}\xleftarrow {\$}{\mathbb {Z}}_2^{2\ell +1};\\ {\mathbf {r}}_{\mathbf {z}}^{(1)},\cdots ,{\mathbf {r}}_{\mathbf {z}}^{(k)}\xleftarrow {\$}{\mathbb {Z}}_q^{(2\ell +1)\cdot 3m};\,{\mathbf {r}}_{\mathbf {w}}\xleftarrow {\$}{\mathbb {Z}}_2^{2d};\\ \pi _1,\cdots ,\pi _k\xleftarrow {\$}{\mathcal {S}}; \, \eta \xleftarrow {\$}{\textsf {S}}_{2d}, \end{array}\right. } \end{aligned}$$

    and send the commitment ${\textsf {CMT}}=({\mathbf {c}}_1',{\mathbf {c}}_2',{\mathbf {c}}_3')$ to the verifier, where

    

  Receiving a challenge from $\widetilde{V}$:

  • – If ${\textsf {Ch}}=1$: Output $\perp$ and abort.

  • – If ${\textsf {Ch}}=2$: Set

    $$\begin{aligned} {\textsf {RSP}}=\left( \,{\mathbf {e}},\,\left\{ \pi _i\right\} _{i=1}^k,\,\eta ,\,\overline{{\mathbf {p}}}^*\oplus {\mathbf {r}}_{{\mathbf {p}}}, \,\left\{ \mathbf {z}_i'+{\mathbf {r}}_{\mathbf {z}}^{(i)}\ \mathrm {mod}\ q\right\} _{i=1}^k,\,\overline{{\mathbf {w}}}^*\oplus {\mathbf {r}}_{\mathbf {w}}\,\right) , \end{aligned}$$

    and output $(r';{\textsf {CMT}};2;{\textsf {RSP}};\rho _1',\rho _3')$.

  • – If ${\textsf {Ch}}=3$: Set

    $$\begin{aligned} {\textsf {RSP}}=\left( \,{\mathbf {e}},\,\{\pi _i\}_{i=1}^k,\,\eta ,\,{\mathbf {r}}_{{\mathbf {p}}},\,\left\{ {\mathbf {r}}_{\mathbf {z}}^{(i)}\right\} _{i=1}^k,\,{\mathbf {r}}_{\mathbf {w}}\,\right) , \end{aligned}$$

    and output $(r';{\textsf {CMT}};3;{\textsf {RSP}};\rho _1',\rho _2')$.

• Case $\overline{{\textsf {Ch}}}=2$: The simulator samples

  $$\begin{aligned} {\left\{ \begin{array}{ll} \rho _1',\rho _2',\rho _3'\xleftarrow {\$}\{0,1\}^n;\,\overline{{\mathbf {p}}},{\mathbf {e}}\xleftarrow {\$}\{0,1\}^\ell ;\,{\mathbf {r}}_{{\mathbf {p}}}\xleftarrow {\$}{\mathbb {Z}}_q^{2\ell +1};\\ \mathbf {z}_1',\cdots ,\mathbf {z}_k'\xleftarrow {\$}{\textsf {SecretExt}}(\overline{{\mathbf {p}}});\,{\mathbf {r}}_{\mathbf {z}}^{(1)},\cdots ,{\mathbf {r}}_{\mathbf {z}}^{(k)}\xleftarrow {\$}{\mathbb {Z}}_q^{(2\ell +1)\cdot 3m};\, \overline{{\mathbf {w}}}^*, {\mathbf {r}}_{\mathbf {w}}\xleftarrow {\$} {\mathbb {Z}}_2^{2d};\\ \pi _1,\cdots ,\pi _k\xleftarrow {\$}{\mathcal {S}}; \, \eta \xleftarrow {\$}{\textsf {S}}_{2d}. \end{array}\right. } \end{aligned}$$

  Set $\overline{{\mathbf {p}}}^*={\textsf {PolicyExt}}(\overline{{\mathbf {p}}})$ and send the commitment ${\textsf {CMT}}=({\mathbf {c}}_1',{\mathbf {c}}_2',{\mathbf {c}}_3')$ to the verifier, where

  

  Receiving a challenge from $\widetilde{V}$:

  • – If ${\textsf {Ch}}=1$: Set

    $$\begin{aligned} {\textsf {RSP}}&=\Big (\overline{{\mathbf {p}}}\oplus {\mathbf {e}},\,T_{\mathbf {e}}'(\overline{{\mathbf {p}}}^*),\,T_{\mathbf {e}}'({\mathbf {r}}_{{\mathbf {p}}}), \,\left\{ T_{\mathbf {e}}\circ \pi _i(\mathbf {z}_i')\right\} _{i=1}^k,\\&\quad \left\{ T_{\mathbf {e}}\circ \pi _i({\mathbf {r}}_{\mathbf {z}}^{(i)}) \right\} _{i=1}^k,\,\eta (\overline{{\mathbf {w}}}^*),\,\eta ({\mathbf {r}}_{\mathbf {w}})\,\Big ), \end{aligned}$$

    and output $(\,r';\,{\textsf {CMT}};\,1;\,{\textsf {RSP}};\,\rho _2',\,\rho _3'\,)$.

  • – If ${\textsf {Ch}}=2$: Output $\perp$ and abort.

  • – If ${\textsf {Ch}}=3$: Set

    $$\begin{aligned} {\textsf {RSP}}=\left( \,{\mathbf {e}},\,\{\pi _i\}_{i=1}^k,\,\eta ,\,{\mathbf {r}}_{\mathbf {p}}, \, \left\{ {\mathbf {r}}_{\mathbf {z}}^{(i)}\right\} _{i=1}^k,\,{\mathbf {r}}_{{\mathbf {w}}}\right) , \end{aligned}$$

    and output $(r';{\textsf {CMT}};3;{\textsf {RSP}};\rho _1',\rho _2')$.

• Case $\overline{{\textsf {Ch}}}=3$: The simulator proceeds the sampling as in the case $\overline{{\textsf {Ch}}}=2$ above. Then send the commitment ${\textsf {CMT}}=({\mathbf {c}}_1',{\mathbf {c}}_2',{\mathbf {c}}_3')$ to the verifier, where

  $$\begin{aligned} {\left\{ \begin{array}{ll} {\mathbf {c}}_1'={\textsf {COM}}\left( \,{\mathbf {e}},\,\left\{ \pi _i\right\} _{i=1}^k,\,\eta ,\,{\mathbf {A}}^*\cdot \left( \sum \nolimits _{i=1}^k\beta _i\left( \mathbf {z}_i'+{\mathbf {r}}_{\mathbf {z}}^{(i)}\right) \right) -{\mathbf {u}}\ \mathrm {mod}\ q,\right. \\ \left. \qquad \qquad \qquad \quad \,\mathbf{G}_1^*\cdot \left( \overline{{\mathbf {p}}}^*\oplus {\mathbf {r}}_{\mathbf {p}}\right) +\mathbf{G}_2^*\cdot \left( \overline{{\mathbf {w}}}^*\oplus {\mathbf {r}}_{\mathbf {w}}\right) -\mathbf{M}\ \mathrm {mod}\ 2;\,\rho _1'\,\right) \\ {\mathbf {c}}_2'={\textsf {COM}}\left( \,\left\{ T_{\mathbf {e}}\circ \pi _i({\mathbf {r}}_{\mathbf {z}}^{(i)})\right\} _{i=1}^k,\,\eta ({\mathbf {r}}_{\mathbf {w}}),\,T'_{\mathbf {e}}({\mathbf {r}}_{{\mathbf {p}}});\,\rho _2'\,\right) \\ {\mathbf {c}}_3'={\textsf {COM}}\left( \,\left\{ T_{\mathbf {e}}\circ \pi _i(\mathbf {z}_i'+{\mathbf {r}}_{\mathbf {z}}^{(i)})\right\} _{i=1}^k,\,\eta (\overline{{\mathbf {w}}}^*\oplus {\mathbf {r}}_{\mathbf {w}}),\,T'_{\mathbf {e}}\left( \overline{{\mathbf {p}}}^*\oplus {\mathbf {r}}_{{\mathbf {p}}}\right) ;\,\rho _3'\,\right) \end{array}\right. } \end{aligned}$$

  Receiving a challenge from $\widetilde{V}$:

  • – If ${\textsf {Ch}}=1$: Set

    $$\begin{aligned}&{\textsf {RSP}}=\Big (\overline{{\mathbf {p}}}\oplus {\mathbf {e}},\,T_{\mathbf {e}}'(\overline{{\mathbf {p}}}^*),\,T_{\mathbf {e}}'({\mathbf {r}}_{{\mathbf {p}}}),\,\left\{ T_{\mathbf {e}}\circ \pi _i(\mathbf {z}_i')\right\} _{i=1}^k,\,\left\{ T_{\mathbf {e}}\circ \pi _i({\mathbf {r}}_{\mathbf {z}}^{(i)})\right\} _{i=1}^k,\,\eta (\overline{{\mathbf {w}}}^*),\,\eta ({\mathbf {r}}_{\mathbf {w}})\,\Big ), \end{aligned}$$

    and output $(r';{\textsf {CMT}};1;{\textsf {RSP}};\rho _2',\rho _3')$.

  • – If ${\textsf {Ch}}=2$: Set

    $$\begin{aligned} {\textsf {RSP}}=\left( \,{\mathbf {e}},\,\{\pi _i\}_{i=1}^k,\,\eta ,\,\overline{{\mathbf {p}}}^*\oplus {\mathbf {r}}_{\mathbf {p}}, \, \left\{ \mathbf {z}_i'+{\mathbf {r}}_{\mathbf {z}}^{(i)}\ \mathrm {mod}\ q\right\} _{i=1}^k,\,\overline{{\mathbf {w}}}^*\oplus {\mathbf {r}}_{{\mathbf {w}}}\right) , \end{aligned}$$

    and output $(r';{\textsf {CMT}};2;{\textsf {RSP}};\rho _1',\rho _3')$.

  • – If ${\textsf {Ch}}=3$: Output $\perp$ and abort.

Since $\mathsf {COM}$ is statistically hiding, the distribution of the commitment CMT and the challenge Ch from $\widetilde{V}$ are statistically close to those in the real interaction. Hence the simulator outputs $\perp$ with probability negligibly close to 1 / 3. Moreover, if it does not halt, it is easy to prove that the simulator produces a successful transcript, and the distribution of the transcript is statistically close to that of the prover in the real interaction.

Appendix 2: Proof of Lemma 7

Let ${\textsf {CMT}}=({\mathbf {c}}_1,{\mathbf {c}}_2,{\mathbf {c}}_3)\in \left( {\mathbb {Z}}_q^n\right) ^3$ and let ${\textsf {RSP}}^{(1)}$, ${\textsf {RSP}}^{(2)}$, and ${\textsf {RSP}}^{(3)}$ be as in (5), (6) and (7). Since all 3 responses satisfy the verification conditions, the followings are true:

$$\begin{aligned} {\left\{ \begin{array}{ll} {\mathbf {v}}_{{\mathbf {p}}}={\textsf {PolicyExt}}({\mathbf {p}}_1); \, {\mathbf {v}}_{{\mathbf {w}}} \in \{0,1\}^{2d}; \, wt({\mathbf {v}}_{{\mathbf {w}}})=d; \,\forall \, i\in [k]: {\mathbf {v}}_{\mathbf {z}}^{(i)}\in {\textsf {SecretExt}}({\mathbf {p}}_1) \\ {\mathbf {c}}_1={\textsf {COM}}\big ({\mathbf {p}}_2,\,\{\phi _i\}_{i=1}^k,\,\rho ,\,{\mathbf {A}}^*(\sum \nolimits _{i=1}^k\beta _i {\mathbf {t}}_{\mathbf {z}}^{(i)})-{\mathbf {u}}\ \mathrm {mod}\ q, \, \mathbf{G}_1^*\cdot {\mathbf {t}}_{{\mathbf {p}}}+\mathbf{G}_2^*\cdot {\mathbf {t}}_{{\mathbf {w}}}-\mathbf{M}\ \mathrm {mod}\ 2\big )\\ \quad \quad ={\textsf {COM}}\big (\,{\mathbf {p}}_3,\,\{\psi _i\}_{i=1}^k,\,\theta ,\,{\mathbf {A}}^*(\sum \nolimits _{i=1}^k\beta _i {\mathbf {h}}_{\mathbf {z}}^{(i)})\ \mathrm {mod}\ q, \, \mathbf{G}_1^*\cdot {\mathbf {h}}_{{\mathbf {p}}}+\mathbf{G}_2^*\cdot {\mathbf {h}}_{{\mathbf {w}}}\ \mathrm {mod}\ 2 \,\big )\\ {\mathbf {c}}_2={\textsf {COM}}\big (\,\{\mathbf {y}_{\mathbf {z}}^{(i)}\}_{i=1}^k,\,\mathbf {y}_{{\mathbf {w}}},\,\mathbf {y}_{{\mathbf {p}}}\,\big )={\textsf {COM}}\big (\,\{T_{{\mathbf {p}}_3}\circ \psi _i({\mathbf {h}}_{\mathbf {z}}^{(i)})\}_{i=1}^k,\,\theta ({\mathbf {h}}_{{\mathbf {w}}}),\,T'_{{\mathbf {p}}_3}({\mathbf {h}}_{{\mathbf {p}}})\big )\\ {\mathbf {c}}_3={\textsf {COM}}\big (\{{\mathbf {v}}_{\mathbf {z}}^{(i)}+\mathbf {y}_{\mathbf {z}}^{(i)}\}_{i=1}^k,\,{\mathbf {v}}_{{\mathbf {w}}} \oplus \mathbf {y}_{{\mathbf {w}}},\,{\mathbf {v}}_{{\mathbf {p}}}\oplus \mathbf {y}_{{\mathbf {p}}}\big )\\ \quad \quad ={\textsf {COM}}\big (\{T_{{\mathbf {p}}_2}\circ \phi _i({\mathbf {t}}_{\mathbf {z}}^{(i)})\}_{i=1}^k,\,\rho ({\mathbf {t}}_{{\mathbf {w}}}),\,T'_{{\mathbf {p}}_2}({\mathbf {t}}_{{\mathbf {p}}})\,\big ) \end{array}\right. } \end{aligned}$$

Since the commitment scheme COM is computationally binding, one can deduce that ${\mathbf {p}}_2={\mathbf {p}}_3$, $\rho =\theta$, $\phi _i=\psi _i$ for all $i\in [k]$, and that

$$\begin{aligned} {\left\{ \begin{array}{ll} \mathbf {y}_{\mathbf {p}}=T_{{\mathbf {p}}_2}'({\mathbf {h}}_{\mathbf {p}});\, \mathbf {y}_{\mathbf {p}}\oplus {\mathbf {v}}_{\mathbf {p}}=T_{{\mathbf {p}}_2}'({\mathbf {t}}_{\mathbf {p}});\\ {\mathbf {A}}^*\cdot \left( \sum \nolimits _{i=1}^k\beta _i\left( {\mathbf {t}}_\mathbf {z}^{(i)}-{\mathbf {h}}_\mathbf {z}^{(i)}\right) \right) ={\mathbf {u}}\ \mathrm {mod}\ q;\\ \mathbf{G}_1^*\cdot \left( {\mathbf {t}}_{{\mathbf {p}}}\oplus {\mathbf {h}}_{\mathbf {p}}\right) +\mathbf{G}_2^*\cdot \left( {\mathbf {t}}_{\mathbf {w}}\oplus {\mathbf {h}}_{\mathbf {w}}\right) =\mathbf{M}\ \mathrm {mod}\ 2;\\ \, \mathbf {y}_{\mathbf {w}}=\rho ({\mathbf {h}}_{\mathbf {w}});\, {\mathbf {v}}_{\mathbf {w}}\oplus \mathbf {y}_{\mathbf {w}}=\rho ({\mathbf {t}}_{\mathbf {w}}){;}\\ \forall i\in [k]: \,\mathbf {y}_\mathbf {z}^{(i)}=T_{{\mathbf {p}}_2}\circ \phi _i({\mathbf {h}}_\mathbf {z}^{(i)});\\ \mathbf {y}_\mathbf {z}^{(i)}+{\mathbf {v}}_\mathbf {z}^{(i)}=T_{{\mathbf {p}}_2}\circ \phi _i({\mathbf {t}}_\mathbf {z}^{(i)}){.}\\ \end{array}\right. } \end{aligned}$$

The extractor ${\mathcal {K}}$ proceeds as follows:

• Extract ${\mathbf {p}}^*={\mathbf {t}}_{\mathbf {p}}\oplus {\mathbf {h}}_{\mathbf {p}}$. From ${\textsf {PolicyExt}}({\mathbf {p}}_1)={\mathbf {v}}_{\mathbf {p}}=T_{{\mathbf {p}}_2}'({\mathbf {t}}_{\mathbf {p}}\oplus {\mathbf {h}}_{\mathbf {p}})=T_{{\mathbf {p}}_2}'({\mathbf {p}}^*)$ and the equivalence (4), get ${\mathbf {p}}^*={\textsf {PolicyExt}}({\mathbf {p}}_1\oplus {\mathbf {p}}_2)$. As ${\mathbf {d}}\rightarrow {\textsf {PolicyExt}}({\mathbf {d}})$ is a bijection between the set $\{0,1\}^\ell$ and the set $\left\{ {\textsf {PolicyExt}}({\mathbf {d}}):{\mathbf {d}}\in \{0,1\}^\ell \right\}$, extract ${\mathbf {p}}'={\mathbf {p}}_1\oplus {\mathbf {p}}_2$ from ${\mathbf {p}}^*$. Note that vectors ${\mathbf {p}}',{\mathbf {p}}^*$ clearly satisfy ${\mathbf {p}}^*={\textsf {PolicyExt}}({\mathbf {p}}')$.

• Extract ${\mathbf {w}}^*={\mathbf {t}}_{\mathbf {w}}\oplus {\mathbf {h}}_{\mathbf {w}}$. From ${\mathbf {v}}_{{\mathbf {w}}} \in \{0,1\}^{2d}, wt({\mathbf {v}}_{{\mathbf {w}}})=d$, ${\mathbf {v}}_{\mathbf {w}}=\rho ({\mathbf {t}}_{\mathbf {w}}\oplus {\mathbf {h}}_{\mathbf {w}})$, get ${\mathbf {w}}^*\in \{0,1\}^{2d}$, $wt({\mathbf {w}}^*)=d$. Parse ${\mathbf {w}}^*$ as $({\mathbf {w}}',{\mathbf {w}}'')$, where ${\mathbf {w}}',{\mathbf {w}}''\in \{0,1\}^d$. Note that from

  $$\begin{aligned} \mathbf{G}_1^*\cdot \left( {\mathbf {t}}_{{\mathbf {p}}}\oplus {\mathbf {h}}_{\mathbf {p}}\right) +\mathbf{G}_2^*\cdot \left( {\mathbf {t}}_{\mathbf {w}}\oplus {\mathbf {h}}_{\mathbf {w}}\right) =\mathbf{M}\ \mathrm {mod}\ 2 \end{aligned}$$

  and the structure of $\mathbf{G}_1^*,\mathbf{G}_2^*$, vector ${\mathbf {w}}'$ satisfies $\mathbf{G}_1\cdot {\mathbf {p}}'+\mathbf{G}_2\cdot {\mathbf {w}}'=\mathbf{M}\ \mathrm {mod}\ 2$.

• From

  $$\begin{aligned} {\mathbf {A}}^*\cdot \left( \sum _{i=1}^k\beta _i\left( {\mathbf {t}}_\mathbf {z}^{(i)}-{\mathbf {h}}_\mathbf {z}^{(i)}\right) \right) ={\mathbf {u}}\ \mathrm {mod}\ q, \end{aligned}$$

  extract $\mathbf {z}^*=\sum _{i=1}^k\beta _i\widetilde{{\mathbf {w}}}_i$, where for each $i\in [k]$, $\widetilde{{\mathbf {w}}}_i$ is obtained as follows:

  • Write the vector $\widehat{{\mathbf {w}}}_i={\mathbf {t}}_\mathbf {z}^{(i)}-{\mathbf {h}}_\mathbf {z}^{(i)}\in \{-1,0,1\}^{(2l+1)\cdot 3m}$ as $2\ell + 1$ blocks of length 3m.

  • Delete last 2m coordinates in each block of $\widehat{{\mathbf {w}}}_i$.

  Note that from ${\mathbf {A}}^*={\textsf {MatrixExt}}({\mathbf {A}})$, vector $\mathbf {z}^*$ satisfies ${\mathbf {A}}\cdot \mathbf {z}^*={\mathbf {u}}\ \mathrm {mod}\ q$. Moreover, from ${\textsf {SecretExt}}({\mathbf {p}}_1)\ni {\mathbf {v}}_\mathbf {z}^{(i)}=T_{{\mathbf {p}}_2}\circ \phi _i\left( {\mathbf {t}}_\mathbf {z}^{(i)}-{\mathbf {h}}_\mathbf {z}^{(i)}\right) =T_{{\mathbf {p}}_2}\circ \phi _i\left( \widehat{{\mathbf {w}}}_i\right)$ and $\phi _i\in {\mathcal {S}}$, by the equivalence (3), vector $\widehat{{\mathbf {w}}}_i$ satisfies $\widehat{{\mathbf {w}}}_i\in {\textsf {SecretExt}}({\mathbf {p}}_1\oplus {\mathbf {p}}_2)={\textsf {SecretExt}}({\mathbf {p}}')$.

  Furthermore, $\left||\mathbf {z}^*\right||_\infty \le \sum _{i=1}^k\beta _i\cdot \left||\widetilde{{\mathbf {w}}_i}\right||_\infty \le \sum _{i=1}^k\beta _i=\beta$, thus $\mathbf {z}^*\in {\textsf {Secret}}_{\beta }({\mathbf {p}}')$, where ${\textsf {Secret}}_\beta ({\mathbf {p}})$ is the set of all vectors

  $$\begin{aligned} {\mathbf {x}}=\left( {\mathbf {x}}_0||{\mathbf {x}}_1^0||{\mathbf {x}}_1^1||\cdots ||{\mathbf {x}}_\ell ^0||{\mathbf {x}}_\ell ^1\right) \in {\mathbb {Z}}^{(2\ell +1)\cdot m} \end{aligned}$$

  having $2\ell +1$ blocks of size m, such that $\left||{\mathbf {x}}\right||_\infty \le \beta$, and the following $\ell$ blocks are zero-blocks ${\mathbf {0}}^m$: ${\mathbf {x}}_1^{1-{\mathbf {p}}[1]},\cdots ,{\mathbf {x}}_\ell ^{1-{\mathbf {p}}[\ell ]}$. Deleting zero blocks, extract $\mathbf {z}'\in {\mathbb {Z}}^{(\ell +1)m}$ from $\mathbf {z}^*\in {\mathbb {Z}}^{(2\ell +1)m}$. Then vector $\mathbf {z}'$ satisfies $\left||\mathbf {z}'\right||_\infty \le \beta$ and ${\mathbf {A}}_{{\mathbf {p}}'}\cdot \mathbf {z}'={\mathbf {u}}\ \mathrm {mod}\ q$.

From the discussion above, the output $({\mathbf {p}}',\mathbf {z}',{\mathbf {w}}')$ of extractor ${\mathcal {K}}$ satisfies the requirement in $R_{\text {PBS}}$ (see Definition 4).

Appendix 3: An improved forking lemma

In [33], Pointcheval and Vaudenay introduced an improved forking lemma for multiple forks. We state an adaptation of their result to the case of 3-fork as follows.

Lemma 8

Let $\mathcal {SS}$ be a signature scheme with security parameter n. Let $\mathcal {A}$ be a probability polynomial-time algorithm whose input only consists of public parameters, and which can ask $q_{\mathcal {H}}$ queries to the random oracle, where $q_{\mathcal {H}}>0$. Assume that, within the time bound T, algorithm $\mathcal {A}$ produces, with probability $\epsilon$, a valid signature $(\{{\textsf {CMT}}^{(i)}\}_{i=1}^t,\{{\textsf {Ch}}^{(i)}\}_{i=1}^t,\{{\textsf {RSP}}^{(i)}\}_{i=1}^t)$ of message $\mathbf{M}$. Then, within time $32\cdot T\cdot q_{\mathcal {H}}/\epsilon$, and with probability $\epsilon '>1/2$, a replay of $\mathcal {A}$ can output 3 valid signatures of message $\mathbf{M}$:

$$\begin{aligned}&\left( \{{\textsf {CMT}}^{(i)}\}_{i=1}^t,\{{\textsf {Ch}}_1^{(i)}\}_{i=1}^t,\{{\textsf {RSP}}_1^{(i)}\}_{i=1}^t\right) ; \left( \{{\textsf {CMT}}^{(i)}\}_{i=1}^t,\{{\textsf {Ch}}_2^{(i)}\}_{i=1}^t,\{{\textsf {RSP}}_2^{(i)}\}_{i=1}^t\right) ;\\&\left( \{{\textsf {CMT}}^{(i)}\}_{i=1}^t,\{{\textsf {Ch}}_3^{(i)}\}_{i=1}^t,\{{\textsf {RSP}}_3^{(i)}\}_{i=1}^t\right) , \end{aligned}$$

such that the vectors $\left( {\textsf {Ch}}_1^{(1)},\cdots ,{\textsf {Ch}}_1^{(t)}\right)$, $\left( {\textsf {Ch}}_2^{(1)},\cdots ,{\textsf {Ch}}_2^{(t)}\right)$, $\left( {\textsf {Ch}}_3^{(1)},\cdots ,{\textsf {Ch}}_3^{(t)}\right)$ are pairwise distinct.