Fiat-Shamir变换在提交-开放身份认证方案中的紧量子安全性及其在后量子签名方案中的应用
Tight quantum security of the Fiat-Shamir transform for commit-and-open identification schemes with applications to post-quantum signature schemes
摘要：
将Fiat-Shamir变换应用于身份认证方案是构造签名方案的主要方法之一。虽然这种变换的经典安全性已经很好地理解，但直到最近才提出了量子情况下的通用结果[DFMS 19，LZ 19]。这些结果是渐近的，因此不能用来推导这些签名方案的具体安全性，而没有一个显着的参数损失。在本文中，我们表明，如果我们开始从一个提交和开放的识别计划，其中证明者首先提交几个字符串，然后作为第二个消息打开一个子集，它们取决于验证者的消息，然后有一个紧密的量子减少的菲亚特-沙米尔变换到特殊的健全的概念。我们的工作适用于这种形式的大多数3轮方案，并可以立即用于导出签名方案的量子具体安全性。我们将我们的技术应用到几个识别方案，导致签名方案，如斯特恩的识别方案基于编码问题，[KTX 08]识别方案基于格问题，[SSH 11]识别方案基于多变量问题，密切相关的NIST候选MQDSS，和PICNIC计划基于多方计算问题，这也是一个NIST候选人。
英文摘要：
Applying the Fiat-Shamir transform on identification schemes is one of the main ways of constructing signature schemes. While the classical security of this transformation is well understood, it is only very recently that generic results for the quantum case have been proposed [DFMS19,LZ19]. These results are asymptotic and therefore can't be used to derive the concrete security of these signature schemes without a significant loss in parameters. In this paper, we show that if we start from a commit-and-open identification scheme, where the prover first commits to several strings and then as a second message opens a subset of them depending on the verifier's message, then there is a tight quantum reduction for the the Fiat-Shamir transform to special soundness notions. Our work applies to most 3 round schemes of this form and can be used immediately to derive quantum concrete security of signature schemes. We apply our techniques to several identification schemes that lead to signature schemes such as Stern's identification scheme based on coding problems, the [KTX08] identification scheme based on lattice problems, the [SSH11] identification schemes based on multivariate problems, closely related to the NIST candidate MQDSS, and the PICNIC scheme based on multiparty computing problems, which is also a NIST candidate.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
