量子随机谕言模型下CRYSTALS-Dilithium的安全性评估
Evaluating the security of CRYSTALS-Dilithium in the quantum random oracle model
AI总结：
本文针对NIST选定的后量子签名方案CRYSTALS-Dilithium依赖的新问题SelfTargetMSIS量子难解性不明的问题，在量子随机谕言模型下通过MLWE归约给出首个证明，推导了适用于q=1 mod 2n条件的Dilithium安全证明与参数集。
摘要：
随着量子计算硬件近期取得进展，美国国家标准与技术研究院（NIST）正在标准化可抵御量子对手攻击的密码协议。NIST选定的主要数字签名方案是CRYSTALS-Dilithium。该方案的安全性基于三类计算问题的难解性：模容错学习（MLWE）、模短整数解（MSIS）以及SelfTargetMSIS。MLWE和MSIS已得到充分研究，被广泛认为具备安全性。但SelfTargetMSIS是新提出的问题，尽管其经典难解性与MSIS相当，但量子难解性尚不明确。\n本文通过在量子随机谕言模型（QROM）下从MLWE问题进行归约，首次给出了SelfTargetMSIS的难解性证明。我们的证明采用了近期发展的量子重编程与倒带技术。该方法的核心部分是证明一类由MSIS问题衍生的特定哈希函数具有坍缩性。基于该方法，我们在合适的参数设置下推导出了Dilithium的全新安全性证明。\n此前，Kiltz、Lyubashevsky与Schaffner（EUROCRYPT 2018）的工作是唯一一份针对Dilithium变体给出严格安全性证明的研究；与之相比，我们的证明优势在于适用于q = 1 mod 2n的条件，其中q表示模数，n表示底层代数环的维数。该条件是Dilithium原始提案的一部分，对方案的高效实现至关重要。我们在q = 1 mod 2n的条件下给出了Dilithium的新安全参数集，发现在相同安全等级下，我们的公钥大小和签名大小分别约为Kiltz等人所提方案的2.9倍和1.3倍。
英文摘要：
In the wake of recent progress on quantum computing hardware, the National Institute of Standards and Technology (NIST) is standardizing cryptographic protocols that are resistant to attacks by quantum adversaries. The primary digital signature scheme that NIST has chosen is CRYSTALS-Dilithium. The hardness of this scheme is based on the hardness of three computational problems: Module Learning with Errors (MLWE), Module Short Integer Solution (MSIS), and SelfTargetMSIS. MLWE and MSIS have been well-studied and are widely believed to be secure. However, SelfTargetMSIS is novel and, though classically as hard as MSIS, its quantum hardness is unclear. In this paper, we provide the first proof of the hardness of SelfTargetMSIS via a reduction from MLWE in the Quantum Random Oracle Model (QROM). Our proof uses recently developed techniques in quantum reprogramming and rewinding. A central part of our approach is a proof that a certain hash function, derived from the MSIS problem, is collapsing. From this approach, we deduce a new security proof for Dilithium under appropriate parameter settings. Compared to the previous work by Kiltz, Lyubashevsky, and Schaffner (EUROCRYPT 2018) that gave the only other rigorous security proof for a variant of Dilithium, our proof has the advantage of being applicable under the condition q = 1 mod 2n, where q denotes the modulus and n the dimension of the underlying algebraic ring. This condition is part of the original Dilithium proposal and is crucial for the efficient implementation of the scheme. We provide new secure parameter sets for Dilithium under the condition q = 1 mod 2n, finding that our public key size and signature size are about 2.9 times and 1.3 times larger, respectively, than those proposed by Kiltz et al. at the same security level.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
