A New Lattice-Based Post-Quantum Digital Signature from Compact Rejection Sampling

Abstract

Rejection samplings are the essential building blocks to design lattice-based digital signatures under the Fiat–Shamir paradigm. Up to now most of them have been built by Gaussian samplings or uniform samplings. Gaussian-based rejection sampling signatures such as the BLISS scheme have very short signature sizes but are vulnerable to timing attacks, whereas the uniform-based rejection sampling signatures such as ML-DSA are allowed to be simply implemented but have larger signature sizes. This work intends to use a new probability distribution, rather than Gaussian or uniform distributions, to build the rejection sampling in Fiat–Shamir signatures, and aims to achieve short signature sizes while avoiding the cost of Gaussian sampling. To this end, we choose centered binomial distribution as a replacement, and build a new and compact rejection sampling that has the properties of both high-precision sampling and semi-uniform operation. As an application, we combine this rejection sampling with Lyubashevsky’s signature scheme, then propose the first lattice-based Fiat–Shamir signature scheme from centered binomial distribution. The proposed scheme not only avoids Gaussian sampling, but also is very efficient in terms of the signature sizes.

1. Introduction

The rise of quantum computing has prompted us to develop post-quantum digital signatures to replace the classical ones. Of all the participants in post-quantum signature algorithms, lattice-based digital signature algorithms seem to be promising candidates owing to their high efficiency. In the standardization process of post-quantum cryptography (PQC) announced by the National Institute of Standards and Technology (NIST), three post-quantum digital signature algorithms have already been announced as the future standards, including two lattice-based digital signature algorithms ML-DSA (Dilithium scheme [1,2]) and FN-DSA (Falcon scheme [3]).

The construction of the lattice-based signatures follows two known approaches. The first one is the hash-and-sign paradigm that is known as the GPV framework [4] in lattice-based constructions. Examples of this approach are the signature schemes FN-DSA [3,5]. The second one follows the Schnorr signature [6] framework, which is also known as Fiat–Shamir paradigm. But in lattice-based constructions, this approach has to add a crucial aborting technique to prevent the secret key leakage [7]. Therefore it is called the Fiat–Shamir with aborts (FSwA) paradigm when it is referred to the constructions in lattices. A known example of the FSwA digital signature is the NIST PQC finalist algorithm ML-DSA [2].

Our interest in this paper is the lattice-based FSwA schemes. As mentioned above, the high-level idea for their constructions follows the Schnorr signature framework, but the technical details involved are much more complicated. The main reason is that the domain of the underlying one-way functions in discrete logarithm is a group, whereas in lattices, it only contains the elements with small norms in some group, and is not even closed under any operation. This precludes lattice-based signatures from using uniformly random masking to hide the secret keys as in Schnorr signature. In order to overcome this barrier, Lyubashevsky [7] introduced an aborting idea, and adds a crucial rejection sampling step [7,8] in the construction of the lattice-based FSwA signature schemes. This rejection sampling is highly associated with the performance of the resulting signature schemes, as it enables the FSwA schemes to prevent their secret keys leakage and keep the signature sizes small.

Consequently, the design of the rejection sampling constitutes the core ingredient for constructing efficient lattice-based FSwA signature schemes. Recently, rejection samplings in schemes Patronus [9] and HAETAE [10] have been built by polytope and hyperball, respectively. The HAETAE scheme has short signature and public key sizes but a highly complex sampler because of Euclidean balls, which may introduce implementation risks, whereas the Patronus scheme has simpler implementation but larger signature sizes. In addition to these, there are two types of rejection samplings depending on the different distribution bases so far, and their corresponding FSwA signatures have rather different characteristics.

The first is Gaussian-based rejection sampling signature (GRS) initiated by Lyubashevsky [8], which uses Gaussian masking as the secret randomness, and adds a rejection sampling step based on the Gaussian distribution in the signing algorithm. Examples of the subsequent works are BLISS [11] and Bai and Galbraith’s scheme [12]. Thanks to the bell-shaped property and the high-precision sampling of Gaussian distribution, GRS schemes are highly efficient in terms of the signature sizes. For example, the combination of the signature and public key sizes of BLISS is around 1500 bytes at approximately the 128-bit security level, which is almost comparable to the standardized signature schemes RSA and ECDSA. However, Gaussian sampling is vulnerable to timing attacks, which may easily result in the leakage of the secret key [13,14,15]. As a result, it is highly challenging to implement GRS schemes securely. Although a very careful implementation can prevent such attacks, it is time consuming [16]. This is partly why the BLISS was not submitted to the NIST PQC standardization process.

Another line of the constructions is uniform-based rejection sampling signature (URS) following the idea of references [7,17]. It uses uniform masking in hypercubes as the secret randomness in FSwA signatures, and the corresponding rejection sampling prevents the secret key leakage by uniform distribution. The URS schemes, such as in the works [2,7,8,17,18,19,20,21,22], only need uniform distribution to build the rejection sampling. Thus they are highly simple to implement securely against timing attacks. However, compared to GRS schemes (such as BLISS), URS schemes (such as ML-DSA) are slightly less efficient in terms of signature and public key sizes. This is mainly because the ${\mathsf{\ell }}_{\infty }$-norm of the final signature is only slightly smaller than that of the chosen secret randomness. At approximately the 128-bit security level, the signature size of BLISS scheme is about 625 bytes, whereas in ML-DSA, it is approximately 2400 bytes.

To summarize, GRS schemes have small parameters (signature and public key sizes) but entail a rather complicated sampling for signing algorithm. URS schemes have a very simple sampling but larger parameters. Therefore the goal of this paper is to build an efficient rejection sampling by choosing a new probability distribution, rather than Gaussian or uniform distributions, and then construct a lattice-based FSwA signature scheme that has both small parameters and a simple sampling.

1.1. Our Contribution

In this work, we choose centered binomial distribution as a candidate to build the rejection sampling, which is closer to Gaussian distribution but is easy to sample. As a result, we construct a new lattice-based signature scheme with a trade-off between security and signature sizes. For simplicity, we name the centered binomial-based rejection sampling signatures as CRS schemes. We now briefly summarize the comparisons of the characteristics of GRS, URS and CRS schemes in

Table 1. Theoretical comparisons of the different approaches for lattice-based signature schemes at approximately 128-bit security level.

The Approach	The Sampling	High-Precision
GRS (BLISS)	Gaussian	Yes
URS (ML-DSA)	Uniform	No
CRS (this work)	Semi-uniform	Yes

. The main contributions of this paper are presented as follows.

• On the Difficulty of Constructing CRS Schemes. Although it would seem that centered binomial distributions have been used to extract the secret key coefficients in lattice-based key exchanges [23] for a long time, it is far from being enough to build a rejection sampling for a FSwA signature scheme. The main difficulty is how to compute bounded but small enough repetitions of M to meet the rejection sampling conditions, as centered binomial distributions hardly have known and related geometric properties in previous works. This prevented previous schemes from using centered binomial distributions to construct the FSwA signatures. In this work, we discuss several very important properties of the centered binomial distributions, and prove that there exists a small enough M to achieve an efficient centered binomial-based rejection sampling.
• Compact Rejection Sampling with High-Precision and Semi-Uniform Operation. This work describes a construction of the compact rejection sampling. It not only has high-precision sampling as Gaussian distribution, but also has the property of semi-uniform operation similar to uniform distribution, which are highly associated with the performance of our proposed FSwA signature scheme. Unlike the rejection samplings in previous works are based on Gaussian or uniform distributions, this work develops a new rejection sampling from centered binomial distribution. A sampling from a centered binomial distribution $B_{\eta }$ is defined as follows:

  –

  Sample $(a_1,a_2,\cdots ,a_{\eta })\leftarrow {\{0,1\}}^{\eta }$, $(b_1,b_2,\cdots ,b_{\eta })\leftarrow {\{0,1\}}^{\eta }$

  –

  Output ${\sum }_{i=1}^{\eta }(a_i-b_i)$

  It only consists of a uniform random sampling and $2\eta -1$ addition and subtraction operations. This is why we name “semi-uniform operation” in this work. Therefore it is simple to resist against timing attacks, as no large tables or data-dependent branches are required [23].
• An Efficient Lattice-Based FSwA Signature Scheme from Centered Binomial Distribution. This work focuses on the lattice-based FSwA signatures, and proposes the use of centered binomial distribution in Lyubashevsky’s signature [8] scheme. Our goal is to attempt to construct a lattice-based FSwA signature by a new probability distribution, rather than Gaussian or uniform distribution. The main technique is our compact rejection sampling from centered binomial distribution, which is the essential building block to design FSwA signature in lattices. To some extent, the proposed scheme combines the advantages of both GRS and URS schemes, while preventing the disadvantages of both. Therefore, our construction may be seen as a new and alternative approach to construct efficient lattice-based signature schemes.
• Minimize the Sizes of Signature and Public Key. The fact that our proposed scheme has short signature and public key sizes is an inherent result. Centered binomial distribution not only has the property of semi-uniform operation but also owns the bell-shaped characteristic and high-precision sampling as Gaussian distribution. This intuitively gives us the desirable parameters for our scheme as the output of the signatures follows the centered binomial distribution. Concretely, the combination of signature and public key sizes of our proposed scheme is slightly larger than those of GRS schemes but smaller than those of URS signature schemes.

1.2. Organization

We start in Section 2 with preliminaries, then discuss centered binomial distribution and the related compact rejection sampling algorithm in Section 3. As an application, we propose our lattice-based FSwA digital signature scheme and analyze it in Section 4. We give the security proof of our scheme in Section 5. Finally, we conclude this work in Section 6.

2. Preliminaries

2.1. Notations

Table 2. The notations of this paper.

Notations	Meaning
$[-\delta ,\delta ]$	The integer set $\{-\delta ,-\delta +1,\cdots ,0,\cdots ,\delta -1,\delta \}$
${\mathbb{Z}}_q$	Module q residue class ring $[-{\displaystyle \frac{q-1}{2}},{\displaystyle \frac{q-1}{2}}]$ for a prime number q
$R_q$	Polynomial ring ${\mathbb{Z}}_q\left[x\right]/\langle x^n+1\rangle$
${\mathit{z}}^t$	Transpose vector of the vector $\mathit{z}$
$\parallel \mathit{z}\parallel$	The ${\mathsf{\ell }}_2$-norm $\parallel \mathit{z}\parallel =({\sum }_i|z_i{{|}^2)}^{1/2}$
${\parallel \mathit{z}\parallel }_1$	The ${\mathsf{\ell }}_1$-norm ${\parallel \mathit{z}\parallel }_1={\sum }_i\left|z_i\right|$
${\parallel \mathit{z}\parallel }_{\infty }$	The ${\mathsf{\ell }}_{\infty }$-norm ${\parallel \mathit{z}\parallel }_{\infty }={max}_i\left|z_i\right|$
$B_{\eta }$	Centered binomial sampling centered at 0
$B_{\eta ,v}$	Centered binomial sampling centered at v, shifting $B_{\eta }$ by the value v
${\mathbb{B}}_{\kappa }^n$	The n-dimension vector set $\{\mathit{c}\in {\{-1,0,1\}}^n:\parallel \mathit{c}{\parallel }_1=\kappa \}$
$s\leftarrow \mathcal{S}$	For a finite set $\mathcal{S}$, s is sampled uniformly from $\mathcal{S}$
$d\leftarrow \mathcal{D}$	For a probability distribution $\mathcal{D}$, d is sampled according to $\mathcal{D}$

illustrates some notations that are mainly used in this paper.

2.2. Digital Signature

We now recall the definition of digital signature and its security model of existential unforgeability against chosen-message attacks (EU-CMA).

Definition 1

(Digital Signature). A signature scheme consists of the following three probabilistic polynomial-time (PPT) algorithms:

• KeyGen: The key generation algorithm takes as input the system parameter, and returns a public/secret key pair $(pk,sk)$.
• Sign: The sign algorithm takes as the message μ and the secret key $sk$. It returns a signature ϱ of μ.
• Verify: The verify algorithm takes as input the pair $(\mu ,\varrho )$ and the public key $pk$. It returns “Accept” if ϱ is a valid signature of message μ; otherwise, it returns “Reject”.

We then describe the EU-CMA security model of the signature as follows:

• Setup: The challenger runs the KeyGen algorithm to get the key pair $(pk,sk)$, sends public key $pk$ to the adversary, and keeps the secret key $sk$ in private.
• Query: The adversary adaptively chooses messages and makes signature queries on these messages. For each signature query on the message ${\mu }_i$, the challenger runs the signing algorithm and sends the signature ${\varrho }_i$ to the adversary.
• Forgery: The adversary returns a forged signature ${\varrho }^{*}$ on some message ${\mu }^{*}$ and wins the game if
  • ${\varrho }^{*}$ is a valid signature of the message ${\mu }^{*}$.
  • The signature of ${\mu }^{*}$ has not been queried.

Definition 2

(EU-CMA). A signature scheme is secure in the EU-CMA model if for all PPT adversaries $\mathcal{A}$, after making q signature queries, the probability of winning the game is negligible.

2.3. Hardness Assumptions in Lattices

Let polynomial ring $R_q={\mathbb{Z}}_q\left[x\right]/\langle x^n+1\rangle$, and $m=\gamma n$ for a positive integer $\gamma$. We now give the ring version of a small integer solution (R-SIS) problem.

Definition 3

(R-${\mathrm{SIS}}_{q,n,m,\beta }$). Given ${\mathit{a}}_1,\cdots ,{\mathit{a}}_{\gamma }\leftarrow R_q$, find elements ${\mathit{s}}_1,\cdots ,{\mathit{s}}_{\gamma }\in R_q$ with at least one ${\mathit{s}}_i\ne \mathbf{0}$, such that ${\sum }_{i=1}^{\gamma }{\mathit{a}}_i{\mathit{s}}_i=\mathbf{0}\in R_q$ and $\parallel \mathit{s}\parallel \le \beta$ where $\mathit{s}=[{\mathit{s}}_1\Vert \cdots \Vert {\mathit{s}}_{\gamma }]$.

Taking $R_q={\mathbb{Z}}_q^n$, the R-SIS problem will be a standard SIS problem. The hardness of the SIS problem is based on the approximate shortest vector problem in the corresponding lattice ${\wedge }_q^{\perp }\left(\mathit{A}\right)=\{\mathit{x}\in {\mathbb{Z}}_q^m:\mathit{Ax}=\mathbf{0}(modq)\}$. Recall that [24] showed that lattice-reduction algorithms are able to find a vector of length $\beta \le {\delta }^{m}det{\left(L\right)}^{1/m}$ in m-dimensional lattices L, where $\delta$ is a parameter that corresponds to the performance of the lattice-reduction algorithm being used. Therefore, running the best known algorithms on this random q-ary lattice ${\wedge }_q^{\perp }\left(\mathit{A}\right)$, one can find a vector of length $\beta$ which is close to

$${\delta }^{m}det{\left({\wedge }_q^{\perp }\left(\mathit{A}\right)\right)}^{1/m}=q^{n/m}{\delta }^m.$$

(1)

In addition, this ${\mathsf{\ell }}_2$-norm $\beta$ must satisfy that $\beta <q$ as well.

2.4. Generic Rejection Sampling

Rejection sampling is a very important abort technique which is especially used in lattice-based signature schemes, and it ensures the output of the signature will not leak any information of the secret key.

Lemma 1

(Generic Rejection Sampling [8]). Let $V\subseteq {\mathbb{Z}}^m$, $h:V\to \mathbb{R}$ and $f:{\mathbb{Z}}^m\to \mathbb{R}$ be probability distributions. If $g_v:{\mathbb{Z}}^m\to \mathbb{R}$ is a family of probability distributions indexed by $v\in V$, and there exists a constant M such that

$$\mathrm{P}\mathrm{r}[M{g}_v\left(z\right)\ge f\left(z\right):z\leftarrow f]<ϵ$$

for any $v\in V$, then the output distributions of the following two algorithms have negligible statistical distance $ϵ/M$:

1.

$v\leftarrow h$, $z\leftarrow f$, output $(z,v)$ with probability $1/M$.

2.

$v\leftarrow h$, $z\leftarrow g_v$, output $(z,v)$ with probability $min\left(f\left(z\right)/\left(M{g}_v\left(z\right)\right),1\right)$.

3. Centered Binomial Distribution and Rejection Sampling

In this section, we prove the main results about centered binomial distribution, and provide a new rejection sampling algorithm, which is at the heart of the construction of our signature scheme.

3.1. Centered Binomial Distribution

Define the centered binomial distribution [23] $B_{\eta }$ centered at 0 for some positive integer $\eta$ as follows:

• Sample $(a_1,a_2,\cdots ,a_{\eta })\leftarrow {\{0,1\}}^{\eta }$, and $(b_1,b_2,\cdots ,b_{\eta })\leftarrow {\{0,1\}}^{\eta }$
• Output ${\sum }_{i=1}^{\eta }(a_i-b_i)$

For different parameters $\eta$, we give its probability distribution in Figure 1. We now prove that its sampling is high precision and tightly concentrated on the value $\sqrt{2\eta m}$ in the following Theorem 1, which ensures that the signature size of our proposed scheme is small enough.

Theorem 1.

Supposing that m is a positive integer and $B_{\eta }$ is a centered binomial distribution, then

$$\mathrm{Pr}[\parallel \mathit{z}\parallel \ge \sqrt{2\eta m}:\mathit{z}\leftarrow B_{\eta }^m]<2^{-m}.$$

Proof. 

According to the definition of the centered binomial distribution, its success probability $p=1/2$ in this distribution, and the probability distribution of $B_{\eta }$ centered at 0 and evaluated at $z\in \{-\eta ,\cdots ,0,\cdots ,\eta \}$ is

$$\begin{array}{c}\hfill B_{\eta }\left(z\right)=\left({\displaystyle \genfrac{}{}{0pt}{}{2\eta }{\eta +z}}\right)·{\left({\displaystyle \frac{1}{2}}\right)}^{\eta +z}·{\left(1-{\displaystyle \frac{1}{2}}\right)}^{2\eta -(\eta +z)}=\left({\displaystyle \genfrac{}{}{0pt}{}{2\eta }{\eta +z}}\right)/2^{2\eta }.\end{array}$$

More generally,

$$B_{\eta }^m\left(\mathit{z}\right)={\displaystyle \frac{{\prod }_{i=1}^m\left(\genfrac{}{}{0pt}{}{2\eta }{\eta +z_i}\right)}{2^{2\eta m}}}$$

for m-dimension vector $\mathit{z}=(z_1,z_2,\cdots ,z_m)$. Therefore, the centered binomial distribution is a shifting of the classic binomial distribution $B(2\eta ,p)$ with success probability $p=1/2$ in horizontal direction, and the standard deviation $\sigma$ of $B_{\eta }$ is

$$\sigma =\sqrt{2\eta p(1-p)}=\sqrt{2\eta }/2.$$

We then use the de Moivre–Laplace central limit theorem [25] which shows that if random variable $S_n\sim B(n,p)$, then

$$\underset{n\to \infty }{lim}\mathrm{Pr}[{\displaystyle \frac{S_n-np}{\sqrt{np(1-p)}}}\le x]=\mathsf{\Phi }\left(x\right)={\displaystyle \frac{1}{\sqrt{2\pi }}}{\int }_{-\infty }^x{e}^{-{\displaystyle \frac{t^2}{2}}}\mathrm{d}t.$$

This theorem shows that the centered binomial distribution $B_{\eta }$ can approximate Gaussian distribution $D_{\sigma }$ as the success probability $p=1/2$ in $B_{\eta }$. In addition, by the result of [8] which shows that for any $\gamma >1$,

$$\mathrm{Pr}[\parallel \mathit{z}\parallel \ge \gamma \sigma \sqrt{m};\mathit{z}\leftarrow D_{\sigma }^m]<{\gamma }^m{e}^{{\displaystyle \frac{m}{2}}(1-{\gamma }^2)}.$$

Therefore, $2\sigma \sqrt{m}$ is the expected value around which $\mathit{z}$ is tightly concentrated in the centered binomial distribution if we set $\gamma =2$. That is,

$$\begin{array}{c}\hfill \mathrm{Pr}[\parallel \mathit{z}\parallel \ge 2\sigma \sqrt{m};\mathit{z}\leftarrow B_{\eta }^m]=\mathrm{Pr}[\parallel \mathit{z}\parallel \ge \sqrt{2\eta m};\mathit{z}\leftarrow B_{\eta }^m]<2^m{e}^{{\displaystyle \frac{m}{2}}(1-2^2)}<2^{-m}.\end{array}$$

In conclusion, we complete the proof. □

For any vector $\mathit{v}\in {\mathbb{Z}}^m$, the m-dimension centered binomial distribution centered at $\mathit{v}$ is defined as

$$B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)={\displaystyle \frac{{\prod }_{i=1}^m\left(\genfrac{}{}{0pt}{}{2\eta }{\eta +z_i-v_i}\right)}{2^{2\eta m}}}.$$

We now prove another result for centered binomial distribution, which is used to build our compact rejection sampling in Theorem 3.

Theorem 2.

For any vector $\mathit{v}\in {\mathbb{Z}}^m$, if $\eta =\lceil \alpha m\parallel \mathit{v}{\parallel }_{\infty }\rceil$ for any real number α satisfying that

$$\alpha >max\left({\displaystyle \frac{3}{2m}},{\left(1+\sqrt{1+{\displaystyle \frac{1}{m}}}\right)}^2\right).$$

Then for $\mathit{z}\leftarrow B_{\eta -T}^m$ where $T={\parallel \mathit{v}\parallel }_{\infty }$, there exists a constant $M={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }$ such that

$$B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)<M.$$

Moreover, if $\mathit{z}\leftarrow B_{\eta }^m$, then

$$\mathrm{Pr}[B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)<M:\mathit{z}\leftarrow B_{\eta }^m]>1-2^{-m}.$$

Proof. 

Before the proof, we first provide the intuition to show that this theorem is definitely valid. Firstly, it is noted that the expression for the rejection sampling of the central binomial distribution is $B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,v}^m\left(\mathit{z}\right)$, which is actually the division of two bounded finite-order polynomials. Therefore, there must exist a constant $M=M\left(\eta ,m,·\right)$ such that $B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,v}^m\left(\mathit{z}\right)<M$ holds. Therefore, if the size of M is not taken into account, this theorem must be valid. In addition, the centered binomial distribution is similar to a bell shape. According to the geometric meaning of the theorem, by shifting the centered binomial distribution $\mathit{v}$ units and expanding it by M times, it is certain to successfully cover the original centered binomial distribution.

Let $\mathit{z}=(z_1,z_2,\cdots ,z_m)$, and thus $z_i\in [-\eta +T,\eta -T]$ for $i=1,2,\cdots ,m$. To simplify the formula $B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)$, there are 3 cases:

$\left(1\right)$ If $v_i\ge 0$ for all $i=1,2,\cdots ,m$, then

$$\begin{array}{cc}\hfill {\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}& ={\displaystyle \frac{{\prod }_{i=1}^m\left(\genfrac{}{}{0pt}{}{2\eta }{\eta +z_i}\right)}{{\prod }_{i=1}^m\left(\genfrac{}{}{0pt}{}{2\eta }{\eta +z_i-v_i}\right)}}\hfill \\ \hfill & ={\displaystyle \prod _{i=1}^m}{\displaystyle \frac{(\eta -z_i+v_i)(\eta -z_i+v_i-1)\cdots (\eta -z_i+1)}{(\eta +z_i)(\eta +z_i-1)\cdots (\eta +z_i-v_i+1)}}\hfill \\ \hfill & ={\displaystyle \prod _{i=1}^m}{\displaystyle \frac{(b_i+v_i)(b_i+v_i-1)\cdots (b_i+1)}{a_i(a_i-1)\cdots (a_i-v_i+1)}},\hfill \end{array}$$

where $a_i=\eta +z_i$, and $b_i=\eta -z_i$ for $i=1,2,\cdots ,m$.

For the different values $z_i\in [-\eta +T,\eta -T]$ for $i=1,2,\cdots ,m$, there are also 3 cases:

$\left(i\right)$ If $z_i\ge 0$ for all $i=1,2,\cdots ,m$. Note that $\alpha >{\displaystyle \frac{3}{2m}}$, thus $\eta -T>T/2\ge v_i/2$.

Case 1. If $z_i\in (v_i/2,\eta -T]$, note that $b_i+v_i<a_i$, so we have

$$B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)<1.$$

Case 2. If $z_i\in [0,v_i/2]$, we have $b_i+v_i>a_i$. In addition, because $\eta +z_i-v_i>0$, it has $a_i>v_i$. Thus

$$1<{\displaystyle \frac{b_i+v_i}{a_i}}<{\displaystyle \frac{b_i+v_i-1}{a_i-1}}<\cdots <{\displaystyle \frac{b_i+1}{a_i-v_i+1}}.$$

By the above inequality, we have

$$\begin{array}{cc}\hfill {\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}& ={\displaystyle \prod _{i=1}^m}{\displaystyle \frac{(b_i+v_i)(b_i+v_i-1)\cdots (b_i+1)}{a_i(a_i-1)\cdots (a_i-v_i+1)}}\hfill \\ \hfill & <{\displaystyle \prod _{i=1}^m}{\left({\displaystyle \frac{b_i+1}{a_i-v_i+1}}\right)}^{v_i}={\left({\displaystyle \frac{\eta -z_i+1}{\eta +z_i-v_i+1}}\right)}^{m{v}_i}\hfill \\ \hfill & <{\left({\displaystyle \frac{\eta }{\eta -v_i}}\right)}^{m{v}_i}={\left(1+{\displaystyle \frac{v_i}{\eta -v_i}}\right)}^{m{v}_i}.\hfill \end{array}$$

Notice that $\eta ={\alpha m\parallel \mathit{v}\parallel }_{\infty }=\alpha mT$, and $0\le v_i<T$, so

$${\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}<{\left(1+{\displaystyle \frac{T}{\eta -T}}\right)}^{mT}={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }.$$

$\left(ii\right)$ If $z_i<0$ for all $i=1,2,\cdots ,m$. Similar to $\left(i\right)$, it is simple to prove that

$${\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}<{\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }.$$

$\left(iii\right)$ If some of $z_i$ are positive, and some are negative for $i=1,2,\cdots ,m$. Without loss of generality, assuming that $z_i\ge 0$ for $i=1,\cdots ,m_1$, and $z_i<0$ for $i=m_1+1,\cdots ,m$, where $1\le m_1\le m-1$. Thus by the cases $\left(i\right)$ and $\left(ii\right)$, we have

$$\begin{array}{cc}\hfill {\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}& ={\displaystyle \frac{B_{\eta }^{m_1}\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^{m_1}\left(\mathit{z}\right)}}·{\displaystyle \frac{B_{\eta }^{m-m_1}\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^{m-m_1}\left(\mathit{z}\right)}}\hfill \\ \hfill & <{\left(1+{\displaystyle \frac{T}{\eta -T}}\right)}^{m_{1}T}·{\left(1+{\displaystyle \frac{T}{\eta -T}}\right)}^{mT-m_{1}T}\hfill \\ \hfill & ={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }.\hfill \end{array}$$

$\left(2\right)$ If $v_i<0$, let $u_i=-v_i>0$ for all $i=1,2,\cdots ,m$, then

$$\begin{array}{cc}\hfill {\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}& ={\displaystyle \prod _{i=1}^m}{\displaystyle \frac{(\eta +z_i-v_i)(\eta +z_i-v_i-1)\cdots (\eta +z_i+1)}{(\eta -z_i)(\eta -z_i-1)\cdots (\eta -z_i+v_i+1)}}\hfill \\ \hfill & ={\displaystyle \prod _{i=1}^m}{\displaystyle \frac{(a_i+u_i)(a_i+u_i-1)\cdots (a_i+1)}{b_i(b_i-1)\cdots (b_i-u_i+1)}},\hfill \end{array}$$

where $a_i=\eta +z_i$, and $b_i=\eta -z_i$ for $i=1,2,\cdots ,m$. We can see that $a_i$ and $b_i$ have the same identity as $z_i$ is symmetric about 0. Therefore the above equation is the same as that in $\left(1\right)$. Moreover, let $f(\mathit{z},\mathit{v}):=B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)$. It is true that $f(\mathit{z},\mathit{v})=f(-\mathit{z},-\mathit{v})$ by the properties of the combination. Hence, we can also use the result of $\left(1\right)$ to discuss this situation. In all, there exists a constant M such that

$$\begin{array}{c}\hfill {\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}<M={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }.\end{array}$$

$\left(3\right)$ If some of $v_i$ are positive, and some are negative for $i=1,2,\cdots ,m$. Without loss of generality, assuming that $v_i\ge 0$ for $i=1,\cdots ,m_2$, and $v_i<0$ for $i=m_2+1,\cdots ,m$, where $1\le m_2\le m-1$. Thus by the cases $\left(1\right)$ and $\left(2\right)$, we have

$$\begin{array}{cc}\hfill {\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}& ={\displaystyle \prod _{i=1}^{m_2}}{\displaystyle \frac{(b_i+v_i)(b_i+v_i-1)\cdots (b_i+1)}{a_i(a_i-1)\cdots (a_i-v_i+1)}}\hfill \\ \hfill & ·{\displaystyle \prod _{i=m_2+1}^m}{\displaystyle \frac{(a_i+u_i)(a_i+u_i-1)\cdots (a_i+1)}{b_i(b_i-1)\cdots (b_i-u_i+1)}}\hfill \end{array}$$

for $a_i=\eta +z_i$ and $b_i=\eta -z_i$. Also by the cases $\left(1\right)$ and $\left(2\right)$, it holds that

$$\begin{array}{cc}\hfill {\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}& <{\left(1+{\displaystyle \frac{T}{\eta -T}}\right)}^{m_{2}T}·{\left(1+{\displaystyle \frac{T}{\eta -T}}\right)}^{(m-m_2)T}\hfill \\ \hfill & ={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }.\hfill \end{array}$$

In conclusion, there exists a constant M such that

$$\begin{array}{c}\hfill {\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}}<M={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }\end{array}$$

for $\mathit{z}\leftarrow B_{\eta -T}^m$.

We now prove the second conclusion that if $\mathit{z}\leftarrow B_{\eta }^m$, then

$$\mathrm{Pr}[B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)<M:\mathit{z}\leftarrow B_{\eta }^m]>1-2^{-m}.$$

Denote a set

$$S^{-}=\{\mathit{z}:\mathit{z}\leftarrow B_{\eta }^m\wedge {\parallel \mathit{z}\parallel }_{\infty }>\eta -T\},$$

then we first prove

$$\mathrm{Pr}[\mathit{z}\in S^{-}:\mathit{z}\leftarrow B_{\eta }^m]<2^{-m}.$$

In fact, because $\alpha >{\left(1+\sqrt{1+{\displaystyle \frac{1}{m}}}\right)}^2$, we have $\sqrt{\alpha }-1>\sqrt{1+{\displaystyle \frac{1}{m}}}$. Therefore,

$$\begin{array}{c}\hfill \alpha -\sqrt{2\alpha }+1>\alpha -2\sqrt{\alpha }+1={(\sqrt{\alpha }-1)}^2>1+{\displaystyle \frac{1}{m}}\end{array}$$

So it has $\alpha m>\sqrt{2\alpha m^2}+1$, and

$$\eta -T=\alpha mT-T>\sqrt{2\alpha m^2}T>\sqrt{2\alpha m^{2}T}=\sqrt{2\eta m}.$$

Thus, for a vector $\mathit{z}\in S^{-}$, we have

$$\parallel \mathit{z}\parallel \ge {\parallel \mathit{z}\parallel }_{\infty }>\eta -T>\sqrt{2\eta m}.$$

According to Theorem 1, it has

$$\begin{array}{c}\hfill \mathrm{Pr}[\mathit{z}\in S^{-}:\mathit{z}\leftarrow B_{\eta }^m]<\mathrm{Pr}[\parallel \mathit{z}\parallel >\sqrt{2\eta m}:\mathit{z}\leftarrow B_{\eta }^m]<2^{-m}.\end{array}$$

Notice that

$$\mathrm{Pr}[B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)<M:\mathit{z}\leftarrow B_{\eta -T}^m]=1.$$

Thus we have

$$\mathrm{Pr}[B_{\eta }^m\left(\mathit{z}\right)/B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)<M:\mathit{z}\leftarrow B_{\eta }^m]>1-2^{-m}.$$

We complete the proof. □

The derivation of the upper bound on M is conservative, which to some extent sacrifices the efficiency of the scheme. However, the main purpose of doing so is to ensure the correctness of our proposed rejection sampling. In addition, owing to the complexity of the formula of centered binomial distribution, we believe that calculating a constant lower bound yet is independent of any sampling $\mathit{z}$ is extremely difficult. We will consider it for future work, as it has a significant relationship with the signature sizes.

3.2. The Proposed Rejection Sampling

We now describe the new and compact rejection sampling theorem from centered binomial distribution.

Theorem 3.

Let V be a subset of ${\mathbb{Z}}^m$ with all its elements having ${\mathsf{\ell }}_{\infty }$-norm less than T, η be the integer number such that $\eta =\lceil \alpha mT\rceil$ for any real number α satisfying that

$$\alpha >max\left({\displaystyle \frac{3}{2m}},{\left(1+\sqrt{1+{\displaystyle \frac{1}{m}}}\right)}^2\right)$$

and $h:V\to \mathbb{R}$ be a probability distribution. Then there exists a constant

$$M={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }$$

such that the distribution of the output of the algorithm $\mathcal{B}$:

1.

$\mathit{v}\leftarrow h$.

2.

$\mathit{z}\leftarrow B_{\eta }^m$.

3.

Output $(\mathit{z},\mathit{v})$ with probability $1/M$.

• is within statistical distance $2^{-m}/M$ of the distribution of the following algorithm $\mathcal{C}$:

1.

$\mathit{v}\leftarrow h$.

2.

$\mathit{z}\leftarrow B_{\eta ,\mathit{v}}^m$.

3.

Output $(\mathit{z},\mathit{v})$ with probability $\min \left({\displaystyle \frac{B_{\eta }^m\left(\mathit{z}\right)}{M·B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)}},1\right)$.

It is obvious that the above proposed theorem is correct by the results of Lemma 1 and Theorem 2.

In the rest of this paper, we will build the FSwA signature in lattices based on the above compact rejection sampling. Nevertheless, the design can be further improved by the bimodal distributions [11] and the compression technique [12]. Specifically, the bimodal centered binomial distribution, centered at both $+\mathit{v}$ and $-\mathit{v}$, reduces the rejection area compared to the unimodal case. The bimodal mixture distribution ${\displaystyle \frac{1}{2}}{B}_{\eta ,\mathit{v}}+{\displaystyle \frac{1}{2}}{B}_{\eta ,-\mathit{v}}$ creates two symmetric sampling centers around $\pm \mathit{v}$. This allows the standard deviation of the signature vector to be smaller. As a result, the generated signature vectors have much smaller norms and lower entropy. This directly facilitates compression that smaller coefficients require fewer bits and can be further shortened using Huffman coding and by discarding low-order bits, leading to substantially more compact signatures. We leave it for future works, as we would like to demonstrate the advantages of our new rejection sampling itself.

4. The Construction

In this section, we will propose a new and efficient lattice-based FSwA signature scheme, and discuss its performance.

4.1. High-Level Description of the Scheme

The construction follows the FSwA paradigm in Lyubashevsky’s work [8], and the core is the rejection sampling that is used to remove the secret’s depend ency on a given nonce distribution. After the key generation algorithm based on R-SIS, in the signing procedure, we choose the nonce $\mathit{y}$ by sampling the centered binomial distribution to conceal the secret key $\mathit{s}$. Once given the message $\mu$ and the corresponding hash value $\mathit{c}$, we compute the signature $\mathit{z}=\mathit{y}+\mathbf{sc}$, and output it with probability $B_{\eta }^m\left(\mathit{z}\right)/(M·B_{\eta ,\mathit{sc}}^m\left(\mathit{z}\right))$ where $M={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }$. By our rejection sampling, the outputting of $\mathit{z}$ will follow the centered binomial distribution $B_{\eta }^m$, and will not leak any information of the secret key $\mathit{s}$. In addition, we also need to restrict ${\parallel \mathit{z}\parallel }_{\infty }\le \eta -l$ where $l\ge {\parallel \mathit{sc}\parallel }_{\infty }$. Otherwise, the coefficients of the sampling in $B_{\eta ,\mathit{sc}}^m$ (shifting $B_{\eta }^m$ by $\mathit{sc}$) may exceed the value $\eta$.

The verify algorithm adds a reasonable abort that $\parallel \mathit{z}\parallel \le \sqrt{2(\eta -l)m}$ for the valid signature as ${\parallel \mathit{z}\parallel }_{\infty }\le \eta -l$. By Theorem 1 and our suggested parameters, the verifier can pass this abort with probability at least $1-2^{-m}$. After the expected repetitions of about $M+2l/(\eta +l)$, our scheme is correct as

$$\begin{array}{cc}\hfill {\mathit{a}}_1{\mathit{y}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{y}}_{\gamma }& ={\mathit{a}}_1({\mathit{z}}_1-{\mathit{s}}_1\mathit{c})+\cdots +{\mathit{a}}_{\gamma }({\mathit{z}}_{\gamma }-{\mathit{s}}_{\gamma }\mathit{c})\hfill \\ \hfill & ={\mathit{a}}_1{\mathit{z}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{\gamma }-\mathbf{tc}.\hfill \end{array}$$

Thus it has $\mathit{c}=H({\mathit{a}}_1{\mathit{z}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{\gamma }-\mathbf{tc},\mu )$.

4.2. Formal Description

• KeyGen: Input security parameter, output public key $({\mathit{a}}_1,\cdots ,{\mathit{a}}_{\gamma },\mathit{t})$ and secret key $({\mathit{s}}_1,\cdots ,{\mathit{s}}_{\gamma })$.
  • Choose ${\mathit{s}}_1,\cdots ,{\mathit{s}}_{\gamma }\in R_q$ where every coefficient of ${\mathit{s}}_i$ is chosen uniformly and independently from $\{-d,\cdots ,0,\cdots ,d\}$.
  • Uniformly random sample ${\mathit{a}}_1,\cdots ,{\mathit{a}}_{\gamma }\leftarrow R_q$.
  • Compute $\mathit{t}={\sum }_{i=1}^{\gamma }{\mathit{a}}_i{\mathit{s}}_i\in R_q$.
  • Return public key $({\mathit{a}}_1,\cdots ,{\mathit{a}}_{\gamma },\mathit{t})$ and secret key $({\mathit{s}}_1,\cdots ,{\mathit{s}}_{\gamma })$.
• Sign: Input the public and secret key pair and the message $\mu$, output a signature $\varrho$ of $\mu$.
  • Sample ${\mathit{y}}_1,\cdots ,{\mathit{y}}_{\gamma }\leftarrow B_{\eta }^n$.
  • Compute $\mathit{c}=H({\mathit{a}}_1{\mathit{y}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{y}}_{\gamma },\mu )$.
  • Compute ${\mathit{z}}_1={\mathit{y}}_1+{\mathit{s}}_1\mathit{c},\cdots ,{\mathit{z}}_{\gamma }={\mathit{y}}_{\gamma }+{\mathit{s}}_{\gamma }\mathit{c}$.
  • Output $\mathit{z}$ with probability $B_{\eta }^m\left(\mathit{z}\right)/\left(M·B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)\right)$, where $\mathit{v}=[{\left({\mathit{s}}_1\mathit{c}\right)}^t\Vert \cdots \Vert {\left({\mathit{s}}_{\gamma }\mathit{c}\right)}^t{]}^t$, $\mathit{z}=[{\mathit{z}}_1^t\Vert \cdots \Vert {\mathit{z}}_{\gamma }^t{]}^t$ and $m=\gamma n$.
  • If ${\parallel \mathit{z}\parallel }_{\infty }>\eta -l$, then restart.
  • Return a signature $\varrho =(\mathit{z},\mathit{c})$.
• Verify: Input public key, signature $\varrho$ and message $\mu$, output “Accept” or “Reject”.
  • If $\parallel \mathit{z}\parallel >\sqrt{2(\eta -l)m}$, return “Reject”.
  • If ${\parallel \mathit{z}\parallel }_{\infty }>\eta -l$, return “Reject”.
  • If $\mathit{c}\ne H({\mathit{a}}_1{\mathit{z}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{\gamma }-\mathit{tc},\mu )$, return “Reject”.
  • Otherwise, return “Accept”.

In addition, the separate rejection sampling algorithm in our scheme can be also described as follows.

• RejectionSampling $({\mathit{z}}_1^t,\cdots ,{\mathit{z}}_{\gamma }^t,{\mathit{s}}_1,\cdots ,{\mathit{s}}_{\gamma },\mathit{c},\eta ,m)$:
  • Let $\mathit{z}\leftarrow {\left({\mathit{z}}_1^t\right|\cdots \left|{\mathit{z}}_{\gamma }^t\right)}^t\in B_{\eta ,\mathit{v}}^m$.
  • Let $\mathit{v}\leftarrow {\left({\mathit{s}}_1\mathit{c}\right|\cdots \left|{\mathit{s}}_{\gamma }\mathit{c}\right)}^t\in B_{\eta ,\mathit{v}}^m$.
  • With probability $B_{\eta }^m\left(\mathit{z}\right)/{M·B}_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)$, output 1, else output 0.

By this separate rejection sampling algorithm, we can also give the sign algorithm as follows.

• Sign: Input the public and secret key pair and message $\mu$, output a signature $\varrho$.
  • Sample ${\mathit{y}}_1,\cdots ,{\mathit{y}}_{\gamma }\leftarrow B_{\eta }^n$.
  • Compute $\mathit{c}=H({\mathit{a}}_1{\mathit{y}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{y}}_{\gamma },\mu )$.
  • Compute ${\mathit{z}}_1={\mathit{y}}_1+{\mathit{s}}_1\mathit{c},\cdots ,{\mathit{z}}_{\gamma }={\mathit{y}}_{\gamma }+{\mathit{s}}_{\gamma }\mathit{c}$.
  • $b\leftarrow RejectionSampling({\mathit{z}}_1^t,\cdots ,{\mathit{z}}_{\gamma }^t,{\mathit{s}}_1,\cdots ,{\mathit{s}}_{\gamma }^t,c,\eta ,m)$.
  • If $b=0$, then restart.
  • If ${\parallel \mathit{z}\parallel }_{\infty }>\eta -l$, then restart.
  • Return a signature $\varrho =(\mathit{z},\mathit{c})$.

4.3. Concrete Parameters

In

Table 3. Concrete parameters for our signature scheme.

Name	Definition	I	II
Target security level $\lambda$	-	128-bit	128-bit
Optimized for	-	Signature size	Repetitions
n	Power of two	512	512
q	Security reduction	12,289	12,289
m	$2n$	1024	1024
d	$d\ll q^{n/m}$	1	1
$\kappa$	$2^{\kappa }·\left({\displaystyle \genfrac{}{}{0pt}{}{n}{\kappa }}\right)\ge 2^{2\lambda }$	60	60
$\alpha$	$\alpha >{\displaystyle \frac{3}{2m}}$	8.2	10
l	$2^l·\left({\displaystyle \genfrac{}{}{0pt}{}{m}{l}}\right)\ge 2^{\lambda }$	16	16
M	${(1+{\displaystyle \frac{1}{\alpha m-1}})}^{ml}$	7	4.9
Expected repetitions	$M+2l/(\eta +l)$	7	4.9
Public key size	$nlogq$	896	896
Secret key size	$mlog(2d+1)$	256	256
Signature size	$mlog\left(6\sqrt{2(\alpha ml-l)}\right)$	1486	1536
Signing time (ms)	-	14.87	12.34

, we describe the concrete parameters for quantum security levels of about 128-bit. $n,q,m,d$ are the underlying R-SIS problem parameters, and they provide the hardness of the underlying R-SIS problem of our scheme. For the ${\mathsf{\ell }}_2$-norm $\beta =2\sqrt{2(\eta -l)m}$, the hardness depends on the ratio $\beta /\sqrt{q}$. In other words, it is necessary to run BKZ algorithm providing a Hermite factor ${\delta }^m<\beta /\sqrt{q}$. For a long-term security, it sets $\delta =1.005$ for the related parameters. Lattice-reduction algorithms are able to find a vector of length $\beta \le {\delta }^{m}det{\left(L\right)}^{1/m}$ in m-dimensional lattices L. In fact, for this value of $\delta$, it estimates that the reduction algorithm is totally out of reach for the underlying problem in dimension about 500. Of course, this ${\mathsf{\ell }}_2$-norm $\beta$ must satisfy that $\beta <q$ as well. The parameter $\kappa$ defines the number of non-zero entries of hash function H. For our targeted bit security $\lambda$, $\kappa$ should satisfy $2^{\kappa }·\left({\displaystyle \genfrac{}{}{0pt}{}{n}{\kappa }}\right)\ge 2^{2\lambda }$.

The parameter $\alpha$ is used to balance the signature sizes and the repetitions of our scheme, and satisfies that

$$\alpha >max\left({\displaystyle \frac{3}{2m}},{\left(1+\sqrt{1+{\displaystyle \frac{1}{m}}}\right)}^2\right).$$

Under this inequality restriction, the specific value of $\alpha$ depends on the trade-off between the repetitions M and signature size. This is because the repetitions $M={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{ml}$, and the signature size is about $mlog\left(6\sqrt{2\left(\alpha ml-l\right)}\right)$ in our proposed scheme. The parameters l is used to bound the entries of $\mathit{v}=[{\left({\mathit{s}}_1\mathit{c}\right)}^t\Vert \cdots \Vert {\left({\mathit{s}}_{\gamma }\mathit{c}\right)}^t{]}^t$ and signature $\mathit{z}$, respectively. In addition, the formula $2^l·\left({\displaystyle \genfrac{}{}{0pt}{}{m}{l}}\right)\ge 2^{\lambda }$ is used to resist key-exhaustion attack for the targeted bit security $\lambda$.

The repetitions $M={(1+{\displaystyle \frac{1}{\alpha m-1}})}^{ml}$ are provided in Theorem 2. In step 5 of our signing algorithm, there is another abort that ${\parallel \mathit{z}\parallel }_{\infty }>\eta -l$. Thus, the total repetitions are $M+2l/(\eta +l)$, and the mathematical relationship between $l,\eta ,m$ and the target security level $\lambda$ is that $M={\left(1+{\displaystyle \frac{1}{\eta /l-1}}\right)}^{ml}$ for $2^l·\left({\displaystyle \genfrac{}{}{0pt}{}{m}{l}}\right)\ge 2^{\lambda }$ and $\eta =\lceil \alpha ml\rceil$. The size of the public key is about $nlogq$. With overwhelming probability, each coefficient of $\mathit{z}$ is of length at most $12\sigma =6\sqrt{2(\eta -l)}$ as the standard deviation

$$\sigma =\sqrt{2(\eta -l)p(1-p)}=\sqrt{2(\eta -l)}/2=\sqrt{2(\alpha ml-l)}/2$$

of $B_{\eta -l}$. Thus the signature size is about $mlog\left(6\sqrt{2(\alpha ml-l)}\right)$.

We now implement the separate sign algorithm of our scheme. The experiments are implemented in Python 3.12, and are run on an Intel Core i5-8500 CPU @ 3.00GHz×4, with parameter sets I and II. Each parameter set is implemented independently ${10}^3$ times. The average signing times are 14.87 ms and 12.34 ms according to our claimed parameters I and II, respectively. Please refer to Table 3 for the detailed results.

To verify the theoretical repetitions M, we now provide the numerical simulation experiments by running our rejection sampling. Each set is sampled independently ${10}^3$ times. The following

Table 4. Comparison between the theoretical and actual acceptance rates.

Parameters Set	Theoretical Acceptance Rate	Actual Acceptance Rate	Standard Deviation
I	$1/7\approx 14.29\%$	$14.21\%$	$\pm 0.035\%$
II	$1/4.9\approx 20.41\%$	$20.39\%$	$\pm 0.014\%$

presents a comparison between the theoretical acceptance rate $1/M$ and the actual acceptance rate. The results prove the rationality and correctness of the repetitions M in our sampling rejection. The error might stem from the number of samplings and the tiny repetitions $2l/\left(\eta +l\right)$ for our parameter sets.

4.4. Security Evaluation

We now provide a full, structured response covering lattice estimator outputs, BKZ cost, primal/dual SIS attack analysis, and classical/quantum security bounds for our parameter sets.

We first discuss lattice estimator and primal/dual attacks by running the official lattice-estimator [26,27] for our core parameter tuple:

• Primal SIS Attack. This attack targets the primal lattice of dimension $m=1024$, directly searching for the short signature vector. The estimator finds the optimal BKZ block size $\theta =348$ for our present parameters. The resulting classical attack cost is $2^{132}$ operations, and the quantum cost is $2^{129}$, both exceeding the target 128-bit security. In addition, the Euclidean norm bound of our signature is larger than the lattice’s heuristic shortest vector, adding extra enumeration overhead for adversaries.
• Dual SIS Attack. This attack works on the smaller dual lattice of dimension $n=512$. To offset the smaller lattice dimension, the optimal BKZ block size rises to $\theta =355$. The dual attack costs $2^{135}$ classical operations and $2^{131}$ quantum gates, which are both higher than the primal attack costs. The tight bound of secret key coefficients removes weak exploitable lattice structures. As the primal attack is computationally cheaper, we use its security bounds as our conservative 128-bit security lower bound.
• Shortest Vector Problem (SVP) Baseline. We take SVP as the core hardness baseline for SIS attacks under our parameters. The primal SIS lattice has volume $q^n$, and the norm of the shortest non-zero lattice vector is ${\lambda }_1\approx \sqrt{m}·q^{n/m}\approx 181$, which exactly matches the Euclidean norm upper bound of our signature, meaning adversaries cannot exploit substantially shorter vectors to weaken the problem. All primal and dual SIS attacks boil down to SVP solved via BKZ lattice sieving, both surpassing 128-bit security by the above discussion.

In addition, we adopt the state-of-the-art BKZ cost model from the lattice estimator. For the classical BKZ cost model, its cost is $2^{0.292\theta }$ for block size $\theta$. Thus it has $0.292\times 348=101.6$ for primal attack of $\theta =348$; combined with the enumeration overhead, it yields a total cost ≥$2^{132}$. For the quantum BKZ cost, it is $2^{0.257\theta }$ for dual attack $\theta =355$, and thus it has $0.257\times 355=91.2$, with quantum enumeration overhead leading to a total cost of ≥$2^{131}$. Even with state-of-the-art GPU-accelerated BKZ implementations, block sizes exceeding $\theta =300$ are computationally infeasible, further confirming our parameters resist real-world lattice reduction.

Finally, we discuss the classical and quantum 128-bit security. The dominant classical lattice attacks including primal BKZ-sieve, dual lattice reduction and exhaustive secret key search, yield minimal computational cost of $2^{132}$ operations, which exceeds the target 128-bit security margin. The gap of 4 bits provides a safe buffer against future incremental improvements to lattice reduction algorithms. We also evaluate quantum lattice sieving algorithms such as quantum sieve for SVP, quantum BKZ enumeration. The minimal quantum attack cost across primal and dual attacks is $2^{129}$ quantum gates, satisfying the NIST post-quantum standard 128-bit security requirement.

To sum up, the lattice security evaluation for our proposed parameter sets is shown in

Table 5. Lattice evaluation results.

	Parameter I	Parameter I
BKZ block size $\theta$ for primal attack	348	349
BKZ block size $\theta$ for dual attack	355	357
Classical cost against primal attack	$2^{132}$	$2^{133}$
Classical cost against dual attack	$2^{135}$	$2^{136}$
Quantum cost against primal attack	$2^{129}$	$2^{130}$
Quantum cost against dual attack	$2^{131}$	$2^{132}$

. With the complete lattice security analysis above, our parameter sets support the claimed 128-bit security level under lattice attacks.

4.5. Efficiency Comparison

In this subsection, we show the theoretical comparisons of the selected state-of-the-art lattice-based FSwA signature schemes in

Table 6. Theoretical comparisons of the FSwA schemes, GPV scheme and our scheme at about 128-bit quantum security level (NIST security level I).

Scheme	Distribution	Repetitions	Acceptance Rate	Public Key Size	Signature Size
ML-DSA [1]	Uniform	6.6	$15.2\%$	1300	2400
BLISS [11]	Gaussian	2.18	$45.9\%$	875	625
Patronus [9]	Uniform in polytope	3	$33.3\%$	832	2070
HAETAE [10]	Uniform in hyperball	6	$16.7\%$	992	1474
Our scheme	Centered binomial	4.9	$20.4\%$	896	1536

. The signature and public key sizes are given in bytes.

First, we compare our signature scheme with the schemes ML-DSA and Patronus. Because the main samplings in our scheme and ML-DSA come from centered binomial or uniform distribution, both the schemes have a very easy implementation. Thanks to the compactness of the rejection sampling from centered binomial distribution, our scheme also has a smaller signature size, by about 37%, than the URS scheme at approximately the 128-bit security level. In addition, the polytope-based and Hyperball-based rejection sampling signatures Patronus [9] and HAETAE [10] also avoid the sampling of the Gaussian distributions, and the signature size of our scheme is comparable to those of the scheme Patronus and HAETAE. Second, we compare with the GRS scheme BLISS. The BLISS scheme has very shot public key and signature sizes but is vulnerable to the timing attacks because of the Gaussian sampling [28], whereas our scheme almost has a same public key size and a larger signature size but avoids the cost of Gaussian sampling.

4.6. The Compactness and Simple Implementation

Compactness: Notice that centered binomial distribution $B_{\eta }$ is bell-shaped, we prove that for a randomness vector $\mathit{z}\leftarrow B_{\eta }^m$, $\sqrt{2\eta m}$ is the expected value around which $\mathit{z}$ is tightly concentrated in $B_{\eta }^m$. That is to say, with probability at least $1-2^{-m}$, it has $\parallel \mathit{z}\parallel \le \sqrt{2\eta m}$. Therefore, the sampling of the corresponding rejection sampling algorithm is high-precision. As a direct consequence, our new rejection sampling is compact, and intuitively the resulting signature scheme will have very short signature sizes as the output distribution of the signatures follows the high-precision centered binomial distribution.

Simple Implementation: In this part, we will implement the rejection sampling as it is the main difference between the constructions of FSwA signatures, and it is highly associated with the performance of the resulting schemes. And besides, we would rather focus more on the advantages of our new rejection sampling itself in this present work. The sampling from centered binomial distribution only consists of a uniform random sampling and $2\eta -1$ addition operations. For the implementation, we use the approach in [23], which is based on a fast pseudorandom generator with a random seed. As a comparison, sampling one polynomial from a discrete Gaussian distribution takes 1,042,700 cycles in [29]. By a computer with Intel(R) Core(TM) i5-8500 CPU @ 3.00GHz×4, whereas our C reference implementation only requires 27,021 cycles to sample from the centered binomial distribution, which is very trivial to resist against timing attacks [23], and has already been used by many transport layer security clients and servers. In this implementation, beyond addition operation, the cycle count also includes pseudorandom bit creation for centered binomial sampling. As for the implementation of the entire signature scheme, we take it as our future works.

In addition, while centered binomial distributions enable straightforward constant time implementations, they do not inherently prevent power analysis if the uniform sampling and addition loops are unprotected. To strengthen the security analysis, we can use side channel countermeasures, such as masking the sampled values, randomizing the loop order, or using redundant computations, to mitigate such physical threats. For example, to mitigate side-channel leakage during the addition–subtraction accumulation of the centered binomial sampling, first-order arithmetic masking can be applied to protect the secret intermediate values. Specifically, the secret sampling result z is split into two additive shares $z_0$ and $z_1$ such that $z=z_0+z_1$. During each iteration, the public difference $(a_i-b_i)$ is securely accumulated into one share, while the other share remains unchanged. The secret value is never reconstructed inside the loop, which effectively eliminates first-order side-channel leakage arising from intermediate addition operations.

5. Security Proof

This section shows that any existential adversary against our scheme can solve the R-${\mathrm{SIS}}_{q,m,n,\beta }$ problem for $\beta =2\sqrt{2(\eta -l)m}$. In our proof, we bound the gap that lies in the proof of the previous FSwA signatures by the results of the work [30]. In addition, the works [31,32] point out that using the R$\acute{\mathrm{e}}$nyi divergence instead of the statistical distance also allows to prove the security of the FSwA signature schemes.

Theorem 4.

Let $q_s$ and $q_h$ be the number of queries to the signer and the random oracle respectively. Then forging a signature with probability τ implies with probability at least ${\tau }^2/\left(2(q_s+q_h)\right)$ solving the R-${\mathit{SIS}}_{q,n,m,2\sqrt{2(\eta -l)m}}$ problem.

Proof. 

Our proof consists of two phases. The first simulation phase shows how one can simulate the signing algorithm without knowing the secret keys.

Concretely, suppose that $\nu$ is the number such that the random oracle H is already programmed and $ϵ$ is negligible. Then the output of our real signing algorithm is within statistical distance $\nu ·2^{-n}+ϵ+2^{-m}/M$ of the output of the following Hybrid signing algorithm.

• Hybridsign $(\mathit{t},{\mathit{a}}_1,\cdots ,{\mathit{a}}_{\gamma },\mu )$:
  • Uniformly random sample $\mathit{c}\leftarrow {\mathbb{B}}_{\kappa }^n$.
  • Sample ${\mathit{z}}_1,\cdots ,{\mathit{z}}_{\gamma }\leftarrow B_{\eta -l}^n$.
  • Output $\mathit{z}$ with probability $1/M$ where $\mathit{z}=[{\mathit{z}}_1^t\Vert {\mathit{z}}_2^t\Vert \cdots \Vert {\mathit{z}}_{\gamma }^t{]}^t$.
  • Program $H({\mathit{a}}_1{\mathit{z}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{\gamma }-\mathit{tc},\mu )=\mathit{c}$.
  • Return $(\mathit{z},\mathit{c})$.

We now prove this conclusion. Define a Hybrid signing algorithm as follows.

• Hybridsign* $(\mathit{t},{\mathit{a}}_1,\cdots ,{\mathit{a}}_{\gamma },{\mathit{s}}_1,\cdots ,{\mathit{s}}_{\gamma },\mu )$:
  • Sample ${\mathit{y}}_1,\cdots ,{\mathit{y}}_{\gamma }\leftarrow B_{\eta }^n$.
  • $H({\mathit{a}}_1{\mathit{y}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{y}}_{\gamma },\mu ):=\mathit{c}\leftarrow {\mathbb{B}}_{\kappa }^n$. That is, it samples a random $\mathit{c}$ and then reprograms H consistently.
  • Compute ${\mathit{z}}_1={\mathit{y}}_1+{\mathit{s}}_1\mathit{c},\cdots ,{\mathit{z}}_{\gamma }={\mathit{y}}_{\gamma }+{\mathit{s}}_{\gamma }\mathit{c}$.
  • Output $\mathit{z}$ with probability $B_{\eta }^m\left(\mathit{z}\right)/\left(M·B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)\right)$, where $\mathit{v}=[{\left({\mathit{s}}_1\mathit{c}\right)}^t\Vert \cdots \Vert {\left({\mathit{s}}_{\gamma }\mathit{c}\right)}^t{]}^t$.
  • If ${\parallel \mathit{z}\parallel }_{\infty }>\eta -l$, then restart.
  • Return $(\mathit{z},\mathit{c})$.

The only divergence between the real signing algorithm and the Hybridsign* occurs when ${\sum }_{i=1}^n{a}_i{y}_i$ collides with a pre-programmed random oracle entry. For v pre-programmed RO values, the collision probability for a single signing query is bounded by $2^{-n}$. This is because for any $\mathit{w}$,

$$\begin{array}{cc}\hfill \mathrm{Pr}\left[\sum _{{\mathit{y}}_i\leftarrow B_{\eta }^n}{\mathit{a}}_i{\mathit{y}}_i=\mathit{w}\right]& =\mathrm{Pr}\left[\widehat{\mathit{a}}{\mathit{u}}_1=\mathit{w}-\sum _{i\ne 1}{\mathit{a}}_i{\mathit{y}}_i;{\mathit{u}}_1\leftarrow B_{\eta }^n\right]\hfill \\ \hfill & \le \underset{\mathit{b}}{max}\mathrm{Pr}\left[\widehat{\mathit{a}}{\mathit{u}}_1=\mathit{b};{\mathit{u}}_1\leftarrow B_{\eta }^n\right]\hfill \\ \hfill & \le B_{\eta }^n\left(\mathit{z}\right){|}_{\mathit{z}=\mathbf{0}}={\left(\left({\displaystyle \genfrac{}{}{0pt}{}{2\eta }{\eta }}\right)/2^{2\eta }\right)}^n\hfill \\ \hfill & \le 2^{-n}.\hfill \end{array}$$

Bounding over v pre-programmed entries, the total statistical distance here is bounded by $\nu ·2^{-n}$.

We then define another Hybrid signing algorithm as follows.

• Hybridsign** $(\mathit{t},{\mathit{a}}_1,\cdots ,{\mathit{a}}_{\gamma },{\mathit{s}}_1,\cdots ,{\mathit{s}}_{\gamma },\mu )$:
  • Sample ${\mathit{y}}_1,\cdots ,{\mathit{y}}_{\gamma }\leftarrow B_{\eta }^n$.
  • Sample $\mathit{c}\leftarrow {\mathbb{B}}_{\kappa }^n$.
  • Compute ${\mathit{z}}_1={\mathit{y}}_1+{\mathit{s}}_1\mathit{c},\cdots ,{\mathit{z}}_{\gamma }={\mathit{y}}_{\gamma }+{\mathit{s}}_{\gamma }\mathit{c}$.
  • Output $\mathit{z}$ with probability $B_{\eta }^m\left(\mathit{z}\right)/\left(M·B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right)\right)$, where $\mathit{v}=[{\left({\mathit{s}}_1\mathit{c}\right)}^t\Vert \cdots \Vert {\left({\mathit{s}}_{\gamma }\mathit{c}\right)}^t{]}^t$.
  • If ${\parallel \mathit{z}\parallel }_{\infty }>\eta -l$, then restart.
  • Program $H({\mathit{a}}_1{\mathit{z}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{\gamma }-\mathbf{tc},\mu )=\mathit{c}$.
  • Return $(\mathit{z},\mathit{c})$.

• The Hybridsign* and Hybridsign** differ only in the order of sampling c and programming the random oracle. We invoke Theorem 3 from reference [30], in which the statistical distance between the Hybridsign* and the Hybridsign** is only related to the security parameter $\lambda$, independent of query counts. Therefore, this result is still valid here, and it proves that reordering uniform sampling of c and lazy RO programming introduces only a negligible statistical distance $ϵ=\mathrm{negl}\left(\lambda \right)$ in the random oracle model.

We finally emphasize that the output of Hybridsign is within statistical distance $2^{-m}/M$ of the output of the Hybridsign** algorithm. This is a direct consequence of Theorem 3. After rejection sampling steps for the generated signature, the output distribution of the signatures is statistically indistinguishable from the distribution of $y_i$. Hence, it also satisfies the smoothness of the distribution in our work. Summing all three disjoint divergence contributions via triangle inequality for statistical distance yields the complete rigorous bound of $\nu ·2^{-n}+ϵ+2^{-m}/M$. This completes the proof of this conclusion.

Then in the second phase, supposing that $\mathcal{A}$ makes $q_s$ signature queries and $q_h$ RO queries, and then with probability at least $\tau$ the adversary $\mathcal{A}$ forges a valid signature. We now show how the simulator $\mathcal{B}$ extracts a solution to the R-SIS problem by a forged signature. Let $\mathit{t},{\mathit{a}}_1,\cdots ,{\mathit{a}}_{\gamma }$ be the R-SIS problem instance, sample a string $({\mathit{c}}_1,\cdots ,{\mathit{c}}_{q_s},{\mathit{c}}_{q_s+1},\cdots ,{\mathit{c}}_{q_s+q_h})\leftarrow {\mathbb{B}}_{\kappa }^n$ uniformly. $\mathcal{B}$ runs $\mathcal{A}$ and keeps a list T. When receiving the i-th RO query $Q_i$ for $i\in (1,\cdots ,q_h)$, $\mathcal{B}$ examines that if the form $(k,Q_i,\widehat{\mathit{c}})\in T$ for $k\in (1,\cdots ,q_s+q_h)$, then responds the defined value $\widehat{\mathit{c}}=H\left(Q_i\right)$ to $\mathcal{A}$; Or else, $\mathcal{B}$ defines $H\left(Q_i\right)={\mathit{c}}_{q_s+i}$, and sends it to $\mathcal{A}$ as a response, and then stores $(q_s+i,Q_i,{\mathit{c}}_{q_s+i})$ in T. Once receiving the signature query for ${\mu }_i$ by $\mathcal{A}$ for $i\in (1,\cdots ,q_s)$, $\mathcal{B}$ runs the simulated signature algorithm to extract the transcript $({\mathcal{Q}}_i,{\mathit{c}}_i,{\mathit{z}}_i)$ where ${\mathcal{Q}}_i={\mathit{ay}}_i={\mathit{az}}_i-\mathit{tc}$. $\mathcal{B}$ examines that if the form $(k,{\mathcal{Q}}_i,{\widehat{\mathit{c}}}^{\prime })\in T$ for $k\in (1,\cdots ,q_s+q_h)$, and outputs ⊥; Or else, $\mathcal{B}$ defines $H\left({\mathcal{Q}}_i\right)={\mathit{c}}_i$, and sends $({\mathit{c}}_i,{\mathit{z}}_i)$ to $\mathcal{A}$ as a response, and then stores $(k=i,{\mathcal{Q}}_i,{\mathit{c}}_i)$ in T.

We now discuss the abort probabilities. The signing algorithm employs rejection sampling to ensure the signature follows a distribution independent of the secret key. For per-iteration success probability, the signing algorithm outputs the signature with probability $B_{\eta }^m\left(\mathit{z}\right)/(M·B_{\eta ,\mathit{v}}^m\left(\mathit{z}\right))$. If the condition is not met, the algorithm aborts. We set $M={\left(1+{\displaystyle \frac{1}{\alpha m-1}}\right)}^{\eta /\alpha }$; the expected number of repetitions is M, and the success probability is $1/M$. For total abort loss across all queries in the security reduction, the simulator must guess which query corresponds to the forgery. If the simulator aborts incorrectly or fails to program the random oracle consistently due to a collision, the reduction fails. The probability that the simulator does not abort during the simulation phase is lower-bounded by Pr[no abort] $\ge {\left(1-1/M\right)}^{q_s}$ for $q_s$ signature queries. This factor contributes directly to the reduction loss.

Then after finishing $q_s$ signature queries and $q_h$ RO queries, $\mathcal{A}$ returns a forged message-signature pair $(\mu ,\mathit{c},\mathit{z})$ which satisfies: (1) The transcript $(\mathcal{Q},\mathit{c},\mathit{z})$ is an accepting conversation; (2) It has that $(\mu ,\mathit{c},\mathit{z})\notin \{({\mu }_1,{\mathit{c}}_1,{\mathit{z}}_1),\cdots ,({\mu }_{q_s},{\mathit{c}}_{q_s},{\mathit{z}}_{q_s})\}$. For this forged message-signature pair $(\mu ,\mathit{c},\mathit{z})$, it holds that

$$\mathit{c}=H({\mathit{a}}_1{\mathit{z}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{\gamma }-\mathit{tc},\mu ).$$

If H was not queried and programmed, then the probability that $\mathcal{A}$ creates a $\mathit{c}$ satisfying $\mathit{c}=H\left(\mathcal{Q}\right)$ is $1/|{\mathbb{B}}_{\kappa }^n|$, and $\mathcal{A}$ has a $\tau -1/|{\mathbb{B}}_{\kappa }^n|$ chance of success and $\mathit{c}\in ({\mathit{c}}_1,\cdots ,{\mathit{c}}_{q_s+q_h})$. Notice that $\mathit{c}$ comes from either RO queries or signature queries, thus there are two possibilities.

Case 1. If $\mathit{c}$ was a response from the signature queries. Then for some $J\in (1,\cdots ,q_s)$, there exists another signature $({\mathit{z}}_J,\mathit{c})$ for some message ${\mu }_J$, and

$$H({\mathit{a}}_1{\mathit{z}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{\gamma }-\mathit{tc},\mu )=H({\mathit{a}}_1{\mathit{z}}_{J1}+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{J\gamma }-\mathit{tc},{\mu }_J).$$

If $\mu \ne {\mu }_J$, there would be another pre-image of $\mathit{c}$. Thus $\mu ={\mu }_J$ and

$${\mathit{a}}_1{\mathit{z}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{\gamma }-\mathit{tc}={\mathit{a}}_1{\mathit{z}}_{J1}+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{J\gamma }-\mathit{tc}.$$

Thus ${\mathit{a}}_1({\mathit{z}}_1-{\mathit{z}}_{J1})+\cdots +{\mathit{a}}_{\gamma }({\mathit{z}}_{\gamma }-{\mathit{z}}_{J\gamma })=\mathbf{0}$. Because $\parallel \mathit{z}\parallel ,\parallel {\mathit{z}}_J\parallel \le \sqrt{2(\eta -l)m}$ where $\mathit{z}=[{\mathit{z}}_1\Vert \cdots \Vert {\mathit{z}}_{\gamma }]$ and ${\mathit{z}}_J=[{\mathit{z}}_{J1}\Vert \cdots \Vert {\mathit{z}}_{J\gamma }]$ and $\mathit{z}\ne {\mathit{z}}_J$, there exists a nonzero vector

$$\mathit{u}=[{\mathit{u}}_1\Vert \cdots \Vert {\mathit{u}}_{\gamma }]=[{\mathit{z}}_1-{\mathit{z}}_{J1}\Vert \cdots \Vert {\mathit{z}}_{\gamma }-{\mathit{z}}_{J\gamma }]$$

such that ${\sum }_{i=1}^{\gamma }{\mathit{a}}_i{\mathit{u}}_i=\mathbf{0}$ and $\parallel \mathit{u}\parallel \le 2\sqrt{2(\eta -l)m}$, and this is a solution to the R-${\mathrm{SIS}}_{q,n,m,2\sqrt{2(\eta -l)m}}$ problem.

Case 2. If $\mathit{c}$ was a response from the RO queries. $\mathcal{B}$ runs the forking algorithm [33] $F_{\mathcal{A}}\left(pk\right)$ associated to $\mathcal{A}$ on $pk$, where the key generation algorithm KeyGen can be seen as the input generator $IG$ in the forking lemma. Then by the general forking lemma $F_{\mathcal{A}}\left(pk\right)$ will extract two different transcripts $(\mathcal{Q},\mathit{z},\mathit{c})$ and $(\mathcal{Q},\widehat{\mathit{z}},\widehat{\mathit{c}})$ for $\mathit{c}\ne \widehat{\mathit{c}}$, and the probability is at least

$$frk\ge \left(\tau -{\displaystyle \frac{1}{|{\mathbb{B}}_{\kappa }^n|}}\right)·\left({\displaystyle \frac{\tau -1/|{\mathbb{B}}_{\kappa }^n|}{q_s+q_h}}-{\displaystyle \frac{1}{|{\mathbb{B}}_{\kappa }^n|}}\right)\ge {\displaystyle \frac{{\tau }^2}{2(q_s+q_h)}}.$$

Let $\tau$ be the success probability of the adversary. The simulator succeeds if the following hold: (1) the adversary produces a valid forgery; (2) simulator correctly guesses the index of the hash query corresponding to the forgery with probability $1/Q_h$; (3) the forking algorithm successfully rewinds adversary to produce a second forgery with the same randomness but different hash output with probability ≥$\tau /2$; (4) the resulting vectors satisfy the non-triviality condition of R-SIS. Combining these, the success probability of solving R-SIS is

$${ϵ}^{\prime }\ge frk·1/Q_h·Pr\left[noabort\right]\ge {\displaystyle \frac{{\tau }^2}{2(q_s+q_h)}}·1/Q_h·{(1-{\displaystyle \frac{1}{M}})}^{q_s}.$$

This explicitly quantifies the reduction loss as roughly quadratic in $\tau$ and linear in the number of queries. Thus with the above probability it has

$${\mathit{a}}_1{\mathit{z}}_1+\cdots +{\mathit{a}}_{\gamma }{\mathit{z}}_{\gamma }-\mathit{tc}={\mathit{a}}_1{\widehat{\mathit{z}}}_1+\cdots +{\mathit{a}}_{\gamma }{\widehat{\mathit{z}}}_{\gamma }-\mathit{t}\widehat{\mathit{c}}.$$

That is to say, ${\sum }_{i=1}^{\gamma }{\mathit{a}}_i({\mathit{z}}_i-{\widehat{\mathit{z}}}_i)=\mathit{t}(\mathit{c}-\widehat{\mathit{c}}).$ Thus $({\mathit{z}}_1-{\widehat{\mathit{z}}}_1,\cdots ,{\mathit{z}}_{\gamma }-{\widehat{\mathit{z}}}_{\gamma },\mathit{c}-\widehat{\mathit{c}})$ is a solution to the approximate inhomogeneous R-${\mathrm{SIS}}_{q,n,m,s,c,\beta }$ problem as follows.

Given $m=\gamma n$ for a positive integer $\gamma$. An instance of R-${\mathrm{SIS}}_{q,n,m,s,c,\beta }$ problem consists of ${\mathit{a}}_1,\cdots ,{\mathit{a}}_{\gamma }\leftarrow R_q$ and a $\mathit{t}={\sum }_{i=1}^{\gamma }{\mathit{a}}_i{\mathit{s}}_i$ where ${\mathit{s}}_i\leftarrow R_q$ and $\parallel {\mathit{s}}_i\parallel \le s$. Find elements ${\mathit{u}}_1,\cdots ,{\mathit{u}}_{\gamma }\in R_q$ with $\parallel \mathit{u}\parallel \le \beta$ and a $\mathit{c}\in {\mathbb{B}}_{\kappa }^n$ with ${0<\parallel \mathit{c}\parallel }_1\le c$ such that

$${\displaystyle \sum _{i=1}^{\gamma }}{\mathit{a}}_i{\mathit{u}}_i=\mathit{t}\mathit{c}\in R_q$$

where $\mathit{u}=[{\mathit{u}}_1\Vert \cdots \Vert {\mathit{u}}_{\gamma }]$.

A lemma in [34] shows under the relationships that $s>2^{\lambda /\left(\gamma d_1\right)-1}·q^{(n+d_1)/\left(\gamma d_1\right)}$ and $sc<q/4$ where $d_1={\parallel \mathit{s}\parallel }_1/d$ and ${\parallel \mathit{s}\parallel }_{\infty }=d$. If there exists an algorithm that solves R-${\mathrm{SIS}}_{q,n,m,s,c,\beta }$ in time t with probability $\epsilon$, there is an algorithm that solves R-${\mathrm{SIS}}_{q,n,m,\beta +sc}$ problem in time poly$\left(n\right)+t$ with at least $(\epsilon -2^{-\lambda })/2$.

As our parameter sets satisfy the above conditions of the bound $sc$, this lemma is also valid in this work, which shows that solving the above R-${\mathrm{SIS}}_{q,n,m,s,c,\beta }$ problem implies solving the R-${\mathrm{SIS}}_{q,n,m,\beta +sc}$ problem. In conclusion, an adversary who breaks the signature scheme can be used to either solve the R-${\mathrm{SIS}}_{q,n,m,2\sqrt{2(\eta -l)}\sqrt{m}}$ problem or the weaker R-${\mathrm{SIS}}_{q,n,m,(2\sqrt{2(\eta -l)}+2d\kappa )\sqrt{m}}$ problem. This completes the proof of our theorem. □

6. Conclusions

Considering that centered binomial distribution is close to the Gaussian distribution while is simple to sample, we construct an efficient lattice-based signature based on the compact rejection sampling apart from Gaussian or uniform distributions. Because of the inherent characteristics of high-precision and semi-uniform operations of the centered binomial distribution, our proposed signature scheme not only avoids the cost of Gaussian sampling but also has very small parameters theoretically.

Our proposed signature scheme does not integrate the bimodal distributions [11] and the compression techniques [12], as we only would like to demonstrate the advantage of the new rejection sampling. Thus there shall be more room to improve the performance of our scheme by adding these techniques. Specifically, the bimodal distribution can reduce the rejection area compared to the unimodal case. This allows the standard deviation of the signature distribution to be smaller. As a result, the generated signatures have much smaller norms and lower entropy. Ideally, when combined with the compression technique, the signature length could be comparable to that of the BLISS scheme. We will take it and the implementation of the entire scheme as future works. In addition, the underlying rejection sampling of our proposed scheme may be also applied to construct more efficient lattice-based privacy-preserving primitives, such as group signatures [35] and ring signatures [36] from the FSwA paradigm.