DPS: A Post-Quantum Proxy Signature Scheme from Dilithium for IoT Applications

Abstract

Proxy signatures enable the secure delegation of signing authority, which is particularly useful in resource-constrained Internet of Things (IoT) environments. However, most existing schemes rely on classical hardness assumptions and therefore cannot resist quantum attacks. To address the challenge, we propose a post-quantum proxy signature scheme based on Dilithium for IoT scenarios. We first propose an asynchronous remote key generation (ARKG) scheme based on CRYSTALS-Kyber, enabling the delegator and proxy signer to generate proxy keys of Dilithium without real-time interaction. We further integrate ARKG with the Dilithium signature scheme to construct a proxy signature scheme called DPS while ensuring the unlinkability of proxy signatures. Additionally, our proposed DPS achieves post-quantum security and provides unforgeability, distinguishability, verifiability, and undeniability with formal proofs. Experimental performance evaluation shows that our scheme yields significant efficiency gains over existing quantum-safe proxy signature solutions, with 10× speedup for both the delegation and proxy signing phases, as well as a 2.4× improvement in the verification phase.

1. Introduction

Internet of Things (IoT) technology connects billions of intelligent devices across domains such as smart homes, the industrial IoT, and smart healthcare, generating and transmitting vast amounts of data [1,2]. In IoT environments, it is common that devices cannot be legitimately accessed by third parties when the device owner is unavailable or that devices themselves lack sufficient computational resources to handle a large volume of requests. Due to limited computational capability or operational availability, a more powerful proxy—such as a fog node or edge server—could be delegated to cope with these situations, thereby improving operational flexibility, alleviating computational burden and reducing system latency.

Proxy signature schemes in cryptography provide a natural primitive for enabling such delegated authorization. A proxy signature scheme, firstly introduced by Mambo et al. [3], is a specialized digital signature primitive that allows an original signer to delegate their signing authority to a proxy agent. It enables a proxy to generate valid signatures on behalf of the original signer, which can be publicly verified using the original signer’s public key.

Early proxy signature schemes were essentially full delegation signatures, in which the original signer directly provides its private key to the proxy signer [4]. Such a design is clearly insecure in practical delegation scenarios, particularly in IoT environments. A more practical approach is delegation by warrant, where the original signer does not reveal its private key but instead issues an unforgeable delegation credential containing the description of the delegated rights and a signature on the proxy’s public key [4]. However, this kind of schemes mostly rely on the proxy signer’s long-term identity and typically require synchronous interaction, which is unrealistic for resource-constrained IoT devices. To address this limitation, Frymann et al. proposed the cryptographic primitive asynchronous remote key generation (ARKG), which enables non-interactive key derivation [5,6]. They also constructed a certificate-based proxy signature scheme in which the delegation credential signs derived and unlinkable public keys rather than a fixed identity, by integrating ARKG into the Proxy Signature with Unlinkable Warrant (PSUW) framework [7].

Existing proxy signature schemes can also be broadly categorized by their underlying hardness assumptions. Some schemes rely on classical mathematics problems such as discrete logarithms (DLP), integer factorization, or elliptic curve variants (ECC) [3,8,9]. Other classical constructions employ Bilinear Pairings for application like the SE-IDPSC-CS scheme [10] used in cloud data sharing. However, all these schemes are vulnerable to quantum attacks.

To address this threat, post-quantum cryptography (PQC), which aims to be quantum-safe, has been developed. In 2022, the National Institute of Standards and Technology (NIST) selected lattice-based CRYSTALS-Kyber (Kyber) [11] and CRYSTALS-Dilithium (Dilithium) [12] for PQC standardization, which were later standardized as the Module-Lattice-based Key-Encapsulation Mechanism (ML-KEM) [13] and Module-Lattice-based Digital Signature Algorithm (ML-DSA) [14] in 2024, respectively. PQC schemes based on MLWE achieve a good balance between efficiency and storage, making them widely suitable for resource-constrained IoT scenarios [15]. For strong security guarantees, CRYSTALS-Dilithium was extended to a variant called Dilithium-QROM with tight security reductions in the Quantum Random Oracle Model (QROM) [16]. At the same time, various identity-based proxy signature schemes based on lattice have been proposed [17,18,19]. These schemes use identity strings (e.g., email addresses) as public keys with the risk of potential illegal impersonation or unauthorized signing [20] and usually necessitate secure channels for secret key distribution. Moreover, they suffer the significant computational overhead of the lattice trapdoor. Beyond this, existing ARKG instantiations remain largely grounded in classical hardness assumptions [6], and the extension to lattice-based cryptography is limited to asynchronous key generation of sKEM (split KEM) [5], leaving lattice-based signature schemes without a dedicated instantiation. Motivated by the trapdoor-free structure of Dilithium-QROM and the PSUW framework, we propose DPS, an efficient post-quantum proxy signature scheme, addressing the synchronization challenges and privacy risks in IoT scenarios. By reconstructing ARKG to enable asynchronous remote key generation for Dilithium-QROM, DPS preserves the asynchrony and unlinkability properties of PSUW while completely eliminating the costly trapdoor computations, thereby significantly reducing the overhead for resource-constrained IoT devices.

1.1. Contribution

Motivated by the need to integrate lattice-based cryptographic primitives into practical IoT applications, we propose a new proxy signature scheme based on Dilithium-QROM tailored for IoT environments, with improved implementation efficiency over other lattice-based works. Our main contributions are as follows:

• We proposed an ARKG scheme based on Kyber for the asynchronous key generation of Dilithium-QROM. It utilizes Kyber as its underlying module to derive, in a one-way manner, a key pair suitable for Dilithium-QROM. The derived key pair can be used as the input to the Dilithium-QROM signing algorithm without compromising its correctness or security guarantees.
• We give the first Dilithium-based proxy signature scheme, denoted as DPS, by instantiating the PSUW framework with our proposed ARKG scheme and Dilithium-QROM. The proposed DPS achieves post-quantum security and provides verifiability, unforgeability, undeniability, and unlinkability, all supported by formal security proofs. Furthermore, constructing proxy signatures directly from Dilithium eliminates the need for lattice trapdoors, leading to improved efficiency.
• We provide an experimental evaluation of the proposed scheme using concrete parameter sets. The results demonstrate that our construction has a greater advantage over other lattice-based schemes in terms of proxy signature efficiency. Specifically, experimental results show that our scheme achieves approximately a 10× speedup for both the delegation and proxy signing phases, as well as a 2.4× performance improvement in the verification phase over comparable works.

1.2. Related Work

Proxy signatures, as a cryptographic primitive enabling the secure delegation of signing rights, hold significant application value in distributed scenarios such as the Industrial Internet of Things (IIoT), Internet of Vehicles (IoV), and cloud data sharing.

Mambo et al. [3] first introduced the concept of proxy signatures, enabling an original signer to delegate signing authority to a proxy signer through a warrant-based mechanism, which laid the theoretical foundation for subsequent studies on delegation and security models. With the development of IoT and IIoT applications, Verma et al. [2] proposed an efficient and provable certificate-based proxy signature scheme with low computational overhead and formal security. To reduce certificate management costs, lightweight certificateless signature schemes are proposed for IoT and IIoT systems [21,22]. However, their constructions suffer from key replacement and secret key distribution problems. Identity-based proxy signature schemes are developed to improve data integrity and authentication [23,24]. These schemes rely on centralized key generation centers and involve complex calculations. More proxy signature schemes for IoV and distributed scenarios are proposed based on algebraic or geometric structures (e.g., bilinear pairings, hyperelliptic curves), yet they generally exhibit poor efficiency [9,25,26]. Notably, the security of these schemes fundamentally relies on traditional hardness assumptions (e.g., the discrete logarithm problem), which have been proven vulnerable to quantum cryptanalysis [27,28].

With the threat of quantum computing, lattice-based cryptography emerged as a leading post-quantum candidate. Wang et al. [29] utilized fixed-dimension lattice basis delegation to optimize efficiency for resource-constrained IoT devices, avoiding the key size expansion inherent in previous techniques [30]. To further enhance functionality, Zhu et al. [18] integrated encryption with signing, proposing an identity-based proxy signcryption scheme that ensures both confidentiality and unforgeability. Guo et al. [17] introduced the identity-based linearly homomorphic proxy signature scheme. This scheme allows a third party to perform linear operations on signed messages while maintaining the validity of the signature, facilitating secure data aggregation.

To mitigate the large key overhead of standard lattices, efficient structured variants like NTRU lattices have been adopted. Wu et al. [29] presented an identity-based proxy signature (IBPS) scheme over NTRU lattices. By leveraging the ring structure of polynomial convolutions, their scheme achieves faster signing operations and more compact signatures compared to unstructured lattice counterparts. Building upon the NTRU framework, Singh et al. [19] recently extended the functionality to blind signatures, preserving the privacy of the message content from the signer.

1.3. Organization

In Section 2, we introduce the notation used throughout the paper and present the necessary preliminaries and basic components. In Section 3, we abstract and model the application scenario and formally define the syntax of our scheme. Section 4 describes the concrete construction of the proposed scheme and provides a security analysis. In Section 5, we present the experimental results and a comparative evaluation with existing schemes. Finally, Section 6 and Section 7 conclude the paper and discusses directions for future work.

2. Preliminaries

This section presents some preliminaries of our proposed scheme. We provide an overview of KEM and Dilithium-QROM used in our construction and give the definitions of ARKG and PSUW, two novel frameworks recently proposed in [5,6].

2.1. Notations

Table 1 summarizes the key mathematical notations and conventions used throughout the paper.

Table 1. Notations and descriptions.

Notation	Description
$R_q$	The polynomial ring ${\mathbb{Z}}_q\left[X\right]/(X^n+1)$
$R_q^{k\times \mathcal{l}}$	A matrix (or vector) consisting of $k\times \mathcal{l}$ (or k) elements from $R_q$
$\mathbf{A},\mathbf{B},\mathbf{C}$	Matrices (uppercase bold)
$\mathbf{a},\mathbf{b},\mathbf{c}$	Vectors (lowercase bold)
${\mathbf{A}}^{\top },{\mathbf{a}}^{\top }$	Transpose of matrix $\mathbf{A}$ or vector $\mathbf{a}$
$x\leftarrow D$	If D is a distribution, it denotes sampling x from distribution D
$x\leftarrow S$	If S is a set, it denotes choosing x uniformly at random from set S
${\parallel ·\parallel ,\parallel ·\parallel }_{\infty }$	The ${\mathcal{l}}_2$ norm and the ${\mathcal{l}}_{\infty }$ norm of a given element, respectively
$B_{\eta }$	A centered binomial distribution with positive integer parameter $\eta$
$S_{\eta }$	The set of all elements satisfying ${\parallel ·\parallel }_{\infty }\le \eta$
$y\leftarrow \mathrm{A}\left(x\right)$	y is sampled from the output of probabilistic algorithm $\mathrm{A}$ on input x
$y:=\mathrm{A}\left(x\right)$	y is the deterministic output of algorithm $\mathrm{A}$ on input x
$\mathrm{Sam}(·)$	An extendable output function from ${\{0,1\}}^{*}\to {\{0,1\}}^{*}$
$H(·)$	A hash function from ${\{0,1\}}^{*}\to {\{0,1\}}^n$ where n is fixed
$\mathrm{PPT}\mathrm{algorithm}$	Probabilistic polynomial-time algorithm
ChSet	The set of possible challenges
($\mathrm{pkdS},\mathrm{skdS}$)	The delegator’s key pair for signing
($\mathrm{pkpS},\mathrm{skpS}$)	The proxy’s key pair for signing

2.2. Dilithium-QROM Signature

Dilithium, which is based on the Module-LWE and Module-SIS problems, has been standardized by NIST as the post-quantum cryptography algorithm ML-DSA [14]. To achieve a tight security reduction in the quantum random oracle model (QROM), Kiltz et al. proposed Dilithium-QROM [16], a variant of Dilithium that fundamentally relies on the hardness of the MLWE problem. This scheme introduces the concept of lossy public keys and constructs a modular security framework, thereby providing resistance against quantum attacks.

Compared to the standard Dilithium scheme, to support a lossy security proof, Dilithium-QROM employs larger parameters n and q, modifies the challenge generation procedure for c, and introduces an explicit upper bound on the counter in the rejection sampling loop. Unlike Dilithium, Dilithium-QROM has only a single bound parameter $\gamma$. While these modifications enable a tight security reduction, they also incur increased storage overhead. The Dilithium-QROM adopted in this work is built upon the construction proposed by Eaton et al. [31]. We reorganize its algorithmic structure to conform to the classical three-tuple signature paradigm (KeyGen, Sign, Verify) without modifying the underlying hardness assumptions, security guarantees, or computational correctness. We give a general description of Dilithium-QROM in Figure 1.

Figure 1. KeyGen, Sign and Verify algorithms of Dilithium-QROM. The detailed implementations of supporting algorithms, including Power2Round, MakeHint, UseHint, Decompose and more, can be found in the specification of Dilithium [14].

2.3. CRYSTALS-Kyber

Kyber [11] is a key encapsulation mechanism (KEM) based on the MLWE problem and has been standardized as Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) [13]. It is constructed by applying the Fujisaki–Okamoto (FO) transform [32] to an IND-CPA-secure public-key encryption scheme, thereby upgrading its security to IND-CCA2. We briefly describe KyberKEM = (KeyGen, EnCap, DeCap) as follows.

• $\mathrm{KyberKEM}.\mathrm{KeyGen}\left(1^{\lambda }\right)\to ({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem})$: The probabilistic key generation algorithm takes the security parameter $\lambda$ as input and outputs a public-secret key pair $({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem})$ where ${\mathrm{pk}}_{kem}\in {\{0,1\}}^{256}\times R_{q_k}^k$ and ${\mathrm{sk}}_{kem}\in R_{q_k}^k$.
• $\mathrm{KyberKEM}.\mathrm{Encap}\left({\mathrm{pk}}_{kem}\right)\to (K,\mathbf{c})$: The probabilistic encapsulation algorithm takes as input a encapsulation public key ${\mathrm{pk}}_{kem}$ and outputs a shared secret $K\in {\{0,1\}}^{256}$ and a ciphertext $\mathbf{c}\in R_{q_k}^{k+1}$.
• $\mathrm{KyberKEM}.\mathrm{Decap}({\mathrm{sk}}_{kem},\mathbf{c})\to K\mathrm{or}\perp$: The deterministic decapsulation algorithm takes as input a decapsulation private key ${\mathrm{sk}}_{kem}$ and the ciphertext $\mathbf{c}$ and outputs a shared secret K or ⊥ on failure.

The Kyber specification provides three parameter sets corresponding to different security levels. Their security levels are based on concrete complexity estimates for BKZ lattice reduction across varying block sizes [33,34,35]. On the theoretical side, KyberKEM is rigorously proven to be IND-CCA secure in the QROM under the MLWE assumption [36].

In this work, we use the Kyber-512 as a building block of our proposed scheme, and denote it as KyberKEM throughout.

2.4. Asynchronous Remote Key Generation, ARKG

ARKG is a recently proposed cryptographic primitive that enables the asynchronous derivation of fresh, unlinkable public keys from an original public key [5]. Only the legitimate key owner can derive the corresponding private keys using the original private key together with auxiliary credentials. Its core security properties are public-key unlinkability and private-key unforgeability.

Definition 1 

(Asynchronous Remote Key Generation). The remote key generation and recovery scheme $\mathrm{ARKG}=(\mathrm{Setup},\mathrm{KGen},\mathrm{DerivePK},\mathrm{DeriveSK},\mathrm{Check})$ consists of the following PPT algorithms:

• $\mathrm{Setup}\left(\lambda \right)$: Generate and output public parameters $\mathrm{pp}$ of the scheme for the security parameter $\lambda \in \mathbb{N}$.
• $\mathrm{KGen}\left(\mathrm{pp}\right)$: Given input parameters $\mathrm{pp}$, generate a private–public key pair $(\mathrm{pk},\mathrm{sk})$.
• $\mathrm{DerivePK}(\mathrm{pk},\mathrm{aux})$: Return a new public key ${\mathrm{pk}}^{\prime }$ together with a credential $\mathrm{cred}$ linking $\mathrm{pk}$ and ${\mathrm{pk}}^{\prime }$. The input auxiliary information $\mathrm{aux}$ is always required but may be empty.
• $\mathrm{DeriveSK}(\mathrm{sk},\mathrm{cred})$: Output either the new private key ${\mathrm{sk}}^{\prime }$, corresponding to ${\mathrm{pk}}^{\prime }$ via $\mathrm{cred}$, or ⊥ on error.
• $\mathrm{Check}({\mathrm{pk}}^{\prime },{\mathrm{sk}}^{\prime })$: On input $({\mathrm{pk}}^{\prime },{\mathrm{sk}}^{\prime })$, return $\mathrm{true}$ if $({\mathrm{pk}}^{\prime },{\mathrm{sk}}^{\prime })$ forms a valid private–public key pair and false otherwise.

2.5. Proxy Signatures with Unlinkable Warrants

Proxy-Signatures with Unlinkable Warrants (PSUW) [6] is built upon ARKG and was originally designed to enable secure account delegation while preserving the core privacy guarantees of the WebAuthn standard. The formal definition of PSUW is presented below.

Definition 2 

(Proxy-Signatures with Unlinkable Warrants). The PSUW scheme consists of six PPT algorithms:

• $\mathrm{Setup}\left(\lambda \right)$: Generate public parameters $\mathrm{pp}$ for security parameter $\lambda \in \mathbb{N}$.
• $\mathrm{dKeyGen}\left(\mathrm{pp}\right)$: Generate private–public key pair $(\mathrm{pkd},\mathrm{skd})$ for a delegator.
• $\mathrm{pKeyGen}\left(\mathrm{pp}\right)$: Generate private–public key pair $(\mathrm{pkp},\mathrm{skp})$ for a proxy.
• $\mathrm{Delegate}(\mathrm{pkd},\mathrm{skp})$: Take the proxy’s public key $\mathrm{pkp}$ and the delegator’s private key $\mathrm{skd}$ as input, and probabilistically return a warrant $\mathrm{warr}$ and delegation data $\mathrm{ddata}$.
• $\mathrm{Sign}(\mathrm{skp},\mathrm{pkd},\mathrm{warr},\mathrm{ddata},m)$: Given the proxy’s private key $\mathrm{skp}$, the delegator’s public key $\mathrm{pkd}$, warrant $\mathrm{warr}$, delegation data $\mathrm{ddata}$, and message m, return a proxy signature $\overline{\sigma }$, or ⊥ on error. Note that $\mathrm{warr}\in \overline{\sigma }$, allowing $\overline{\sigma }$ to be verified as a standalone signature. The $\mathrm{ddata}$ is used to compute the signing key but is not included in $\overline{\sigma }$.
• $\mathrm{Verify}(\mathrm{pkd},\overline{\sigma },m)$: Return $\mathrm{true}$ if $\overline{\sigma }$ is a valid proxy signature on m with respect to $\mathrm{pkd}$, and $\mathrm{false}$ otherwise.

3. Problem Formulation

In this section, we first describe the workflow of proxy signatures in IoT scenarios and define the involved entities Section 3.1. We then present the syntax of our scheme in detail in Section 3.2. Finally, we formalize the corresponding security definitions in Section 3.3.

3.1. System Model of IoT Proposed Scheme

In Internet of Things (IoT) environments, delegating signing capabilities to a proxy entity typically arises in two common situations: the original signer (e.g., the device owner) may be temporarily unavailable to participate in authentication procedures or IoT devices often have limited computational resources and cannot efficiently handle large volumes of authentication or signing requests.

In both cases, the proxy entity performs signing operations on behalf of the original signer within the scope defined by a delegation credential while allowing external parties to verify the validity of the proxy-generated signatures. Based on these observations, we integrate these IoT delegation scenarios into a three-entity model as shown in Figure 2, in which an IoT device or its data owner delegates signing capabilities to a more available or computationally powerful entity to perform authentication or signing tasks on their behalf.

Figure 2. System model of IoT environment using delegation.

• Delegator: The delegator is typically an IoT device (e.g., a sensor or controller) or its owner, who possesses the original signing key pair and controls the device or its data. The delegator authorizes a proxy signer by issuing a verifiable delegation credential.
• Proxy Signer: The proxy signer is the core entity in the proxy signature process. In IoT scenarios, it is usually a trusted entity with stronger computational capabilities, such as a fog node or a cloud server. The proxy signer holds its own long-term key pair and, after receiving authorization from the delegator, obtains the capability to generate proxy signatures on behalf of the delegator.
• Verifier: The verifier represents external service providers or authentication servers, such as device manufacturers or data processing centers. In the system model, the verifier primarily interacts with the proxy signer but may also communicate with the delegator when necessary. Its role is to verify both the legitimacy of the delegation credential and the correctness of the proxy signature generated by the proxy signer.

Remark 1. 

As illustrated in the system model, the delegator typically consists of low-power IoT terminals. To conserve energy, these devices frequently enter sleep mode, making real-time synchronization with the proxy signer impractical; thus, an asynchronous authorization mechanism is essential. Furthermore, the signing workload can be delegated to entities with stronger computational capabilities. Benefiting from Dilithium’s trapdoor-free design, DPS achieves a notable speedup over trapdoor-based schemes, as validated by our experiments, and supports flexible deployment on resource-constrained IoT nodes.

3.2. Syntax of Proposed Scheme

We propose a Dilithium-based proxy signature (DPS) scheme instantiated under the ARKG and PSUW frameworks. The proposed ARKG is a 5-tuple based on the Kyber KEM, consisting of the following PPT algorithms: (SetUp, KeyGen, DerivePK, DeriveSK, Check).

• $\mathrm{ARKG}.\mathrm{SetUp}\left(\lambda \right)\to \mathrm{pp}$: On input the security parameter $\lambda$, this algorithm initializes the global system parameters and outputs two public parameter sets: $\mathrm{ppK}$ for the key encapsulation component and $\mathrm{ppS}$ for the signature component. The complete public parameter tuple is defined as $\mathrm{pp}=(\mathrm{ppK},\mathrm{ppS})$.
• $\mathrm{ARKG}.\mathrm{KeyGen}\left(\mathrm{pp}\right)\to ({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS})$: This algorithm invokes $\mathrm{Kyber}\mathrm{KEM}.\mathrm{KeyGen}$ with $\mathrm{ppK}$ and Dilithium-QROM. KeyGen with $\mathrm{pp}$, obtaining the corresponding keys $({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS})$, where $({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem})$ is the encapsulation key pair and $(\mathrm{pkpS},\mathrm{skpS})$ is the proxy’s signature key pair.
• $\mathrm{ARKG}.\mathrm{DerivePK}(\mathrm{pkpS},{\mathrm{pk}}_{kem})\to ({\mathrm{pk}}_{\tau },\mathrm{cred})$: This algorithm, executed by the delegator, takes as input the proxy’s encapsulation public key ${\mathrm{pk}}_{kem}$ and the proxy’s signature public key $\mathrm{pkpS}$, outputs the derived public key ${\mathrm{pk}}_{\tau }$ for $\mathrm{pkpS}$ and credential $\mathrm{cred}$.
• $\mathrm{ARKG}.\mathrm{DeriveSK}(\mathrm{cred},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS})\to {\mathrm{sk}}_{\tau }$: This algorithm, executed by the proxy, takes as input the credential $\mathrm{cred}$ transmitted by the delegator, the decapsulation private key ${\mathrm{sk}}_{kem}$, and its signature key pair $\mathrm{pkpS},\mathrm{skpS}$, and outputs the derived signature private key ${\mathrm{sk}}_{\tau }$.
• $\mathrm{ARKG}.\mathrm{Check}({\mathrm{pk}}_{\tau },{\mathrm{sk}}_{\tau })$: This algorithm returns $\mathrm{true}$ if ${\mathrm{pk}}_{\tau }$ and ${\mathrm{sk}}_{\tau }$ form a valid public–private key pair, and $\mathrm{false}$ otherwise.

We treat ARKG as an encapsulated cryptographic component and propose the DPS scheme based on the PSUW framework, which consists of six PPT algorithms as described below.

• $\mathrm{DPS}.\mathrm{SetUp}\left(\lambda \right)\to \mathrm{pp}$: This algorithm initializes the global environment of the delegation system. Given the security parameter $\lambda$, it outputs public parameters $\mathrm{pp}$, including $\mathrm{ppK}$ for the key encapsulation component and $\mathrm{ppS}$ for the signature component.
• In the key generation phase, the algorithm generates long-term identity keys. Since the delegator and the proxy assume different roles within the protocol, we distinguish between two key generation procedures. Specifically, given the public parameters $\mathrm{pp}$, the algorithms are defined as follows.
  • $\mathrm{DPS}.\mathrm{dKeyGen}\left(\mathrm{ppS}\right)\to (\mathrm{pkdS},\mathrm{skdS})$: The key generation procedure for the delegator is denoted by DPS.dKeyGen. On inputting public parameter $\mathrm{ppS}$, the delegator invokes Dilithium-QROM. KeyGen to generate its signature key pairs $(\mathrm{pkdS},\mathrm{skdS})$.
  • $\mathrm{DPS}.\mathrm{pKeyGen}(\mathrm{pp}=(\mathrm{ppK},\mathrm{ppS}))\to ({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS})$: The key generation procedure for the proxy signer is denoted by DPS.pKeyGen. On inputting public parameter $\mathrm{ppK}$ and $\mathrm{ppS}$, the proxy signer invokes ARKG. KeyGen to generate its key pairs for encapsulation and signature respectively.
• $\mathrm{DPS}.\mathrm{Delegate}(\mathrm{pkpS},{\mathrm{pk}}_{kem},\mathrm{skdS})\to (\mathrm{ddata},\mathrm{warr}=({\mathrm{pk}}_{\tau },{\sigma }_{\tau }))$: Taking as input the proxy’s signature public key $\mathrm{pkpS}$, encapsulation public key ${\mathrm{pk}}_{kem}$ and the delegator’s signing key $\mathrm{skdS}$, this algorithm invokes $\mathrm{ARKG}.\mathrm{DerivePK}(\mathrm{pkpS},{\mathrm{pk}}_{kem})$ to obtain a derived public key ${\mathrm{pk}}_{\tau }$ and credential $\mathrm{cred}$, where $\mathrm{cred}$ is packed into $\mathrm{ddata}$ for the proxy to recover the corresponding signing key ${\mathrm{sk}}_{\tau }$. The delegator then obtains the signature ${\sigma }_{\tau }$ by signing the derived public key ${\mathrm{pk}}_{\tau }$ with $\mathrm{skdS}$, forming the warrant $\mathrm{warr}:=({\mathrm{pk}}_{\tau },{\sigma }_{\tau })$ that cryptographically binds ${\mathrm{pk}}_{\tau }$ to the delegator’s identity and authorizes the proxy to sign on the delegator’s behalf, and returns $(\mathrm{ddata},\mathrm{warr})$.
• $\mathrm{DPS}.\mathrm{ProxySign}(\mathrm{ddata},\mathrm{pkdS},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS},\mathrm{warr},m)\to {\sigma }_m$: After verifying the warrant $\mathrm{warr},$ the proxy signing algorithm first invokes ARKG. DeriveSK with the credential $\mathrm{cred}$ extracted from $\mathrm{ddata}$ and decapsulation key ${\mathrm{sk}}_{kem}$ and proxy’s key pair $(\mathrm{pkpS},\mathrm{skpS})$ to derive the proxy signing key ${\mathrm{sk}}_{\tau }$, then signs message m with ${\mathrm{sk}}_{\tau }$ to output a valid proxy signature ${\sigma }_m$ using Dilithium-QROM. Sign.
• $\mathrm{DPS}.\mathrm{Verify}(\mathrm{pkdS},\mathrm{warr},{\sigma }_m,m)\to \{\mathrm{true},\mathrm{false}\}$: The verification algorithm is executed by a third-party verification platform and aims to confirm that a signature has been generated by an authorized proxy. Given the delegator’s signature public key $\mathrm{pkdS}$, the corresponding authorization $\mathrm{warr}=({\mathrm{pk}}_{\tau },{\sigma }_{\tau })$, the message attached with its proxy signature ${\sigma }_m$, the algorithm verifies signature ${\sigma }_{\tau }$ with $\mathrm{pkdS}$ and signature ${\sigma }_m$ with ${\mathrm{pk}}_{\tau }$. It outputs $\mathrm{true}$ if both verifications pass, and $\mathrm{false}$ otherwise.

3.3. Security Definitions

The DPS scheme satisfies the security properties of proxy signatures [37], which are described as follows:

• Unforgeability: A designated proxy signer can create a valid proxy signature for the original signer. But the original signer and other third parties who are not designated as a proxy signer cannot create a valid proxy signature.
• Distinguishability: Proxy signatures are distinguishable from normal signatures by everyone.
• Verifiability: From the proxy signature, the verifier can be convinced of the original signer’s agreement on the signed message.
• Strong undeniability: Once a proxy signer creates a valid proxy signature of an original signer, he/she cannot repudiate the signature creation.

To satisfy the unforgeability property, an adversary $\mathcal{A}$ should not be able to forge a proxy signature with respect to a delegator’s public key $\mathrm{pkdS}$ without knowledge of the corresponding secret key $\mathrm{skdS}$. Based on the PSUW framework [7], we define the unforgeability experiment for our scheme in Figure 3. The adversary $\mathcal{A}$ is allowed to make a polynomial number of queries to the oracles modeling registration, delegation, proxy signing, and corruption, which are formally defined in Appendix A.

Figure 3. Unforgeability experiment for DPS scheme.

Definition 3 

(Unforgeability). Let $\mathcal{A}$ be any probabilistic polynomial-time adversary against the unforgeability of the proposed scheme with security parameter λ. A DPS scheme provides unforgeability if the following advantage is negligible in λ:

$${\mathrm{Adv}}_{\mathit{DPS},\mathcal{A}}^{\mathit{unforge}}\left(\lambda \right):=\mathrm{Pr}\left[{\mathrm{Exp}}_{DPS,\mathcal{A}}^{\mathit{unforge}}\left(\lambda \right)=1\right]$$

In addition, DPS provides an unlinkability property by using the PSUW framework. This property is described as follows:

• Unlinkability: If an adversary observes multiple derived public keys and their corresponding proxy signatures, it cannot link them to the long-term public key of the proxy signer.

4. Proposed Scheme

In this section, we first present an ARKG scheme based on Kyber KEM in Section 4.1. Building upon this ARKG scheme and the PSUW framework, we propose a post-quantum proxy signature scheme in the QROM based on Dilithium in Section 4.2. Finally, we provide the security proof and correctness proof of our scheme in Section 4.3 and Section 4.4, respectively.

4.1. ARKG Instantiated on KyberKEM

Inspired by [31], we have instantiated the ARKG scheme based on Kyber KEM, and in this instance, the derived public and private keys can serve as input values for the Dilithium signature algorithm.

• ARKG.SetUp$\left(\lambda \right):$ Given the security parameters $\lambda \in \mathbb{N}$, the system initializes and generates the system public parameters and hash functions using the parameter setting method of the lattice cryptography. The specific algorithm is below.

  (1)

  Runs $\mathrm{KyberKEM}.\mathrm{SetUp}\left(\lambda \right)$ to get parameter $\mathrm{ppK}$.

  (2)

  Runs $\mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M}.\mathrm{SetUp}\left(\lambda \right)$ to get parameters $(q_s,n_s,k,l,d,d^{\prime },\beta ,\gamma ,{\eta }_s)$, where $q_s$ and $n_s$ define the polynomial ring $R={\mathbb{Z}}_{q_s}\left[X\right]/(X^{n_s}+1)$, k and l determine the matrix dimensions, d and $d^{\prime }$ are rounding parameters, and $\beta$, $\gamma$, and ${\eta }_s$ specify the bounds used in key generation and signing.

  (3)

  Initializes secure functions: Hash function $H_1:{\{0,1\}}^{*}\times R_{q_s}^k\times R_{q_s}^k\to \mathrm{ChSet}$, Extendable output function(XOF) $\mathrm{Sam}:{\{0,1\}}^{*}\to R_{q_s}^{k\times \mathcal{l}}$, Deterministic sampling algorithms based on XOF $G_1:R_{q_s}^{\mathcal{l}}\times {\{0,1\}}^{*}\to S_{{\eta }_s}^{\mathcal{l}}\times S_{{\eta }_s}^k$, and $G_2:{\{0,1\}}^{*}\to S_{\gamma -1}^{\mathcal{l}}$.

  (4)

  Publishes the public parameters $\mathrm{pp}=(\mathrm{ppK},\mathrm{ppS})$, where $\mathrm{ppS}=(q_s,n_s,k,l,d,d^{\prime },\beta ,\gamma ,{\eta }_s,H_1,\mathrm{Sam},G_1,G_2)$.

• $\mathrm{ARKG}.\mathrm{KeyGen}\left(\mathrm{pp}\right)$: Taking the public parameter $\mathrm{pp}$ as input, it computes and outputs $({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS})$ as described in Algorithm 1, where $({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem})$ is the encapsulation key pair and $(\mathrm{pkpS},\mathrm{skpS})$ is the proxy’s signature key pair.
• ARKG.DerivePK$(\mathrm{pkpS},{\mathrm{pk}}_{kem})$: Given the proxy’s signature public key $\mathrm{pkpS}$ and the encapsulation public key ${\mathrm{pk}}_{kem}$, it computes and outputs $({\mathrm{pk}}_{\tau },\mathrm{cred})$ as described in Algorithm 2, where ${\mathrm{pk}}_{\tau }$ is the derived key for $\mathrm{pkpS}$ and $\mathrm{cred}$ is a credential data which contains the link between the original key and the derived key.
• ARKG.DeriveSK$(\mathrm{cred},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS})$: Given the credential $\mathrm{cred}$, the decapsulation private key ${\mathrm{sk}}_{kem}$, and the proxy’s signature key pair $(\mathrm{pkpS},\mathrm{skpS})$, it computes and outputs the derived secret key ${\mathrm{sk}}_{\tau }$ for $\mathrm{skpS}$ as described in Algorithm 3.
• ARKG.Check(${\mathrm{pk}}_{\tau },{\mathrm{sk}}_{\tau }$): Given the derived key pair ${\mathrm{pk}}_{\tau }$ and ${\mathrm{sk}}_{\tau }$, this algorithm outputs a boolean value as described in Algorithm 4.

Algorithm 1 ARKG.KeyGen($\mathrm{pp}$)

Input: Public parameter $\mathrm{pp}=(\mathrm{ppK},\mathrm{ppS})$. Output: An encapsulation key pair $({\mathrm{sk}}_{kem},{\mathrm{pk}}_{kem})$ and a signature key pair$(\mathrm{pkpS},\mathrm{skpS})$.   1:  $({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem})\leftarrow \mathrm{KyberKEM}.\mathrm{KeyGen}\left(\mathrm{ppK}\right)$   2:  ${\rho }_{s,p},K_p\leftarrow {\{0,1\}}^{256}$   3:  $\mathbf{A}\leftarrow R_{q_s}^{k\times \mathcal{l}}:=\mathrm{Sam}\left({\rho }_{s,p}\right)$   4:  $({\mathbf{s}}_{1,p},{\mathbf{s}}_{2,p})\leftarrow S_{{\eta }_s}^{\mathcal{l}}\times S_{{\eta }_s}^k$   5:  ${\mathbf{t}}_p:=\mathbf{A}{\mathbf{s}}_{1,p}+{\mathbf{s}}_{2,p}$   6:  ${\mathbf{t}}_{1,p}:={\mathrm{Power2Round}}_{q_s}({\mathbf{t}}_p,d)$   7:  ${\overline{\mathbf{t}}}_{1,p}:={\mathrm{Power2Round}}_{q_s}({\mathbf{t}}_p,d^{\prime }-1)$   8:  ${\mathbf{t}}_{0,p}:={\mathbf{t}}_p-{\mathbf{t}}_{1,p}·2^d$   9:  $\mathrm{pkpS}=({\rho }_{s,p},{\mathbf{t}}_{1,p},{\overline{\mathbf{t}}}_{1,p})$  10:  $\mathrm{skpS}=({\rho }_{s,p},{\mathbf{s}}_{1,p},{\mathbf{s}}_{2,p},{\mathbf{t}}_{0,p},K_p)$  11:  return $({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS})$

Algorithm 2 ARKG.DerivePK($\mathrm{pkpS},{\mathrm{pk}}_{kem}$)

Input: Proxy’s signature public key $\mathrm{pkpS}=({\rho }_{s,p},{\mathbf{t}}_{1,p},{\overline{\mathbf{t}}}_{1,p})$ and the encapsulation public key ${\mathrm{pk}}_{kem}$. Output: The derived public key ${\mathrm{pk}}_{\tau }$, and credential data $\mathrm{cred}$. 1:  $(\tau ,\mathbf{v})\leftarrow \mathrm{KyberKEM.}.\mathrm{Encap}\left({\mathrm{pk}}_{kem}\right)$ 2:  $({\mathbf{s}}_{1,p}^{\prime },{\mathbf{s}}_{2,p}^{\prime }):={\mathrm{G}}_1({\overline{\mathbf{t}}}_{1,p}\parallel \tau )$ 3:  $\mathbf{A}\leftarrow \mathrm{Sam}\left({\rho }_{s,p}\right)$ 4:  ${\mathbf{t}}_p^{\prime }:=\mathbf{A}{\mathbf{s}}_{1,p}^{\prime }+{\mathbf{s}}_{2,p}^{\prime }$ 5:  ${\mathbf{t}}_{1,p}^{\prime }:={\mathrm{Power2Round}}_{{\mathrm{q}}_{\mathrm{s}}}({\mathbf{t}}_p^{\prime },d^{\prime }-1)$ 6:  ${\overline{\mathbf{t}}}_{1,\tau }:={\overline{\mathbf{t}}}_{1,p}+{\mathbf{t}}_{1,p}^{\prime }$ 7:  return $({\mathrm{pk}}_{\tau }=({\rho }_{s,p},{\overline{\mathbf{t}}}_{1,\tau }),\mathrm{cred}=\mathbf{v})$

Algorithm 3 ARKG.DeriveSK($\mathrm{cred},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS}$)

Input: The credential $\mathrm{cred}=\mathbf{v}$, the decapsulation private key ${\mathrm{sk}}_{kem}$, and the proxy’s signature key pair $(\mathrm{pkpS},\mathrm{skpS})=(({\rho }_{s,p},{\mathbf{t}}_{1,p},{\overline{\mathbf{t}}}_{1,p}),({\rho }_{s,p},{\mathbf{s}}_{1,p},{\mathbf{s}}_{2,p},{\mathbf{t}}_{0,p},K_p))$. Output: The derived secret key ${\mathrm{sk}}_{\tau }$. 1:  $\tau :=\mathrm{KyberKEM}.\mathrm{Decap}({\mathrm{sk}}_{kem},\mathbf{v})$ 2:  $({\mathbf{s}}_{1,p}^{\prime },{\mathbf{s}}_{2,p}^{\prime })\leftarrow {\mathrm{G}}_1({\overline{\mathbf{t}}}_{1,p}\parallel \tau )$ 3:  ${\mathbf{s}}_{1,\tau }:={\mathbf{s}}_{1,p}^{\prime }+{\mathbf{s}}_{1,p}$ 4:  ${\mathbf{s}}_{2,\tau }:={\mathbf{s}}_{2,p}^{\prime }+{\mathbf{s}}_{2,p}$ 5:  $\mathbf{A}\leftarrow \mathrm{Sam}\left({\rho }_{s,p}\right)$ 6:  ${\mathbf{t}}_{\tau }:=\mathbf{A}{\mathbf{s}}_{1,\tau }+{\mathbf{s}}_{2,\tau }$ 7:  ${\mathbf{t}}_{0,\tau }:={\mathbf{t}}_{\tau }-{\mathrm{Power2Round}}_{q_s}({\mathbf{t}}_{\tau },d^{\prime })$ 8:  $K_{\tau }:=K_p$ 9:  return ${\mathrm{sk}}_{\tau }=({\rho }_{s,p},{\mathbf{s}}_{1,\tau },{\mathbf{s}}_{2,\tau },{\mathbf{t}}_{0,\tau },K_{\tau })$

Algorithm 4 ARKG.Check(${\mathrm{pk}}_{\tau },{\mathrm{sk}}_{\tau }$)

Input: The derived key pair ${\mathrm{pk}}_{\tau }=({\rho }_{s,p},{\overline{\mathbf{t}}}_{1,\tau })$ and ${\mathrm{sk}}_{\tau }=({\rho }_{s,p},{\mathbf{s}}_{1,\tau },{\mathbf{s}}_{2,\tau },{\mathbf{t}}_{0,\tau },K_{\tau })$. Output: If the check passes, it outputs $\mathrm{true}$; otherwise, $\mathrm{false}$. 1: $\mathbf{A}\leftarrow \mathrm{Sam}\left({\rho }_{s,p}\right)$ 2: ${\mathbf{t}}_{\tau }:=\mathbf{A}{\mathbf{s}}_{1,\tau }+{\mathbf{s}}_{2,\tau }$ 3: ${\mathbf{t}}_{1,\tau }:={\mathrm{Power2Round}}_{q_s}({\mathbf{t}}_{\tau },d^{\prime })$ 4: ${\alpha }_1:={\mathrm{Power2Round}}_{q_s}(2{\mathbf{t}}_{1,\tau }·2^{d^{\prime }-1},d^{\prime })$ 5: ${\alpha }_2:={\mathrm{Power2Round}}_{q_s}({\overline{\mathbf{t}}}_{1,\tau }·2^{d^{\prime }-1},d^{\prime })$ 6: if $\parallel {\alpha }_1-{\alpha }_2{\parallel }_{\infty }\le 1$ then 7:     return true 8: end if 9: return false

4.2. Description of Proposed DPS Scheme

Based on the above building blocks, we propose an innovative lattice-based proxy signature scheme DPS, which relies on our proposed ARKG scheme and the PSUW framework. We also give the workflow of our scheme as shown in Figure 4.

Figure 4. The workflow of DPS scheme.

• DPS.Setup$\left(\lambda \right)$: Given the security parameters $\lambda$, the system runs $\mathrm{ARKG}.\mathrm{SetUp}\left(\lambda \right)$ to get public parameters $\mathrm{pp}$, and parse it as $(\mathrm{ppK},\mathrm{ppS})$.
• DPS.dKeyGen$\left(\mathrm{ppS}\right)$: Delegator generates its own key pair by running
  $\mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M}.\mathrm{KeyGen}\left(\mathrm{ppS}\right)$ to generate $(\mathrm{pkdS},\mathrm{skdS})$:

  $$\begin{array}{cc}\hfill \mathrm{pkdS}& =({\rho }_{s,d},{\mathbf{t}}_{1,d})\in {\{0,1\}}^{256}\times R_{q_s}^k,\hfill \\ \hfill \mathrm{skdS}& =({\rho }_{s,d},{\mathbf{s}}_{1,d},{\mathbf{s}}_{2,d},{\mathbf{t}}_{0,d},K_d)\in {\{0,1\}}^{256}\times S_{{\eta }_s}^{\mathcal{l}}\times S_{{\eta }_s}^k\times R_{q_s}^k\times {\{0,1\}}^{256}.\hfill \end{array}$$
• DPS.pKeyGen$\left(\mathrm{pp}\right)$: The proxy signer generates its own key pairs by running $\mathrm{ARKG}.\mathrm{KeyGen}\left(\mathrm{pp}\right)$ to generate $({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem})$ and $(\mathrm{skpS},\mathrm{pkpS})$:

  $$\begin{array}{cc}\hfill \mathrm{pkpS}& =({\rho }_{s,p},{\mathbf{t}}_{1,p},{\overline{\mathbf{t}}}_{1,p})\in {\{0,1\}}^{256}\times R_{q_s}^k\times R_{q_s}^k,\hfill \\ \hfill \mathrm{skpS}& =({\rho }_{s,p},{\mathbf{s}}_{1,p},{\mathbf{s}}_{2,p},{\mathbf{t}}_{0,p},K_p)\in {\{0,1\}}^{256}\times S_{{\eta }_s}^{\mathcal{l}}\times S_{{\eta }_s}^k\times R_{q_s}^k\times {\{0,1\}}^{256}.\hfill \end{array}$$
• $\mathrm{DPS}.\mathrm{Delegate}(\mathrm{pkpS},{\mathrm{pk}}_{kem},\mathrm{skdS})$: This algorithm takes as input the proxy’s signature public key $\mathrm{pkpS}$, encapsulation public key ${\mathrm{pk}}_{kem}$, and the delegator’s signature private key $\mathrm{skdS}$. It computes and outputs the derived public key ${\mathrm{pk}}_{\tau }$ for $\mathrm{pkpS}$, the delegator’s signature ${\sigma }_{\tau }$ on this derived public key, and the delegation data $\mathrm{ddata}$ as auxiliary information. The formal procedure is described as follows.

  (1)

  Given the proxy’s public key $\mathrm{pkpS}=({\rho }_{s,p},{\mathbf{t}}_{1,p},{\overline{\mathbf{t}}}_{1,p})$ and ${\mathrm{pk}}_{kem}$, compute

  $$({\mathrm{pk}}_{\tau },\mathrm{cred})\leftarrow \mathrm{ARKG}.\mathrm{DerivePK}(\mathrm{pkpS},{\mathrm{pk}}_{kem}).$$

  (2)

  Compute ${\sigma }_{\tau }\leftarrow \mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M}.\mathrm{sign}(\mathrm{skdS},{\mathrm{pk}}_{\tau })$, and output $(\mathrm{ddata}=\mathrm{cred},\mathrm{warr}=({\mathrm{pk}}_{\tau },{\sigma }_{\tau }))$.

• $\mathrm{DPS}.\mathrm{ProxySign}(\mathrm{ddata},\mathrm{pkdS},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS},\mathrm{warr},m)$: The algorithm first verifies the warrant $\mathrm{warr}$ under the delegator’s public key $\mathrm{pkdS}$. If the verification fails, it outputs ⊥. Otherwise, it invokes ARKG. DeriveSK on $\mathrm{ddata}$, ${\mathrm{sk}}_{kem}$, and the proxy signing key pair $(\mathrm{pkpS},\mathrm{skpS})$ to derive the delegated signing key. It then uses the derived key to sign m and outputs the proxy signature $({\sigma }_m,\mathrm{warr})$. The detailed procedure is given in Algorithm 5.

Algorithm 5 DPS.ProxySign(ddata, pkdS, skkem, pkpS, skpS, warr, m))

Input: The delegation data $\mathrm{ddata}$, the delegator’s public key $pkdS$, the decapsulation private key ${\mathrm{sk}}_{kem}$, the proxy’s signature key pair $(\mathrm{pkpS},\mathrm{skpS})$, the warrant $\mathrm{warr}=({\mathrm{pk}}_{\tau },{\sigma }_{\tau })$, and the message m. Output: The signature ${\sigma }_m$ for m and the warrant $\mathrm{warr}$.   1:  if Dilithium-QROM.Verify$(\mathrm{pkdS},{\mathrm{pk}}_{\tau },{\sigma }_{\tau })=\mathrm{false}$ then return ⊥   2:  end if   3:  $({\rho }_{s,p},{\mathbf{s}}_{1,\tau },{\mathbf{s}}_{2,\tau },{\mathbf{t}}_{0,\tau },K_{\tau })\leftarrow \mathrm{ARKG}.\mathrm{DeriveSK}(\mathrm{ddata},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS})$   4:  $\mathbf{A}\leftarrow R_q^{k\times \mathcal{l}}:=\mathrm{Sam}\left({\rho }_{s,p}\right)$   5:  $\kappa :=0$   6:  while $(\mathbf{z},\mathbf{h})=(\perp ,\perp )$ and $\kappa \le 200/(1-\delta )$ do   7:      $\kappa \leftarrow \kappa +1$   8:      $\mathbf{y}\leftarrow {\mathcal{S}}_{\gamma -1}^{\mathcal{l}}:=G_2(K_{\tau }\parallel m\parallel \kappa )$   9:      $\mathbf{w}:=\mathbf{A}\mathbf{y}$  10:      ${\mathbf{w}}_1:={\mathrm{HighBits}}_{q_s}(\mathbf{w},2\gamma )$  11:      $c\leftarrow {\mathrm{H}}_1(m\parallel {\mathbf{w}}_1\parallel {\overline{\mathbf{t}}}_{1,\tau })$  12:      $\mathbf{z}:=\mathbf{y}+c{\mathbf{s}}_{1,\tau }$  13:      if ${\parallel \mathbf{z}\parallel }_{\infty }\ge \gamma -2\beta$ or $\parallel {\mathrm{LowBits}}_{q_s}(\mathbf{w}-c{\mathbf{s}}_{2,\tau },2\gamma ){\parallel }_{\infty }\ge \gamma -2\beta$ then  14:          $(\mathbf{z},\mathbf{h})\leftarrow (\perp ,\perp )$  15:      else  16:          $\mathbf{h}:={\mathrm{MakeHint}}_{q_s}(-c{\mathbf{t}}_{0,\tau },\mathbf{w}-c{\mathbf{s}}_{2,\tau }+c{\mathbf{t}}_{0,\tau },2\gamma )$  17:      end if  18:  end while  19:  ${\sigma }_m:=(\mathbf{z},\mathbf{h},c)$  20:  return $({\sigma }_m,\mathrm{warr})$

6.

DPS.Verify($\mathrm{pkdS},\mathrm{warr},{\sigma }_m,m$): This verification algorithm takes as input the delegator’s signature public key $\mathrm{pkdS}$, the warrant authorized by delegator $\mathrm{warr}=({\mathrm{pk}}_{\tau },{\sigma }_{\tau })$, a proxy signature ${\sigma }_m$ and the message m. It checks whether the signature ${\sigma }_m$ is valid under the public key ${\mathrm{pk}}_{\tau }$, and simultaneously verifies whether the warrant $\mathrm{warr}=({\mathrm{pk}}_{\tau },{\sigma }_{\tau })$ is valid using the verification function $\mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M}.\mathrm{Verify}(\mathrm{pkdS},{\mathrm{pk}}_{\tau },{\sigma }_{\tau })$. The procedure is formally described in Algorithm 6.

Algorithm 6 DPS.Verify(pkdS, warr, σm, m)

Input: The delegator’s public key $\mathrm{pkdS}$, the signature on requested message ${\sigma }_m=({\mathbf{z}}_m,{\mathbf{h}}_m,c_m)$, the warrant $\mathrm{warr}$, and the requested message m. Output: The algorithm outputs $\mathrm{true}$ if both verifications succeed, and $\mathrm{false}$ otherwise. 1:  $\mathbf{A}\leftarrow \mathrm{Sam}\left({\rho }_{s,p}\right)$ 2:  ${\mathbf{w}}_1^{\prime }:={\mathrm{UseHint}}_{q_s}({\mathbf{h}}_m,{\mathbf{Az}}_m-c_m{\overline{\mathbf{t}}}_{1,\tau }·2^{d^{\prime }-1},2\gamma )$ 3:  if $\parallel {\mathbf{z}}_m{\parallel }_{\infty }<\gamma -2\beta$ and $c_m={\mathrm{H}}_1(m\parallel {\mathbf{w}}_1^{\prime }\parallel {\overline{\mathbf{t}}}_{1,\tau })\mathbf{and} \mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M}.\mathrm{Verify}(\mathrm{pkdS},{\mathrm{pk}}_{\tau },{\sigma }_{\tau })$ then 4:      return $\mathrm{true}$ 5:  else 6:      return $\mathrm{false}$ 7:  end if

4.3. Security Proof

Unforgeability. Since the proposed scheme is instantiated using the Kyber KEM and the Dilithium-QROM signature scheme, it inherits their established security guarantees. In particular, the unforgeability of the underlying primitives directly implies the following lemma.

Lemma 1 

(Unforgeability). Let $\mathcal{A}$ be any probabilistic polynomial-time adversary against the unforgeability of the proposed DPS with security parameter λ, $p\left(\lambda \right)$ and $p^{\prime }\left(\lambda \right)$ be polynomials in the security parameter λ. Then we have

$$\begin{array}{c}\hfill {\mathbf{Adv}}_{\mathit{DPS},\mathcal{A}}^{\mathit{unforge}}\left(\lambda \right)\le p\left(\lambda \right){\mathbf{Adv}}_{\mathit{Kyber},\mathcal{B}}^{IND\text{-}CCA}\left(\lambda \right)+p^{\prime }\left(\lambda \right){\mathbf{Adv}}_{Dilithium\text{-}QROM,\mathcal{B}}^{SUF\text{-}CMA}\left(\lambda \right).\end{array}$$

Proof. 

We begin by observing that an adversary $\mathcal{A}$ wins the experiment ${\mathrm{Exp}}_{DPS,\mathcal{A}}^{\mathrm{unforge}}\left(\lambda \right)$ (Figure 3) if it succeeds in either breaking the delegation of warrants or producing a forged signature. This is reflected in Line 5 of the experiment, within the procedure $\mathrm{Verify}$, where two verification checks are performed, namely, $\mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M}.\mathrm{Verify}(\mathrm{pkdS},{\mathrm{pk}}_{\tau },{\sigma }_{\tau })$ and $\mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M}.\mathrm{Verify}({\mathrm{pk}}_{\tau },m,{\sigma }_m)$.

Accordingly, we decompose the advantage of $\mathcal{A}$ into two winning events, denoted by ${\mathcal{E}}_1$ and ${\mathcal{E}}_2$, where ${\mathcal{E}}_1$ corresponds to a forgery of ${\sigma }_{\tau }$ and ${\mathcal{E}}_2$ corresponds to a forgery of ${\sigma }_m$. We bound the adversary’s advantage by the sum of the probabilities of these two events.

$$\mathrm{Pr}\left[{\mathrm{Exp}}_{DPS,\mathcal{A}}^{\mathrm{unforge}}\left(\lambda \right)=1\right]=\mathrm{Pr}[{\mathcal{E}}_1=1]+\mathrm{Pr}[{\mathcal{E}}_2=1].$$

For the forgery of ${\sigma }_{\tau }$, we argue directly that the probability that an adversary wins this game is bounded by the unforgeability of the digital signature scheme Dilithium-QROM, namely,

$$\begin{array}{c}\hfill Pr[{\mathcal{E}}_1=1]\le {\mathbf{Adv}}_{\mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M},\mathcal{B}}^{SUF\text{-}CMA}\left(\lambda \right).\end{array}$$

For the forgery of ${\sigma }_m$, from Theorem 2 of [7] we have that

$$\begin{array}{c}\hfill \mathrm{Pr}[{\mathcal{E}}_2=1]\le p_1\left(\lambda \right)·{\mathbf{Adv}}_{\mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M},\mathcal{B}}^{\mathrm{SUF}-\mathrm{CMA}}\left(\lambda \right)+p_2\left(\lambda \right)·{\mathbf{Adv}}_{\mathrm{ARKG},\mathcal{B}}^{\mathrm{KS}}\left(\lambda \right),\end{array}$$

where $p_1\left(\lambda \right)$ and $p_2\left(\lambda \right)$ are polynomials in the security parameter $\lambda$.

For the secret key security of our ARKG, in a secret key derivation procedure, we first invoke $\mathrm{KyberKEM}.\mathrm{Decap}$ to recover the $\tau$ from the ciphertext. The value $\tau$ is then concatenated with $t_1$ and fed into a cryptographic hash function to generate pseudorandom key material. Therefore, the key security of our ARKG can be reduced to the IND-CCA security of Kyber, and we have

$$\begin{array}{c}\hfill {\mathbf{Adv}}_{\mathrm{ARKG},\mathcal{B}}^{\mathrm{KS}}\left(\lambda \right)\le {\mathbf{Adv}}_{\mathrm{Kyber},\mathcal{B}}^{\mathrm{IND-CCA}}\left(\lambda \right)+\epsilon \left(\lambda \right),\end{array}$$

where $\epsilon \left(\lambda \right)$ is a polynomials that is negligible in $\lambda$. Let $p\left(\lambda \right)=p_2\left(\lambda \right)$ and $p^{\prime }\left(\lambda \right)=1+p_1\left(\lambda \right)$, and finally we obtain

$${\mathbf{Adv}}_{\mathrm{DPS},\mathcal{A}}^{\mathrm{unforge}}\left(\lambda \right)\le p\left(\lambda \right){\mathbf{Adv}}_{\mathrm{Kyber},\mathcal{B}}^{IND\text{-}CCA}\left(\lambda \right)+p^{\prime }\left(\lambda \right){\mathbf{Adv}}_{\mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M},\mathcal{B}}^{SUF\text{-}CMA}\left(\lambda \right)$$

□

Distinguishability. When the verifier receives the signature of the message he requested with $\mathrm{warr}$, double verification must be carried out. Namely, the verifier verifies the proxy certificate authorized by the delegator with the delegator’s public key $\mathrm{pkdS}$, and simultaneously the signature of the message he requests with the proxy public key ${\mathrm{pk}}_{\tau }$. After this procedure, the verifier can distinguish the proxy signatures and common signatures.

Verifiability. In the verification phase, the verifier first uses the delegator’s long-term public key to validate the authorization credential $\mathrm{warr}$ generated for the proxy signer. Subsequently, the proxy public key contained in $\mathrm{warr}$ is used to verify the signature produced by the proxy signer. It is the first step that guarantees that the delegator has explicitly authorized the proxy to perform operations on its behalf.

Strong undeniability. The proxy key pair is jointly generated by the delegator and a designated proxy, ensuring uniqueness. Furthermore, due to the unforgeability of the scheme, no third party can generate a valid proxy signature ${\sigma }_m$. Once the signature successfully passes the verification of its authorization credential, the proxy signer cannot repudiate the signature generation action.

Unlinkability. This is mainly attributed to the indistinguishability during key derivation under the PSUW framework. The shared secret $\tau$ is computationally indistinguishable from a random string. Thus, $t_{1,p}^{\prime }$ derived from $\tau$ is also random, leading to the distribution of $p{k}_{\tau }$ being computationally indistinguishable from a uniform sample over the public key space. Additionally, since the signature carries no trace of the secret key or the original identity, an adversary cannot identify the underlying signer from the signature, either.

4.4. Correctness Proof

Our construction consists of two main components: the ARKG scheme and Dilithium-QROM signature scheme. The correctness of the overall DPS scheme follows from the correctness guarantees of these two building blocks. We first formalize this intuition below and then prove each component separately.

Lemma 2 

(Correctness of DPS). Let ${\tau }_1$ and ${\tau }_2$ denote the failure probabilities of ARKG and Dilithium-QROM, respectively. If both ${\tau }_1$ and ${\tau }_2$ are negligible in the security parameter λ, then the overall failure probability of the DPS scheme satisfies

$$\tau \le {\tau }_1+{\tau }_2,$$

which is also negligible. Hence, the DPS scheme is correct with overwhelming probability.

Correctness of ARKG. Our ARKG construction is instantiated based on KyberKEM. We first recall the correctness notion of KyberKEM.

Definition 4 

(KyberKEM Correctness [36]). Let $\mathrm{KyberKEM}=(\mathrm{KeyGen},\mathrm{Encap},\mathrm{Decap})$. For $(p{k}_{kem},s{k}_{kem})\leftarrow \mathrm{KeyGen}\left(\right)$ and $(K,c)\leftarrow \mathrm{Encap}\left(p{k}_{kem}\right)$, the scheme is said to be ${\delta }_{kem}$-correct if

$$\mathrm{Pr}\left[\mathrm{Decap}(s{k}_{kem},c)\ne K\right]\le {\delta }_{kem}.$$

If ${\delta }_{kem}=0$, the scheme is perfectly correct.

According to the Kyber specification [38], the decapsulation failure probability ${\delta }_{kem}$ is negligible across all security levels, ranging from $2^{-174}$ to $2^{-139}$. To analyze the correctness of the ARKG, we adopt the notion introduced by Frymann et al. [6].

Definition 5 

(ARKG Correctness). An ARKG scheme is correct if for all $\lambda \in \mathbb{N}$ and $\mathrm{pp}\leftarrow \mathrm{Setup}\left(\lambda \right)$,

$$\mathrm{Pr}\left[\mathrm{ARKG}.\mathrm{Check}({\mathrm{pk}}_{\tau },{\mathrm{sk}}_{\tau })=\mathrm{true}\right]=1,$$

where

$$\begin{array}{cc}\hfill ({\mathrm{pk}}_{kem},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS})& \leftarrow \mathrm{ARKG}.\mathrm{KeyGen}\left(\mathrm{pp}\right);\hfill \\ \hfill ({\mathrm{pk}}_{\tau },\mathrm{cred})& \leftarrow \mathrm{ARKG}.\mathrm{DerivePK}(\mathrm{pkpS},{\mathrm{pk}}_{kem});\hfill \\ \hfill {\mathrm{sk}}_{\tau }& \leftarrow \mathrm{ARKG}.\mathrm{DeriveSK}(\mathrm{cred},{\mathrm{sk}}_{kem},\mathrm{pkpS},\mathrm{skpS}).\hfill \end{array}$$

We show in Appendix B that the derived key pair $({\mathrm{pk}}_{\tau },{\mathrm{sk}}_{\tau })$ always satisfies the ARKG.Check predicate, except with probability stemming from KEM decapsulation failure. Combining the above, the overall correctness error of ARKG is dominated by the KyberKEM failure probability, i.e.,

$${\tau }_1={\delta }_{kem}\in [2^{-174},2^{-139}],$$

which is negligible.

Correctness of Dilithium-QROM. We next analyze the correctness of the signature component. For correctness, it is required that for any valid key pair $({\mathrm{pk}}_{\tau },{\mathrm{sk}}_{\tau })$ and any message m, a signature $\sigma \leftarrow \mathrm{D}\mathrm{i}\mathrm{l}\mathrm{i}\mathrm{t}\mathrm{h}\mathrm{i}\mathrm{u}\mathrm{m}\text{-}\mathrm{Q}\mathrm{R}\mathrm{O}\mathrm{M}.\mathrm{Sign}({\mathrm{sk}}_{\tau },m)$ verifies successfully except with negligible probability.

Dilithium-QROM can be viewed as the Fiat–Shamir with aborts transform applied to an identification scheme [39], i.e., $\mathrm{FS}[ID,H,\kappa ]$ [16], where $\kappa$ denotes the maximum number of repetitions.

Lemma 3 

(Lemma 4.4 of [16,31]). Under the conditions

$$\underset{s\in S_{\eta },c\in \mathit{ChSet}}{\max }\parallel c{\mathbf{s}}_{1,\tau }{\parallel }_{\infty }\le \beta ,\underset{t_0\in S_{2^{d^{\prime }}},c\in \mathit{ChSet}}{\max }{\parallel c{\mathbf{t}}_{0,\tau }\parallel }_{\infty }\le \gamma ,$$

with $\beta \ll \gamma$, the identification scheme Dilithium-QROM-ID has correctness error

$${\delta }_{ID}\approx 1-\exp \left(-\beta n\left({\displaystyle \frac{k}{\gamma }}+{\displaystyle \frac{\mathcal{l}}{\gamma }}\right)\right).$$

Due to the use of rejection sampling (i.e., aborts), the signing algorithm repeats the identification protocol up to $\kappa$ times until a valid transcript is obtained. Therefore, the overall failure probability of the signature scheme is

$${\tau }_2={\delta }_{ID}^{\kappa }.$$

Following the parameterization in [14], we set $\kappa ={\displaystyle \frac{200}{1-{\delta }_{ID}}}$, which yields

$${\tau }_2\le \exp (-200),$$

and hence ${\tau }_2$ is negligible.

Combining the above results, the total failure probability of the DPS scheme satisfies

$$\tau \le {\tau }_1+{\tau }_2,$$

where both ${\tau }_1$ and ${\tau }_2$ are negligible. Therefore, the proposed DPS scheme is correct with overwhelming probability.

5. Performance Evaluation

In this section, we first compare the functionality of the proposed scheme with that of other proxy signature schemes [2,17,18,19,20,26,29]. Subsequently, we analyze the theoretical complexity of each post-quantum scheme and finally present our experimental results.

5.1. Functionalities

In terms of functionality, we compare our scheme with both post-quantum proxy signature schemes and classical proxy signature schemes. The comparison mainly focuses on two properties: asynchrony and unlinkability.

• Asynchrony: After the derived proxy public key is generated, the corresponding private key can be computed later by the legitimate key owner, thereby separating the generation process of the public–private key pair.
• QROM: QROM is a strict extension of the classical ROM into the quantum setting. While the classical ROM only models classical adversaries, QROM allows quantum adversaries to query the oracle in superposition [16]. It implies that QROM security is strictly stronger than ROM security and generally requires a separate proof.

Additionally, we stress that our scheme is secure under the QROM. This provides a tighter security guarantee compared with most existing post-quantum proxy signature schemes, whose security proofs are typically established in ROM. Table 2 shows the functionality comparison between our proposed DPS and other related solutions [2,17,18,19,20,26,29].

Table 2. Functionality comparison of different schemes.

Scheme	Post-Quantum Security	Unlinkability	Asynchrony	QROM
Li et al. [20]	✓	✓	×	×
Guo et al. [17]	✓	✓	×	×
Singh et al. [19]	✓	✓	×	×
Wang et al. [29]	✓	✓	×	×
Zhu et al. [18]	✓	✓	×	×
Verma et al. [2]	×	✓	×	×
Ghada et al. [26]	×	✓	✓	×
Ours	✓	✓	✓	✓

5.2. Theoretical Complexity

We consider theoretical complexity from the perspective of space complexity and theoretical time efficiency and compare our proposed DPS with the related post-quantum solutions [18,19,20,29].

Table 3 shows the key and signature size comparison between our proposed scheme and other lattice-based proxy signature schemes [17,18,19,29]. Here, q denotes the modulus and n denotes the dimension. And m represents the dimension of matrix $\mathbf{A}$, while k denotes the dimension of the secret vector. Our proxy signing key and signature structure are consistent with the module-based design of Dilithium. Benefiting from this structure, our scheme achieves significantly more compact sizes compared to traditional lattice-based ID-based proxy signature schemes.

Table 3. Key and signature size comparison of different schemes.

Scheme	PK	SK	Proxy-Signing Key	Signature
SRP+[19]	$n\log q$	$2n\log \left(\sigma \sqrt{n}\right)$	$2n\log \left(\sigma \sqrt{n}\right)$	$6n\log q$
LSL+ [20]	$2mn\log q$	$2mkn\log q$	$3mkn\log q$	$9n\log q$
ZWW+ [18]	$nm\log q$	$mk\log (2d+1)$	$mk\log q$	$\lambda \log k+k\log q+m\log \left(12\sigma \right)$
WHC [29]	$mn\log q$	$m^2\log q$	$m\log q$	$2m\log q$
Ours	$kn\log q$	$(2k+l)n\log (2\eta +1)$	$(2k+l)n\log (2\eta +1)$	$\mathcal{l}n\log \left(2(\gamma -\beta )\right)$

Table 4 shows the theoretical time efficiency of each procedure in our signature scheme and comparisons with other schemes. We denote computational costs as $t_h$ for the hash algorithm, $t_m$ for matrix multiplication, $t_s$ for sample computation, and $t_r$ for rejection sampling cost. $t_{nk}$ denote the NIZK operation which is used in LSL+ [20]. $t_b$, $t_e$ and $t_p$ denote the computational costs of the BasisDel, ExtBasis and SamplePre algorithms, respectively, which are used in [17,18,29]. In the KeyGen and Proxy KeyGen phases, our scheme does not require the computationally intensive SamplePre and ExtBasis operation, resulting in significantly higher time efficiency compared to existing methods. During the Delegate and Proxy Sign phases, our scheme also avoids the costly SamplePre operation relative to LSL+ [20] and WHC [29], thereby achieving improved computational efficiency. Compared to SRP [19] and ZWW+ [18], our scheme requires fewer hash evaluations and matrix multiplications, offering a theoretical advantage in time efficiency. This improvement in efficiency is particularly beneficial in IoT scenarios, where computational resources are often limited.

Table 4. Theoretical time efficiency of different schemes.

Scheme	KeyGen	Delegate	Proxy KeyGen	Proxy Sign	Verify
SRP+ [19]	$t_h+t_s+t_p$	$t_h+3t_m+2t_s+t_r$	$t_h+t_s+t_p$	$5t_h+6t_s+9t_m+2t_r$	$7t_h+7t_m$
LSL+ [20]	$t_h+t_m+t_e$	$3t_h+2t_m+t_e$	$t_h+t_m+t_e$	$3t_h+2t_e+t_p+t_{nk}$	$t_h+t_{nk}$
ZWW+ [18]	$t_h+k{t}_p$	$t_h+t_s+2t_m+t_r$	$2t_h+2t_m+k{t}_p$	$3t_h+t_s+3t_m+t_r$	$3t_h+3t_m$
WHC [29]	$t_m+t_b$	$t_h+t_s+t_p$	$t_h+t_b+t_s$	$t_h+t_p$	$2t_h+6t_m$
Ours	$2t_m+t_h+4t_s$	$2t_h+2t_m+2t_s+t_r$	$t_m+t_h$	$t_h+t_s+2t_m+t_r$	$2t_m+2t_h$

5.3. Experimental Result

In this part, we present the implementation results with the related works [18,19,20,29] as detailed below. The performance is benchmarked across the five fundamental stages of a proxy signature scheme: KeyGen, Proxy KeyGen, Delegate, Proxy Sign, and Verify, where Proxy KeyGen corresponds to the DeriveSK algorithm in our scheme. All experiments run on the same machine with an AMD Ryzen 5 3600 6-Core @3.60 GHz and 32 GB RAM, running Ubuntu 22.04.6 LTS. Our code is publicly available at https://github.com/PQC-ProxySign/DPS (accessed on 10 May 2026). To ensure statistical reliability, all reported timing results are the average of 1000 independent executions. The recommended parameter sets of our DPS scheme are presented in Table 5 for the 128-bit security level in QROM. All performance data in Figure 5 were obtained under this unified setup, ensuring a fair comparison between our DPS scheme and the prior works.

Table 5. Recommended parameters for the DPS scheme.

Dilithium-QROM Parameters
q	$2^{45}-21,283$
$n_s$	512
$(k,\mathcal{l})$	$(4,4)$
d	15
$d^{\prime }=\lfloor {\displaystyle \frac{d}{2}}\rfloor$	7
$\mathrm{ChSet}=\{c\in R\mid \parallel c{\parallel }_{\infty }=1\wedge \parallel c\parallel =\dots \}$	$\sqrt{46}$
$\beta$	322
$\gamma$	905,679
${\eta }_s$	7
BKZ-blocksize [13]	480
Kyber512 Parameters
$q_k$	3329
k	2
BKZ-blocksize [16]	406

Figure 5. Performance comparison of different phases. (a) The comparison of Key Generation Performance. (b) The comparison of Delegate/Proxy Sign/Verify phase.

Remark 2. 

We instantiate Kyber at NIST security level 1 (Kyber512) specified in [13] and adopt the Dilithium-QROM parameter set of [16]. As shown in Table 5, the two parameter sets yield BKZ block sizes of 406 [13] and 480 [16], respectively. Under the standard lattice attack cost model [33,35], both are estimated to provide no less than 128-bit security against lattice attacks. Thus, our scheme satisfies 128-bit security.

As shown in Figure 5a, our scheme significantly outperforms SRP+ and ZWW+ in both the KeyGen and Proxy KeyGen phases. Specifically, the KeyGen time of our scheme is only 1.36 s, which is much lower than that of SRP+ [19] (15.75 s) and ZWW+ [18] (18.34 s). Similarly, in the Proxy KeyGen phase, our scheme requires only 1.24 s, while SRP+ [19] and ZWW+ [18] consume 16.65 s and 18.38 s, respectively. Overall, our scheme achieves approximately 13.5× speedup in the KeyGen phase and 14.8× speedup in the Proxy KeyGen phase compared with existing schemes, demonstrating its high efficiency in key generation-related operations.

As shown in Figure 5b, our scheme exhibits significant performance advantages in the Delegate, Proxy Sign, and Verify phases. In the Delegate phase, our scheme completes the operation in only 7.09 s, achieving 11.6× and 10.3× speedups compared with LSL+ [20] and WHC [29], respectively. Similarly, in the Proxy Sign phase, our scheme only costs 7.08 s, which is 12.2× and 10.25× faster than LSL+ [20] and WHC [29]. In the verification phase, our scheme reduces the running time from 1.32 s and 1.04 s to 0.43 s, achieving approximately 3.1× and 2.4× speedups over LSL+ and WHC, respectively. Overall, our scheme achieves approximately a 10× speedup for both the delegation and proxy signing phases, as well as a 2.4× performance improvement in the verification phase, which further validates its high efficiency in practical scenarios.

6. Discussion

Choice of KEM. Our construction is instantiated with CRYSTALS-Kyber but is not restricted to it. Any post-quantum KEM satisfying CCA security can be used as the encapsulation primitive in DPS.ARKG. Kyber is chosen primarily for its natural compatibility with Dilithium: both are NIST-standardized, MLWE-based, and supported by QROM security proofs. This yields a uniform post-quantum security foundation for the overall DPS scheme. Owing to the modularity of ARKG, alternative post-quantum KEMs can be incorporated without severely changing the high-level proxy-signature design.

Implementation and Performance.We provide both theoretical and empirical evaluations of our lattice-based proxy signature scheme. And the experimental results show computational gains over existing identity-based post-quantum schemes. Notably, most lattice-based proxy constructions lack concrete benchmarks, highlighting opportunities for future work to optimize and rigorously compare these schemes.

Trade-offs and Limitations. As inherent to lattice-based cryptography, our scheme incurs larger public key and signature sizes and longer execution times than classical mathematical problem-based counterparts. While conventional proxy signatures typically run in milliseconds, lattice-based constructions execute in seconds. Integrating lattice-based schemes with specialized hardware is a key avenue for enabling deployment in resource-constrained environments.

Broader Applicability. Beyond the IoT, the scheme’s core framework supports post-quantum secure delegation in diverse authorization scenarios, providing a foundation for broader applications and future research.

7. Conclusions

In this work, we first propose an ARKG scheme based on Kyber to support asynchronous key generation for Dilithium-QROM. Building upon this, we instantiate the first Dilithium-based proxy signature (DPS) under the PSUW framework, which eliminates the need for lattice trapdoors and thus achieves higher efficiency. Furthermore, our scheme supports asynchronous proxy key generation and unlinkability among derived keys, thereby enhancing the flexibility and practical applicability of the scheme in delegated IoT scenarios. We implement our scheme and evaluate it against the state-of-the-art approaches. Experimental results demonstrate that our scheme achieves significant performance improvements in the delegation, proxy signing, and verification phases.