Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

MIRANDA: short signatures from a leakage-free full-domain-hash scheme

Alain Couvreur, Thomas Debris-Alazard, Philippe Gaborit, Adrien Vinçotte

TL;DR

Miranda introduces a quantum-resistant FDH signature family built on matrix codes by integrating the GPV trapdoor framework with an AddRemove masking of Gabidulin codes. The core idea is to decode a public, randomly masked code by sampling a random component from a trapdoor code, yielding many preimages while preserving uniformity to prevent leakage of the trapdoor. The scheme achieves short signatures (as small as ~90 bytes) and moderate public-key sizes (~2.6 MB) at 128-bit classical security, with signing that can be parallelized and does not require rejection sampling. Miranda’s security relies on the hardness of inverting a MinRank-type problem in the masked-code setting, complemented by an average trapdoor preimage sampling property proven via the leftover hash lemma, making the signatures non-informative about the trapdoor. Beyond Gabidulin codes, the authors show the framework can accommodate any code that decodes uniquely, offering a versatile approach to secure, FDH-based signatures in the post-quantum era.

Abstract

We present $\mathsf{Miranda}$, the first family of full-domain-hash signatures based on matrix codes. This signature scheme fulfils the paradigm of Gentry, Peikert and Vaikuntanathan ($\mathsf{GPV}$), which gives strong security guarantees. Our trapdoor is very simple and generic: if we propose it with matrix codes, it can actually be instantiated in many other ways since it only involves a subcode of a decodable code (or lattice) in a unique decoding regime of parameters. Though $\mathsf{Miranda}$ signing algorithm relies on a decoding task where there is exactly one solution, there are many possible signatures given a message to sign and we ensure that signatures are not leaking information on their underlying trapdoor by means of a very simple procedure involving the drawing of a small number of uniform bits. In particular $\mathsf{Miranda}$ does not use a rejection sampling procedure which makes its implementation a very simple task contrary to other $\mathsf{GPV}$-like signatures schemes such as $\mathsf{Falcon}$ or even $\mathsf{Wave}$. We instantiate $\mathsf{Miranda}$ with the famous family of Gabidulin codes represented as spaces of matrices and we study thoroughly its security (in the EUF-CMA security model). For~$128$ bits of classical security, the signature sizes are as low as~$90$ bytes and the public key sizes are in the order of~$2.6$ megabytes.

MIRANDA: short signatures from a leakage-free full-domain-hash scheme

TL;DR

Miranda introduces a quantum-resistant FDH signature family built on matrix codes by integrating the GPV trapdoor framework with an AddRemove masking of Gabidulin codes. The core idea is to decode a public, randomly masked code by sampling a random component from a trapdoor code, yielding many preimages while preserving uniformity to prevent leakage of the trapdoor. The scheme achieves short signatures (as small as ~90 bytes) and moderate public-key sizes (~2.6 MB) at 128-bit classical security, with signing that can be parallelized and does not require rejection sampling. Miranda’s security relies on the hardness of inverting a MinRank-type problem in the masked-code setting, complemented by an average trapdoor preimage sampling property proven via the leftover hash lemma, making the signatures non-informative about the trapdoor. Beyond Gabidulin codes, the authors show the framework can accommodate any code that decodes uniquely, offering a versatile approach to secure, FDH-based signatures in the post-quantum era.

Abstract

We present , the first family of full-domain-hash signatures based on matrix codes. This signature scheme fulfils the paradigm of Gentry, Peikert and Vaikuntanathan (), which gives strong security guarantees. Our trapdoor is very simple and generic: if we propose it with matrix codes, it can actually be instantiated in many other ways since it only involves a subcode of a decodable code (or lattice) in a unique decoding regime of parameters. Though signing algorithm relies on a decoding task where there is exactly one solution, there are many possible signatures given a message to sign and we ensure that signatures are not leaking information on their underlying trapdoor by means of a very simple procedure involving the drawing of a small number of uniform bits. In particular does not use a rejection sampling procedure which makes its implementation a very simple task contrary to other -like signatures schemes such as or even . We instantiate with the famous family of Gabidulin codes represented as spaces of matrices and we study thoroughly its security (in the EUF-CMA security model). For~ bits of classical security, the signature sizes are as low as~ bytes and the public key sizes are in the order of~ megabytes.

Paper Structure

This paper contains 24 sections, 15 theorems, 125 equations, 1 figure, 3 tables, 3 algorithms.

Table of Contents

  1. Introduction
  2. Notation and matrix codes background
  3. Rank-based signatures via Average Trapdoor Preimage Sampleable Functions
  4. Miranda signature scheme
  5. Trapdoor: Add-And-Remove matrix codes transformation
  6. Gabidulin codes
  7. $\mathsf{Miranda}$'s trapdoor
  8. Miranda: how to invert with the help of the trapdoor?
  9. About the genericity of our approach
  10. Security
  11. Computing low rank elements in matrix codes
  12. An exponential time distinguisher based on (the lack of) low rank codewords
  13. An attack on the system
  14. About the hidden $\mathbb{F}_{q^m}$--linear structure
  15. Context
  16. ...and 9 more sections

Key Result

Proposition 1

Given a Gabidulin code $\mathsf{Gab}(\mathbf{g},\kappa)$ with parameters $m,n,\kappa,q$, i.e., given the knowledge of $\mathbf{g}\in \mathbb{F}_{q^m}^{n}$ and $\kappa$, there exists a deterministic algorithm $\mathsf{Decode}^{\mathsf{Gab}}$ running in $O(n^{2})$ operations in $\mathbb{F}_{q^m}$ and

Figures (1)

  • Figure 1: Element of an $m \times n$ matrix code of dimension $k = am+b$ obtained from Gaussian elimination in the matrix code.

Theorems & Definitions (41)

  • Definition 1: $\mathsf{MinRank}$
  • Definition 2
  • Definition 3: Add-and-Remove matrix-code construction
  • Remark 1
  • Definition 4: Gabidulin codes
  • Remark 2
  • Remark 3
  • Remark 4
  • Proposition 1: G85
  • Proposition 2
  • ...and 31 more