Fiat-Shamir with Aborts: Applications to Lattice and Factoring-Based Signatures

We demonstrate how the framework that is used for creating efficient number-theoretic ID and signature schemes can be transferred into the setting of lattices. This results in constructions of the most efficient to-date identification and signature schemes with security based on the worst-case hardness of problems in ideal lattices. In particular, our ID scheme has communication complexity of around 65, 000 bits and the length of the signatures produced by our signature scheme is about 50, 000 bits. All prior lattice-based identification schemes required on the order of millions of bits to be transferred, while all previous lattice-based signature schemes were either stateful, too inefficient, or produced signatures whose lengths were also on the order of millions of bits. The security of our identification scheme is based on the hardness of finding the approximate shortest vector to within a factor of ˜O(n2 ) in the standard model, while the security of the signature scheme is b...

• Type: Conference
• Year: 2009
• Where: ASIACRYPT
• Authors: Vadim Lyubashevsky
• Keywords: ASIACRYPT 2009, Cryptology, Identification Scheme, Lattice-based Signature Schemes, Signature Scheme