Abstract:

The lattice-based G+G digital signature is a novel digital signature scheme. It adopts Gaussian convolution technology to replace the flooding or rejection sampling methods commonly used in traditional lattice-based digital signatures, thereby offering a new approach for the design and implementation of lattice-based digital signatures with the Fiat-Shamir transform. However, software experiments have revealed that the G+G scheme can hardly be correctly implemented using its originally recommended parameters. Existing security analyses indicate that the G+G scheme either fails in practical implementation, or works normally but cannot resist ratio attacks based on the truncated Cauchy distribution. Therefore, secure and efficient parameter setting has become a crucial problem for the further research and application of the G+G scheme. By investigating the properties of the private key derivation matrix Σ involved in the G+G scheme, this paper pointed out that the validity of the private key should essentially be verified by judging the positive definiteness of matrix Σ, so as to ensure the G+G signature scheme can resist the ratio attack while being correctly implemented. On this basis, this paper presented a set of parameter adjustment methods for the G+G signature scheme and the recommended specific parameters after adjustment, and then analyzed the impact of parameter adjustment on public key size and signature length. Software experiments confirm the effectiveness of the proposed parameter adjustment methods and the implementation correctness of the G+G scheme with adjusted parameters.

Key words: lattice-based cryptography, G+G digital signature, ratio attack, positive definiteness