a590003

6 Applications
The main applications of “strong” trapdoors have included digital signature schemes in both the randomoracle
and standard models, encryption secure under chosen-ciphertext attack (CCA), and (hierarchical)
identity-based encryption. Here we focus on signature schemes and CCA-secure encryption, where our
techniques lead to significant new improvements (beyond what is obtained by plugging in our trapdoor
generator as a “black box”). Where appropriate, we also briefly mention the improvements that are possible
in the remaining applications.
6.1 Algebraic Background
In our applications we need a special collection of elements from a certain ring R, which induce invertible
matrices H ∈ Z n×n
q as required by our trapdoor construction. We construct such a ring using ideas from the
literature on secret sharing over groups and modules, e.g., [DF94, Feh98]. Define the ring R = Z q [x]/(f(x))
for some monic degree-n polynomial f(x) = x n + f n−1 x n−1 + · · · + f 0 ∈ Z[x] that is irreducible
modulo every prime p dividing q. (Such an f(x) can be constructed by finding monic irreducible degreen
polynomials in Z p [x] for each prime p dividing q, and using the Chinese remainder theorem on their
coefficients to get f(x).) Recall that R is a free Z q -module of rank n, i.e., the elements of R can be
represented as vectors in Z n q relative to the standard basis of monomials 1, x, . . . , x n−1 . Multiplication by
any fixed element of R then acts as a linear transformation on Z n q according to the rule x · (a 0 , . . . , a n−1 ) t =
(0, a 0 , . . . , a n−2 ) t −a n−1 (f 0 , f 1 , . . . , f n−1 ) t , and so can be represented by an (efficiently computable) matrix
in Z n×n
q relative to the standard basis. In other words, there is an injective ring homomorphism h: R → Z n×n
q
that maps any a ∈ R to the matrix H = h(a) representing multiplication by a. In particular, H is invertible
if and only if a ∈ R ∗ , the set of units in R. By the Chinese remainder theorem, and because Z p [x]/(f(x))
is a field by construction of f(x), an element a ∈ R is a unit exactly when it is nonzero (as a polynomial
residue) modulo every prime p dividing q. We use this fact quite essentially in the constructions that follow.
6.2 Signature Schemes
6.2.1 Definitions
A signature scheme SIG for a message space M (which may depend on the security parameter n) is a tuple
of PPT algorithms as follows:
• Gen(1 n ) outputs a verification key vk and a signing key sk.
• Sign(sk, µ), given a signing key sk and a message µ ∈ M, outputs a signature σ ∈ {0, 1} ∗ .
• Ver(vk, µ, σ), given a verification key vk, a message µ, and a signature σ, either accepts or rejects.
The correctness requirement is: for any µ ∈ M, generate (vk, sk) ← Gen(1 n ) and σ ← Sign(sk, µ). Then
Ver(vk, µ, σ) should accept with overwhelming probability (over all the randomness in the experiment).
We recall two standard notions of security for signatures. An intermediate notion is strong unforgeability
under static chosen-message attack, or su-scma security, is defined as follows: first, the forger F
outputs a list of distinct query messages µ (1) , . . . , µ (Q) for some Q. (The distinctness condition simplifies
our construction, and does not affect the notion’s usefulness.) Next, we generate (vk, sk) ← Gen(1 n )
and σ (i) ← Sign(sk, µ (i) ) for each i ∈ [Q], then give vk and each σ (i) to F. Finally, F outputs an attempted
forgery (µ ∗ , σ ∗ ). The forger’s advantage Adv su-scma
SIG (F) is the probability that Ver(vk, µ ∗ , σ ∗ )
accepts and (µ ∗ , σ ∗ ) ≠ (µ (i) , σ (i) ) for all i ∈ [Q], taken over all the randomness of the experiment. The
30
4. Trapdoors for Lattices