Computer Science

CLC number: TP391

An Algorithm Substitution Attack on Fiat-Shamir Signatures Based on Lattice

¹ School of Cyber Security, Northwestern Polytechnical University, Xi’an 710072, Shaanxi, China
² Research & Development Institute of Northwestern Polytechnical University, Shenzhen 518057, Guangdong, China
³ School of Cyber Security, Xi’an University of Posts and Telecommunications, Xi’an 710121, Shaanxi, China
⁴ School of Computer Science, Guizhou University of Finance and Economics, Guiyang 550025, Guizhou, China
⁵ School of Computer Science, Wuhan University, Wuhan 430072, Hubei, China

^† To whom correspondence should be addressed. E-mail: yuyongxy@163.com

Received: 15 September 2021

Abstract

Many evidences have showed that some intelligence agencies (often called big brother) attempt to monitor citizens’ communication by providing coerced citizens a lot of subverted cryptographic algorithms and coercing them to adopt these algorithms. Since legalized services on large number of various applications and system architectures depend on digital signature techniques, in the context some coerced users who use double authentication preventing signatures to design some novel digital signature techniques, have some convincing dissertations to defuse requests from authorities and big brothers creating some corresponding subverted signatures. As rapid progress in quantum computers, National Security Agency advisory memorandum and announcement of National Institute of Standards and Technology procedures from standardization focus on some cryptographic algorithms which are post quantum secure. Motivated by these issues, we design an algorithm substitution attack against Fiat-Shamir family based on lattices (e.g., BLISS, BG, Ring-TESLA, PASSSign and GLP) that are proven post-quantum computational secure. We also show an efficient deterable way to eliminate big brother’s threat by leaking signing keys from signatures on two messages to be public. Security proof shows that our schemes satisfy key extraction, undetectability and deterability. Through parameters analysis and performance evaluation, we demonstrate that our deterring subverted Fiat-Shamir signature is practical, which means that it can be applied to privacy and protection in some system architectures.