[Paper Review] Design and Implementation of a Digital Signature Scheme Based on Low-density Generator Matrix Codes

Marco Baldi, Alessandro Barenghi+5 more|arXiv (Cornell University)|Jul 16, 2018

Coding theory and cryptography18 references3 citations

TL;DR

This paper presents LEDAsig, a post-quantum digital signature scheme based on low-density generator matrix (LDGM) codes, offering high efficiency and compact keys. It introduces optimized algorithms for key generation, signing, and verification, while providing rigorous security estimates against classical and quantum attacks, enabling new parameter choices for long-term security and performance benchmarks via a publicly available implementation.

ABSTRACT

In this paper we consider a post-quantum digital signature scheme based on low-density generator matrix codes and propose efficient algorithmic solutions for its implementation. We also review all known attacks against this scheme and derive closed-form estimates of their complexity when running over both classical and quantum computers. Based on these estimates, we propose new parametrization for the considered system to achieve given pre-quantum and post-quantum security levels. Finally, we provide and discuss performance benchmarks obtained through a suitably developed and publicly available reference implementation of the considered system.

Motivation & Objective

• To design an efficient, post-quantum digital signature scheme resistant to both classical and quantum attacks.
• To address the limitations of prior code-based signature schemes, such as high decoding complexity and vulnerability to statistical key recovery.
• To provide new parameter sets that ensure long-term security under both pre-quantum and post-quantum threat models.
• To implement and benchmark LEDAsig with optimized algorithms for practical deployment.
• To analyze and estimate the complexity of all known attacks on the scheme, including recent statistical and quantum-optimized attacks.

Proposed method

• The scheme uses a private quasi-cyclic low-density generator matrix (QC-LDGM) code and a public quasi-cyclic (QC) code derived from it, enabling efficient signature generation via syndrome decoding.
• It leverages a sparse syndrome decoding problem (sparse SDP) where only low-weight syndromes are used, reducing decoding to vector manipulation without requiring full decoding.
• A public function $\mathcal{F}_{\Theta}$ maps message hashes to low-weight vectors $s$ of length $r$ and weight $w \ll r$, forming the public syndrome.
• The scheme uses a random codeword $c$ of weight $w_c$ to mask the signature, with the attacker unable to distinguish bits set in the secret support from random ones.
• Security analysis includes deriving closed-form probability estimates for statistical key recovery, using $P_I(w_L, w_c)$ and $P_J(w_L, w_c)$ to model bit distinguishability across signatures.
• The attack complexity is estimated using iterative application of equation (70) and combined with $P_{\land}(r, \{s_1,\dots,s_L\}, w_L)$ to compute the success probability of statistical key recovery ($P_{\text{SIA}}$).

Experimental results

Research questions

• RQ1 How can a code-based digital signature scheme be designed to be both efficient and secure against known attacks, including quantum-optimized ones?
• RQ2 What are the precise computational complexities of known attacks on LDGM-based signatures, including statistical and quantum attacks, under classical and quantum computing models?
• RQ3 How can the system parameters be reparametrized to ensure long-term security while maintaining high performance?
• RQ4 What is the actual performance of the scheme in practice, and how does it compare to existing code-based signature schemes?
• RQ5 Can statistical side-channel analysis be mitigated through careful parameter selection and masking techniques?

Key findings

• The scheme achieves signature generation throughput of approximately 60,000 signatures per second on embedded hardware, making it one of the fastest code-based signature schemes in open literature.
• The authors derive closed-form expressions for the probability of bit distinguishability in statistical attacks, enabling precise estimation of key recovery success rates.
• By analyzing both classical and quantum attack complexities, the paper proposes new parameter sets that achieve 128-bit classical and 128-bit post-quantum security levels.
• The probability of successful statistical key recovery is significantly reduced by increasing the number of signatures $L$ and carefully selecting $w_L$, $w_c$, and code parameters.
• The reference implementation of LEDAsig is publicly available, enabling reproducible performance benchmarks and further research.
• The analysis shows that the use of a random codeword $c$ with controlled weight $w_c$ effectively masks the secret structure, preventing statistical leakage across multiple signatures.