Efficient Lattice-Based Signcryption in Standard Model

Algorithm 4

SampleDG(T, 𝐀_𝟎, 𝐌_𝐈, y, 𝑠).

Input:

  Offline phase:

   (i) Trapdoor matrix 𝐓∈𝑍^𝑚0_𝑞^×𝑤;

   (ii) Partial parity-check matrix 𝐀_𝟎∈ℤ^𝑛×𝑚0_𝑞;

   (iii) Positive definite 𝐓𝐈𝚺≥(2+𝚺_𝐆)[𝐓^𝐭‖𝐈], for example, any 𝚺=𝑠²≥(𝑠₁(𝐓)²+1)(𝑠₁(𝚺_𝐆)+2).

  Online phase:

   (i) Invertible tag 𝐌_𝐈∈ℤ_𝑞^𝑛×𝑚 defining 𝐀=[𝐀_𝟎‖𝐌_𝐈𝐆−𝐀_𝟎𝐓];

   (ii) Syndrome 𝐲∈ℤ^𝑛_𝑞.

Output:

  A vector 𝐱, which is statistically close to 𝐷_{√Λ(𝟏/𝐲)(𝐀),𝑟𝚺}.

  Offline phase:

(1) Compute 𝚺_𝐩𝐓𝐈=𝚺−𝚺_𝐆[𝐓^𝐭𝐓𝐈‖𝐈]≥𝟐[𝐓^𝐭‖𝐈], choose vector 𝐩←𝐷_{ℤ𝑚,𝑟𝚺𝐩};

(2) Parse 𝐏𝐏=^𝟏𝐏_𝟐 where 𝐩_𝟏∈ℤ^𝑚0, 𝐩_𝟐∈ℤ^𝑤. Compute 𝐰_𝟎=𝐀_𝟎(𝐩_𝟏−𝐓𝐩_𝟐)∈ℤ^𝑛_𝑞 and 𝐰=𝐆𝐏_𝟐∈ℤ^𝑛_𝑞;

    Online phase:

(3) Compute 𝐯←𝐌_𝐈^−𝟏(𝐲−𝐰_𝟎)−𝐰=𝐌_𝐈^−𝟏(𝐲−𝐀𝐩)∈ℤ^𝑛_𝑞;

(4) Choose 𝐳←𝐷_{Λ(𝟏/𝐕)(𝐆),𝑟𝚺𝐆} by calling SampleD(𝐒_𝐤,𝐯,𝑟,𝚺_𝐆) see Algorithm 3;

(5) Return 𝐓𝐈𝐱=𝐩+𝐳.