Efficient Lattice-Based Signcryption in Standard Model

Table 2

Performance comparison with WHW12 [15] and LMK12 [14].

	WHW12 [15]	LMK12 [14]	Ours
Cipher length in bits	𝑙^′+6𝑙0𝑛log^2𝑞	𝑙^′+6𝑛log^2𝑞	𝑙^′+5𝑛log^2𝑞
public para. size in bits	12(𝑙0−1)𝑛^2log^2𝑞	0	𝑙0𝑛^2log^2𝑞
public key size in bits	12𝑛^2log^2𝑞	6𝑛^2log^2𝑞	2𝑛^2log^2𝑞
private key size in bits	72𝑛^2log^3𝑞	36𝑛^2log^3𝑞	𝑛^2log^3𝑞
Sigcry cost
DGS*	6(𝑙0−1)𝑛log𝑞	0	7𝑛log𝑞
PIS^†	1 PIS of [20]	1 PIS of [20]	1 PIS of [17]
×ℤ𝑞^‡	6𝑙0𝑛^2log𝑞	6𝑛^2log𝑞	8𝑛^2𝑙𝑜𝑔𝑞+𝑛^2log^2𝑞
+ℤ𝑞^∗∗	6𝑙0𝑛log𝑞	6𝑛log𝑞	𝑙0/2⋅𝑛^2log^2𝑞
Unsc cost
×ℤ𝑞^‡	72𝑛^2log^2𝑞+(𝑙0+6)𝑛^2log𝑞	72𝑛^2log^2𝑞+6𝑛^2log𝑞	9𝑛^2log𝑞+3𝑛^2log^2𝑞
+ℤ𝑞^∗∗	6(𝑙0−1)𝑛log𝑞	6𝑛log𝑞	𝑙0/2⋅𝑛^2log^2𝑞
Security
Model	RO	RO	ST
Conf.***	IND-CCA2	IND-CCA2	IND-CCA2
UF.^#	SUF-CMA	SUF-CMA	SUF-CMA

∗Discrete Gaussian sampling, that is, SampleZ: 𝑧_𝑖←𝐷_{ℤ,𝑠′𝑖,𝑐′𝑖} in [20], †preimage sampling, ‡multiplication over 𝕫_𝑞, **addition over 𝕫_𝑞, ***confidentiality, ^#unforgeability.