Efficient Lattice-Based Signcryption in Standard Model

Algorithm 2

Invert𝒪 (T, A, b, 𝐌_𝐈).

Input:

  Parity-check matrix A ∈ ℤ_𝑞^𝑛×𝑚;

   G-trapdoor T ∈ ℤ^{𝑚0×𝑘𝑛} of A and corresponding invertible tag 𝐌_𝐈 ∈ ℤ_𝑞^𝑛×𝑛;

  Vector 𝐛^𝐭 = 𝑔_𝐀 (s, e) for suitably small e  ∈ ℤ^𝑚.

Output:

  Vectors s and e.

(1) Compute 𝐛^𝐭 = 𝐛^𝐭 𝐓𝐈;

(2) Obtain (𝐬̂, 𝐞̂) by calling 𝒪(𝐛);

(3) Returns s = 𝐌_𝐈^−𝐭𝐬̂ and e = b −  𝐀^𝐭 s.