Efficient Lattice-Based Signcryption in Standard Model

Algorithm 3

SampleD(B, 𝑐, 𝑟, 𝚺).

Input:

  Offline phase: Basis 𝐁 of a 𝑞-ary integer Λ=𝐿(𝐁); rounding parameter 𝑟=𝜔(log𝑛);

  positive definite covariance matrix Σ≥𝑟²⋅(4𝐁𝐁^𝐭+𝐈);

  Online phase: a vector 𝑐∈ℤ^𝑛;

Output:

  Vector 𝐯∈  Λ +𝐜 drawn from a distribution within 𝑛𝑒𝑔𝑙(𝑛) statistical distance of 𝐷_{√Λ+𝑐,Σ};

  Offline phase:

(1) Compute 𝐙=𝑞⋅𝐁^−𝟏∈ℤ^𝑛×𝑛;

(2) Let    𝚺_𝟏= 2𝑟²⋅𝐁𝐁^𝐭, let 𝚺_𝟐= 𝚺− 𝚺_𝟏≥ 𝑟²⋅(2𝐁𝐁^𝐭)+𝐈, and compute some M𝐁_𝟏=𝚺_𝟐−𝑟²;

(3) Choose𝐲 from 𝐷_ℤ^𝑛_,Σ2 by letting 𝐲←𝐁_𝟏⋅𝐷_1𝑟;

    Online phase:

(4) Return 𝑥←𝐙(𝐜−𝐲)/𝑞_𝑟.