Practical NTRU Signcryption in the Standard Model

Abstract

Based on the NTRU trapdoor used in NIST’s Falcon, a signcryption scheme following the sign-then-encrypt paradigm is constructed. The existing partitioning technique based on Waters hash over the lattice can not complete the security reduction in the standard model for the signature part due to the “partiality” of the pre-image generated with the NTRU trapdoor. To address this, a variant of Waters hash over small integers is proposed and, the probability of the successful reduction is analyzed. The resulting signcryption achieves existential unforgeability under the adaptive chosen-message attacks. By utilizing the uniqueness of the secret and the noise in an NTRU instance, the tag used in encryption is eliminated. Furthermore, a method to construct tamper-sensitive lattice public key encryption is proposed. This approach implants the ciphertext-sensitive information into the lattice public key encryption and binds it to the encrypted information. The malleability to the public key ciphertext triggers the change of the message–signature pair so that the IND-CCA2 security of the entire ciphertext can be guaranteed by the signature for the message. Thanks to the rational design and the efficiency of the NTRU trapdoor, the computational overhead of the proposed scheme is reduced significantly compared to the existing lattice-based signcryption scheme, reaching orders of magnitude improvement in efficiency. The experiment shows that the proposed scheme is efficient.

1. Introduction

Network interaction in complex scenarios provides better services and more convenience for people to live, work, and study. The information security issues in complex scenarios have also become a thorny issue for network workers. In general, a common requirement for information security in complex scenarios is to ensure the comprehensive security of information: confidentiality, integrity, authentication, and non-repudiation. The signcryption due to Zheng [1] can simultaneously guarantee the above-integrated security at a low cost. Designing a secure signcryption scheme has become a research hotspot. Cryptographers have conducted a lot of in-depth research on signcryption based on the number theory and have achieved a series of good results. However, the rapid development of quantum computing [2] has posed a serious threat to the security foundation of traditional cryptography based on number theory. Lattice-based cryptography is becoming the backbone of quantum-resistant cryptography, due to its advantages in efficiency, flexibility, and security in the average case. It has become a common concern to construct a signcryption scheme based on the lattice.

1.1. Related Works

To resist quantum attacks, Li et al. proposed the first lattice-based signcryption [3]. After that, the lattice signcryption is developed in three directions: different security models, advanced primitives, and specific applications. Regarding the applications, the signcryption applied to the management of health records has been studied in depth [4,5]. In terms of advanced signcryption primitives, the identity-based signcryption scheme [6], attribute-based signcryption scheme [7] (to support non-interactive fine-grained access control), and multi-recipient scheme [8] were constructed. For the security model, the schemes under the random oracle [9,10,11,12,13], in which [11] is the most efficient due to drawing lessons from the signcryption on Schnorr signature from [14] and the compression technique [15,16], and some schemes under the standard model were constructed.

In 2013, Yan et al. constructed a secure lattice signcryption scheme [17] under the standard model (YWW+13 [17] for short) based on the MP trapdoor [18]. This scheme follows the sign-then-encrypt (StE) paradigm, and the security of the ciphertext must be shifted to a reliance on the unforgeability of the signature with the help of the message authentication code (MAC). In fact, the MAC itself has the ability to improve IND-CCA1 security to IND-CCA2 security. Since the tag used for encryption is generated with the signature value, the lattice-based chameleon hash function is required in the process to vanish the trapdoor for completing the security reduction, which increases the computational overhead and the size of the public key. In 2018, Sato et al. made great progress in proposing a secure signcryption scheme [19] (SS18 [19] for short) under the standard model also based on the MP trapdoor. The lattice-based public key encryption (PKE) is actually an instance of learning with errors (LWE), ${\mathbf{c}}^{\prime }$ = ${[\mathbf{A}\parallel \mathbf{u}]}^t\mathbf{s}+\mathbf{e}$, plus the encoding of the message $[\mathbf{0}\parallel \mu ]\lfloor q/2\rfloor$. The malleability of the ciphertext lies in the homomorphic computational property of the LWE instance and that of the message. That is, it will affect the decryption, adding ${[\mathbf{A}\parallel \mathbf{u}]}^t{\mathbf{s}}^{\prime }$ to the LWE instance, appending a small error ${\mathbf{e}}^{\prime }$ to the LWE instance or superimposing additional information to the message. To eliminate the malleability of the ciphertext, the LWE instance is signed along with the original message in SS18 [19]. Meanwhile, the homomorphic malleability to the plaintext code will of course break the signatures. In this sense, the scheme belongs to the encrypt-then-sign (EtS) paradigm instead of the StE paradigm, as they claim. In 2019, Yang et al. constructed a signcryption scheme [20] (YCL+19 [20] for short) under the standard model based on ring learning with errors (RLWE) [21]. YCL+19 uses the key exchange [22,23] rather than the public key encryption to generate the key for the symmetric encryption, which reduces the size of the public key encryption. The hint information of the lattice-based key exchange is naturally immune to tampering due to its sensitivity to key recovery. However, it incurs a security risk to expose another part of the key exchange. Liu et al. proposed an NTRU-based signcryption [24] (LTTM19 [24] for short) by adopting NTRU-based key encapsulation [25] and an NTRU-based signature [26]. However, the unsigncryption queries can not be implemented in the security reduction under the standard model, so the scheme is not IND-CCA2 secure as they claimed. In the sign-then-encrypt (StE) paradigm, the signature seems more natural than that in encrypt-then-sign (EtS) paradigm since it is signed only for the message. Moreover, the construction of signcryption under the StE paradigm is more concerned with cryptographers [27,28]. It is also a problem of great importance to design a secure lattice-based signcryption scheme following the StE paradigm.

To address the quantum threat to cryptography based on number theory, in 2017, the National Institute of Standards and Technology (NIST) began collecting the post-quantum public key cryptography algorithms through an open, competitive process. The post-quantum cryptographic (PQC) algorithm should meet the following five requirements: secure under the existing computing conditions and quantum computers, fast operation, reasonable communication overhead, can be used as a direct replacement for the existing algorithms and protocols, and broad application scenarios. After many rounds of rigorous screening, NIST announced the screening results of the third round of post-quantum cryptographic algorithm standardization in July 2022. In the four post-quantum algorithms, there are two lattice-based signature algorithms, CRYSTALS-Dilithium [29] and Falcon [30], and they are more efficient than the hash-based signature. In fact, in May 2022, the scientists from Google published the latest research results [31] in the journal “Nature” to illustrate the importance of post-quantum cryptography (PQC) and appeal to transition to PQC. Thus, it is a natural question: Can an efficient signcryption scheme following the StE paradigm be designed based on the NIST standard, which is secure in the standard model and does not require MAC transferring?

1.2. Proposed Design

To resist quantum attacks, we construct a signcryption scheme based on NTRU, referred to as SC-NTRU. Our contribution can be summarized in two main points. First, we introduce an approach to improve the security of the encryption segment using the signature segment for the messages in the signcryption. The signature security can be appropriately decreased compared with that in the EtS paradigm. Second, we construct a new abort-resistant hash to adapt to the approximate pre-image scenario, and utilize it to build an NTRU signature secure in the standard model. The reasonable design and efficient trapdoor of SC-NTRU lead to a significant reduction in computational overhead, surpassing existing lattice-based signcryption methods by several orders of magnitude.

We have developed a method to achieve IND-CCA2 security in signcryption by combining three techniques. Firstly, we leverage the uniqueness of the secret and noise used in lattice-based encryption to transform tag-based encryption into general encryption. Secondly, we embed sensitive information related to the ciphertext itself into the ciphertext, binding it to the information to be encrypted using public key encryption (PKE). As the entire encryption is a hybrid encryption, the plaintext hidden in PKE serves as a key for symmetric encryption. Any modification to the ciphertext will consequently modify the key of the symmetric encryption due to their interdependence. Thirdly, we exploit the one-to-one property of symmetric encryption, such that a modified public key ciphertext will produce a modified message–signature pair. Subsequently, the unforgeability of the signature can be utilized to check the malleability and enhance the IND-CCA2 security of the complete ciphertext. It is important to note that the signature here does not need to achieve strong unforgeability while the strong unforgeability for a signature is necessary in the general construction of the IND-CCA2 secure encryption scheme. Since the message–signature pair here is encrypted and concealed from potential adversaries, any attempt to forge a signature would result in a new signature. In summary, the requirement for the signature to enhance encryption to IND-CCA2 security is diminished. Even a strong forgery of the signature supplies no help to unsigncrypting.

A common approach to constructing a secure lattice signature scheme in the standard model is through a partitioning technique based on Waters hash [32]. In [33], this hash function takes the form $H({\nu }_0,{\nu }_1,\cdots ,{\nu }_{\aleph })={\sum }_{i=0}^{\aleph }{(-1)}^{{\nu }_i}{p}_i$, with $p_i\in {\mathbb{Z}}_q$ for $i=0,1,\cdots ,\aleph$; it is also referred to as an abort-resistant hash function. The probability of the hash not aborting is demonstrated using the concept of the hyperplane in [34]. However, we find that this hash proposed in [34] can not help us complete the security reduction for the signature component involved in the signcrytion. The pre-image generated by the NTRU trapdoor exhibits a certain level of “partiality”. The entire NTRU trapdoor does not fall into the category of approximate trapdoors, such as that constructed by Chen [35] based on [18], and the pre-image generated by NTRU trapdoor can be exact in its entirety. However, the checkout polynomial only operates on a subset of the pre-image, which is reflected in its form ${\mathbf{s}}_{\mathbf{1}}+{\mathbf{s}}_{\mathbf{2}}\ast {\mathbf{h}}_{\mathbf{f}}=\mathbf{0}$ (refer to Algorithm 2). In other words, the pre-image corresponding to the checkout polynomial is merely an approximate pre-image, as there exists a small error vector ${\mathbf{x}}^{\prime }=\mathbf{y}-{\mathbf{h}}_{\mathbf{f}}\mathbf{x}$. The range of the existing abort-resistant hash is ${\mathbb{Z}}_q$. When the hash value operates on the checkout polynomial, the product of the hash value and the short error vector $x^{\prime }$ results in a vector close to the uniform distribution over ${\mathbb{Z}}_q^n$. Consequently, this product vector makes it impossible to simulate the signature in security reduction. To address this issue, we modify the hash range to a space with a small value. However, this modification leads to a significant increase in the abort probability, which hinders secure reduction. To overcome this issue, we introduce a new random variable that cyclically selects random numbers when the abort condition is met. This helps to avoid premature abandonment. Subsequently, we need to evaluate the probability of successfully completing reduction when an adversary forges a signature. However, this evaluation is not trivial since the hyperplane model for the abort-resistant hash defined over a ring (${\mathbb{Z}}_q$) is inadequate for the hash over small integers.

2. Preliminaries

In this paper, the notations are as follows. $\mathbb{Z}$: the set of integers; ${\mathbb{Z}}^{+}$: the set of positive integers; $\mathcal{R}$: the ring $\mathcal{R}$: $=\mathbb{Z}\left[x\right]/(1+x^n)$; for a prime q, ${\mathcal{R}}_q$: $=\mathcal{R}/q$; the bold lowercase letter: polynomial or the vector composed of the coefficients of the polynomial; the bold uppercase letter: matrix; $\tilde{\mathbf{B}}$: Gram–Schmidt orthogonalization of the matrix $\mathbf{B}$; $\parallel \mathbf{x}\parallel$: the two-norm of a vector named $\mathbf{x}$; $\parallel \mathbf{X}\parallel$: the maximum of the column vectors, $\parallel \mathbf{X}\parallel =ma{x}_i\{\parallel {\mathbf{X}}_i\parallel \}$.

2.1. NTRU Lattice and Hard Problem

Definition 1 (NTRU Lattice).

Let $\mathcal{R}$: $=\mathbb{Z}\left[x\right]/(1+x^n)$ for some power-of-two integer n. Let $\mathbf{h}=\mathbf{g}\ast {\mathbf{f}}^{-1}modq$ for $\mathbf{f},\mathbf{g}\in \mathcal{R}$ and $q\in {\mathbb{Z}}^{+}$. The corresponding NTRU lattice to $\mathbf{h},\mathbf{f}$ is defined as

$$\begin{array}{c}\hfill \begin{array}{c}\hfill {\Lambda }_{\mathbf{h},q}=\{(\mathbf{u},\mathbf{v})\in {\mathcal{R}}^2|\mathbf{u}+\mathbf{v}\ast \mathbf{h}=\mathbf{0}modq\}.\end{array}\end{array}$$

${\Lambda }_{\mathbf{h},q}$ is a full-rank lattice over ${\mathbb{Z}}^{2n}$ linearly spanned by the row vectors of ${\mathbf{A}}_{\mathbf{h},q}=\left(\begin{array}{cc}-A_N\left(\mathbf{h}\right)& {\mathbf{I}}_{\mathbf{n}}\\ q{\mathbf{I}}_{\mathbf{n}}& {\mathbf{O}}_{\mathbf{n}}\end{array}\right)$, where $A_N\left(\mathbf{h}\right)$ denotes the anti-circulant matrix generated by the vector $\mathbf{h}$.

Definition 2

(Decisional Small Polynomial Ratio: DSPR [36]). Let $\mathcal{R}$: $=\mathbb{Z}\left[x\right]/(1+x^n)$, ${\mathcal{R}}_q=\mathcal{R}/q$. For $\mathbf{g},\mathbf{f}\in \mathcal{R}$ with small coefficients and $\mathbf{f}$ invertible over ${\mathcal{R}}_q$, the distinguishing problem between the distribution of $\mathbf{h}=\mathbf{g}{\mathbf{f}}^{-1}modq$ and that of ${\mathbf{h}}^{\prime }\stackrel{\$}{\leftarrow }{\mathcal{R}}_q$ is defined as the decisional small polynomial ratio problem.

The hardness of the search version of DSPR has been studied in [37].

Definition 3 (Search Learning with Errors in a Ring of Integers).

Let Ψ be a family of distributions over $K_{\mathbb{R}}$ and $2<q\in \mathbb{Z}$. The RLWE problem RLWE${}_{q,\Psi }$ is to find $s\in R_q^{\vee }$ by allowing access to arbitrarily many samples from $A_{s,\Psi }$ for $\psi \in \Psi$.

Proposition 1

(Hardness of RLWE [21]). Let K denote an arbitrary number field with degree n. Let $\mathbb{Z}\ni q=q\left(n\right)\ge 2$ and arbitrary $\alpha =\alpha \left(n\right)\in (0,1)$ satisfying $\alpha q\ge \omega \left(\sqrt{\log n}\right)$. A probabilistic polynomial time quantum reduction can be constructed from K-${\mathrm{DGS}}_{\gamma }$ to ${\mathcal{O}}_K$-${\mathrm{LWE}}_{q,{\Psi }_{\le \alpha }}$, where $\gamma ={\eta }_{ϵ}\left(\mathbf{I}\right)·\omega \left(\sqrt{\log n}\right)/\alpha$.

2.2. Trapdoor Generation and Pre-Image Sample Algorithm

Proposition 2 (NTRU Key Generation).

Inputting dimension n and modulus q, there is an efficient keyGen algorithm to output public key $\mathbf{h}$ and the trapdoor $\mathbf{B}=\left(\begin{array}{cc}{A}_N\left(\mathbf{g}\right)& -A_N\left(\mathbf{f}\right)\\ A_N\left({\mathbf{g}}^{\prime }\right)& -A_N\left({\mathbf{f}}^{\prime }\right)\end{array}\right)$, such that $\mathbf{h}$ is computationally indistinguishable from the uniform distribution over $\mathcal{R}$, $\parallel \tilde{\mathbf{B}}\parallel \le 1.17\sqrt{q}$, and $\mathbf{g},\mathbf{f}\leftarrow D_{{\mathbb{Z}}^n,\eta }$ for $\eta \le 1.17\sqrt{q/\left(2n\right)}$.

Proposition 3

(Pre-Image Sampling [38]). Let $ϵ=2^{-\lambda }/\left(2n\right)$ for arbitrary $n,\lambda \in {\mathbb{Z}}^{+}$, Δ denote statistical distance. For any basis $\mathbf{B}\in {\mathbb{Z}}^{n\times n}$ of ${\Lambda }_{\mathbf{A},q}$ and arbitrary syndrome vector $\mathbf{u}\in {\mathbb{Z}}^n$, there is a pre-image sampling algorithm $\mathcal{GS}$, $\mathbf{x}=\mathcal{GS}(\mathbf{B},\eta ,\mathbf{u})$, such that $\mathbf{A}\mathbf{x}=\mathbf{u}modq$ and $\Delta (D_{\Lambda (\mathbf{B},\eta ,\mathbf{u})},\mathbf{x})\le 2^{-\lambda }$, when $\eta \ge \parallel \tilde{\mathbf{B}}\parallel ·{\zeta }_{ϵ}^{\prime }\left(\mathbb{Z}\right)$ and ${\zeta }_{ϵ}^{\prime }\left(\mathbb{Z}\right)\approx \frac{1}{\pi }\sqrt{\frac{1}{2}ln\left(2+\frac{2}{ϵ}\right)}$. ϵ can be relaxed to $2^{-\lambda /2}/\left(4\sqrt{2}n\right)$, and ${\zeta }_{ϵ}^{\prime }\left(\mathbb{Z}\right)\approx \frac{1}{\sqrt{2}\pi }\sqrt{ln{2}^{(\lambda +7)/2}n}$.

Proposition 4 (Discrete Gaussian Distribution).

Let Λ be an m-dimension lattice. Let real s be the Gauss parameter and $\mathbf{c}\in {\mathbb{R}}^m$ be the center. The discrete Gauss distribution has the following good properties.

1. 

(Lemma 4.4 of [39]) For any positive real k, $Pr\left[\right|x|>ks;x\stackrel{\$}{\leftarrow }{D}_{\mathbb{Z},s}]\le 2e^{-k^2/2}$.

2. 

(Lemma 4.4 of [39]) When $s>3/\sqrt{2\pi }$, $D_{\mathbb{Z},s}^m\left(\mathbf{x}\right)<2^{-m}$ for all vector $\mathbf{x}\in {\mathbb{Z}}^m$.

3. 

(Lemma 4.4 of [39]) For any positive real k, $Pr[\parallel \mathbf{x}\parallel >ks\sqrt{m};\mathbf{x}\stackrel{\$}{\leftarrow }{D}_{\mathbb{Z},s}^m]\le k^m{e}^{(1-k^2)m/2}$.

4. 

(Lemma 4.3 of [39]) Let $t\in {\mathbb{R}}^{+},\mathbf{v}\in {\mathbb{R}}^m$. Then $Pr[\langle \mathbf{z},\mathbf{v}\rangle >t]\le 2e^{-t^2/(2s^2{\parallel \mathbf{v}\parallel }^2)}$.

5. 

(Lemma 4.4 of [40]) $\underset{\mathbf{x}\sim D_{\Lambda ,s,\mathbf{c}}}{Pr}[\parallel \mathbf{x}-\mathbf{c}\parallel \ge s\sqrt{m}]\le {\displaystyle \frac{1-ϵ}{1+ϵ}}{2}^{-m}$.

6. 

(Lemma 5.2 and Corollary 5.4 of [41]) Let $n,m$ be integers, s real and q prime. When $s\ge \omega \left(\sqrt{\log m}\right)$, $s\ge {\eta }_{ϵ}\left({\Lambda }^{\perp }\left(\mathbf{A}\right)\right)$ for $ϵ\in (0,1/2)$. When $m\ge 2n\log q,s\ge \omega \left(\sqrt{\log m}\right)$, with $1-2q^{-n}$ probability, the syndrome $\mathbf{y}=\mathbf{A}\mathbf{x}$ is statistically close to uniform over ${\mathbb{Z}}_q^n$ for all $\mathbf{A}\in {\mathbb{Z}}_q^{n\times m}$, $x\stackrel{\$}{\leftarrow }{D}_{\mathbb{Z},s}^m$.

7. 

(Lemma 2.4 of [42] or lemma 4.4 [40]).

$${\rho }_s(\Lambda +c)\in \left[{\displaystyle \frac{1-ϵ}{1+ϵ}},1\right]·{\rho }_s(\Lambda ).$$

3. Signcryption: Syntax and Security Models

In this section, the syntax and security models of signcryption are presented.

3.1. Syntax of Signcryption

A signcryption scheme is composed of the following four algorithms:

• Setup $\left(\lambda \right)$: This algorithm takes a security parameter $\lambda$ as input, then returns the public parameter $PP$.
• KeyGen $(\lambda ,\mathit{PP})$: Input the security parameter $\lambda$ and the public parameter $PP$, and output the public key and private key pairs $(PK,SK)$ for users.
• SignCrypt $(\mu ,P{K}_s,S{K}_s,P{K}_r)$: Take a message $\mu$, the sender’s public key $P{K}_s$ and private key $S{K}_s$, and the recipient’s public key $P{K}_r$, generate a ciphertext c.
• UnSignCrypt $(c,P{K}_s,S{K}_r)$: Inputting a ciphertext c, the sender’s public key $P{K}_s$ and the recipient’s private key $S{K}_r$, this algorithm unsigncrypts the ciphertext and verifies the signature. If the signature can pass the verification, it returns the message $\mu$, otherwise it returns ⊥.

3.2. Security Models of Signcryption

To clarify the confidence of the signcryption, an IND-CCA2 game is introduced (

Table 1. Game IND-CCA2 between $\mathcal{C}$ and $\mathcal{A}$.

	$\mathcal{C}$	Communication	$\mathcal{A}$
Intial.	$\{(p{k}_s,s{k}_s),(p{k}_r,s{k}_r)\}\leftarrow \mathrm{KeyGen}\left(1^k\right)$	$\stackrel{p{k}_s,p{k}_r,s{k}_s}{\to }$
Phase 1.		$\underset{\mathrm{for}\mathrm{Unsigncrypt}}{\overset{c}{\leftarrow }}$	choose c
	$\mu =\mathrm{UnSigncrypt}(c,p{k}_r,p{k}_s,s{k}_r)$	$\underset{\mathrm{as}\mathrm{reply}}{\overset{\mu }{\to }}$
	…	…	…
Challenge		$\underset{\mathrm{for}\mathrm{challenge}}{\overset{{\mu }_0,{\mu }_1}{\leftarrow }}$	choose ${\mu }_0,{\mu }_1$ with equal length
	Toss a coin b, $c^{\ast }=\mathrm{Signcrypt}({\mu }_b,p{k}_r,p{k}_s,s{k}_s)$	$\underset{\mathrm{as}\mathrm{reply}}{\overset{c^{\ast }}{\to }}$
Phase 2.	repeat Phase 1, except reply ⊥ to the query for $c^{\ast }$	repeat	repeat
Guess		$\underset{\mathrm{as}\mathrm{reply}}{\overset{b^{\prime }}{\leftarrow }}$	guess $b^{\prime }$

).

• Initial: The challenger $\mathcal{C}$ runs the setup and key generation algorithms to generate public parameters $PP$, the receiver’s keys $(P{k}_r,S{K}_r)$, and the sender’s keys $(P{k}_s,S{K}_s)$, followed by giving $(PP,P{k}_r,P{k}_s,S{K}_s)$ to an adversary $\mathcal{A}$.
• Phase 1: The adversary $\mathcal{A}$ implements the unsigncryption queries in an adaptive manner bounded by polynomial times. If c is a valid ciphertext, $\mathcal{C}$ replies with the corresponding plaintext $\mu$, otherwise it returns ⊥.
• Challenge: $\mathcal{A}$ selects two plaintexts ${\mu }_0,{\mu }_1$ with equal length and gives them to $\mathcal{C}$. $\mathcal{C}$ tosses a fair coin $b\in \{0,1\}$ and generates a challenge ciphertext $c^{\ast }=$ signcrypt$(P{K}_s,S{K}_s,$$P{K}_r,{\mu }_b)$ followed by giving $c^{\ast }$ to $\mathcal{A}$.
• Phase 2: $\mathcal{A}$ continues to perform unsigncryption queries as in Phase 1, except for not permitting to query unsigncryption on $c^{\ast }$.
• Guess: $\mathcal{A}$ gives $b^{\ast }$ as the guess on b tossed by $\mathcal{C}$.

Then, the advantage of $\mathcal{A}$ to win Game IND-CCA2 is defined as $Adv\left(\mathcal{A}\right)=|Pr[b=b^{\prime }]-\frac{1}{2}|$.

Definition 4 (Confidentiality of Signcryption).

A signcryption scheme is said to be indistinguishable against inner choose ciphertext attacks (IND-CCA2) if there exists no probabilistic polynomial time inner adversary who can win Game IND-CCA2 with a non-negligible advantage.

To capture the unforgeability of the signcryption, an EUF-CMA game is introduced (

Table 2. Game EUF-CMA between $\mathcal{C}$ and $\mathcal{A}$.

	$\mathcal{C}$	Communication	$\mathcal{A}$
Initial.	$\{(p{k}_s,s{k}_s),(p{k}_r,s{k}_r)\}\leftarrow \mathrm{KeyGen}\left(1^k\right)$	$\stackrel{p{k}_s,p{k}_r,s{k}_r}{\to }$
Queries		$\underset{\mathrm{for}\mathrm{Signcrypt}}{\overset{\mu }{\leftarrow }}$	choose $\mu$
	$c=\mathrm{SC}(\mu ,p{k}_r,p{k}_s,s{k}_s)$	$\underset{\mathrm{as}\mathrm{reply}}{\overset{c}{\to }}$
	…	…	…
Forgery		$\underset{\mathrm{as}\mathrm{reply}}{\overset{c^{\ast }}{\leftarrow }}$	generate $c^{\ast }$

).

• Initial: The challenger $\mathcal{C}$ runs the setup and key generation algorithms to generate public parameters, the keys for the receiver and sender are as in the IND-CCA2 Game. Subsequently, $\mathcal{C}$ gives $(PP,P{k}_s,P{k}_r,S{K}_r)$ to $\mathcal{A}$.
• Signcrypt: $\mathcal{A}$ chooses messages $\mu$ and implements polynomially-bounded signcryption queries by an adaptive approach. $\mathcal{C}$ replies with the corresponding ciphertexts c.
• Forge: $\mathcal{A}$ outputs $c^{\ast }$, which contains a new signature for some $\mu$ that has not been previously queried.

Then, the advantage of $\mathcal{A}$ to win Game EUF-CMA is defined as $Adv\left(\mathcal{A}\right)=Pr\left[\right(\mu ,\sigma )$ = $\mathbf{Unsigncrypt}$$\left(c^{\ast }\right)\mathtt{and}\mathfrak{N}]$, where $\mathfrak{N}$ denotes the fact that $\sigma$ is a valid signature for $\mu$ not discoved by the unsigncryption queries.

Definition 5 (Existential Unforgeability of Signcryption).

A signcryption scheme is said to be existentially unforgeable against inner chosen message attacks (EUF-CMA) if no probabilistic polynomial time forgery can win Game UF-CMA with a non-negligible advantage.

4. Signcryption Based on NTRU

In this section, a signcryption scheme based on NTRU is proposed, followed by its correctness and parameter settings.

4.1. Construction

The symmetric encryption ENC involved in the proposed scheme is IND-OT secure and one-to-one. That is, for a plaintext $\mu$ and symmetric key k, there is only one ciphertext c satisfying DEC${}_k\left(c\right)=\mu$.

• Setup$(1^{\lambda })$: On inputting a security parameter $1^{\lambda }$, generate the public parameters and hash functions.
  • Choose hash functions: $H_0:{\{0,1\}}^{\ast }\to {\{0,1\}}^{\aleph }$, $H_1:R_q\to R_q$, $H_2:R_q\times R_q\to {\{0,1,2,3\}}^n$.
  • $\mathbf{y},\mathbf{u}\stackrel{\$}{\leftarrow }{R}_q$.
  • ${\mathbf{z}}_{\mathbf{i}}\stackrel{\$}{\leftarrow }{R}_q$ for $i=0,1,\cdots ,\aleph$.
  • publish public parameters $(\mathbf{y},\mathbf{u},{\left\{{\mathbf{z}}_{\mathbf{i}}\right\}}_{i=1}^{\aleph })$.
• KeyGen$(1^{\ell })$: User i generates it own public key and private key.
  • $(\mathbf{B},\mathbf{h})\leftarrow \mathrm{KeyGen}(n,q)$ to satisfy $\mathbf{B}\left(\begin{array}{c}\mathbf{i}\\ \mathbf{h}\end{array}\right)=\mathbf{0}$ where $\mathbf{B}=\left(\begin{array}{cc}A\left(\mathbf{g}\right)& -A\left(\mathbf{f}\right)\\ A\left(\mathbf{G}\right)& -A\left(\mathbf{F}\right)\end{array}\right)\in {\mathbb{Z}}^{2n\times 2n}$, The coefficient vector of $\mathbf{i}$ is ${(1,0,0,\cdots ,0)}^t$.
  • $\mathbf{b},\mathbf{d}\stackrel{\$}{\leftarrow }{R}_q$.
  • Publish $(\mathbf{b},\mathbf{d},\mathbf{h})$ as public key and keep $\mathbf{B}$ as private key. Namely, the sender’s (resp. receiver’s) public and private key are $(({\mathbf{b}}_{\mathbf{s}},{\mathbf{d}}_{\mathbf{s}},{\mathbf{h}}_{\mathbf{s}}),{\mathbf{B}}_{\mathbf{s}})$ (resp. $(({\mathbf{b}}_{\mathbf{r}},{\mathbf{d}}_{\mathbf{r}},{\mathbf{h}}_{\mathbf{r}}),{\mathbf{B}}_{\mathbf{r}})$).
• SignCrypt$(\mu ,{\mathbf{h}}_{\mathbf{r}},{\mathbf{B}}_{\mathbf{s}},{\left\{{\mathbf{z}}_{\mathbf{i}}\right\}}_{i=0}^{\aleph })$.
  • $\mathbf{k}\stackrel{\$}{\leftarrow }{\{0,1,2,3\}}^n$.
  • $\nu$: $=H_0(\mu ,{\mathbf{b}}_{\mathbf{r}},\mathbf{k})$.
  • $\mathbf{z}$: $={\mathbf{z}}_{\mathbf{0}}+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{\mathbf{z}}_{\mathbf{i}}$.
  • ${\mathbf{x}}_{\mathbf{1}}\leftarrow D_{{\mathbb{Z}}^n,{\eta }_1}$.
  • $\mathbf{t}$: $=\mathbf{y}-\mathbf{z}{\mathbf{x}}_{\mathbf{1}}$.
  • $({\mathbf{x}}_{\mathbf{0}}^{\prime },{\mathbf{x}}_{\mathbf{0}})$: $=(\mathbf{t},\mathbf{0})-\mathrm{SamplePre}({\mathbf{B}}_{\mathbf{s}},{\eta }_1,(\mathbf{t},\mathbf{0}))$.
  • $\mathbf{x}$: $={({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})}^t$.
  • $\mathbf{r}\stackrel{\$}{\leftarrow }{\{-1,0,1\}}^n$, ${\mathbf{e}}_{\mathbf{0}},{\mathbf{e}}_{\mathbf{2}}\stackrel{\$}{\leftarrow }{\{-\varrho ,\cdots ,\varrho \}}^n$, ${\mathbf{e}}_{\mathbf{1}}\stackrel{\$}{\leftarrow }{([-\varrho \sqrt{n},\varrho \sqrt{n}]\cap \mathbb{Z})}^n$.
  • ${\mathbf{c}}_{\mathbf{0}}$: $=\mathbf{r}{\mathbf{h}}_{\mathbf{r}}+{\mathbf{e}}_{\mathbf{0}}$.
  • ${\mathbf{c}}_{\mathbf{1}}$: $=\mathbf{r}({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}\right){\mathbf{d}}_{\mathbf{r}})+{\mathbf{e}}_{\mathbf{1}}$.
  • ${\mathbf{c}}_{\mathbf{2}}^{\prime }$: $=\lfloor (\mathbf{r}\mathbf{u}+{\mathbf{e}}_{\mathbf{2}})/2^{\ell }\rfloor$.
  • ${\mathbf{c}}_{\mathbf{2}}$: $={\mathbf{c}}_{\mathbf{2}}^{\prime }+\lfloor \left((H_2({\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}}^{\prime })\oplus \mathbf{k})\lfloor q/8\rfloor \right)/2^{\ell }\rfloor$.
  • $c_3$: $={\mathtt{Enc}}_{H_3\left(\mathbf{k}\right)}(\mathbf{x},\mu )$.
  • output $({\mathbf{c}}_{\mathbf{0}},{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3)$.
• UnSignCrypt$({\mathbf{c}}_{\mathbf{0}},{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3,{\mathbf{B}}_{\mathbf{r}},{\mathbf{h}}_{\mathbf{s}},{\left\{{\mathbf{z}}_{\mathbf{i}}\right\}}_{i=0}^{\aleph })$.
  • ${\mathbf{s}}_{\mathbf{1}}\leftarrow D_{{\mathbb{Z}}^n,{\eta }_2}$.
  • $\mathbf{t}$: $=\mathbf{u}-{\mathbf{s}}_{\mathbf{1}}({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}\right){\mathbf{d}}_{\mathbf{r}})$.
  • $({\mathbf{s}}_{\mathbf{0}}^{\prime },{\mathbf{s}}_{\mathbf{0}})=(\mathbf{t},\mathbf{0})-\mathrm{SamplePre}({\mathbf{B}}_{\mathbf{r}},{\eta }_2,(\mathbf{t},\mathbf{0}))$.
  • $\mathbf{w}$: $={\mathbf{c}}_{\mathbf{2}}\ast 2^{\ell }-{\mathbf{s}}_{\mathbf{1}}{\mathbf{c}}_{\mathbf{1}}-{\mathbf{s}}_{\mathbf{0}}{\mathbf{c}}_{\mathbf{0}}$.
  • $\tilde{\mathbf{k}}:=\lfloor \frac{\mathbf{w}}{\lfloor q/8\rfloor }\rceil$.
  • ${\mathbf{c}}_{\mathbf{2}}^{\prime }={\mathbf{c}}_{\mathbf{2}}-\lfloor \tilde{\mathbf{k}}\lfloor q/8\rfloor /2^{\ell }\rfloor$.
  • $\mathbf{k}=\tilde{\mathbf{k}}\oplus H_2({\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}}^{\prime })$.
  • $(\mathbf{x},\mu )$: $={\mathtt{Dec}}_{H_3\left(\mathbf{k}\right)}\left(c_3\right)$.
  • $\nu$: $=H_0(\mu ,{\mathbf{b}}_{\mathbf{r}},\mathbf{k})$.
  • $\mathbf{z}$: $={\mathbf{z}}_{\mathbf{0}}+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{\mathbf{z}}_{\mathbf{i}}$.
  • If $\parallel ({\mathbf{h}}_{\mathbf{s}},\mathbf{z})\mathbf{x}-\mathbf{y}\parallel \le \frac{1}{2{\pi }^3}\aleph n^{5/2}{(ln(2^{(7+\lambda )/2}n))}^{3/2}$ return $\mu$, otherwise return ⊥.

4.2. Correctness

In the proposed scheme, we draw lessons from [43] to use the ciphertext generated in the previous step (i.e., ${\mathbf{c}}_{\mathbf{0}}$) as the tag to produce the subsequent ciphertext. On the one hand, it can transform a tag encryption to a normal encryption. On the other hand, when ${\mathbf{c}}_{\mathbf{0}}$ is determined, the rest of the ciphertexts are relatively determined except for the influence of errors and the value to be encrypted, which is important for the security reduction (reference to Theorem 1). We give the unique witness for NTRU as follows.

Lemma 1 (Unique Witness).

Let $\varrho =20\log n,q=\frac{5}{{\pi }^3}\varrho \aleph n^3{(ln(2^{(7+\lambda )/2}n))}^{3/2}$ for all but a negligible fraction of $\mathbf{h}\in \mathcal{R}$ and any syndrome $\mathbf{c}\in \mathcal{R}$ be the number of the pair $(\mathbf{r},\mathbf{e})\in {\{-1,0,1\}}^n\times {\{-\varrho ,\cdots ,\varrho \}}^n$ to satisfy that $\mathbf{c}=\mathbf{r}\mathbf{h}+\mathbf{e}$ is no more than one.

Proof. 

For each $\mathbf{c}\in \mathcal{R}$, suppose that there exist two different $(\mathbf{r},\mathbf{e})\ne ({\mathbf{r}}^{\prime },{\mathbf{e}}^{\prime })\in {\{-1,0,1\}}^n\times {\{-1,0,1\}}^n$ satisfying $\mathbf{r}+\mathbf{h}\mathbf{e}={\mathbf{r}}^{\prime }+\mathbf{h}{\mathbf{e}}^{\prime }=\mathbf{c}$. Then, $(\mathbf{r}-{\mathbf{r}}^{\prime })\mathbf{h}={\mathbf{e}}^{\prime }-\mathbf{e}\in {\{-2\varrho ,\cdots ,2\varrho \}}^n$. To complete this lemma, it only needs to argue that $\parallel \tilde{\mathbf{r}}{\mathbf{h}\parallel }_{\infty }>4\varrho +1$ with overwhelming probability, for $\tilde{\mathbf{r}}\in {\{-2,\cdots ,2\}}^n$. Let £ denote the n-dimension open ${\ell }_{\infty }$ cube with the radius of each dimension being $4\varrho +1$ (edge length $8\varrho +2$). Then, for any fix $\tilde{\mathbf{r}}\in {\{-2,\cdots ,2\}}^n$, the probability that $\tilde{\mathbf{r}}\mathbf{h}$ falls into some cubic £ is ${(8\varrho +2)}^n/q^n$. According to the union bound, for all $\tilde{\mathbf{r}}\in {\{-2,\cdots ,2\}}^n$, the probability of $\tilde{\mathbf{r}}\mathbf{h}$ falling into some £ is no more than

$$5^n{\left(\frac{8\varrho +2}{q}\right)}^n={\left(\frac{40\varrho +10}{q}\right)}^n<{\left(\frac{41\varrho }{\frac{5}{{\pi }^3}\varrho \aleph n^3{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}}\right)}^n={\left(\frac{41{\pi }^3}{5\aleph n^3{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}}\right)}^n,$$

$$5^n{\left(\frac{8\varrho +2}{q}\right)}^n={\left(\frac{40\varrho +10}{q}\right)}^n<{\left(\frac{41\varrho }{\frac{6\sqrt{2}}{{\pi }^3}\varrho \aleph n^3{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}}\right)}^n={\left(\frac{41{\pi }^3}{6\sqrt{2}\aleph n^3{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}}\right)}^n,$$

which is negligible. That is, for all but a negligible fraction of $\mathbf{h}$, $\parallel \tilde{\mathbf{r}}{\mathbf{h}\parallel }_{\infty }>4\varrho +1$.    □

By the way, in the scheme, the converted ciphertext with each dimensional error less than $\frac{4}{\sqrt{2}{\pi }^2}\varrho n^3{(ln(2^{(7+\lambda )/2}n))}^{3/2}$, the unique witness also holds. The corresponding probability is ${(\frac{8}{\sqrt{2}{\pi }^2}\varrho n^3{(ln(2^{(7+\lambda )/2}n))}^{3/2}/q)}^n{5}^n\approx {(5/36)}^n$, which is negligible.

In order to guarantee the correctness and security of the proposed scheme, the following requirements should be satisfied.

• The RLWE should be hard $\alpha q\ge \omega (\sqrt{\log n})$ (Proposition 1).
• The pre-image sample algorithm works well, $\eta \ge \parallel \tilde{\mathbf{B}}\parallel ·{\zeta }_{ϵ}^{\prime }\left(\mathbb{Z}\right)$ for ${\zeta }_{ϵ}^{\prime }\left(\mathbb{Z}\right)\approx \frac{1}{\pi }$$\sqrt{\frac{1}{2}ln\left(2+\frac{2}{ϵ}\right)}$ and $ϵ=2^{-\lambda /2}/(4\sqrt{2}n)$ [38], where $\mathbf{B}$ is the corresponding basis of a lattice (Proposition 3).
• In the security reduction, a simulated trapdoor (Algorithm 1) can be used for sampling (Proposition 3).
• The correctness of the unsigncryption requires that both the error in the public key encryption and the error in the signature are small enough to guarantee security.

Therefore, the Gaussian parameter and the modulus can be set as follows. ${\eta }_2$: Gaussian parameter for decryption; ${\eta }_1$: Gaussian parameter for signature. The correctness of the proposed scheme is implied in Lemmas 11 and 16.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & {\eta }_1=\frac{1}{2{\pi }^3}\aleph n^2{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2},{\eta }_2=\frac{1}{\sqrt{2}{\pi }^2}n{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2},\varrho =10{\left(\log n\right)}^{3/4},\hfill \\ & q=\frac{6\sqrt{2}}{{\pi }^3}\varrho \aleph n^3{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2},{\eta }_3=\frac{1}{\sqrt{2}{\pi }^2}\sqrt{n}ln\left(2^{(7+\lambda )/2}n\right)\hfill \end{array}\end{array}$$

(1)

5. Security and Performance

The confidentiality and unforgeability of SC-NTRU are demonstrated in Section 5.1. The efficiency of the SC-NTRU is evaluated by analyzing the numbers of different kinds of computations in Section 5.2. An experiment for SC-NTRU is presented in Section 5.3.

5.1. Security

The IND-CCA2 security of the proposed scheme is based on a variant of the search RLWE implied in [38]. We formalize it as follows.

Definition 6 (Variant of Search RLWE).

Let $\varrho ,t$ be small integers, $\mathbf{s}\in R_q$ with ${\parallel \mathbf{s}\parallel }_{\infty }\le \varrho$. Let ℓ denote a positive integer, and Ψ be a family of distributions over $K_{\mathbb{R}}$. For $i\in [\ell +1]$, ${\mathbf{e}}_{\mathbf{i}}\leftarrow \Psi$, ${\mathbf{a}}_{\mathbf{i}}\leftarrow R_q$. The search RLWE is to find $\mathbf{k}\in {\left[2^{t-1}\right]}^n$ from ${\mathbf{c}}_{\mathbf{i}}={\mathbf{a}}_{\mathbf{i}}\mathbf{s}+{\mathbf{e}}_{\mathbf{i}}$ for $i\in [\ell ]$ and ${\mathbf{c}}_{\ell +\mathbf{1}}={\mathbf{a}}_{\ell +\mathbf{1}}\mathbf{s}+{\mathbf{e}}_{\ell +\mathbf{1}}+\mathbf{k}\lfloor q/2^t\rfloor$.

Remark 1.

The variant is as hard as the standard search LWE. Suppose there exists an adversary $\mathcal{A}$ who can find the correct $\mathbf{k}$. Then, $\mathcal{A}$ can compute ${\mathbf{c}}_{\ell +\mathbf{1}}^{\prime }={\mathbf{a}}_{\ell +\mathbf{1}}\mathbf{s}+{\mathbf{e}}_{\ell +\mathbf{1}}$ due to $\mathbf{k}\lfloor q/2^t\rfloor$ hidden by ${\mathbf{c}}_{\ell +\mathbf{1}}^{\prime }$. That is, $\mathcal{A}$ has the ability to compute ${\mathbf{c}}_{\ell +\mathbf{1}}^{\prime }$ from ${\left\{{\mathbf{c}}_{\mathbf{i}}\right\}}_{i=1}^{\ell }$. One method is that $\mathcal{A}$ learns $\mathbf{r}$ from ${\left\{{\mathbf{c}}_{\mathbf{i}}\right\}}_{i=1}^{\ell }$, then $\mathcal{A}$ uses the same $\mathbf{r}$ to get $\mathbf{k}$ from ${\mathbf{c}}_{\ell +\mathbf{1}}$. This means that the variant of the search RLWE can be reduced to the standard search RLWE in polynomial time. The other method is that $\mathcal{A}$ can find the mapping from ${\left\{{\mathbf{a}}_{\mathbf{i}}\right\}}_{i=1}^{\ell }$ to ${\mathbf{a}}_{\ell +\mathbf{1}}$. The mapping must have the form as ${\mathbf{a}}_{\ell +\mathbf{1}}={\sum }_{i=1}^{\ell }{\mathbf{x}}_{\mathbf{i}}{\mathbf{a}}_{\mathbf{i}}+\mathbf{y}$, where ${\mathbf{x}}_{\mathbf{i}},\mathbf{y}$ are sampled from $R_q$ with small coefficients. Otherwise, ${\mathbf{a}}_{\ell +\mathbf{1}}={\sum }_{i=1}^{\ell }{\mathbf{x}}_{\mathbf{i}}{\mathbf{a}}_{\mathbf{i}}^{{\kappa }_i}+\mathbf{y}$, $1\ne {\kappa }_i\in \mathbb{Z}$. When the mapping is applied to ${\left\{{\mathbf{c}}_{\mathbf{i}}\right\}}_{i=1}^{\ell }$, the error will increase almost to the uniform distribution, which leads to failing to obtain $\mathbf{k}$ from ${\mathbf{c}}_{\ell +\mathbf{1}}$. In fact, it is also a search RLWE problem to find the mapping ${\mathbf{a}}_{\ell +\mathbf{1}}={\sum }_{i=1}^{\ell }{\mathbf{x}}_{\mathbf{i}}{\mathbf{a}}_{\mathbf{i}}^{{\kappa }_i}+\mathbf{y}$.

Theorem 1 (IND-CCA2).

Under the parameter settings as in Equation (1), the proposed signcryption scheme is IND-CCA2 secure against inner adversaries in the standard model, as long as the RLWE${}_{n,m,q}$ problem and DSPR problem are computationally intractable.

Proof. 

The theorem can be proven by a series of games G${}_0$, G${}_1$, ⋯, G${}_{13}$. In each game, the adversary $\mathcal{A}$’s probability of success is $Pr\left[A_i\right]$ for $i\in \{0,1,\cdots ,13\}$. G${}_0$ is the real IND-CCA2 security game. In G${}_0\cdots$ G${}_{10}$, the challenge ciphertexts are all hybrid encryption ciphertexts. It is proven that the successive games satisfy the indistinguishability or the game transitions based on failure events to $\mathcal{A}$. Thus, the difference between attacking in G${}_0$ and attacking in G${}_{10}$ is guaranteed to be negligible. Due to the security of the symmetric encryption involved, the ciphertext of the symmetric encryption $c_3$ does not reveal any information about the plaintext and the corresponding signature.

Only using symmetric encryption, a direct attack on the message–signature pair is no less difficult than an attack on the symmetric key. According to the unforgeability of the signature and the security of the symmetric encryption, it is proven that it is impossible to manipulate $c_3$ to obtain a valid ciphertext to help the attack. Therefore, ignoring the ciphertext $c_3$ in the challenge ciphertext of G${}_{11}$, the transformation does not increase the hardness of the adversary’s attack. Following that, it is shown that the game transitions based on failure events are satisfied from game G${}_{11}$ to G${}_{13}$. In G${}_{13}$, the challenge ciphertext is an RLWE instance, and the probability that the adversary succeeds to obtain the information encrypted by the public key is negligible. Thus, the $\mathcal{A}$’s success probability to attack in G${}_0$ is also negligible. This means that the proposed scheme is IND-CCA2 secure. The games are as follows.

• G${}_0$: The game G${}_0$ is the original IND-CCA2 game, namely, ${\mathbf{h}}_{\mathbf{r}}\leftarrow \mathbf{KeyGen},{\mathbf{b}}_{\mathbf{r}},{\mathbf{d}}_{\mathbf{r}}\leftarrow {\mathbb{Z}}_q^n$.

  –

  Setup: Choose hash functions: $H_0:{\{0,1\}}^{\ast }\to {\{0,1\}}^{\aleph }$, $H_1:R_q\to R_q$, $H_2:R_q\times R_q\to {\{0,1,2,3\}}^{\ast }$, and public parameters $\mathbf{y},\mathbf{u}\stackrel{\$}{\leftarrow }{R}_q$.

  –

  KeyGen: Generate the public and private keys: $({\mathbf{B}}_{\mathbf{s}},{\mathbf{h}}_{\mathbf{s}})\leftarrow \mathrm{KeyGen}(n,q)$, $({\mathbf{B}}_{\mathbf{r}},{\mathbf{h}}_{\mathbf{r}})$$\leftarrow \mathrm{KeyGen}(n,q)$, ${\mathbf{b}}_{\mathbf{s}},{\mathbf{d}}_{\mathbf{s}}\stackrel{\$}{\leftarrow }{R}_q,{\mathbf{z}}_{\mathbf{i}}\stackrel{\$}{\leftarrow }{R}_q$ for $i=0,1,\cdots ,\aleph$. Publish $({\mathbf{b}}_{\mathbf{s}},{\mathbf{d}}_{\mathbf{s}},{\mathbf{h}}_{\mathbf{s}},{\mathbf{h}}_{\mathbf{r}})$ as the public key and keep ${\mathbf{B}}_{\mathbf{s}}$ and ${\mathbf{B}}_{\mathbf{r}}$ as private keys.

  –

  Phase I: Upon receiving an unsigncryption query from $\mathcal{A}$, $\mathcal{C}$ uses the private key ${\mathbf{B}}_{\mathbf{r}}$ to unsigncrypt as in the proposed scheme. If the signature satisfies the constraint $\parallel ({\mathbf{h}}_{\mathbf{s}},\mathbf{z})\mathbf{x}-\mathbf{y}\parallel \le \frac{1}{2{\pi }^3}\aleph n^{5/2}{(ln(2^{(7+\lambda )/2}n))}^{3/2}$, $\mathcal{C}$ returns the message $\mu$, otherwise it returns ⊥.

  –

  Challenge: After a polynomial round of interaction with $\mathcal{C}$, $\mathcal{A}$ gives a satisfied signal to $\mathcal{C}$. $\mathcal{C}$ randomly chooses a message $\mu$ and generates the challenge ciphertext ${\mathbf{c}}^{\ast }=({\mathbf{c}}_0^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast },{\mathbf{c}}_{\mathbf{3}}^{\ast })$ according to the steps of sincryption in the proposed scheme, then gives ${\mathbf{c}}^{\ast }$ to $\mathcal{A}$.

  –

  Phase II: If the ciphertext for unsigncryption from $\mathcal{A}$ is ${\mathbf{c}}^{\ast }$, $\mathcal{C}$ replies with ⊥ directly. Otherwise, $\mathcal{C}$ unsigncrypts the querying ciphertext as in Phase I.

• G${}_1$: In the game G${}_1$, only the producing method of ${\mathbf{b}}_{\mathbf{r}}$ is changed. Let ${\mathbf{b}}_{\mathbf{r}}={\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}$ where $\mathbf{p}\leftarrow {\{-1,0,1\}}^n,\mathbf{e}\leftarrow {\{-\varrho ,\cdots ,\varrho \}}^n$. Since $\mathcal{C}$ has the normal private key, the unsigncryption approach is the same as in G${}_0$.
• G${}_2$: Before publishing the public keys, $\mathcal{C}$ generates a challenge ciphertext ${\mathbf{c}}^{\ast }=({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast },{\mathbf{c}}_{\mathbf{3}}^{\ast })$ normally, namely ${\mathbf{c}}_{\mathbf{0}}^{\ast }=\mathbf{r}{\mathbf{h}}_{\mathbf{r}}+{\mathbf{e}}_{\mathbf{0}}$, ${\mathbf{c}}_{\mathbf{1}}^{\ast }=\mathbf{r}({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}})+{\mathbf{e}}_{\mathbf{1}}$, ${\mathbf{c}}_{\mathbf{2}}^{\prime }$: $=\lfloor (\mathbf{r}\mathbf{u}+{\mathbf{e}}_{\mathbf{2}})/2^{\ell }\rfloor$, ${\mathbf{c}}_{\mathbf{2}}^{\ast }$: $={\mathbf{c}}_{\mathbf{2}}^{\prime }+\lfloor ((H_2({\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\prime })\oplus \mathbf{k})\lfloor q/8\rfloor )/2^{\ell }\rfloor$, $c_3^{\ast }$: $={\mathtt{Enc}}_{H_3\left(\mathbf{k}\right)}(\mathbf{x},\mu )$ for $\mathbf{r}\stackrel{\$}{\leftarrow }{\{-1,0,1\}}^n,{\mathbf{e}}_{\mathbf{0}},{\mathbf{e}}_{\mathbf{2}}\stackrel{\$}{\leftarrow }{\{-\varrho ,\cdots ,\varrho \}}^n,{\mathbf{e}}_{\mathbf{1}}\stackrel{\$}{\leftarrow }{([-\varrho \sqrt{n},\varrho \sqrt{n}]\bigcap \mathbb{Z})}^n$.
• G${}_3$: In the game G${}_3$, $\mathcal{C}$ continues changing ${\mathbf{b}}_{\mathbf{r}}$ as ${\mathbf{b}}_{\mathbf{r}}={\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}-H_0\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}}$ where the method to generate $\mathbf{p},\mathbf{e}$ is identical to that in G${}_2$.
• G${}_4$: The game G${}_4$ is the same as G${}_3$, except for the approach to produce ${\mathbf{d}}_{\mathbf{r}}$. $\mathcal{C}$ generates ${\mathbf{d}}_{\mathbf{r}}$ by KeyGen algorithm, ${\mathbf{d}}_{\mathbf{r}}\leftarrow \mathbf{KeyGen}$, instead of ${\mathbf{d}}_{\mathbf{r}}\stackrel{\$}{\leftarrow }{R}_q$.
• G${}_5$: $\mathcal{C}$ answers with ⊥ to the unsigncryption queries with the kind of ciphertext $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3)$ in phase I. The others remain the same as in the game G${}_5$.
• G${}_6$: In this game, in phase I, $\mathcal{C}$ answers all the unsigncryption queries normally, but $\mathcal{C}$ replies with ⊥ to the queries with ciphertext $({\mathbf{c}}_{\mathbf{0}},{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}})$ satisfying ${\mathbf{c}}_{\mathbf{0}}\ne {\mathbf{c}}_{\mathbf{0}}^{\ast }$ but $H_1\left({\mathbf{c}}_{\mathbf{0}}\right)=H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right)$.
• G${}_7$: In phase II, $\mathcal{C}$ answers with ⊥ to unsigncryption queries with the kind of ciphertext $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast },c_3)$ meeting $c_3\ne {\mathbf{c}}_{\mathbf{3}}^{\ast }$. Except for the cases above, $\mathcal{C}$ responds to the unsigncryption queries as in G${}_6$.
• G${}_8$: In phase II, $\mathcal{C}$ responds with ⊥ to the unsigncryption queries with the form $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3)$, satisfying $({\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}})\ne ({\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast })$. Replying to the other unsigncryption queries keeps the same as in G${}_7$.
• G${}_9$: In this game, $\mathcal{C}$ produces ${\mathbf{h}}_{\mathbf{r}}\leftarrow {\mathbb{Z}}_q^n$ instead of ${\mathbf{h}}_{\mathbf{r}}\leftarrow \mathrm{KeyGen}$. Moreover, $\mathcal{C}$ will use ${\mathbf{d}}_{\mathbf{r}}$ to answer the unsigncryption queries. The others are identical to the game G${}_8$.
• G${}_{10}$: In this game, $\mathcal{C}$ produces the challenge ciphertext by collaborating with a signer, which for convenience will be called signature oracle ${\mathcal{O}}_{sign}$. First, $\mathcal{C}$ generates $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast }\prime )$ normally as in G${}_9$, followed by giving $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast }\prime )$ to ${\mathcal{O}}_{sign}$. Then, ${\mathcal{O}}_{sign}$ randomly chooses a message $\mu$ and $\mathbf{k}\stackrel{\$}{\leftarrow }{\{0,1,2,3\}}^n$, and produces a signature $(\mathbf{x},\mathbf{k})$ for $\mu$. Next, ${\mathcal{O}}_{sign}$ generates $c_3^{\ast }={\mathtt{Enc}}_{\mathbf{k}}(\mu ,\mathbf{x})$ and gives it to $\mathcal{C}$. Lastly, $\mathcal{C}$ gives $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast },c_3^{\ast })$ to $\mathcal{A}$ as the challenge ciphertext and waits to get $(\mu ,\mathbf{k},\mathbf{x})$ from $\mathcal{A}$.
• G${}_{11}$: $\mathcal{C}$ changes the challenge ciphertext a little. $\mathcal{C}$ does not give $\mathbf{k}$ to ${\mathcal{O}}_{sign}$ and does not need to get $c_3$ from ${\mathcal{O}}_{sign}$. $\mathcal{C}$ just gives the ciphertext $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast })$ generated by itself to $\mathcal{A}$ as the challenge ciphertext. If $\mathcal{A}$ is able to obtain the plaintext $\mathbf{k}$ in ${\mathbf{c}}_{\mathbf{2}}^{\ast }$ with non-negligible probability, $\mathcal{C}$ admits that $\mathcal{A}$ wins the game with the same probability.
• G${}_{12}$: This game is identical with the game G${}_{11}$ except that the challenge ciphertext ${\mathbf{c}}_{\mathbf{1}}^{\ast }$ is computed as ${\mathbf{c}}_{\mathbf{1}}^{\ast }={\mathbf{c}}_{\mathbf{0}}^{\ast }\mathbf{p}+{\mathbf{e}}_{\mathbf{1}}$ where ${\mathbf{e}}_{\mathbf{1}}\stackrel{\$}{\leftarrow }{([-\varrho \sqrt{n},\varrho \sqrt{n}]\bigcap \mathbb{Z})}^n$.
• G${}_{13}$: $\mathcal{C}$ queries the variant RLWE oracle to fetch an instance $\left(\left(\begin{array}{c}{\mathbf{a}}_{\mathbf{1}}\\ {\mathbf{a}}_{\mathbf{2}}\end{array}\right),\left(\begin{array}{c}{\mathbf{z}}_{\mathbf{1}}\\ {\mathbf{z}}_{\mathbf{2}}\end{array}\right)\right)$ Then, $\mathcal{C}$ publishes the public keys as ${\mathbf{h}}_{\mathbf{r}}={\mathbf{a}}_{\mathbf{1}},\mathbf{u}={\mathbf{a}}_{\mathbf{2}}$. $\mathcal{C}$ and sets the challenge ciphertext as follows ${\mathbf{c}}_{\mathbf{0}}^{\ast }={\mathbf{z}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}}^{\ast }={\mathbf{z}}_{\mathbf{2}}$. The construction method for ${\mathbf{c}}_{\mathbf{1}}^{\ast }$ remains identical with that in G${}_{12}$, that is ${\mathbf{c}}_{\mathbf{1}}^{\ast }={\mathbf{c}}_{\mathbf{0}}^{\ast }\mathbf{p}+{\mathbf{e}}_{\mathbf{1}}$.

□

Lemma 2.

The games G${}_1$ and G${}_0$ are computationally indistinguishable when $\varrho =20\log n$.

Proof. 

This lemma can be proven by hybrids. First, $\mathcal{C}$ chooses ${\mathbf{h}}^{\prime }\stackrel{\$}{\leftarrow }{R}_q$ and calculates ${\mathbf{b}}_{\mathbf{r}}^{\prime }={\mathbf{h}}^{\prime }\mathbf{p}+\mathbf{e}$ where $\mathbf{p}\stackrel{\$}{\leftarrow }{\{-1,0,1\}}^n,\mathbf{e}\stackrel{\$}{\leftarrow }{\{-\varrho ,\cdots ,\varrho \}}^n$. The infinity norm of the error $\mathbf{e}$ is set at $20\log n$, which satisfies the constraint for errors in RLWE, i.e., the Gaussian parameter $\alpha q\ge \omega \left(\sqrt{\log n}\right)$ (see Proposition 1). According to the intractability of RLWE, ${\mathbf{b}}_{\mathbf{r}}^{\prime }$ and ${\mathbf{b}}_{\mathbf{r}}\stackrel{\$}{\leftarrow }{R}_q$ are computationally indistinguishable. Next, $\mathcal{C}$ continues modifying ${\mathbf{b}}_{\mathbf{r}}^{\prime }$ as ${\mathbf{b}}_{\mathbf{r}}^{\prime }={\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}$. Since ${\mathbf{h}}_{\mathbf{r}}$ and ${\mathbf{h}}^{\prime }$ are statistically indistinguishable according to the uniform property of the algorithm KeyGen, the new ${\mathbf{b}}_{\mathbf{r}}^{\prime }$ is computationally indistinguishable with ${\mathbf{b}}_{\mathbf{r}}\stackrel{\$}{\leftarrow }{R}_q$. Given all this, the games G${}_1$ and G${}_0$ are computationally indistinguishable.   □

Lemma 3.

The games G${}_2$ and G${}_1$ are identical from the view of $\mathcal{A}$.

Proof. 

Since the computation procedure for $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast },{\mathbf{c}}_{\mathbf{3}}^{\ast })$ is completely hidden from $\mathcal{A}$. In the view of $\mathcal{A}$, it makes no difference whether or not some challenge ciphertext has been generated before the public key is published. That is, the difference between G${}_2$ and G${}_1$ is only the difference in concept. Consequently, the lemma holds.    □

Lemma 4.

The game G${}_3$ is statistically indistinguishable with the game G${}_2$.

Proof. 

The only difference between the games G${}_3$ and G${}_2$ is ${\mathbf{b}}_{\mathbf{r}}$. In G${}_3$, $\mathcal{C}$ calculates ${\mathbf{b}}_{\mathbf{r}}={\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}-H_0\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}}$, while in G${}_2$${\mathbf{b}}_{\mathbf{r}}={\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}$. Since ${\mathbf{c}}_{\mathbf{0}}^{\ast }$ is fixed and ${\mathbf{d}}_{\mathbf{r}}$ submits to the uniform distribution. Therefore, the ${\mathbf{b}}_{\mathbf{r}}$ is statistically indistinguishable with the ${\mathbf{b}}_{\mathbf{r}}$ in the game G${}_2$.    □

Due to the uniform property of the public keys generated by the KeyGen algorithm, we have the following lemma.

Lemma 5.

The game G${}_4$ is statistically indistinguishable with the game G${}_3$.

It is difficult to directly prove the statistical indistinguishability between the games G${}_5$ and G${}_4$. However, the game sequences can be continued by the game transitions based on failure events.

Lemma 6.

Let E${}_5$ denote the event that $\mathcal{A}$ makes the unsigncryption queries with the ciphertexts $({\mathbf{c}}_{\mathbf{0}},{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3)$ meeting ${\mathbf{c}}_{\mathbf{0}}={\mathbf{c}}_{\mathbf{0}}^{\ast }$ in phase I. From the point of view of $\mathcal{A}$, the games G${}_5$ and G${}_4$ are totally the same, when E${}_5$ does not occur. Furthermore, $Pr\left[A_5\right|\neg {\mathtt{E}}_5]=Pr\left[A_4\right|\neg {\mathtt{E}}_5]$, and $Pr\left[{\mathtt{E}}_5\right]$ is negligible.

Proof. 

First, in the game G${}_5$, $\mathcal{C}$ may reply to all the unsigncryption queries normally except for the queried ciphertexts $({\mathbf{c}}_{\mathbf{0}},{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3)$ with ${\mathbf{c}}_{\mathbf{0}}={\mathbf{c}}_{\mathbf{0}}^{\ast }$. Therefore, the behavior of $\mathcal{C}$ is identical in games G${}_5$ and G${}_4$, when E${}_5$ does not happen. That is, $\mathcal{A}$ learns exactly the same knowledge form $\mathcal{C}$, when not considering the event E${}_5$.

Second, in the games G${}_5$ and G${}_4$, ${\mathbf{c}}_{\mathbf{0}}^{\ast }$ is hidden from $\mathcal{A}$ in phase I. Whether ${\mathbf{c}}_{\mathbf{0}}^{\ast }$ is obtained by evaluating $\mathbf{r}{\mathbf{h}}_{\mathbf{r}}+{\mathbf{e}}_{\mathbf{0}}$ or by guessing, the probability that $\mathcal{A}$ computes a ciphertext with the form $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3)$ is $q^{-n}$. That is to say, the probability that $\mathcal{C}$ can not correctly answer the valid unsigncryption queries is no more than $q^{-n}$, which is negligible. The difference is that $\mathcal{C}$ deliberately answers the query E${}_5$ with ⊥ in G${}_5$ instead of unsigncrypting normally as in G${}_4$. In summary, the reduction for the attack capability learned in G${}_5$ compared to that in G${}_4$ is negligible.    □

Lemma 7.

Let E${}_6$ denote the events that $\mathcal{A}$ makes the unsigncryption queries with the ciphertexts $({\mathbf{c}}_{\mathbf{0}},{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3)$ meeting ${\mathbf{c}}_{\mathbf{0}}\ne {\mathbf{c}}_{\mathbf{0}}^{\ast }$ but $H_1\left({\mathbf{c}}_{\mathbf{0}}\right)=H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right)$ in phase I. The games G${}_6$ and G${}_5$ are identical in the adversary $\mathcal{A}$’s view, when E${}_6$ does not happen, $Pr\left[A_6\right|\neg {\mathtt{E}}_6]=Pr\left[A_5\right|\neg {\mathtt{E}}_6]$. Moreover, $Pr\left[{\mathtt{E}}_6\right]$ is negligible.

Proof. 

First, in G${}_6$, the approach of $\mathcal{C}$ to answer the unsigncryption queries is totally identical when the queried ciphertexts $({\mathbf{c}}_{\mathbf{0}},{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3)$ satisfy ${\mathbf{c}}_{\mathbf{0}}\ne {\mathbf{c}}_{\mathbf{0}}^{\ast }$ and $H_1\left({\mathbf{c}}_{\mathbf{0}}\right)=H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right)$. Therefore, the knowledge learned from G${}_6$ and G${}_5$ is the same, when not considering the event E${}_6$.

Second, for a known ${\mathbf{c}}_{\mathbf{0}}^{\ast }$, $\mathcal{A}$ finds a ${\mathbf{c}}_{\mathbf{0}}$ satisfying ${\mathbf{c}}_{\mathbf{0}}\ne {\mathbf{c}}_{\mathbf{0}}^{\ast }$ but $H_0\left({\mathbf{c}}_{\mathbf{0}}\right)=H_0\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right)$, which means $\mathcal{A}$ discovers a hash collision. We set the hash function to satisfy the security intensity of the proposed signcryption system, namely, the probability that hash collision occurs is no more than a negligible probability $2^{-\lambda }$. In fact, ${\mathbf{c}}_{\mathbf{0}}^{\ast }$ is hidden in phase I, then the probability that $\mathcal{A}$ just computes a ciphertext with ${\mathbf{c}}_{\mathbf{0}}\ne {\mathbf{c}}_{\mathbf{0}}^{\ast }$ and $H_0\left({\mathbf{c}}_{\mathbf{0}}\right)=H_0\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right)$ is also no more than the above probability $2^{-\lambda }$. Thus, even though the attack power of $\mathcal{A}$ obtained in G${}_6$ is less than that in G${}_5$, the difference is negligible.    □

Lemma 8.

Let E${}_7$ denote the events that $\mathcal{A}$ set the unsigncryption queries with the type of ciphertext $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast },c_3)$ meeting $c_3\ne c_3^{\ast }$ in phase II. In the adversary $\mathcal{A}$’s view, the games G${}_7$ and G${}_6$ are identical, when E${}_7$ does not happen. Namely, $Pr\left[A_7\right|\neg {\mathtt{E}}_7]=Pr\left[A_6\right|\neg {\mathtt{E}}_7]$. Furthermore, $Pr\left[{\mathtt{E}}_7\right]$ is negligible.

Proof. 

The ciphertext elements $({\mathbf{c}}_{\mathbf{0}},{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}})$ constitute the ciphertext of the public key encryption. Once the elements are determined, the plaintext $\mathbf{k}$ involved in the public key encryption is determined and unique. That is, the key used for the symmetric encryption is fixed. According to the one-to-one property of the symmetric encryption ENC, modifying $c_3$ will yield a distinct message–signature pair $({\mathbf{x}}^{\prime },{\mu }^{\prime })={\mathtt{Dec}}_{\mathbf{k}}\left(c_3\right)$ (relative to $(\mathbf{x},\mu )$). The probability of the new message–signature pair successfully passing the signature verification is negligible. We prove this conclusion through a classification discussion. It can be divided into two cases.

• Case 1: $\mathcal{A}$ generates the ciphertext $c_3$ by its signature for some message $\mu$. As an inner adversary, $\mathcal{A}$ has the ability to yield signatures by itself. However, the procedure to generate $c_3$ requires ${\mathbf{k}}^{\ast }$. The probability of obtaining ${\mathbf{k}}^{\ast }$ from $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast })$ is negligible due to the security of the public key encryption part. Please refer to Lemma 15 for more details.
• Case 2: $\mathcal{A}$ generates the ciphertext $c_3$ randomly. According to the one-to-one property of the symmetric encryption, a random message–signature pair $(\mu ,\mathbf{x})$ is unsigncrypted from $c_3$. Since $\mathcal{A}$ does not possess knowledge of $\mu$, it cannot generate a valid signature for it despite having the private key for signature generation. Consequently, the probability $(\mu ,\mathbf{k},\mathbf{x})$ passing signature verification is negligible.

   □

Lemma 9.

Let E${}_8$ denote the event that in phase II, $\mathcal{A}$ makes the unsigncryption queries with the form of the ciphertext as $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}},c_3)$ and $({\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}})\ne ({\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast })$. In the adversary $\mathcal{A}$’s view, the games G${}_8$ and G${}_7$ are identical, when $E_8$ does not occur. Namely, $Pr\left[A_8\right|\neg {\mathtt{E}}_8]=Pr\left[A_7\right|\neg {\mathtt{E}}_8]$. Moreover, $Pr\left[{\mathtt{E}}_8\right]$ is negligible.

Proof. 

This lemma can be argued by a classification discussion. Let $\mathbf{k},{\mathbf{k}}^{\ast }$ be the keys concealed in ${\mathbf{c}}_{\mathbf{2}}$, ${\mathbf{c}}_{\mathbf{2}}^{\ast }$, respectively.

• Case 1: ${\mathbf{k}}^{\ast }$ remains unchanged, i.e., $\mathbf{k}={\mathbf{k}}^{\ast }$. To guarantee the validity of the ciphertext, the information hidden by ${\mathbf{c}}_{\mathbf{2}}$ should be $\lfloor (H({\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}}^{\prime })\oplus {\mathbf{k}}^{\ast })\lfloor q/8\rfloor /2^{\ell }\rfloor$. To fulfill this requirement, there are only two possible subcases.

  –

  $\mathcal{A}$ generates ${\mathbf{c}}_{\mathbf{2}}$ through encryption. On one hand, $\mathcal{A}$ does not know the ${\mathbf{k}}^{\ast }$ concealed in ${\mathbf{c}}_{\mathbf{2}}^{\ast }$. On the other hand, $\mathcal{A}$ chooses a $\mathbf{r}$ distinct from the secret $\mathbf{r}$ used in the ${\mathbf{c}}_{\mathbf{0}}^{\ast }$, which will lead to an invalid public key ciphertext. Thus, the probability of this subcase occurring is negligible.

  –

  $\mathcal{A}$ produces ${\mathbf{c}}_{\mathbf{2}}$ by falsifying ${\mathbf{c}}_{\mathbf{2}}^{\ast }$. For this, $\mathcal{A}$ should have the ability to compute ${\mathbf{c}}_{\mathbf{2}}-{\mathbf{c}}_{\mathbf{2}}^{\ast }+\lfloor ((H({\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}}^{\prime })\oplus {\mathbf{k}}^{\ast })-(H({\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast }\prime )\oplus {\mathbf{k}}^{\ast }))\lfloor q/8\rfloor /2^{\ell }\rfloor$. The probability of this event is negligible since ${\mathbf{c}}_{\mathbf{2}}^{\ast }\prime$ and $\mathbf{k}$ involved in ${\mathbf{c}}_{\mathbf{2}}^{\ast }$ are hidden from $\mathcal{A}$.

• Case 2: $\mathbf{k}\ne {\mathbf{k}}^{\ast }$ and $c_3$ remains unchanged. In this case, due to the one-to-one property of the symmetric encryption, the message–signature pair $(\mu ,\mathbf{k},\mathbf{x})$ extracted from $c_3$ is completely random. As a result, the probability of $(\mu ,\mathbf{k},\mathbf{x})$ passing signature verification is negligible.
• Case 3: $\mathbf{k}\ne {\mathbf{k}}^{\ast }$ and $c_3\ne c_3^{\ast }$. The case can be divided into two subcases.

  –

  In the procedure to generate $c_3$, the plaintext $\mu$ corresponding to it is not known to $\mathcal{A}$. Consequently, the probability $({\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}},{\mathbf{c}}_{\mathbf{3}})$ being a valid ciphertext is negligible. The argument is the same as that of case 2 in the proof of Lemma 8.

  –

  The ciphertext $c_3$ is generated based on a valid message–signature pair produced by $\mathcal{A}$. It can be further divided into two subcases. (1) ${\mathbf{c}}_{\mathbf{2}}$ is obtained though encrypting by $\mathcal{A}$. The argument to this subcase is identical to subcase 1 of case 1 in this Lemma 9. Due to the uniqueness of LWE (see Lemma 1), $\mathbf{r}$ has already been determined by ${\mathbf{c}}_{\mathbf{0}}^{\ast }$. The probability of $\mathcal{A}$ choosing $\mathbf{r}$ used in ${\mathbf{c}}_{\mathbf{0}}^{\ast }$ is negligible. The the distinct $\mathbf{r}$ yields an invalid ciphertext. (2) ${\mathbf{c}}_{\mathbf{2}}$ is falsified from ${\mathbf{c}}_{\mathbf{2}}^{\ast }$ by $\mathcal{A}$. This is similar to the demonstration in subcase 2 of case 1 of Lemma 9. $\mathcal{A}$ needs to compute ${\mathbf{c}}_{\mathbf{2}}-{\mathbf{c}}_{\mathbf{2}}^{\ast }+\lfloor ((H({\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}}^{\prime })\oplus \mathbf{k})-(H({\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast }\prime )\oplus {\mathbf{k}}^{\ast }))\lfloor q/8\rfloor /2^{\ell }\rfloor$ without knowing ${\mathbf{k}}^{\ast }$, and the probability of this event is negligible.

   □

Algorithm 1 SimExtractE$({\mathbf{h}}_{\mathbf{r}},{\mathbf{b}}_{\mathbf{r}},{\mathbf{d}}_{\mathbf{r}},\tau ,{\tau }^{\ast },\mathbf{u})$

Require:   public keys ${\mathbf{h}}_{\mathbf{r}},{\mathbf{b}}_{\mathbf{r}},{\mathbf{d}}_{\mathbf{r}}\in R_q$, in which ${\mathbf{d}}_{\mathbf{r}}\leftarrow \mathtt{KeyGen}$, ${\mathbf{b}}_{\mathbf{r}}={\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}$ for $\mathbf{p},\mathbf{e}\leftarrow {\{-\varrho ,\cdots ,\varrho \}}^n$;   a pair of un-equivalent tags $\tau ,{\tau }^{\ast }\leftarrow {\{-\varrho ,\cdots ,\varrho \}}^n$;   a syndrome $\mathbf{u}\in {\mathcal{R}}_q$. Ensure:   A private key $({\mathbf{x}}_{\mathbf{1}},{\mathbf{x}}_{\mathbf{2}})$.  1: ${\mathbf{x}}_{\mathbf{0}}^{\prime }\leftarrow {\{-1,0,1\}}^n$  2: ${\mathbf{x}}^{\prime }=(\mathbf{u}-{\mathbf{h}}_{\mathbf{r}}{\mathbf{x}}_{\mathbf{0}}^{\prime })/(\tau -{\tau }^{\ast })$  3: $({\mathbf{x}}_{\mathbf{1}}^{\prime },{\mathbf{x}}_{\mathbf{1}})=({\mathbf{x}}^{\prime },\mathbf{0})-\mathrm{SamplePre}({\mathbf{B}}_{\mathbf{d}},{\eta }_2,({\mathbf{x}}^{\prime },\mathbf{0}))$ (${\eta }_2=\frac{1}{\sqrt{2}{\pi }^2}n{(ln(2^{(7+\lambda )/2}n))}^{3/2}$)  4: ${\mathbf{x}}_{\mathbf{0}}={\mathbf{x}}_{\mathbf{0}}^{\prime }-\mathbf{p}{\mathbf{x}}_{\mathbf{1}}$  5: output $({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})$ as the private key.

Lemma 10.

Under the parameter settings as in Equation (1), the $({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})$ generated in Algorithm 1 is a valid private key. That is, $\parallel \mathbf{u}-[{\mathbf{h}}_{\mathbf{r}}\parallel {\mathbf{b}}_{\mathbf{r}}+\tau {\mathbf{d}}_{\mathbf{r}}]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})\parallel \le \frac{3}{\sqrt{2}{\pi }^2}\varrho n^{5/2}{(ln(2^{(7+\lambda )/2}n))}^{3/2}$ and $\parallel ({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})\parallel \le \frac{1}{\sqrt{2}{\pi }^2}\varrho n^{5/2}{(ln(2^{(7+\lambda )/2}n))}^{3/2}$. It ensures that this private key can be used correctly in unsigncryption.

Proof. 

First, we argue that the multiplication of $[{\mathbf{h}}_{\mathbf{r}}\parallel {\mathbf{b}}_{\mathbf{r}}+\tau {\mathbf{d}}_{\mathbf{r}}]$ and $({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})$ is close enough to $\mathbf{u}$.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill [{\mathbf{h}}_{\mathbf{r}}\parallel {\mathbf{b}}_{\mathbf{r}}+\tau {\mathbf{d}}_{\mathbf{r}}]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})& ={\mathbf{h}}_{\mathbf{r}}{\mathbf{x}}_{\mathbf{0}}+({\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}-{\tau }^{\ast }{\mathbf{d}}_{\mathbf{r}}+\tau {\mathbf{d}}_{\mathbf{r}}){\mathbf{x}}_{\mathbf{1}}\hfill \\ \hfill & ={\mathbf{h}}_{\mathbf{r}}({\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}})+\mathbf{e}{\mathbf{x}}_{\mathbf{1}}+(\tau -{\tau }^{\ast }){\mathbf{d}}_{\mathbf{r}}{\mathbf{x}}_{\mathbf{1}}\hfill \\ \hfill & ={\mathbf{h}}_{\mathbf{r}}{\mathbf{x}}_{\mathbf{0}}^{\prime }+\mathbf{e}{\mathbf{x}}_{\mathbf{1}}+(\tau -{\tau }^{\ast })({\mathbf{x}}^{\prime }-{\mathbf{x}}_{\mathbf{1}}^{\prime })\hfill \\ \hfill & ={\mathbf{h}}_{\mathbf{r}}{\mathbf{x}}_{\mathbf{0}}^{\prime }+\mathbf{e}{\mathbf{x}}_{\mathbf{1}}+(\mathbf{u}-{\mathbf{h}}_{\mathbf{r}}{\mathbf{x}}_{\mathbf{0}}^{\prime })-(\tau -{\tau }^{\ast }){\mathbf{x}}_{\mathbf{1}}^{\prime }\hfill \\ \hfill & =\mathbf{u}+\mathbf{e}{\mathbf{x}}_{\mathbf{1}}-(\tau -{\tau }^{\ast }){\mathbf{x}}_{\mathbf{1}}^{\prime }\hfill \end{array}\end{array}$$

(2)

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \parallel \mathbf{u}-[{\mathbf{h}}_{\mathbf{r}}\parallel {\mathbf{b}}_{\mathbf{r}}+\tau {\mathbf{d}}_{\mathbf{r}}]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})\parallel =& \parallel (\tau -{\tau }^{\ast }){\mathbf{x}}_{\mathbf{1}}^{\prime }-\mathbf{e}{\mathbf{x}}_{\mathbf{1}}\parallel \le \parallel \mathbf{e}{\mathbf{x}}_{\mathbf{1}}\parallel + \parallel (\tau -{\tau }^{\ast }){\mathbf{x}}_{\mathbf{1}}^{\prime }\parallel \hfill \\ \hfill \le & {\parallel \mathbf{e}\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\sqrt{n}+\parallel \mathbf{Ø}-{\mathbf{Ø}}^{\ast }{\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}^{\prime }\parallel \sqrt{n}\sqrt{n}\hfill \\ \hfill =& \varrho {\eta }_2\sqrt{n}n+2{\eta }_2\sqrt{n}n\le (\varrho +2)\frac{1}{\sqrt{2}{\pi }^2}n{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}{n}^{3/2}\hfill \\ \hfill =& \frac{1}{\sqrt{2}{\pi }^2}(\varrho +2)n^{5/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}.\hfill \end{array}\end{array}$$

(3)

Second, we demonstrate that $({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})$ is short.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \parallel ({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})\parallel =& \sqrt{\parallel {\mathbf{x}}_{\mathbf{0}}{\parallel }^2+{\parallel {\mathbf{x}}_{\mathbf{1}}\parallel }^2}\le \sqrt{\parallel {\mathbf{x}}_{\mathbf{0}}^{\prime }{\parallel }^2+\parallel \mathbf{p}{\mathbf{x}}_{\mathbf{1}}{\parallel }^2+{\parallel {\mathbf{x}}_{\mathbf{1}}\parallel }^2}\hfill \\ \hfill \approx & \parallel \mathbf{p}{\mathbf{x}}_{\mathbf{1}}{\parallel \le \parallel \mathbf{p}\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\sqrt{n}\approx \varrho {\eta }_2\sqrt{n}n\hfill \\ \hfill \le & \frac{1}{\sqrt{2}{\pi }^2}n\varrho {(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}{n}^{3/2}\hfill \\ \hfill =& \frac{1}{\sqrt{2}{\pi }^2}\varrho n^{5/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}\hfill \end{array}\end{array}$$

(4)

Here, ${\mathbf{x}}_{\mathbf{0}}$ takes up most of the length of the whole vector $[{\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}}]$. That is,

$$\begin{array}{c}\hfill \begin{array}{c}\hfill \parallel {\mathbf{x}}_{\mathbf{0}}\parallel \le \frac{1}{\sqrt{2}{\pi }^2}\varrho n^{5/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2},\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \le \frac{1}{\sqrt{2}{\pi }^2}{n}^{3/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}.\end{array}\end{array}$$

(5)

From the above, the private key and the error are of the same magnitude, differing only by a constant factor. In fact, we can use Lemma 3 of [43] to reduce the length of the private key and the error by the factor $\sqrt{n}$, so that the modulus q can also be reduced by $\sqrt{n}$.    □

Lemma 11.

In the adversary $\mathcal{A}$’s view, the games G${}_9$ and G${}_8$ are totally identical. Furthermore, $Pr\left[F_9\right]=Pr\left[F_8\right]$.

Proof. 

First, the public keys in the games G${}_9$ and G${}_8$ are identical. Second, $\mathcal{C}$ does not reply to the unsigncryption queries for the ciphertexts with ${\mathbf{c}}_{\mathbf{0}}\ne {\mathbf{c}}_{\mathbf{0}}^{\ast }$ in the games G${}_9$ and G${}_8$. Third, we argue that $\mathcal{C}$ can correctly unsigncrypt with the private key produced in Algorithm 1, when ${\mathbf{c}}_{\mathbf{0}}\ne {\mathbf{c}}_{\mathbf{0}}^{\ast }$. Let $\widetilde{{\mathbf{c}}_{\mathbf{2}}}=\mathbf{r}\mathbf{u}+{\mathbf{e}}_{\mathbf{2}}+(H_2({\mathbf{c}}_{\mathbf{1}},{\mathbf{c}}_{\mathbf{2}}^{\prime })\oplus \mathbf{k})\lfloor q/8\rfloor$.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill 2^{\ell }{\mathbf{c}}_{\mathbf{2}}-[{\mathbf{c}}_{\mathbf{0}}\parallel {\mathbf{c}}_{\mathbf{1}}]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})& =2^{\ell }{\mathbf{c}}_{\mathbf{2}}-\widetilde{{\mathbf{c}}_{\mathbf{2}}}+\widetilde{{\mathbf{c}}_{\mathbf{2}}}-[{\mathbf{c}}_{\mathbf{0}}\parallel {\mathbf{c}}_{\mathbf{1}}]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})\hfill \\ \hfill & =1-2^{\ell }+\mathbf{r}\mathbf{u}+{\mathbf{e}}_{\mathbf{2}}+\mathbf{k}\lfloor q/8\rfloor -[(\mathbf{r}{\mathbf{h}}_{\mathbf{r}}+{\mathbf{e}}_{\mathbf{0}})\parallel (\mathbf{r}({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}\right){\mathbf{d}}_{\mathbf{r}})+{\mathbf{e}}_{\mathbf{1}})]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})\hfill \\ \hfill & \approx \mathbf{k}\lfloor q/8\rfloor +\mathbf{r}[\mathbf{u}-[{\mathbf{h}}_{\mathbf{r}}\parallel ({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}\right){\mathbf{d}}_{\mathbf{r}})]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})]+{\mathbf{e}}_{\mathbf{2}}-{\mathbf{e}}_{\mathbf{0}}{\mathbf{x}}_{\mathbf{0}}-{\mathbf{e}}_{\mathbf{1}}{\mathbf{x}}_{\mathbf{1}}\hfill \end{array}\end{array}$$

(6)

Let ${\mathbf{e}}^{\prime }=\mathbf{u}-[{\mathbf{h}}_{\mathbf{r}}\parallel ({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}\right){\mathbf{d}}_{\mathbf{r}})]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})$. According to Lemma 10, $\parallel {\mathbf{e}}^{\prime }\parallel \le \frac{1}{\sqrt{2}{\pi }^2}({\varrho }^2+3\varrho )n^{5/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}$. Then,

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & \parallel \mathbf{r}[\mathbf{u}-[{\mathbf{h}}_{\mathbf{r}}\parallel ({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}\right){\mathbf{d}}_{\mathbf{r}})]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})]+{\mathbf{e}}_{\mathbf{2}}-{\mathbf{e}}_{\mathbf{0}}{\mathbf{x}}_{\mathbf{0}}-{\mathbf{e}}_{\mathbf{1}}{\mathbf{x}}_{\mathbf{1}}{\parallel }_{\infty }={\parallel \mathbf{r}{\mathbf{e}}^{\prime }+{\mathbf{e}}_{\mathbf{2}}-{\mathbf{e}}_{\mathbf{0}}{\mathbf{x}}_{\mathbf{0}}-{\mathbf{e}}_{\mathbf{1}}{\mathbf{x}}_{\mathbf{1}}\parallel }_{\infty }\hfill \\ \hfill \le & \parallel \mathbf{r}{\mathbf{e}}^{\prime }{\parallel }_{\infty }+\parallel {\mathbf{e}}_{\mathbf{2}}{\parallel }_{\infty }+\parallel {\mathbf{e}}_{\mathbf{0}}{\mathbf{x}}_{\mathbf{0}}{\parallel }_{\infty }+\parallel {\mathbf{e}}_{\mathbf{1}}{\mathbf{x}}_{\mathbf{1}}{\parallel }_{\infty }\le {\parallel \mathbf{r}\parallel }_{\infty }\parallel {\mathbf{e}}^{\prime }\parallel \sqrt{n}+\parallel {\mathbf{e}}_{\mathbf{2}}{\parallel }_{\infty }+\parallel {\mathbf{e}}_{\mathbf{0}}{\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{0}}\parallel \sqrt{n}+\parallel {\mathbf{e}}_{\mathbf{1}}{\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\hfill \\ \hfill \le & \parallel {\mathbf{e}}^{\prime }\parallel \sqrt{n}+\parallel {\mathbf{e}}_{\mathbf{2}}{\parallel }_{\infty }+\parallel {\mathbf{e}}_{\mathbf{0}}{\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{0}}^{\prime }\parallel \sqrt{n}+\parallel {\mathbf{e}}_{\mathbf{0}}{\parallel }_{\infty }{\parallel \mathbf{p}\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\sqrt{n}\sqrt{n}+\parallel {\mathbf{e}}_{\mathbf{1}}{\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\hfill \\ \hfill \le & \frac{3}{\sqrt{2}{\pi }^2}\varrho n^{5/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}\sqrt{n}+\varrho +\varrho \sqrt{n}\sqrt{n}+{\varrho }^2\frac{1}{\sqrt{2}{\pi }^2}n{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}{n}^{1/2}{n}^{3/2}\hfill \\ \hfill & +\varrho \sqrt{n}\frac{1}{\sqrt{2}{\pi }^2}nln{\left(2^{(7+\lambda )/2}n\right)}^{3/2}{n}^{1/2}{n}^{1/2}\hfill \\ \hfill \approx & \frac{1}{\sqrt{2}{\pi }^2}({\varrho }^2+3\varrho )n^3{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}\hfill \end{array}\end{array}$$

(7)

Since $\frac{1}{\sqrt{2}{\pi }^2}({\varrho }^2+3\varrho )n^3{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}<\frac{1}{9}q$, the simulated private key can be used to correctly decrypt the public-key ciphertext. In summary, the games G${}_9$ and G${}_8$ are identical in $\mathcal{A}$’s view. Therefore, $\mathcal{A}$ has the same ability to attack the proposed schemes in G${}_9$ and G${}_8$.    □

Lemma 12.

In the adversary $\mathcal{A}$’s view, the games G${}_{10}$ and G${}_9$ are identical. It is reasonable that $\mathcal{C}$ needs $\mathcal{A}$ to return $(\mu ,\mathbf{k},\mathbf{x})$. Moreover, $Pr\left[F_{10}\right]=Pr\left[F_9\right]$.

Proof. 

In the games G${}_{10}$ and G${}_9$, the difference is that $\mu$ is chosen by ${\mathcal{O}}_{sign}$, and the signature $(\mathbf{k},\mathbf{x})$ and the ciphertext ${\mathbf{c}}_{\mathbf{3}}^{\ast }$ are also generated by ${\mathcal{O}}_{sign}$ in G${}_{10}$, while they are all generated by $\mathcal{C}$ in G${}_9$. However, the public keys and private keys for the signature are identical, and the procedure for generating $(\mu ,\mathbf{k},\mathbf{x})$ is executed strictly according to the signcryption algorithm. Therefore, the distribution of the challenge ciphertexts and the signatures involved in them are also identical in both games. In a word, the difference between the two games is only conceptual, and $\mathcal{A}$’s view in the games G${}_{10}$ and G${}_9$ are completely the same. Therefore, what $\mathcal{A}$ can learn in the two games is identical.

Next, we demonstrate by contradiction that it is reasonable to require $\mathcal{A}$ to return $(\mu ,\mathbf{k},\mathbf{x})$ in G${}_{10}$. Suppose that $\mathcal{A}$ does not know the information of $\mathbf{k}$, but it can recover $(\mu ,\mathbf{x})$. That is, $\mathcal{A}$ computes the correct $\mu$ without knowing $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast })$. Due to $(\mu ,\mathbf{x})=DE{C}_{\mathbf{K}}\left(c_3\right)$, $\mathcal{A}$ obtaining $(\mu ,\mathbf{x})$ from $c_3$ without $\mathbf{k}$ is contradictory to the security of the symmetric encryption. That is, $\mathcal{A}$ knows $\mathbf{k}$ with the same probability to recover $(\mu ,\mathbf{x})$. Therefore, it is equivalent to computing $(\mu ,\mathbf{x})$ and computing $(\mu ,\mathbf{k},\mathbf{x})$ from the challenge ciphertext. Thus, $\mathcal{C}$ requiring $\mathcal{A}$ to return $(\mu ,\mathbf{k},\mathbf{x})$ does not increase the hardness to attack the scheme.    □

Lemma 13.

The modification to the game is rational, and the hardness of winning the game G${}_{11}$ is the same as that of winning G${}_{10}$, in $\mathcal{A}$’s view. Furthermore, $Pr\left[F_{11}\right]=Pr\left[F_{10}\right]$.

Proof. 

First, as proven in Lemma 12, if $\mathcal{A}$ can guess the $\mathbf{k}$ encrypted in ${\mathbf{c}}_{\mathbf{2}}$, then it can compute the corresponding message and signature when given $c_3$. From this perspective, the crux of cracking the proposed scheme lies in obtaining $\mathbf{k}$.

Second, $c_3$ does not provide any assistance in obtaining $\mathbf{k}$. Firstly, it is impossible to directly obtain $\mathbf{k}$ from $c_3$. Since the symmetric encryption used in this scheme is IND-OT secure and one-to-one, $c_3$ does not leak any information of $H_3\left(\mathbf{k}\right)$ to $\mathcal{A}$. Therefore, $c_3$ does not disclose any information of $\mathbf{k}$. Secondly, as proven in Lemma 8, the probability of obtaining assistance in computing $\mathbf{k}$ by changing $c_3$ is negligible.

Third, in the absence of $c_3$, it will not increase the probability of obtaining $\mathbf{k}$ by falsifying $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast })$. Although the message and signature ($\mu ,\mathbf{x}$) concealed in $c_3$ can help to verify the correctness of $\mathbf{k}$, the information of $\mathbf{k}$ can not also be changed without $c_3$. As proven in Lemma 7, the probability that $\mathcal{A}$ gets assistance to obtain $\mathbf{k}$ by changing ${\mathbf{c}}_{\mathbf{0}}^{\ast }$ is negligible. The probability of $\mathcal{A}$ receiving assistance to obtain $\mathbf{k}$ by changing $({\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast })$ is also negligible, as proven in Lemma 9.

In conclusion, the hardness of winning the games G${}_{11}$ and G${}_{10}$ is identical whether $c_3$ is known or not.    □

Lemma 14.

In $\mathcal{A}$’s view, the games G${}_{12}$ and G${}_{11}$ are statistically indistinguishable. Furthermore, $Pr\left[F_{12}\right|\neg E_{12}]=Pr\left[F_{11}\right|\neg E_{11}]$ and $Pr\left[E_{12}\right]=Pr\left[E_{11}\right]$ is negligible.

Proof. 

In the game G${}_{11}$, ${\mathbf{c}}_{\mathbf{1}}^{\ast }=\mathbf{r}({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}})+{\mathbf{e}}_{\mathbf{1}}=\mathbf{r}({\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}-H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}})+{\mathbf{e}}_{\mathbf{1}}=\mathbf{r}{\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{r}\mathbf{e}+{\mathbf{e}}_{\mathbf{1}}={\mathbf{c}}_{\mathbf{0}}^{\ast }\mathbf{p}-{\mathbf{e}}_{\mathbf{0}}\mathbf{p}+\mathbf{r}\mathbf{e}+{\mathbf{e}}_{\mathbf{1}}$.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill {\mathbf{c}}_{\mathbf{1}}^{\ast }& =\mathbf{r}({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}})+{\mathbf{e}}_{\mathbf{1}}=\mathbf{r}({\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}-H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}})+{\mathbf{e}}_{\mathbf{1}}\hfill \\ \hfill & =\mathbf{r}{\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{r}\mathbf{e}+{\mathbf{e}}_{\mathbf{1}}={\mathbf{c}}_{\mathbf{0}}^{\ast }\mathbf{p}-{\mathbf{e}}_{\mathbf{0}}\mathbf{p}+\mathbf{r}\mathbf{e}+{\mathbf{e}}_{\mathbf{1}}\hfill \end{array}\end{array}$$

Let $\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }}$ denote the ciphertext ${\mathbf{c}}_{\mathbf{1}}^{\ast }$ in the game G${}_{12}$. Then, $\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }}={\mathbf{c}}_{\mathbf{0}}^{\ast }\mathbf{p}+{\mathbf{e}}_{\mathbf{1}}={\mathbf{c}}_{\mathbf{1}}^{\ast }+{\mathbf{e}}_{\mathbf{0}}\mathbf{p}-\mathbf{r}\mathbf{e}$, where ${\mathbf{c}}_{\mathbf{1}}^{\ast }$ is the corresponding ciphertext in G${}_{11}$. We need to argue that $({\mathbf{c}}_{\mathbf{0}}^{\ast },\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }},{\mathbf{c}}_{\mathbf{2}}^{\ast })$ is also a valid ciphertext. That is, $({\mathbf{c}}_{\mathbf{0}}^{\ast },\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }},{\mathbf{c}}_{\mathbf{2}}^{\ast })$ can be decrypted correctly with the valid private key. Suppose that $({\mathbf{s}}_{\mathbf{0}},{\mathbf{s}}_{\mathbf{1}})$ is a valid private key for the ciphertext, i.e., $({\mathbf{s}}_{\mathbf{0}},{\mathbf{s}}_{\mathbf{1}})$ is short enough. It might be good to set the key $({\mathbf{s}}_{\mathbf{0}},{\mathbf{s}}_{\mathbf{1}})$ to an equal element size to that of the simulated key. The simulated key can decrypt well, although in the two kinds of known keys, the element size of the simulated key is a little larger than that of the real key. That is, $\parallel {\mathbf{s}}_{\mathbf{0}}\parallel \le \frac{1}{\sqrt{2}{\pi }^2}\varrho n^{5/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}$, $\parallel {\mathbf{s}}_{\mathbf{1}}\parallel \le \frac{1}{\sqrt{2}{\pi }^2}\varrho n^{3/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}$.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \parallel {\mathbf{c}}_{\mathbf{2}}^{\ast }-({\mathbf{c}}_{\mathbf{0}}^{\ast }\parallel \widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }})({\mathbf{s}}_{\mathbf{0}}\parallel {\mathbf{s}}_{\mathbf{1}}){\parallel }_{\infty }=& \parallel {\mathbf{c}}_{\mathbf{2}}^{\ast }-({\mathbf{c}}_{\mathbf{0}}^{\ast }\parallel {\mathbf{c}}_{\mathbf{1}}^{\ast })({\mathbf{s}}_{\mathbf{0}}\parallel {\mathbf{s}}_{\mathbf{1}})-(\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }}-{\mathbf{c}}_{\mathbf{1}}^{\ast }){\mathbf{s}}_{\mathbf{1}}{\parallel }_{\infty }\hfill \\ \hfill \le & \parallel {\mathbf{c}}_{\mathbf{2}}^{\ast }-({\mathbf{c}}_{\mathbf{0}}^{\ast }\parallel {\mathbf{c}}_{\mathbf{1}}^{\ast })({\mathbf{s}}_{\mathbf{0}}\parallel {\mathbf{s}}_{\mathbf{1}}){\parallel }_{\infty }+{\parallel (\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }}-{\mathbf{c}}_{\mathbf{1}}^{\ast }){\mathbf{s}}_{\mathbf{1}}\parallel }_{\infty }.\hfill \end{array}\end{array}$$

(8)

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \parallel {\mathbf{c}}_{\mathbf{2}}^{\ast }-({\mathbf{c}}_{\mathbf{0}}^{\ast }\parallel \widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }})({\mathbf{s}}_{\mathbf{0}}\parallel {\mathbf{s}}_{\mathbf{1}}){\parallel }_{\infty }& =\parallel {\mathbf{c}}_{\mathbf{2}}^{\ast }-({\mathbf{c}}_{\mathbf{0}}^{\ast }\parallel {\mathbf{c}}_{\mathbf{1}}^{\ast })({\mathbf{s}}_{\mathbf{0}}\parallel {\mathbf{s}}_{\mathbf{1}})-(\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }}-{\mathbf{c}}_{\mathbf{1}}^{\ast }){\mathbf{s}}_{\mathbf{1}}{\parallel }_{\infty }\hfill \\ \hfill & \le \parallel {\mathbf{c}}_{\mathbf{2}}^{\ast }-({\mathbf{c}}_{\mathbf{0}}^{\ast }\parallel {\mathbf{c}}_{\mathbf{1}}^{\ast })({\mathbf{s}}_{\mathbf{0}}\parallel {\mathbf{s}}_{\mathbf{1}}){\parallel }_{\infty }+{\parallel (\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }}-{\mathbf{c}}_{\mathbf{1}}^{\ast }){\mathbf{s}}_{\mathbf{1}}\parallel }_{\infty }\hfill \end{array}\end{array}$$

(9)

$\parallel {\mathbf{c}}_{\mathbf{2}}^{\ast }-({\mathbf{c}}_{\mathbf{0}}^{\ast }\parallel {\mathbf{c}}_{\mathbf{1}}^{\ast })({\mathbf{s}}_{\mathbf{0}}\parallel {\mathbf{s}}_{\mathbf{1}}){\parallel }_{\infty }\le \frac{1}{\sqrt{2}{\pi }^2}({\varrho }^2+3\varrho )n^3{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}$.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \parallel (\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }}-{\mathbf{c}}_{\mathbf{1}}^{\ast }){\mathbf{s}}_{\mathbf{1}}{\parallel }_{\infty }& =\parallel ({\mathbf{e}}_{\mathbf{0}}\mathbf{p}-\mathbf{r}\mathbf{e}){\mathbf{s}}_{\mathbf{1}}{\parallel }_{\infty }\le \parallel {\mathbf{e}}_{\mathbf{0}}\mathbf{p}{\mathbf{s}}_{\mathbf{1}}{\parallel }_{\infty }+\parallel \mathbf{r}\mathbf{e}{\mathbf{s}}_{\mathbf{1}}{\parallel }_{\infty }\le \parallel {\mathbf{e}}_{\mathbf{0}}{\parallel }_{\infty }\parallel \mathbf{p}{\mathbf{s}}_{\mathbf{1}}\parallel \sqrt{n}+{\parallel \mathbf{r}\parallel }_{\infty }{\parallel \mathbf{e}{\mathbf{s}}_{\mathbf{1}}\parallel }_{\infty }\hfill \\ \hfill & \le {\varrho \parallel \mathbf{p}\parallel }_{\infty }\parallel {\mathbf{s}}_{\mathbf{1}}\parallel n^{3/2}+{\parallel \mathbf{e}\parallel }_{\infty }\parallel {\mathbf{s}}_{\mathbf{1}}\parallel n^{3/2}\le ({\varrho }^2+\varrho )\frac{1}{\sqrt{2}{\pi }^2}n{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}\sqrt{n}{n}^{3/2}\hfill \\ \hfill & \le \frac{1}{\sqrt{2}{\pi }^2}({\varrho }^2+\varrho ){(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}{n}^3\hfill \end{array}\end{array}$$

(10)

Therefore, $\parallel {\mathbf{c}}_{\mathbf{2}}^{\ast }-({\mathbf{c}}_{\mathbf{0}}^{\ast }\parallel \widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }})({\mathbf{s}}_{\mathbf{0}}\parallel {\mathbf{s}}_{\mathbf{1}}){\parallel }_{\infty }\le \frac{1}{\sqrt{2}{\pi }^2}(2{\varrho }^2+4\varrho ){(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}{n}^3<\lfloor q/16\rfloor$. Thus, the challenge ciphertext is also a valid one. That is, if $\mathcal{A}$ can obtain the correct $\mathbf{k}$ from $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{1}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast })$, then it can also obtain the same $\mathbf{k}$ from $({\mathbf{c}}_{\mathbf{0}}^{\ast },\widetilde{{\mathbf{c}}_{\mathbf{1}}^{\ast }},{\mathbf{c}}_{\mathbf{2}}^{\ast })$.    □

Lemma 15.

In $\mathcal{A}$’s view, the games G${}_{13}$ and G${}_{12}$ are computationally indistinguishable. Furthermore, $Pr\left[F_{13}\right|\neg E_{13}]=Pr\left[F_{12}\right|\neg E_{12}]$, and $Pr\left[E_{13}\right]=Pr\left[E_{12}\right]$ is negligible.

Proof. 

Reduction from LWE. When the LWE oracle is $\mathcal{O}={\mathcal{O}}_s$, namely the pseudorandom case, the challenge ciphertext has the same distribution as in the game G${}_{12}$. First, the public keys used directly to encrypt the challenge ciphertext are $({\mathbf{h}}_{\mathbf{r}},{\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}},\mathbf{u})=({\mathbf{a}}_{\mathbf{1}},{\mathbf{a}}_{\mathbf{1}}\mathbf{p}+\mathbf{e}-H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}},{\mathbf{a}}_{\mathbf{2}})=({\mathbf{a}}_{\mathbf{1}},{\mathbf{a}}_{\mathbf{1}}\mathbf{p}+\mathbf{e},{\mathbf{a}}_{\mathbf{2}})$. Second, the challenge ciphertext is ${\mathbf{c}}_{\mathbf{0}}^{\ast }={\mathbf{z}}_{\mathbf{0}}=\mathbf{r}{\mathbf{a}}_{\mathbf{1}}+{\mathbf{e}}_{\mathbf{0}}$ for some $\mathbf{r},{\mathbf{e}}_{\mathbf{0}}\leftarrow {\{-1,0,1\}}^n$, according to the definition of LWE. Due to ${\mathbf{z}}_{\mathbf{2}}=\mathbf{r}{\mathbf{a}}_{\mathbf{2}}+{\mathbf{e}}_{\mathbf{2}}$, ${\mathbf{c}}_{\mathbf{2}}^{\ast }={\mathbf{z}}_{\mathbf{2}}+\mathbf{k}\lfloor q/2\rfloor =\mathbf{r}{\mathbf{a}}_{\mathbf{2}}+{\mathbf{e}}_{\mathbf{2}}+\mathbf{k}\lfloor q/2\rfloor$. The ${\mathbf{c}}_{\mathbf{1}}^{\ast }$ is as follows.

$${\mathbf{c}}_{\mathbf{1}}^{\ast }={\mathbf{c}}_{\mathbf{0}}^{\ast }\mathbf{p}+\tilde{\mathbf{e}}=(\mathbf{r}{\mathbf{a}}_{\mathbf{1}}+{\mathbf{e}}_{\mathbf{0}})\mathbf{p}+(\mathbf{r}\mathbf{e}-{\mathbf{e}}_{\mathbf{0}}\mathbf{p}+{\mathbf{e}}_{\mathbf{1}})=\mathbf{r}({\mathbf{a}}_{\mathbf{1}}\mathbf{r}+\mathbf{e})+{\mathbf{e}}_{\mathbf{1}}=\mathbf{r}({\mathbf{b}}_{\mathbf{r}}+H_1\left({\mathbf{c}}_{\mathbf{0}}^{\ast }\right){\mathbf{d}}_{\mathbf{r}})+{\mathbf{e}}_{\mathbf{1}}.$$

Obviously, the challenge ciphertext ${\mathbf{c}}^{\ast }$ is exactly the challenge ciphertext in game G${}_{12}$. In this case, $\mathcal{A}$’s advantage to distinguish the two games is zero.

When the LWE oracle is the real random case $\mathcal{O}={\mathcal{O}}_{\$}$, the challenge ciphertext is uniformly distributed. In the challenge ciphertext, ${\mathbf{c}}_{\mathbf{0}}^{\ast }={\mathbf{z}}_{\mathbf{0}}$ obeys the uniform distribution. Due to ${\mathbf{z}}_{\mathbf{1}}\stackrel{\$}{\leftarrow }{\mathbb{Z}}_q^n$, ${\mathbf{c}}_{\mathbf{2}}^{\ast }={\mathbf{z}}_{\mathbf{1}}+\mathbf{k}\lfloor q/2\rfloor$ is distributed uniformly. On the other hand, the generation method for ${\mathbf{c}}_{\mathbf{1}}^{\ast }$ stays the same as in game G${}_{12}$. ${\mathbf{c}}_{\mathbf{1}}^{\ast }=({\mathbf{z}}_{\mathbf{1}}\mathbf{p}+{\mathbf{e}}_{\mathbf{1}})-{\mathbf{e}}_{\mathbf{0}}\mathbf{p}+\mathbf{r}\mathbf{e}$. $({\mathbf{z}}_{\mathbf{1}}\mathbf{p}+{\mathbf{e}}_{\mathbf{1}})$ is computationally indistinguishable from the uniform distribution over ${\mathbb{Z}}_q^n$, and $-{\mathbf{e}}_{\mathbf{0}}\mathbf{p}+\mathbf{r}\mathbf{e}$ is restricted to a small range. Therefore, ${\mathbf{c}}_{\mathbf{1}}^{\ast }$ is computationally indistinguishable from the uniform distribution over ${\mathbb{Z}}_q^n$. That is to say, in terms of distinguishing the games G${}_{12}$ and G${}_{11}$, ${\mathbf{c}}_{\mathbf{1}}^{\ast }$ is no more effective than $({\mathbf{c}}_{\mathbf{0}}^{\ast },{\mathbf{c}}_{\mathbf{2}}^{\ast })$.

$\mathcal{C}$ uses the guess from $\mathcal{A}$ as the answer for the LWE oracle. Therefore, the advantage of $\mathcal{A}$ in distinguishing the two games is an adversary’s advantage in attacking RLWE, which is negligible.    □

In Theorem 2, the unforgeability of SC-NTRU will be proven by the interaction between the challenger $\mathcal{C}$ and an adversary $\mathcal{A}$. To complete Theorem 2, some necessary conclusions are demonstrated in Lemmas 16 to 18.

Lemma 16.

In the query phase, the simulated signature generated by the simulated trapdoor in Algorithm 2 is indistinguishable from the real signature, and it can pass the signature verification.

Proof. 

To argue that the signature generated by the simulated trapdoor in Algorithm 2 and that by the real trapdoor are identical, it is sufficient to demonstrate that the simulated trapdoor is short and has the same structure property as that of the real trapdoor. For the size property, we argue that the simulated trapdoor is short enough that it can use the same Gaussian parameter to sample as that used in the sample with the real trapdoor. For the structure property, we show that the size of the deviation and the length of the simulated trapdoor are the same, which is also the inherent character of the real trapdoor.

In Algorithm 2, for the case of $r=0$:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill [{\mathbf{h}}_{\mathbf{s}}\parallel \mathbf{f}]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})& =[{\mathbf{h}}_{\mathbf{s}}\parallel {\mathbf{h}}_{\mathbf{s}}\mathbf{p}+\mathbf{e}+p{\mathbf{h}}_{\mathbf{f}}]({\mathbf{x}}_{\mathbf{0}}^{\prime }-\mathbf{p}{\mathbf{x}}_{\mathbf{1}},{\mathbf{x}}_{\mathbf{1}})={\mathbf{h}}_{\mathbf{s}}({\mathbf{x}}_{\mathbf{0}}^{\prime }-\mathbf{p}{\mathbf{x}}_{\mathbf{1}})+({\mathbf{h}}_{\mathbf{s}}\mathbf{p}+\mathbf{e}+p{\mathbf{h}}_{\mathbf{f}}){\mathbf{x}}_{\mathbf{1}}\hfill \\ \hfill & =p({\mathbf{h}}_{\mathbf{s}}{\mathbf{x}}_{\mathbf{0}}^{\prime }/p+{\mathbf{h}}_{\mathbf{f}}{\mathbf{x}}_{\mathbf{1}})+\mathbf{e}{\mathbf{x}}_{\mathbf{1}}=\mathbf{e}{\mathbf{x}}_{\mathbf{1}}-p{\mathbf{x}}_{\mathbf{1}}^{\prime }\hfill \\ \hfill \parallel \mathbf{e}{\mathbf{x}}_{\mathbf{1}}-p{\mathbf{x}}_{\mathbf{1}}^{\prime }\parallel & \le p\parallel {\mathbf{x}}_{\mathbf{1}}^{\prime }\parallel +\parallel \mathbf{e}{\mathbf{x}}_{\mathbf{1}}\parallel \le p\parallel {\mathbf{x}}_{\mathbf{1}}^{\prime }{\parallel +\parallel \mathbf{e}\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\sqrt{n}\le p{\eta }_3^{\prime }\sqrt{n}+\varrho (\aleph +1){\eta }_3^{\prime }\sqrt{n}\sqrt{n}\sqrt{n}\hfill \\ \hfill & ={\eta }_3^{\prime }\sqrt{n}(p+\varrho (\aleph +1)n)={\eta }_3^{\prime }\sqrt{n}(\aleph +1)(\xi +\varrho n)\approx \varrho (\aleph +1)\frac{1}{\sqrt{2}{\pi }^2}\sqrt{n}ln\left(2^{(7+\lambda )/2}n\right)n^{3/2}\hfill \\ \hfill & =\frac{1}{\sqrt{2}{\pi }^2}\varrho (\aleph +1)n^{2}ln\left(2^{(7+\lambda )/2}n\right)\hfill \\ \hfill \parallel ({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})\parallel & =\parallel ({\mathbf{x}}_{\mathbf{0}}^{\prime }-\mathbf{p}{\mathbf{x}}_{\mathbf{1}},{\mathbf{x}}_{\mathbf{1}})\parallel =\sqrt{\parallel {\mathbf{x}}_{\mathbf{0}}^{\prime }-\mathbf{p}{\mathbf{x}}_{\mathbf{1}}{\parallel }^2+{\parallel {\mathbf{x}}_{\mathbf{1}}\parallel }^2}\le \sqrt{\parallel {\mathbf{x}}_{\mathbf{0}}^{\prime }{\parallel }^2+\parallel \mathbf{p}{\mathbf{x}}_{\mathbf{1}}{\parallel }^2+{\parallel {\mathbf{x}}_{\mathbf{1}}\parallel }^2}\hfill \\ \hfill & \approx \parallel \mathbf{p}{\mathbf{x}}_{\mathbf{1}}{\parallel \le \parallel \mathbf{p}\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\sqrt{n}\le (\aleph +1){\eta }_3{n}^{3/2}=\frac{1}{\sqrt{2}{\pi }^2}(\aleph +1)n^{2}ln\left(2^{(7+\lambda )/2}n\right)\hfill \end{array}\end{array}$$

(11)

In the case of $r=1$:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill [{\mathbf{h}}_{\mathbf{s}}\parallel \mathbf{f}]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})& =[{\mathbf{h}}_{\mathbf{s}}\parallel {\mathbf{h}}_{\mathbf{s}}\mathbf{p}+\mathbf{e}+p{\mathbf{h}}_{\mathbf{f}}](-\mathbf{p}{\mathbf{x}}_{\mathbf{1}},{\mathbf{x}}_{\mathbf{1}})={\mathbf{h}}_{\mathbf{s}}(-\mathbf{p}{\mathbf{x}}_{\mathbf{1}})+({\mathbf{h}}_{\mathbf{s}}\mathbf{p}+\mathbf{e}+p{\mathbf{h}}_{\mathbf{f}}){\mathbf{x}}_{\mathbf{1}}\hfill \\ \hfill & =p({\mathbf{x}}_{\mathbf{1}}^{\prime }+{\mathbf{h}}_{\mathbf{f}}{\mathbf{x}}_{\mathbf{1}})+\mathbf{e}{\mathbf{x}}_{\mathbf{1}}-p{\mathbf{x}}_{\mathbf{1}}^{\prime }=\mathbf{e}{\mathbf{x}}_{\mathbf{1}}-p{\mathbf{x}}_{\mathbf{1}}^{\prime }\hfill \\ \hfill \parallel \mathbf{e}{\mathbf{x}}_{\mathbf{1}}-p{\mathbf{x}}_{\mathbf{1}}^{\prime }\parallel & \le p\parallel {\mathbf{x}}_{\mathbf{1}}^{\prime }\parallel +\parallel \mathbf{e}{\mathbf{x}}_{\mathbf{1}}\parallel \le p\parallel {\mathbf{x}}_{\mathbf{1}}^{\prime }{\parallel +\parallel \mathbf{e}\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\sqrt{n}\le p{\eta }_0\sqrt{n}+\varrho (\aleph +1){\eta }_0\sqrt{n}n\hfill \\ \hfill & ={\eta }_0\sqrt{n}((\aleph +1)\xi +\varrho (\aleph +1)n)\approx \frac{1}{\sqrt{2}\pi }\varrho (\aleph +1)n^{3/2}\sqrt{ln\left(2^{(7+\lambda )/2}n\right)}\hfill \\ \hfill \parallel ({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})\parallel & =\parallel (-\mathbf{p}{\mathbf{x}}_{\mathbf{1}},{\mathbf{x}}_{\mathbf{1}})\parallel \le \sqrt{\parallel \mathbf{p}{\mathbf{x}}_{\mathbf{1}}{\parallel }^2+{\parallel {\mathbf{x}}_{\mathbf{1}}\parallel }^2}\approx {\parallel \mathbf{p}\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\sqrt{n}=(\aleph +1){\eta }_0\sqrt{n}n\hfill \\ \hfill & \approx \frac{1}{\sqrt{2}\pi }(\aleph +1)n^{3/2}\sqrt{ln\left(2^{(7+\lambda )/2}n\right)}\hfill \end{array}\end{array}$$

(12)

When using the simulated trapdoor to sign, the Gaussian parameter to sample is

$$\frac{1}{\sqrt{2}{\pi }^2}(\aleph +1)n^{2}ln\left(2^{(7+\lambda )/2}n\right)\frac{1}{\sqrt{2}\pi }\sqrt{ln\left(2^{(7+\lambda )/2}n\right)}=\frac{1}{2{\pi }^3}(\aleph +1)n^2{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}$$

For simplicity, it can be set as $\frac{1}{2{\pi }^3}(\aleph +1)n^2{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}$. The Gaussian parameter for the real trapdoor to sign is also this value, according to Equation (1). It is easy to see that the size and structure property of the simulated trapdoor are the same as those of the real trapdoor, respectively.    □

Lemma 17.

Under the parameter settings in Equation (1), the vector ${\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}}$ constructed by $\mathcal{C}$ in the forgery phase of Theorem 2 derives a valid solution for the search RLWE instance $({\mathbf{h}}_{\mathbf{s}},\mathbf{y})$.

Proof. 

Since the $\mathbf{x}$ output by $\mathcal{A}$ is a valid forgery, $\mathbf{x}$ obeys $D_{{\mathbb{Z}}^n,\mathbf{0},\eta }$ with $\eta =\frac{1}{2{\pi }^3}(\aleph +1)n^2{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}$ and $\parallel \mathbf{y}-({\mathbf{h}}_{\mathbf{s}},\mathbf{f}){\mathbf{x}\parallel }_{\infty }\le \frac{1}{2{\pi }^3}(\aleph +1)\varsigma n^2{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}$ for some constant $\varsigma >1$. Then, it has

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & \parallel \mathbf{y}-{\mathbf{h}}_{\mathbf{s}}({\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}}){\parallel }_{\infty }=\parallel \mathbf{y}-[{\mathbf{h}}_{\mathbf{s}}\left|\right|{\mathbf{h}}_{\mathbf{s}}\mathbf{p}]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}}){\parallel }_{\infty }=\parallel \mathbf{y}-[{\mathbf{h}}_{\mathbf{s}}\left|\right|{\mathbf{h}}_{\mathbf{s}}\mathbf{p}+\mathbf{e}{]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})+\mathbf{e}{\mathbf{x}}_{\mathbf{1}}\parallel }_{\infty }\hfill \\ \hfill \le & \parallel \mathbf{y}-[{\mathbf{h}}_{\mathbf{s}}\left|\right|{\mathbf{h}}_{\mathbf{s}}\mathbf{p}+\mathbf{e}]({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}}){\parallel }_{\infty }+\parallel \mathbf{e}{\mathbf{x}}_{\mathbf{1}}{\parallel }_{\infty }\le \frac{1}{2{\pi }^3}(\aleph +1)\varsigma n^2{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}+{\parallel \mathbf{e}\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\hfill \\ \hfill \le & \frac{1}{2{\pi }^3}(\aleph +1)\varsigma n^2{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}+\varrho \frac{1}{2{\pi }^3}{(\aleph +1)}^2{n}^2{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}n\hfill \\ \hfill \approx & \frac{1}{2{\pi }^3}\varrho {(\aleph +1)}^2{n}^3{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}\hfill \end{array}\end{array}$$

(13)

Similarly, $\parallel \mathbf{y}-{\mathbf{h}}_{\mathbf{s}}({\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}})\parallel \le \frac{1}{2{\pi }^3}\varrho {(\aleph +1)}^2{n}^{7/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}$.

Furthermore, the size of the vector ${\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}}$ may be evaluated in the same approach.

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \parallel {\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}}\parallel \le & \parallel {\mathbf{x}}_{\mathbf{0}}\parallel +\parallel \mathbf{p}{\mathbf{x}}_{\mathbf{1}}\parallel \le \parallel {\mathbf{x}}_{\mathbf{0}}{\parallel +\parallel \mathbf{p}\parallel }_{\infty }\parallel {\mathbf{x}}_{\mathbf{1}}\parallel \sqrt{n}\sqrt{n}\hfill \\ \hfill \le & \frac{1}{2{\pi }^3}{(\aleph +1)}^2{n}^{7/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}.\hfill \end{array}\end{array}$$

(14)

Therefore, $\mathbf{y}-{\mathbf{h}}_{\mathbf{s}}({\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}})$ and ${\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}}$ is short enough, and they form a solution for the RLWE instance $({\mathbf{h}}_{\mathbf{s}},\mathbf{y})$ under the parameter settings in Equation (1).    □

Lemma 18.

For the query times $0<Q<\sqrt{\frac{2}{3}\pi \aleph \xi (\xi +1)}$, the upper bound ξ of $p_i$ for i from 1 to ℵ. Both the signature queries and forgery in the simulation can be completed without aborts, with probability

$$\begin{array}{c}\hfill \begin{array}{c}\hfill \frac{\sqrt{3}}{\pi \sqrt{2\aleph \xi (\xi +1)}}\left(1-\frac{\sqrt{3}Q}{\pi \sqrt{2\aleph \xi (\xi +1)}}\right)\le Pr\left[complete\right]\le \frac{\sqrt{3}}{\pi \sqrt{2\aleph \xi (\xi +1)}},\end{array}\end{array}$$

(15)

no matter what strategy $\mathcal{A}$ takes. In particular, when $Q<\frac{\sqrt{3}{\pi }^{4}q}{20n^2{\aleph }^{1/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}}$, the sucessful probability satisfies $\frac{\sqrt{3}}{\pi \sqrt{20\aleph \xi (\xi +1)}}<Pr\left[complete\right]<\frac{\sqrt{3}}{\pi \sqrt{2\aleph \xi (\xi +1)}}$.

Proof. 

First, we evaluate the probability $Pr[1+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{p}_i=0|{\nu }_i\stackrel{\$}{\leftarrow }\{0,1\},p_i\stackrel{\$}{\leftarrow }\{-\xi ,-\xi +1,\cdots ,\xi \}]$ since ${(-1)}^{{\nu }_i}{p}_i$ submits the uniform distribution over $\{-\xi ,-\xi +1,\cdots ,\xi \}$, $Pr[{(-1)}^{{\nu }_i}{p}_i$ = $t|{\nu }_i\stackrel{\$}{\leftarrow }\{0,1\},p_i\stackrel{\$}{\leftarrow }\{-\xi ,-\xi +1,\cdots ,\xi \}$, $t\in \{-\xi ,-\xi +1,\cdots ,\xi \}]$ = $1/(2\xi +1)$. The mean and variance are $E\left[{(-1)}^{{\nu }_i}{p}_i\right]=0,$$D\left[{(-1)}^{{\nu }_i}{p}_i\right]=\frac{1}{2\xi +1}{\sum }_{i=-\xi }^{\xi }{i}^2=\frac{1}{3}\xi (\xi +1)$, respectively. Then, $E\left[\frac{1}{\aleph }{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{p}_i\right]=0$, $D\left[\frac{1}{\aleph }{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{p}_i\right]=\frac{1}{3\aleph }\xi (\xi +1)$. When ℵ becomes big enough, $\frac{1}{\aleph }{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{p}_i$ obeys the Gaussian distribution ${\psi }_{0,\sqrt{\frac{1}{3\aleph }\xi (\xi +1)}}$, according to the Central Limit Theorem. Then,

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill & Pr[1+\sum _{i=1}^{\aleph }{(-1)}^{{\nu }_i}{p}_i=0|{\nu }_i\stackrel{\$}{\leftarrow }\{0,1\},p_i\stackrel{\$}{\leftarrow }\{-\xi ,-\xi +1,\cdots ,\xi \}]\hfill \\ \hfill =& Pr[\frac{1}{\aleph }\sum _{i=1}^{\aleph }{(-1)}^{{\nu }_i}{p}_i=-\frac{1}{\aleph }|{\nu }_i\stackrel{\$}{\leftarrow }\{0,1\},p_i\stackrel{\$}{\leftarrow }\{-\xi ,-\xi +1,\cdots ,\xi \}]\hfill \\ \hfill =& \frac{1}{\sqrt{2\pi }\sqrt{\frac{\aleph }{3}\xi (\xi +1)}}{e}^{-1/\left(\frac{2}{3}{\aleph }^3\xi (\xi +1)\right)}\approx \frac{\sqrt{3}}{\sqrt{2\pi \aleph \xi (\xi +1)}}\hfill \end{array}\end{array}$$

(16)

This probability is non-negligible.

Next, we evaluate the probability that the simulation normally completes the signature queries and forgery with the affine subspaces method, as in [34]. Since ${\mathbf{f}}_{\mathbf{i}}={\mathbf{h}}_{\mathbf{s}}{\mathbf{p}}_{\mathbf{i}}+{\mathbf{e}}_{\mathbf{i}}+p_i^{\prime }{\mathbf{h}}_{\mathbf{f}}$, ${\mathbf{p}}_{\mathbf{i}},{\mathbf{e}}_{\mathbf{i}}\stackrel{\$}{\leftarrow }{\{-1,0,1\}}^n$, $p_i^{\prime }\stackrel{\$}{\leftarrow }\{-\xi ,-\xi +1,\cdots ,\xi \}$ from $i=0$ to ℵ except $p_0^{\prime }=1$. At the beginning of the game, the values of $p_i^{\prime }$s are completely hidden from $\mathcal{A}$ by the LWE instances ${\mathbf{h}}_{\mathbf{s}}{\mathbf{p}}_{\mathbf{i}}+{\mathbf{e}}_{\mathbf{i}}$. Even though $\mathcal{A}$ knows the calculation form of ${\mathbf{f}}_{\mathbf{i}}$, some information is leaked due to signature queries. $\mathcal{A}$ can not infer enough information by Bayesian updating to observably increase the probability of forging. For ${\nu }^{\ast }$, the event $1+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i^{\ast }}{p}_i^{\prime }=0$ corresponds a hyperplane $V^{\ast }$ with $|V^{\ast }|=\frac{\sqrt{3}}{\sqrt{2\pi \aleph \xi (\xi +1)}}\left|V\right|$, where $\left|V\right|$ denotes the size of the total space determined by $(p_1,p_2,\cdots p_{\aleph })$. Let $V_j$ denote a hyperplane that can lead to an abort in the jth signature query. Then, $|V^{\ast }\setminus V_j|=|V^{\ast }-V^{\ast }\cap V_j|=\frac{\sqrt{3}}{\sqrt{2\pi \aleph \xi (\xi +1)}}(1-\frac{\sqrt{3}}{\sqrt{2\pi \aleph \xi (\xi +1)}})\left|V\right|$. The lower bound can be computed by the union bound,

$$\begin{array}{c}\hfill \begin{array}{c}\hfill Pr\left[complete\right]=Pr[(p_1,p_2\cdots ,p_{\aleph })\in ({\mathbb{V}}^{\ast }\setminus {\cup }_{j=1}^Q{V}_j)]\ge \frac{\sqrt{3}}{\sqrt{2\pi \aleph \xi (\xi +1)}}\left(1-\frac{\sqrt{3}Q}{\sqrt{2\pi \aleph \xi (\xi +1)}}\right)\end{array}\end{array}$$

(17)

The upper bound can be evaluated trivially, $Pr\left[complete\right]\le \frac{\sqrt{3}}{\sqrt{2\pi \aleph \xi (\xi +1)}}$.

Specifically, when

$$Q<\frac{9\sqrt{2\pi \aleph \xi (\xi +1)}}{10\sqrt{3}}<\frac{9\sqrt{2\pi \aleph \varrho n(\varrho n+1)}}{10\sqrt{3}}\approx \frac{9\varrho n\sqrt{2\pi \aleph }}{10\sqrt{3}}\approx \frac{\sqrt{3}{\pi }^{7/2}q}{20n^2{\aleph }^{1/2}{(ln\left(2^{(7+\lambda )/2}n\right))}^{3/2}},$$

$\frac{\sqrt{3}Q}{\sqrt{2\pi \aleph \xi (\xi +1)}}<\frac{9}{10}$, $\frac{\sqrt{3}}{10\sqrt{2\pi \aleph \xi (\xi +1)}}<Pr\left[complete\right]<\frac{\sqrt{3}}{\pi \sqrt{2\aleph \xi (\xi +1)}}$.    □

Theorem 2.

If there exists an adversary $\mathcal{A}$ who can forge an existential signature for SC-NTRU with probability ϵ by carrying out adaptive chosen-message queries, then a probabilistic algorithm $\mathcal{C}$ can be constructed to solve the search LWE${}_{n,m,q}$ problem with parameter settings in Equation (1) in almost the same time with probability $\frac{\sqrt{3}ϵ}{\pi \sqrt{2\aleph \xi (\xi +1)}}\left(1-\frac{\sqrt{3}Q}{\pi \sqrt{2\aleph \xi (\xi +1)}}\right)$.

Proof. 

Setup. The challenger $\mathcal{C}$ queries the RLWE oracle to fetch a random RLWE$(q,n,m,\beta )$ instance $({\mathbf{h}}_{\mathbf{s}},\mathbf{y})$. Then, $\mathcal{C}$ generates the simulation environment for $\mathcal{A}$ as follows.

• $\mathcal{C}$ generates a public and private key pair by running the KeyGen algorithm $({\mathbf{B}}_{\mathbf{f}},{\mathbf{h}}_{\mathbf{f}})\leftarrow \mathrm{KeyGen}(n,q)$.
• $\mathcal{C}$ samples ${\mathbf{p}}_{\mathbf{i}},{\mathbf{e}}_{\mathbf{i}}\stackrel{\$}{\leftarrow }{\{-1,0,1\}}^n$, $p_i^{\prime }\stackrel{\$}{\leftarrow }\{-\xi ,-\xi +1,\cdots ,\xi \}$ from $i=1$ to ℵ but sets $p_i^{\prime }=1$, then computes ${\mathbf{f}}_{\mathbf{i}}={\mathbf{h}}_{\mathbf{s}}{\mathbf{p}}_{\mathbf{i}}+{\mathbf{e}}_{\mathbf{i}}+p_i^{\prime }{\mathbf{h}}_{\mathbf{f}}$ for i from 1 to ℵ.

$\mathcal{C}$ returns $({\mathbf{h}}_{\mathbf{f}},{\left\{{\mathbf{f}}_{\mathbf{i}}\right\}}_{i=0}^{\aleph })$ to $\mathcal{A}$.

Queries. $\mathcal{A}$ submits a randomly chosen message $\mu \in {\{0,1\}}^{\ast }$ to $\mathcal{C}$ to query. $\mathcal{C}$ replies to the query by generating the corresponding signature as follows.

• $\mathbf{k}\stackrel{\$}{\leftarrow }{\{0,1\}}^{\lambda }$.
• $\nu$: $=H_0(\mu ,{\mathbf{b}}_{\mathbf{r}},\mathbf{k})$.
• $p^{\prime }=p_0^{\prime }+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{p}_i^{\prime }$. If $p^{\prime }=0$, go to step 1.
• $\mathbf{p}={\mathbf{p}}_{\mathbf{0}}+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{\mathbf{p}}_{\mathbf{i}}$.
• $\mathbf{f}$: $={\mathbf{f}}_{\mathbf{0}}+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{\mathbf{f}}_{\mathbf{i}}$.
• $\mathbf{e}$: $={\mathbf{e}}_{\mathbf{0}}+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{\mathbf{e}}_{\mathbf{i}}$.
• Generate a basis $\mathbf{B}:=$ SimExtractS $({\mathbf{h}}_{\mathbf{s}},\mathbf{p},\mathbf{e},p^{\prime },{\mathbf{h}}_{\mathbf{f}},{\mathbf{B}}_{\mathbf{f}})$ for $({\mathbf{h}}_{\mathbf{s}},\mathbf{f})$ (see Algorithm 2).
• $({\mathbf{x}}^{\prime },\mathbf{x})$: $=(\mathbf{y},\mathbf{0})-\mathrm{SamplePre}(\mathbf{B},\eta ,(\mathbf{y},\mathbf{0}\left)\right)$.
• return $\mathbf{x}$ as the signature.

Forgery. $\mathcal{C}$ receives a forgery $\mathbf{x}$ signature on a new message $\mu$, then constructs the solution for ISIS as follows.

• Compute $p^{\prime }=p_0^{\prime }+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{p}_i^{\prime }$. If $p^{\prime }\ne 0$, abort.
• $\mathbf{p}={\mathbf{p}}_{\mathbf{0}}+{\sum }_{i=1}^{\aleph }{(-1)}^{{\nu }_i}{\mathbf{p}}_{\mathbf{i}}$.
• Divide $\mathbf{x}$ as $({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})\in {\mathbb{Z}}_q^n\times {\mathbb{Z}}_q^n$.
• Return $({\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}},\mathbf{y}-{\mathbf{h}}_{\mathbf{s}}({\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}}))$ as the solution for $({\mathbf{h}}_{\mathbf{s}},\mathbf{y})$.

Firstly, according to Lemma 16, the simulated signatures generated during the query phase are valid and indistinguishable from the real signatures. That is, $\mathcal{C}$ creates a simulated environment, indistinguishable from reality for adversaries. This will lead $\mathcal{A}$ to complete the reduction game.

Secondly, according to Lemma 17, the coefficient vector of $\mathbf{y}-{\mathbf{h}}_{\mathbf{s}}({\mathbf{x}}_{\mathbf{0}}+\mathbf{p}{\mathbf{x}}_{\mathbf{1}})$ is short enough under the parameter settings in Equation (1). Therefore, the polynomials generated in step 4 of the forgery phase form a solution for the RLWE instance $({\mathbf{h}}_{\mathbf{s}},\mathbf{y})$.

Finally, according to Lemma 18, the simulation can successfully complete both signature queries and forgery without aborting, with non-negligible probability.

In summary, $\mathcal{C}$ can obtain a solution for an RLWE instance with non-negligible probability, if $\mathcal{A}$ has the ability to forge a valid signature for the SC-NTRU scheme.    □

Algorithm 2 SimExtractS$({\mathbf{h}}_{\mathbf{s}},\mathbf{p},\mathbf{e},p,{\mathbf{h}}_{\mathbf{f}},{\mathbf{B}}_{\mathbf{f}}$)

Require:   public keys ${\mathbf{h}}_{\mathbf{s}},{\mathbf{h}}_{\mathbf{f}}\in {\mathcal{R}}_q$ and syndrome $\mathbf{u}\in {\mathcal{R}}_q$, in which ${\mathbf{h}}_{\mathbf{f}}\leftarrow KeyGen$, ${\mathbf{b}}_{\mathbf{r}}={\mathbf{h}}_{\mathbf{r}}\mathbf{p}+\mathbf{e}$ for $\mathbf{p},\mathbf{e}\leftarrow {\{-1,0,1\}}^n$;   a pair of un-equivalent tags $\tau ,{\tau }^{\ast }$;   a syndrome $\mathbf{u}\in {\mathcal{R}}_q$;   a basis ${\mathbf{B}}_{\mathbf{f}}$ for ${\mathbf{h}}_{\mathbf{f}}$. Ensure:   A private key $({\mathbf{x}}_{\mathbf{1}},{\mathbf{x}}_{\mathbf{2}})$.  1: $\mathbf{f}={\mathbf{h}}_{\mathbf{s}}\mathbf{p}+\mathbf{e}+p{\mathbf{h}}_{\mathbf{f}}$  2: $\Gamma =\left\{\right\}$  3: repeat  4:  $r\stackrel{\$}{\leftarrow }\{0,1\}$  5:  if $r=0$ then  6:   ${\mathbf{x}}_{\mathbf{0}}^{\prime }\leftarrow D_{{\mathbb{Z}}^n,{\eta }_0,\mathbf{0}}$ (where ${\eta }_0=\frac{1}{\pi }\sqrt{\frac{1}{2}ln\left(2^{(7+\lambda )/2}n\right)}$ )  7:   ${\mathbf{y}}^{\prime }=(-{\mathbf{h}}_{\mathbf{s}}{\mathbf{x}}_{\mathbf{0}}^{\prime })/p$  8:   $({\mathbf{x}}_{\mathbf{1}}^{\prime },{\mathbf{x}}_{\mathbf{1}})$: $=({\mathbf{y}}^{\prime },\mathbf{0})-\mathrm{SamplePre}({\mathbf{B}}_{\mathbf{f}},{\eta }_3,({\mathbf{y}}^{\prime },\mathbf{0}))$ where ${\eta }_3=\frac{1.17}{\pi }\sqrt{\frac{1}{2}ln\left(2^{(7+\lambda )/2}n\right)q}$  9:   ${\mathbf{x}}_{\mathbf{0}}={\mathbf{x}}_{\mathbf{0}}^{\prime }-\mathbf{p}{\mathbf{x}}_{\mathbf{1}}$  10:  else  11:   $({\mathbf{x}}_{\mathbf{1}}^{\prime },{\mathbf{x}}_{\mathbf{1}})$: $=({\mathbf{g}}_{{\mathbf{f}}_{\mathbf{i}}},{\mathbf{t}}_{{\mathbf{f}}_{\mathbf{i}}})$ where $({\mathbf{g}}_{{\mathbf{f}}_{\mathbf{i}}},{\mathbf{t}}_{{\mathbf{f}}_{\mathbf{i}}})$ is a basis vector of ${\Lambda }_{\mathbf{f},q}$  12:   ${\mathbf{x}}_{\mathbf{0}}=-\mathbf{p}{\mathbf{x}}_{\mathbf{1}}$  13:  end if  14:  $\mathbf{b}=({\mathbf{x}}_{\mathbf{0}},{\mathbf{x}}_{\mathbf{1}})$  15:  if $\mathbf{b}$ is linearly independent with the vectors in $\Gamma$ then  16:   $\Gamma =\Gamma \cap \mathbf{b}$  17:  end if  18: until$\left|\Gamma \right|=2n$  19: covert $2n$ linearly independent vectors in $\Gamma$ to a basis $\mathbf{B}$ of $({\mathbf{h}}_{\mathbf{s}}\parallel \mathbf{f})$ with the algorithm in Lemma $7.1$ of [44].

5.2. Performance

In the existing lattice-based signcryption schemes, some building blocks are often used, such as the algorithm SampleD of [18], Inver of [18], SamplePre of [41], inverting matrix and solving system of linear equations, etc. To facilitate the performance comparison, we summarize some basic conclusions about the computational cost for these building blocks. In order to clearly state these conclusions, we introduce some notations for the basic mathematical operations. Let ${\times }_{\mathbb{Z}}$, ${\times }_{{\mathbb{Z}}_q}$, ${\times }_{\mathbb{R}}$ denote the multiplication operation over $\mathbb{Z}$, ${\mathbb{Z}}_q$, $\mathbb{R}$, respectively. Let ${+}_{\mathbb{Z}}$, ${+}_{{\mathbb{Z}}_q}$, ${+}_{\mathbb{R}}$ denote the addition operation over $\mathbb{Z}$, ${\mathbb{Z}}_q$, $\mathbb{R}$, respectively.

The computational overhead of matrix inversion and solving systems of linear equations can be evaluated by regular computation.

Proposition 5.

The computational cost to invert an n-dimensional matrix over ${\mathbb{Z}}_q$ is about $\frac{2}{3}n(n^2+3n-1)$ multiplications over ${\mathbb{Z}}_q$.

Proposition 6.

The computational cost of solving $n\times m$-dimension nonhomogeneous linear equations over ${\mathbb{Z}}_q$ is about $\frac{1}{2}n(n+1)(m+1)+\frac{1}{6}(n-2)(n-1)(n+3)$ multiplications and additions over ${\mathbb{Z}}_q$, and $2nO\left(\log q\right)$ inversion over ${\mathbb{Z}}_q$. Here, the equation substitution is $mn-\frac{1}{2}n(n-1)$ multiplications and $mn+\frac{1}{2}n(n+1)$ additions over ${\mathbb{Z}}_q$ and $O\left(\log q\right)$ inversion over ${\mathbb{Z}}_q$.

Micciancio and Peikert presented a pre-image sample algorithm named SampleD${}^{\mathcal{O}}$, specifically designed for the MP trapdoor [18]. For more details, please refer to [18]. The computational overhead of the algorithm can be broken down into the following steps:

• Step 1: Generating $\left(2n\log q\right)$-dimension DGS.
• Step 2: Performing $(n^2{\log }^{2}q+n^2\log q)$${\times }_{\mathbb{Z}}$ and ${+}_{\mathbb{Z}}$, as well as $\left(n^2\log q\right)$${\times }_{{\mathbb{Z}}_q}$ and ${+}_{{\mathbb{Z}}_q}$.
• Step 3: Conducting $\left(n^2\right)$${\times }_{\mathbb{Z}}$ and ${+}_{\mathbb{Z}}$, $\left(n^2\right)$${\times }_{{\mathbb{Z}}_q}$ and ${+}_{{\mathbb{Z}}_q}$, and utilizing $n\log q$-dimension DGS.
• Step 4: Involving $(n^2{\log }^{2}q)$${\times }_{\mathbb{Z}}$ and ${+}_{\mathbb{Z}}$.

Therefore, the overall computational overhead of SampleD${}^{\mathcal{O}}$ is summarized as follows.

Proposition 7.

The computational cost of Algorithm SampleD${}^{\mathcal{O}}$ of [18] is about $3n\log q$ discrete Gaussian samples (DGS), $2n^2{\log }^{2}q+n^2\log q+n\log q$ multiplications and additions over $\mathbb{Z}$, $n^2\log q+n^2$ multiplications and additions over ${\mathbb{Z}}_q$. The overhead to compute the Gaussian parameter is $3n^3{\log }^{3}q$, which can be precomputed.

Except for SampleD, the computational cost of signcryption of [17] is about $5n\log q$ DGS, $8n^2\log q$ multiplications over ${\mathbb{Z}}_q$, $(\lambda +8)n^2\log q+n\log q-n$ additions over ${\mathbb{Z}}_q$, $n^2{\log }^{2}q+n\log q$ multiplications over $\mathbb{Z}$, $n^2{\log }^{2}q-n\log q$ additions over $\mathbb{Z}$.

In [18], an inversion algorithm called $Inver$ is presented for the MP trapdoor. The computational overhead of the steps is described as follows.

• Step 1: Involves $(n^2{\log }^{2}q)$ ${\times }_{\mathbb{Z}}$ and ${+}_{\mathbb{Z}}$.
• Step 2: Includes $\left(n\log q\right)$ ${\times }_{\mathbb{Z}}$ and ${+}_{\mathbb{Z}}$, as well as $\left(n\log q\right)$ ${\times }_{{\mathbb{Z}}_q}$ and ${+}_{{\mathbb{Z}}_q}$.
• Step 3: Requires $(2n^2\log q+n^2)$ ${\times }_{{\mathbb{Z}}_q}$ and ${+}_{\mathbb{Z}}$.

Therefore, the total computational overhead of Algorithm $Inver$ is as follows.

Proposition 8.

The computational cost of Algorithm Inver of [18] is about $n^2{\log }^{2}q+2n^2\log q+n^2+n\log q$ multiplications and $n^2{\log }^{2}q+2n^2\log q+n^2-2n$ additions over ${\mathbb{Z}}_q$, $2n\log q$ multiplications and additions over $\mathbb{Z}$. In the process, the cost of the inversion oracle is $2n\log q$ multiplications and additions over $\mathbb{Z}$.

In addition to solving system of linear equations, Algorithm SamplePre also involves executing the randomized nearest-plane algorithm. The computational cost of its steps is as follows.

• step a: Involves $\left(2m\right)$ ${\times }_{\mathbb{R}}$ and $(2m-2)$ ${+}_{\mathbb{R}}$.
• step b: Requires 1 DGS.
• step c: Needs m ${\times }_{\mathbb{Z}}$ and $\left(2m\right)$ ${+}_{\mathbb{Z}}$.

The procedure is carried out m times. Consequently, the total computational cost of SamplePre without solving equations is calculated as follows.

Proposition 9.

Except for solving equations, the computational cost of Algorithm SamplePre of [41] is about 2 $m^2$ multiplications and additions over $\mathbb{R}$, $m^2$ multiplications and 2 $m^2$ additions over $\mathbb{Z}$ and m DGS.

The operations involved in Algorithm Gaussian_Sampler of [38] are almost identical to those in Algorithm SamplePre except for the solving equations part. However, the dimension of the basis used in Gaussian_Sampler is $2n\times 2n$. Consequently, its computational overhead includes $\left(8n^2\right)$ ${\times }_{\mathbb{R}}$ and ${+}_{\mathbb{R}}$, $\left(4n^2\right)$ ${\times }_{\mathbb{Z}}$ and $\left(8n^2\right)$ ${+}_{\mathbb{Z}}$, and $2n$ DGS. However, the circulant property of the basis matrix allows for the use of fast Fourier orthogonalization, which can speed up the procedure significantly [45]. According to [45], when adopting fast Fourier orthogonalization, the complexity of the Gaussian_Sampler is given as follows.

Proposition 10.

The computational cost of Algorithm Gaussian_Sampler of [38] is about $2n$ DGS, $4\Theta \left(n\log n\right)$ multiplications and additions over $\mathbb{R}$, $4\Theta \left(n\log n\right)$ multiplications and additions over $\mathbb{Z}$.

In

Table 3. Comparison of the key size, public parameter size, and security of the related schemes.

Scheme	YWW+13 [17]	SS18 [19]	YCL+19 [20]	Ours
public parameter	$(\lambda +3)n^2{\log }^{2}q$ $+n\ell \log q$	$(\lambda +3)n^2{\log }^{2}q$ $+n\ell \log q$	$(2k^{\prime }+\ell +5)$ $n^2{\log }^{2}q$	$(\aleph +1)n\log q$ 1
public key	$3n^2{\log }^{2}q$ $+n\ell \log q$	$3n^2{\log }^{2}q$ $+n\ell \log q$	$n^2{\log }^{2}q$	$3n\log q$
private key	$24n^2{\log }^{2}q\log \sigma$ 2	$24n^2{\log }^{2}q\log \sigma$	$12n^2{\log }^{2}q\log \sigma$	$48n\log \sigma$
ciphertext	$2n{\log }^{2}q+\left|\mu \right|$ $+48n\log q\log {\sigma }_1$ 3	$2n{\log }^{2}q+\left|\mu \right|$ $+12(7n+\ell )\log q$ $·\log {\sigma }_2$	$4n{\log }^{2}q+\left|\mu \right|$ $+36n\log q\log {\sigma }_3$ $+n+\ell$	$3n\log q+\left|\mu \right|$ $+24n\log {\sigma }_4$
security	IND-CCA2, SUF-CMA	IND-CCA2, SUF-CMA	IND-CCA2, EUF-CMA	IND-CCA2, EUF-CMA
based on NIST	No	No	No	Yes

¹ $\lambda$, $\ell$, $\aleph$ are all with the security parameter, so they are roughly the same. ² Every element of the private key is stored in 12log$\sigma$, when its Gaussian parameter is $\sigma$. ³ $|\mu |$ denotes the length of the message.

, the sizes of public parameters, public key, private key, ciphertext, and security are compared. The sizes of the public parameters and the public key of SC-NTRU are approximately in the order of magnitude of $1/\left(n\log q\right)$ of those of YWW+13 [17], SS18 [19], and YCL+19 [20]. The private key size of SC-NTRU is roughly in the order of magnitude of $2/(n{\log }^{2}q)$ of those of YWW+13 [17] and SS18 [19], and $4/\left(n{\log }^{2}q\right)$ of that of YCL+19 [20]. Except for the plaintext length, the ciphertext size of SC-NTRU is about at the order of magnitude of $1/\log q$ of those of YWW+13 [17], SS18 [19], and YCL+19 [20]. Regarding security, the proposed scheme achieves IND-CCA2 security against adaptively chosen ciphertext attacks, similar to the other schemes in the table. However, when facing adaptively chosen message attacks, the proposed scheme is EUF-CMA secure instead of SUF-CMA security, as in YWW+13 [17] and SS18 [19]. Our intention is to demonstrate that a EUF-CMA secure signature component is sufficient to guarantee the IND-CCA2 security of the signcryption ciphertext.

In

Table 4. Comparison of the computation overhead of the related signcryption schemes.

	Computation Type	YWW+13 [17]	SS18 [19]	YCL+19 [20]	Ours
Setup	$\leftarrow U\left({\mathbb{Z}}_q\right)$	$(\lambda +3)n^2\log q$ $+n\ell$	$(\lambda +3)n^2\log q$ $+n\ell +n$	$(\ell +5)n\log q$	$(\aleph +5)n$
KeyGen	$\leftarrow U\left({\mathbb{Z}}_q\right)$	$n^2\log q$	$n^2\log q$	$\sigma n\left(\right(m-2\sigma -r)$ $/\lceil \log q\rceil +r+2)$	0
	DGS	$n^2{\log }^{2}q$	$n^2{\log }^{2}q$	0	$2n$
	${\times }_{{\mathbb{Z}}_q}$	$n^3{\log }^{2}q$ $+\frac{2}{3}{n}^3+2n^2$	$n^3{\log }^{2}q$ $+\frac{2}{3}{n}^3+2n^2$	$(m-2\sigma -r)$ $(r+\sigma )$	$7O\left(n^2\log n\right)$ $+8O\left(n\log n\right)$
	${+}_{{\mathbb{Z}}_q}$	$n^3{\log }^{2}q$ $+\frac{2}{3}{n}^3+2n^2$	$n^3{\log }^{2}q$ $+\frac{2}{3}{n}^3+2n^2$	$(m-2\sigma -r)$ $(r+\sigma )$	$7O\left(n^2\log n\right)$ $+8O\left(n\log n\right)$
	${\times }_{\mathbb{Z}}$	0	0	0	$4n$
	${+}_{\mathbb{Z}}$	0	0	0	$4n$
Signcrypt	DGS	$8n\log q$	$9n\log q+\ell$	$n^2{\log }^{2}q$ $+6n\log q+n$	$2n$
	${\times }_{{\mathbb{Z}}_q}$	$10n^2\log q$ $+2n\log q$ $+n^2+n\ell$	$10n^2\log q$ $+n\log q$ $+n^2+n\ell$	$n\log q(3\log q+8)$ $·O\left(n\log n\right)+$ $(2\log q-1)n^2\log q$	$5O\left(n\log n\right)$
	${+}_{{\mathbb{Z}}_q}$	$(\lambda +10)n^2\log q$ $+n^2+n\ell -2n$	$(\lambda +11)n^2\log q$ $+n^2+n\ell -5n$ $+4n\log q+\ell$	$n\log q(3\log q+8)$ $·O\left(n\log n\right)+n\ell +$ $(2\log q-1)n^2\log q$	$5O\left(n\log n\right)$ $+(\aleph +3)n$
	${\times }_{\mathbb{Z}}$	$2n^2{\log }^{2}q$ $+n^2\log q$ $+3n\log q+n^2$	$2n^2{\log }^{2}q$ $+n^2\log q$ $+3n\log q+\ell$	$(n{\log }^{3}q+2{\log }^{2}q)$ $·O\left(n\log n\right)$	$4\theta \left(n\log n\right)$
	${+}_{\mathbb{Z}}$	$2n^2{\log }^{2}q$ $+n^2\log q$ $+2n\log q+n^2$	$2n^2{\log }^{2}q$ $+n^2\log q$ $+n\log q$	$(n{\log }^{3}q+2{\log }^{2}q)$ $·O\left(n\log n\right)+n\log q\ell$	$4\theta \left(n\log n\right)$
	${\times }_{\mathbb{R}}$	0	0	$(n{\log }^{3}q+2{\log }^{2}q)$ $·O\left(n\log n\right)$	$4\theta \left(n\log n\right)$
	${+}_{\mathbb{R}}$	0	0	$(n{\log }^{3}q+2{\log }^{2}q)$ $·O\left(n\log n\right)$	$4\theta \left(n\log n\right)$
UnSigncrypt	DGS	0	$3nk\ell$	$2n\log q$	$3n$
	${\times }_{{\mathbb{Z}}_q}$	$8n^2\log q$ $+n\ell$	$n^2{\log }^{2}q$ $+n^2\log q(\ell +11)$ $+n^2(\ell +1)$ $+2n\log q\ell$	$(8\log q+1)O\left(n\log n\right)$ $+O\left(n\log q\log \left(n\log q\right)\right)$	$4O\left(n\log n\right)$ $+O\left(2n\log 2n\right)$
	${+}_{{\mathbb{Z}}_q}$	$8n^2\log q$ $+\lambda n\log q$ $+n\ell -n$	$n^2{\log }^{2}q+n^2$ $\log q(\lambda +\ell +11)$ $+n^2(\ell +1)$ $+2n\log q(2\ell +1)$	$(8\log q+1)O\left(n\log n\right)$ $+O\left(n\log q\log \left(n\log q\right)\right)$ $+6n\log q$	$4O\left(n\log n\right)$ $+O\left(2n\log 2n\right)$ $+\aleph n$
	${\times }_{\mathbb{Z}}$	$2n^2{\log }^{2}q$ $+8n\log q$ $+2\log q$	$2n^2{\log }^{2}q\ell$ $+n^2\log q\ell$ $+2n\log q\ell$ $+5n\log q+2\ell$	$\log qO\left(n\log n\right)$ $+2n\log q$	$4\theta \left(n\log n\right)$ $+5n$
	${+}_{\mathbb{Z}}$	$2n^2{\log }^{2}q$ $+6n\log q$ $+2\log q$	$2n^2{\log }^{2}q\ell$ $+n^2\log q\ell$ $+2n\log q\ell$ $+5n\log q+2\ell$	$\log qO\left(n\log n\right)$ $+2n\log q$	$4\theta \left(n\log n\right)$ $+3n$
	${\times }_{\mathbb{R}}$	0	0	$\log qO\left(n\log n\right)$ $+2n\log q$	$4\theta \left(n\log n\right)$
	${+}_{\mathbb{R}}$	0	0	$\log qO\left(n\log n\right)$ $+2n\log q$	$4\theta \left(n\log n\right)$

, the computational overhead of YWW+13 [17], SS18 [19], YCL+19 [20], and SC-NTRU is compared. First, the cost of the key generation is compared. In the key generation phase of YWW+13 [17] and SS18 [19], the computation of $(\frac{2}{3}{n}^3+2n^2){\times }_{{\mathbb{Z}}_q}$ is required to invert the matrix $\mathbf{H}$. As it is the repeating computation in signcryption, it is reasonable to count its overhead into the key generation instead of signcryption. The numbers of ${\times }_{{\mathbb{Z}}_q}$ and ${+}_{{\mathbb{Z}}_q}$ of SC-NTRU are in the order of magnitude of $1/n$ of those of YWW+13 [17] and SS18 [19], and at a lower order of magnitude of YCL+19 [20]. The number of DGS of SC-NTRU is about $2/(n{\log }^{2}q)$ of those of YWW+13 [17] and SS18 [19]. In SC-NTRU, the samples from $U\left({\mathbb{Z}}_q\right)$ are not needed; however, the numbers of samples reach $n^2\log q$ in YWW+13 [17] and SS18 [19].

Next, the overhead of the signcryption is compared. The ${\times }_{{\mathbb{Z}}_q}$ and ${+}_{{\mathbb{Z}}_q}$ operations in SC-NTRU are in the order of magnitude of $1/n$ of YWW+13 [17] and SS18 [19], respectively. The numbers of ${\times }_{\mathbb{Z}}$ and ${+}_{\mathbb{Z}}$ of SC-NTRU are in the order of magnitude of $1/\left(n\log q\right)$ of those of YWW+13 [17] and SS18 [19], and at a lower order of magnitude of YCL+19 [20]. The number of DGS of SC-NTRU is no more than $1/\left(4\log q\right)$ of those of YWW+13 [17] and SS18 [19], and at a lower order of magnitude of YCL+19 [20]. Compared with YWW+13 [17] and SS18 [19], SC-NTRU requires $\left(4\theta \right(n\log n\left)\right)$ additional ${\times }_{\mathbb{R}}$ and ${+}_{\mathbb{R}}$, and they are about $4/(n{\log }^{3}q)$ of YCL+19 [20]. In summary, although the schemes of YWW+13 [17] and SS18 [19] are built on the ordinary lattice, their signcryption performance significantly outperforms that of YCL+19 [20], due to not requiring the expensive basis extension. However, their signcryption cost is several orders of magnitude higher than that of SC-NTRU.

Finally, the cost of unsigncryption is compared. The numbers of ${\times }_{{\mathbb{Z}}_q}$ and ${+}_{{\mathbb{Z}}_q}$ operations of SC-NTRU are in the order of magnitude of $1/n$ and $1/(n\log q+\ell )$ of those of YWW+13 [17] and SS18 [19], respectively. The numbers of ${\times }_{\mathbb{Z}}$ and ${+}_{\mathbb{Z}}$ operations of SC-NTRU are in the order of magnitude of $1/\left(n\log q\right)$ and $1/(n\log q\ell )$ of those of YWW+13 [17] and SS18 [19], respectively. Compared with YWW+13 [17], SC-NTRU needs $3n$ additional DGS; however, it is only $1/(k\ell )$ of that of SS18 [19]. The numbers of DGS, ${\times }_{{\mathbb{Z}}_q}$ and ${+}_{{\mathbb{Z}}_q}$, ${\times }_{\mathbb{Z}}$ and ${+}_{\mathbb{Z}}$, ${\times }_{\mathbb{R}}$ and ${+}_{\mathbb{R}}$ of SC-NTRU are in the order of magnitude of $3/\left(2\log q\right)$, $1/\log q$, $4/\log q$, and $4/\log q$ of those of YCL+19 [20]. In summary, since YCL+19 [20] adopts the ideal lattice, the performance of the unsigncryption greatly outperforms YWW+13 [17] and SS18 [19]; however, its overheads are $\log q/4$ to $2\log q/3$ of those of SC-NTRU.

To sum up, due to the efficiency of the NTRU trapdoor and reasonable construction, the proposed scheme achieves orders of magnitude of improvement in computation cost over the existing signcryption schemes.

5.3. Experiment

To assess the actual performance of SC-NTRU, we conducted experiments using the C programming language. The experimental environment is set up on a Ubuntu platform with 4 GB of memory. The dimension of the NTRU lattice has a significant impact on security. Therefore, we choose three sets of typical parameters: n = 256, 512, and 1024, corresponding to low, medium, and high levels of security, respectively. We run the experiment 1000 times and calculate the average time. The experimental data are presented in

Table 5. Actual performance of SC-NTRU under different parameters.

n	q	Keygen (ms)	SC (μs)	USC (μs)
256	52,145,447,681	16.45	1342.48	1198.03
512	425,478,982,619	36.17	2904.77	2585.58
1024	3,470,791,299,527	95.81	6134.78	5436.07

. According to the data in the table, the running time of key generation, signcrypt, and unsigncrypt exhibit running times on the order of milliseconds. Notably, the running time of signcrypt (and unsigncrypt) ranges between 1.3 and 6.2 (1.1 and 5.5), demonstrating the efficiency of SC-NTRU.

6. Conclusions

In this paper, a signcryption scheme following the StE paradigm is proposed based on the intractability of the NTRU lattice and RLWE, which serves as the security foundation of Falcon in NIST PQC. First, it is shown how to embed some sensitive information into a general lattice-based public key encryption (PKE) and bind it with the message being encrypted by PKE. The malleability to the ciphertext ultimately leads to the modification in the message–signature pair. Consequently, the signature for the message can also be utilized to verify and guarantee the IND-CCA2 security of the ciphertext. Thus, the need for the MAC to transfer from the public key to the signature is eliminated.

Secondly, a new abort-resistant hash is proposed to match the “partiality” of the pre-image in relation to the checkout polynomial, so that an NTRU signature secure in the standard model can be built with it. The computational overhead analysis demonstrates a significant improvement in the efficiency of SC-NTRU, surpassing existing lattice-based signcryption methods by orders of magnitude. The experiment shows that SC-NTRU is very efficient.