Sonia Belaïd

Ryad Benadjila

Nicolas Bon

Louis Goubin

Darius Mercadier

Viet-Sang Nguyen

Pascal Paillier

Matthieu Rivain

Abdul Rahman Taleb

Aleksei Udovenko

Junwei Wang

J'ai

Geoffroy Couteau

Alain Couvreur

Tanja Lange

Emmanuela Orsini

Nicolas Sendrier

Ahmed Khulaif Alharbi

Samuel Bouaziz-Ermann

Charles Bouillaguet

Calle Andersson

Orel Viera

Ambroise Cosseron

Mickaël Fleury

Jules Hamdad

Florette Maire

Julia Martinez

Abdul Rahman Sauvage

Damien Taleb

Vergnaud

Keywords: zero-knowledge proofs, post-quantum signatures, MPC-in-the-Head. -iii

The ongoing effort to build a quantum computer urges the cryptography community to develop new secure cryptosystems based on quantum-hard cryptographic problems. In this thesis, we focus on the design of signature schemes built from zero-knowledge proofs of knowledge. More precisely, we focus on the MPC-in-the-Head paradigm which provides a generic way to build zero-knowledge proofs using techniques from secure multiparty computation.

We propose several new signature schemes using the MPC-in-the-Head framework. Most of these schemes are competitive with the existing schemes in the post-quantum literature. They have signature sizes between 5 KB and 20 KB for 128-bit security, and have very small public keys (less than 200 B). Their security relies on a large scope of hard problems. Some of them rely on code-based assumptions, such as the hardness of solving the syndrome decoding problem for random linear codes. Others rely on the multivariate quadratic problem, the subset sum problem, and the MinRank problem.

We also develop two new MPC-in-the-Head techniques. The first one aims to efficiently address a context of small secret values over large modulus. The second one consists of a new way of transforming an MPC protocol into a zero-knowledge proof. This new transformation provides new trade-offs in terms of communication costs vs running times. In particular, it enables us to achieve small verification times.

Several submissions in the NIST call for additional post-quantum signatures rely (sometimes partially) on ideas developed in this thesis.

Résumé

Le développement actuel des ordinateurs quantiques pousse la communauté cryptographique à mettre au point de nouveaux cryptosystèmes dont la sécurité se fonde sur la difficulté à résoudre des problèmes cryptographiques résistant au calcul quantique. Dans le cadre de cette thèse, nous nous sommes focalisés sur la conception de schémas de signatures électroniques construits à partir de preuves à divulgation nulle de connaissance (zero-knowledge proofs of knowledge en anglais). Plus précisément, nous nous sommes intéressés au paradigme "MPC-in-the-Head" (littéralement, "calcul-multipartite-dans-la-tête" en français) qui fournit une méthode générique de construire de telles preuves en utilisant des techniques de calcul multipartite sécurisé.

Nous proposons plusieurs nouveaux schémas de signatures utilisant le paradigme "MPC-inthe-Head". La plupart d'entre eux sont compétitifs avec les schémas existants dans l'état de l'art post-quantique. Ils produisent des signatures ayant des tailles entre 5 et 20 kilo-octets (pour un niveau de sécurité de 128 bits) et possèdent de très petites clés (de moins de 200 octets). Les problèmes difficiles sur lesquels la sécurité de ces schémas se fonde sont très variés. Certains schémas s'appuient sur des hypothèses de sécurité issues de la théorie des codes correcteurs d'erreurs, telle que celle sur la difficulté à résoudre le problème de décodage par syndrome pour des codes linéaires aléatoires. Les autres schémas s'appuient sur la difficultés à résoudre un système d'équations quadratiques, le problème de la somme de sous-ensembles ou le problème MinRank.

Nous avons également mis au point deux nouvelles techniques de MPC-in-the-Head. La première vise à gérer efficacement les situations où le secret est de petite taille avec un grand modulus. La seconde consiste en une nouvelle méthode pour transformer un protocole de calcul multipartite en preuve de divulgation nulle de connaissance. Cette nouvelle transformation offre des nouveaux compromis entre coût de communication et temps de calcul. En particulier, elle permet de produire des algorithmes de vérification très rapides.

Plusieurs soumissions à l'appel du NIST pour des schémas de signatures post-quantiques supplémentaires s'appuient (parfois partiellement) sur des idées développées dans le cadre de cette thèse.

Introduction 1.1. Cryptology

How would you send a love declaration to someone who is far away while preventing curious people from reading its content? How could you have the guarantee that nobody will change it? And for the receiver, how can she/he be sure that the message is really sent by the right person? Unfortunately, we are clearly not living in a world where everyone can be trusted. If you want to declare your love without being troubled, two ways can be considered: either you make the journey to meet the (wo)man of your heart, or you use the cryptography. The latter provides many technological solutions to build secure communication over an insecure channel (e.g. phone, internet, ...) with the following features:

• confidentiality: the message is unintelligible for anyone except the receiver (and the sender),

• message authentication: the receiver can check the identity of the sender of the message,

• data integrity: the receiver can verify that the message has not been modified during its transfer.

Cryptography consists in the conception of sets of algorithms, usually named cryptosystems, which provide one or several of the above security features. On the other side, the cryptanalysis consists in finding ways to break the security properties of those cryptosystems. Together they form the "science of secrecy", named cryptology.

There exist two types of cryptosystems:

• Symmetric cryptography: in that setting, the sender and the receiver know a common secret key (it can be a number, a passphrase, ...). The sender will encrypt the message using this key, and the receiver will also use it to put back the message in an intelligible form.

• The asymmetric cryptography (or public-key cryptography): in that setting, the receiver produces two keys, a public key and a secret key. She sends the first one to the sender. Using it, the sender encrypts the message. Then using the private key, the receiver decrypts it.

The symmetric setting has the drawback of requiring that both parties have a common secret. For example, if you want to securely browse the website of a bank, you do not have a common secret to establish secure communication. Asymmetric cryptography addresses this issue. The bank website can send you a public key and you can use it to encrypt the requests for the website. However, the asymmetric schemes are quite heavy in terms of bandwidth and computation. So, they will be used only to derive a common secret key. Then, using the latter, the user and the bank website can securely communicate using symmetric schemes.

Post-quantum cryptography

The security of the current public-key cryptosystems (for example, on the Internet) relies on the hardness of factorizing a composite number "Given a number n, one needs to find non-trivial p and q such that n = p • q." and to solve the discrete logarithm problem "Given a modulus n and two non-zero elements y and g, one needs to find x such that y = g x mod n."

(or its variant on elliptic curves). However, Shor [START_REF] Shor | Algorithms for Quantum Computation: Discrete Logarithms and Factoring[END_REF] showed that a quantum computer would be able to solve "easily" those two problems. It means that such a computer would break all the current secure communications using asymmetric schemes (i.e. it would decrypt the messages without the keys, impersonify people, etc...). Hopefully, this technology is not functional yet, but it is improving constantly. Quantum computers may exist in a dozen years1 .

Because of this threat, the research community and standardization organizations are searching for new cryptosystems that would be secure against quantum technology. These schemes compose what is called the post-quantum cryptography (also known as the quantumsafe/quantum-resilient cryptography). The goal is to replace the vulnerable algorithms with post-quantum secure ones. In 2016, the National Institute of Standards and Technology (NIST) opened a call for proposals for the future standards of post-quantum cryptosystems [START_REF]Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process[END_REF]. In November 2017 (call deadline), 59 key encapsulation mechanisms (KEM) and 23 signature schemes have been submitted. We are currently in the 4 th round of the standardization process. Most of the schemes have been eliminated. In July 2022, the NIST announced that 4 candidates have been selected for standardization: the key encapsulation mechanism Kyber [START_REF] Avanzi | CRYSTALS-Kyber -Algorithm Specifications and Supporting Documentation[END_REF], and the signature schemes Dilithium [START_REF] Shi Bai | CRYSTALS-Dilithium -Algorithm Specifications and Supporting Documentation[END_REF], Falcon [START_REF] Fouque | Falcon: Fast-Fourier Lattice-based Compact Signatures over NTRU[END_REF] and SPHINCS + [START_REF] Aumasson | SPHINCS+ -Submission to the NIST post-quantum project[END_REF]. In the 4 th round, there are 4 KEM but no signature schemes.

Let us discuss the case of the signature schemes. There are no more signatures in the selection process of the NIST. Three schemes will be standardized. The security of two of them (Dilihium and Falcon) relies on the hardness of solving structured lattice problems. The security of the last scheme (SPHINCS + ) relies on the security of cryptographic hash functions. One could say that lattice-based cryptography (the schemes for which the security relies on the hardness of solving the lattice problems) is the true winner of the NIST post-quantum standardization process. Those schemes have the best global performance. However, we should avoid putting all our eggs in one basket. In case the cryptanalysis of the lattice-based schemes would improve (for example, one finds a polynomial quantum attack against them), we should have backup solutions. For this reason, the NIST also selected SPHINCS + . The latter is very conservative, however it is a heavy scheme: it has quite a large signature size and a long signing time. Since there is no more scheme in the standardization process, the NIST chose to re-open a call for additional proposals [START_REF]Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process[END_REF], but only for the signature schemes. In June 2023 (the deadline for the new call), 50 signature schemes have been submitted. Among them, 40 have been kept for the first round of the new call.

Signature Schemes

In this thesis, we focus on post-quantum signature schemes. The goal of a (digital) signature scheme is to verify the authenticity of messages or documents. A valid digital signature on a message ensures that the message comes from a sender known to the recipient. The principle is the following. The signer produces two keys: a public key pk and a secret key sk. Using the secret key, she can sign a message m, i.e. she can generate a signature σ. She will broadcast pk to everyone. Then, using this public key, everyone can check that σ is a valid signature for the message m. The desired security property for a signature scheme is the existential unforgeability: nobody should be able to produce a valid signature for a message (which has not been already signed) for a public key without knowing the corresponding secret key 2 .

There exist two approaches to build a signature scheme. The first one is the hash-and-sign paradigm. To use it, one needs to have a function F which is computationally impossible to invert unless one knows a trapdoor. To sign a message m, the signer needs to hash the message h ← Hash(m) and then she uses her trapdoor (which corresponds to the secret key) to compute a pre-image of h by the function F : σ ← F -1 (h).

This pre-image σ corresponds to the signature of m. Then to verify σ, one just needs to compute the image of σ by F and check that it equals the hash digest of the message:

F (σ) ? = Hash(m).
Forging a valid signature without knowing the secret key consists in finding a pre-image of F , which is computationally impossible by the definition of F . This technique leads to short signature sizes, but since it relies on a trapdoor, the underlying problem must have some structure and it is hence more sensitive to structural attacks. Moreover, the public key consists of the description of a function with a trapdoor (i.e. the function F ), and thus, it is often large.

The second approach to build signature schemes uses zero-knowledge proofs and the Fiat-Shamir transformation. A zero-knowledge proof of knowledge is an interactive protocol enabling a prover to convince the verifier that she knows a secret satisfying some properties without revealing any information about the secret itself. For example, let us assume that the prover wants to convince the verifier that she knows the solution to a system of quadratic equations. One naive method for the prover would be to reveal this solution, but in the end, the verifier will also know the solution. Thus, a zero-knowledge proof of knowledge consists of a discussion between the prover and the verifier such that, at the end of this interaction, the verifier will be convinced that the prover really knows such a solution without getting any clue about the solution itself. There are two security properties for such protocols:

• Soundness: if the prover does not know the secret she is claiming to know, then the verifier should not be convinced at the end of the discussion,

• Zero-Knowledge: if the prover really knows the secret, the discussion should not leak any information (even partial) about the secret itself.

A signature could be considered as a proof that the signer is the holder of the secret key which corresponds to the considered public key. However, between a signature scheme and a zero-knowledge proof of knowledge of a secret key (which corresponds to an identification scheme), there are two differences:

1. the proof of knowledge is a discussion (i.e. it is interactive), while a signature scheme should not require interaction between the signer and possible verifiers;

2. the signature involves a message, not the proof of knowledge.

Hopefully, there exists the Fiat-Shamir transformation: it enables us to convert a proof of knowledge into a signature scheme by removing the interactions of the proof system while binding each proof to a message. Signature schemes built from a zero-knowledge proof tend to lead to larger signatures (compared to the hash-and-sign approach). They do not rely on a trapdoor, so their public keys are often very small and their security is often considered conservative.

Contributions of this Thesis

In this thesis, we study how we can improve the state of the art of post-quantum signature schemes built from zero-knowledge proofs. More precisely, we focus on one promising framework of zero-knowledge proofs: the MPC-in-the-Head paradigm. The latter (presented in Chapter 3) provides a generic method to build proof systems using techniques from secure multiparty computation (MPC). First of all, in Chapter 4 and in Chapter 5, we propose two new code-based signature schemes relying on the hardness of the syndrome decoding problem for random linear codes (in Hamming metric), one of the oldest problems of code-based cryptography. These schemes outperform the former schemes based on the same assumptions and are highly competitive with other code-based signature schemes.

Then, in Chapter 6, we describe a new MPC-in-the-Head technique to efficiently handle the case where we should manipulate small secret values over a large modulus. We use this technique to propose two signature schemes: one relying on the hardness of the subset sum problem, the other one relying on the security of the BHH pseudo-random function [START_REF] Boneh | The Modular Inversion Hidden Number Problem[END_REF]. While improving drastically the schemes based on the same assumption, the first proposal is unfortunately not competitive with the post-quantum literature. The performance of the second proposal is highly competitive, but its security is much less mature (regarding the state of quantum cryptanalysis).

In Chapter 7, we apply a systematic methodology to build signature schemes using the MPCin-the-Head paradigm. We propose several schemes relying on the multivariate quadratic problem, the MinRank problem, the rank syndrome decoding problem and the permuted kernel problem. For most of them, we improve the existing literature.

In Chapter 8, we propose a new MPC-in-the-Head technique to transform an MPC protocol into a zero-knowledge proof. Instead of relying on additive sharing as all the existing MPCitHbased signature schemes, we show how using a low-threshold linear secret sharing can provide interesting trade-offs in terms of communication costs vs running times. While slightly increasing the signature size, it drastically improves the running times, especially for the verifier.

Finally, in Chapter 9, we describe the process we follow to transform theoretical schemes described in research articles into practical implementations. We also briefly present some signature schemes submitted to the recent NIST call for additional post-quantum signatures [START_REF]Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process[END_REF] designed in the context of this thesis.

In this manuscript, most of the theorems deal with the security properties of the proposed zero-knowledge proofs of knowledge and the signature schemes. Formally proving such theorems is verbose, with proofs taking many pages. Moreover, the contributions of this thesis are minor in these proofs since the latter correspond to standard proof techniques. For example, proving the security of a signature scheme consists of game transitions which are quite the same between all the MPCitH-based schemes. We thus refer the interested reader to the corresponding articles for the security proofs. In this manuscript, we only provide the security proofs of the theorems of Chapter 8 since these proofs differ from what we can find in other articles. However, because of the verbosity of the proofs, we provide them in appendices and we give the proof intuition in the body of the manuscript.

In what follows, you can find the articles (published or not yet) and the NIST submissions related to this thesis.

Publications in peer-reviewed venues:

• [FJR23] T. Feneuil • [START_REF] Feneuil | Threshold Linear Secret Sharing to the Rescue of MPC-in-the-Head[END_REF] T. Feneuil, and M. Rivain. Threshold Linear Secret Sharing to the Rescue of MPC-in-the-Head. To appear in the proceedings of Asiacrypt 2023. Content of this work appears in Chapter 8.

Notations

Throughout the manuscript, F shall denote a finite field. We denote F q the field of order q.

For any m ∈ N * , the integer set {1, . . . , m} is denoted [1 : m]. For a probability distribution D, the notation s ← D means that s is sampled from D. For a finite set S, the notation s ← S means that s is uniformly sampled at random from S. For an algorithm A, out ← A(in) further means that out is obtained by a call to A on input in (using uniform random coins whenever A is probabilistic). Along the paper, probabilistic polynomial time is abbreviated PPT.

All the vectors are written as column vectors. For any matrix H ∈ F m×n , the kernel of H denoted Ker(H), is the set of solutions to the equations Hx = 0. For any vector x ∈ F n , the Hamming weight of x, denoted wt H (x), is the number of non-zero coordinates of x.

A function µ : N → R is said negligible if, for every positive polynomial p(•), there exists an integer N p > 0 such that for every λ > N p , we have |µ(λ)| < 1/p(λ). When not made explicit, a negligible function in λ is denoted negl(λ) while a polynomial function in λ is denoted poly(λ). We further use the notation poly(λ 1 , λ 2 , ...) for a polynomial function in several variables.

Two distributions {D λ } λ and {E λ } λ indexed by a security parameter λ are (t, ε)-indistinguishable (where t and ε are N → R functions) if, for any algorithm A running in time at most t(λ) we have

Pr[A D λ () = 1] -Pr[A E λ () = 1] ≤ ε(λ) ,
with A Dist meaning that A has access to a sampling oracle of distribution Dist. The two distributions are said

• computationally indistinguishable if ε ∈ negl(λ) for every t ∈ poly(λ);

• statistically indistinguishable if ε ∈ negl(λ) for every (unbounded) t;

• perfectly indistinguishable if ε = 0 for every (unbounded) t.

Cryptographic Building Blocks

Hash Functions

A hash function is an efficient function that maps data of arbitrary size to a fixed-size bitstring. A cryptographic hash function h must be resistant to collisions, i.e. it should be very hard to find x and x such that h(x) = h(x ).

Definition 2.2.1 (Collision-Resistant Hash Functions).

A family of functions {Hash k : {0, 1} * → {0, 1} (λ) ; k ∈ {0, 1} κ(λ) } λ indexed by a security parameter λ is collision-resistant, for some , κ : N → N, if there exists a negligible function ν such that, for any PPT algorithm A, we have

Pr x = x ∩ Hash k (x) = Hash k (x ) k ← {0, 1} κ(λ) ; (x, x ) ← A(k) ≤ ν(λ) .
Cryptographic hash functions are central in cryptography. They can be used to build other cryptographic primitives such as message authentication codes (MAC), block ciphers, pseudo-random generators, commitment schemes, ...

Pseudo-Random Generator

A pseudo-random generator (PRG) is a deterministic algorithm that takes an initial value named seed and produces a bitstring that looks like a random string. Formally, it is defined as below. Definition 2.2.2 (Pseudorandom Generator (PRG)). Let G : {0, 1} * → {0, 1} * and let (•) be a polynomial such that for any input s ∈ {0, 1} λ we have G(s) ∈ {0, 1} (λ) . Then, G is a (t, )-secure pseudorandom generator if the following two conditions hold:

• Expansion: (λ) > λ;

• Pseudorandomness: the distributions {G(s) | s ← {0, 1} λ } and {r | r ← {0, 1} (λ) } are computationally (t, ε)-indistinguishable.

The first condition simply states that the algorithm must produce more bits than those received as input. The second condition states that there exists no efficient algorithm which can distinguish the PRG output from true randomness, as soon as we choose the seed randomly.

This primitive is very useful in cryptography. One reason is that producing true randomness is very expensive (since we need to rely on physical phenomena). If we need to have a large quantity of randomness, it can be an issue. A solution would be to produce a seed using true randomness and to rely on a secure PRG initialized with this seed to get the desired data. Another reason could be to save communication. In some cryptosystems, we need to send large random data. If we generate the latter thanks to a pseudo-random generator, we just need to send the used seed.

Another interesting primitive we will use in the following chapters is puncturable pseudorandom functions (puncturable PRF). • for all k and index i, there exists a punctured key k * i together with an efficient evaluation algorithm A such that ∀j ∈ [1 : N ]\{i}, A(k * i , j) = F k (j);

Definition 2.2.3 (Puncturable PRF). A puncturable PRF family F on the set

• given the punctured key k * i , the value F k (i) should remain indistinguishable from a random value.

Intuitively, such a primitive produces N pseudo-random values and provides a way to reveal all the values but one. The naive way to proceed would be to reveal the N -1 values directly, but it could lead to large communication. The challenge when building such primitives is to minimize the communication needed to reveal those N -1 values.

A standard construction of puncturable PRFs can be derived from the tree-based construction of [START_REF] Goldreich | How to Construct Random Functions[END_REF], usually named the GGM construction. The idea is to use a tree PRG in which one uses a pseudorandom generator to expand a root seed mseed into N subseeds in a structured way. The principle is to label the root of a binary tree of depth log 2 N with mseed. Then, one inductively labels the children of each node with the output of a standard PRG applied to the node's label. The subseeds (seed i ) i∈ [N ] are defined as the labels of the N leaves of the tree. To reveal N -1 subseeds, one reveals the siblings of all nodes in the path from the punctured seed to the tree root, it will be the punctured key. Thus, the communication cost scales with log 2 (N ) , and not N -1. We can generalize this process to reveal all the subseeds but a small subset E ⊂ [1 : N ] by only revealing at most |E| • log(N/|E|) labels of the tree. The idea is to reveal the labels on the siblings of the paths from the root of the tree to leaves i ∈ E (excluding the labels of those paths themselves). Those labels allow someone to reconstruct (seed i ) i ∈E while still hiding (seed i ) i∈E .

Commitment Schemes

We now formally introduce the notion of commitment scheme which is instrumental in many zero-knowledge protocols. Such schemes allow one to commit a chosen value while keeping it hidden to other people, with the ability to reveal the committed value later. Informally, they can be seen as the digital equivalent of a sealed envelope: whenever someone wants to commit to a message m, she puts m in the envelope. At a later moment, she can open the envelope to publicly reveal the message she committed to. Definition 2.2.4 (Commitment Scheme). A commitment scheme is a triplet of algorithms (KeyGen, Com, Verif) such that • KeyGen is a PPT algorithm that, on input 1 λ , outputs some public parameters pp ∈ {0, 1} poly(λ) containing a definition of the message space, the randomness space and the commitment space.

• Com is a deterministic polynomial-time algorithm that, on input the public parameters pp, a message x and the randomness ρ, outputs a commitment c.

• Verif is a deterministic polynomial-time algorithm that, on input the public parameters pp, a message x, a commitment c and the randomness ρ, outputs a bit b ∈ {0, 1}.

It should verify the following properties:

• Correctness: for any message x and any randomness ρ:

Pr[Verif pp (x, c, ρ) = 1 | c ← Com pp (x; ρ)] = 1 .
• Hiding: for any two messages x 0 and x 1 , the following distributions {c | c ← Com pp (x 0 ; ρ), ρ random} and {c | c ← Com pp (x 1 ; ρ), ρ random} are indistinguishable.

• Binding: there exists a negligible function ν such that, for every (PPT) algorithm A, we have

Pr    x = x ∩ Verif pp (x, c, ρ) = 1 ∩ Verif pp (x , c, ρ ) = 1 pp ← KeyGen(); (x, x , ρ, ρ , c) ← A(pp)    ≤ ν(λ) ,
where the probability is taken over the randomness of A and KeyGen. If we restrict A to being PPT, then the scheme is computationally binding. If the computation time of A is unbounded, then the scheme is statistically binding.

In this manuscript, the public parameter input pp will be made implicit in the calls to Com and Verif.

Remark 2.2.5. We can build a commitment scheme from a cryptographic hash function h.

To commit a value v, we sample a random string ρ and we compute c ← h(v ρ).

To open the commitment c, we just need to reveal v and ρ, and the verifier can check that c has been well-built. The binding property of the obtained scheme comes from the collision resistance of the hash function while the hiding property comes from the randomness ρ and the pre-image resistance. We denote this scheme as the hash-based commitment scheme. In some settings in which we need a weaker hiding property, when the value v has a large enough entropy, we can omit the randomness ρ.

A vector commitment scheme is a commitment scheme enabling to commit a vector of values (v 1 , . . . , v n ). Then, instead of revealing all those values, one can decide to reveal a subset of them. A naive method would consist in committing all these values separately:

c i ← Commit(v i ; ρ i ),
but sending (c 1 , . . . , c n ) could be too expensive. We can use a collision-resistant hash function to have a more efficient solution thanks to the Merkle trees (also known as hash trees) [START_REF] Ralph | A Digital Signature Based on a Conventional Encryption Function[END_REF]. A Merkle tree is a binary tree in which every leaf node is labelled with the commitment digest of the data block v i , and every non-leaf node is labelled with the cryptographic hash of the labels of its child nodes. Given a collision-resistant hash function Hash(•), the Merkle hash root for N = 2 n input data blocks v 1 , . . . , v N , denoted MerkleTree(v 1 , . . . , v N ), is hence defined as

MerkleTree(v 1 , . . . , v N ) = Hash MerkleTree(v 1 , . . . , v N/2 ) MerkleTree(v N/2+1 , . . . , v N ) if N > 1 Com(v 1 ; ρ) if N = 1
A Merkle tree makes it possible to show the consistency of a small subset E ⊂ [N ] of revealed inputs (v i ) i∈E with the hash root h = MerkleTree(v 1 , . . . , v N ) without having to communicate all the other inputs (v i ) i / ∈E (or their corresponding hash). The principle is to reveal the sibling paths of (v i ) i∈E in the Merkle tree, that we shall denote auth((v 1 , . . . , v N ), E), and which contains at most |E| • log(N/|E|) hash values.

Zero-Knowledge Proofs

Interactive Protocols

A two-party protocol is a triplet Π = (Init, A, B) where Init is an initialization algorithm that, on input 1 λ , produces a pair (in A , in B ), and where A and B are two stateful algorithms, called the parties. The parties originally receive their inputs in A and in B then interact by exchanging messages, and finally one of the parties, say B, produces the output of the protocol. More formally, an execution of the protocol consists of a sequence:

state A ← A(in A ) state B ← B(in B ) (Msg A [0], state A ) ← A(state A ) . . . (Msg B [i], state B ) ← B(state B , Msg A [i -1]) (Msg A [i], state A ) ← A(state A , Msg B [i]) . . . out ← B(state B , Msg A [n])
The sequence of exchanged messages is called the transcript of the execution, which is denoted

View( A(in A ), B(in B ) ) := (Msg A [0], Msg B [1], . . . , Msg A [n]
) .

An execution producing an output out is further denoted

A(in A ), B(in B ) → out .

In our exposition, the state of the parties shall be made implicit. We shall then say that an algorithm has rewindable black-box access to a party A if this algorithm can copy the state of A at any moment, relaunch A from a previously copied state, and query A (with its current state) on input messages. A variable x is said to be extractable from A if there exists a PPT algorithm E which, given a rewindable black-box access to A, returns x after a polynomial number of queries to A.

Proofs of Knowledge

We will focus on a special kind of two-party protocol called an interactive proof which involves a prover P and a verifier V. In such a protocol, P tries to prove a statement to V. The first message sent by P is called a commitment, denoted Com. From this commitment V produces a first challenge Ch 1 to which P answers with a response Rsp 1 , followed by a next challenge Ch 2 from V, and so on. After receiving the last response Rsp n , V produces a binary output: either Accept, meaning that she was convinced by P, or Reject otherwise. Such an m-round interactive proof with m = 2n + 1 (1 commitment + n challenge-response pairs) is illustrated on Protocol 1. The sequence of exchanged messages is called the transcript of the execution, which is denoted View( P(in P ), V(in V ) ) := (Com, Ch 1 , Rsp 1 , . . . , Ch n , Rsp n )

where in P and in V respectively denote the prover and verifier inputs. An execution producing an output out ∈ {Accept, Reject} is further denoted A proof of knowledge for relation R with soundness error ε is a two-party protocol between a prover P and a verifier V with the following two properties:

P(in P ), V(in V ) → out .
• Perfect completeness: If (x, w) ∈ R, then a prover P who knows a witness w for x succeeds in convincing the verifier V of his knowledge. More formally:

Pr[ P(x, w), V(x) → Accept] = 1,
i.e. given the interaction between the prover P and the verifier V, the probability that the verifier is convinced is 1.

• Soundness: If there exists a PPT prover P such that ε := Pr[ P(x), V(x) → Accept] > ε, then there exists an algorithm E (called an extractor) which, given rewindable black-box access to P, outputs a witness w for x in time poly(λ, (ε -ε) -1 ) with probability at least 1/2.

Informally, a proof of knowledge has soundness error ε if a prover P without knowledge of the witness cannot convince the verifier with probability greater than ε assuming that the underlying problem (recovering a witness for the input statement) is hard. Indeed, if a prover P can succeed with a probability greater than ε, then the existence of the extractor (algorithm E) implies that P can be used to compute a witness w ∈ W (x) in polynomial time.

We now recall the notion of honest-verifier zero-knowledge proof:

Definition 2.3.2 (Honest-Verifier Zero-Knowledge Proof). A proof of knowledge is {computationally, statistically, perfectly} honest-verifier zero-knowledge (HVZK) if there exists a PPT algorithm S (called simulator) whose output distribution is {computationally, statistically, perfectly} indistinguishable from the distribution View( P(x, w), V(x) ) obtained with an honest V.

Informally, the previous definition says that a genuine execution of the protocol can be simulated without any knowledge of the witness. In other words, the transcript of an execution between the prover and an honest verifier does not reveal any information about the witness.

Definition 2.3.3 (Public-Coin Proof).

A proof of knowledge is said public-coin if the verifier challenges Ch 1 , . . . , Ch n are chosen following a public probability distribution.

In practice, the challenges of most of the public-coin proofs of knowledge are chosen uniformly at random from public challenge sets.

Schwartz-Zippel Lemma and Variants

In some of our zero-knowledge proofs, we will rely on the Schwartz-Zippel Lemma or one of its variants. This lemma is a common probabilistic tool to determine whether a given polynomial is the zero polynomial. It states that, if we evaluate a non-zero polynomial into a random point, we obtain zero only with a small probability. Proof. There are |S| possible different draws when we uniformly sample an element in S. But P can have at most d roots, so the studied event occurs for at most d of these draws.

Lemma 2.3.5 (Schwartz-Zippel, multi-point variant). Let P ∈ F[X] be a polynomial of degree d > 0; for any S ⊂ F and any t ≥ 1, Pr r 1 ,...,rt←S

[P (r 1 ) = 0 ∩ . . . ∩ P (r t ) = 0 | {r i } are distinct ] ≤ d t |S| t .
Proof. There are |S| t possible different draws when we uniformly sample t distinct elements in S. But P can have at most d roots, so the studied event occurs for at most d t of these draws.

Lemma 2.3.6 (Schwartz-Zippel, multi-point variant 2). Let P ∈ F[X] be a polynomial of degree d > 0; for any S ⊂ F and any t, ≥ 1, Pr r 1 ,...,rt←S

[#{i : P (r i ) = 0} = | {r i } are distinct ] ≤ max i≤d i • |S|-i t- |S| t .
Proof. There are |S| t possible different draws when we uniformly sample t distinct elements in S. But P can have at most d roots. Let us denote i ≤ d the number of roots of P in S. The studied event occurs for i • |S|-i t-possible draws. We thus get Pr r 1 ,...,rt←S

[#{i : P (r i ) = 0} = | {r i } are distinct ] ≤ max i≤d i • |S|-i t- |S| t .

Secure Multiparty Computation

Secret Sharing Schemes

Along the thesis, the sharing of a value s is denoted s := ( s 1 , . . . , s N ) with s i denoting the share of index i for every i ∈ [1 : N ]. For any subset of indices J ⊆ [1 : N ], we shall further denote s J := s i i∈J .

Definition 2.4.1 (Threshold LSSS). Let F be a finite field and let V 1 and V 2 be two vector spaces over F. Let t and N be integers such that

1 < t ≤ N . A (t, N )-threshold linear secret sharing scheme is a method to share a secret s ∈ V 1 into N shares s := ( s 1 , . . . , s N ) ∈ V N 2
such that the secret can be reconstructed from any t shares while no information is revealed on the secret from the knowledge of t -1 shares.

Formally, an (t, N )-threshold LSSS consists of a pair of algorithms:

Share : V 1 × R → V N 2 Reconstruct J : V t 2 → V 1
where R ⊆ {0, 1} * denotes some randomness space and where Reconstruct J is indexed by a set (and defined for every) J ⊂ [1 : N ] such that |J| = t. This pair of algorithms satisfies the three following properties:

1. Correctness: for every s ∈ V 1 , r ∈ R, and J ⊂ [1 : N ] s.t. |J| = t, and for s ← Share(s; r), we have:

Reconstruct J ( s J ) = s.
2. Perfect (t -1)-privacy: for every s 0 , s

1 ∈ V 1 and I ⊂ [1 : N ] s.t. |I| = t -1, the two distributions s 0 I | r ← R s 0 ← Share(s 0 ; r) and s 1 I | r ← R s 1 ← Share(s 1 ; r)
are perfectly indistinguishable.

Linearity: for every

v 0 , v 1 ∈ V t 2 , α ∈ F, and J ⊂ [1 : N ] s.t. |J| = t, Reconstruct J (α • v 0 + v 1 ) = α • Reconstruct J (v 0 ) + Reconstruct J (v 1 ).
Definition 2.4.2 (Threshold Ramp LSSS). Let F be a finite field and let V 1 and V 2 be two vector spaces over F. Let t 1 , t 2 and N be integers such that 1 ≤ t 1 < t 2 ≤ N . A (t 1 , t 2 , N )-threshold ramp linear secret sharing scheme is a method to share a secret s ∈ V 1 into N shares s := ( s 1 , . . . , s N ) ∈ V N 2 such that the secret can be reconstructed from any t 2 shares while no information is revealed on the secret from the knowledge of t 1 shares.

The formal definition of (t 1 , t 2 , N )-threshold ramp LSSS is similar to Definition 2.4.1 with the Reconstruct J function defined over V t 2 2 (instead of V t 2 ) and with cardinalities |I| = t 1 and |J| = t 2 (instead of |I| = t -1 and |J| = t). In particular an (t -1, t, N )-threshold ramp LSSS is an (t, N )-threshold LSSS.

Definition 2.4.3 (Additive Secret Sharing

). An additive secret sharing scheme over F is an (N, N )-threshold LSSS for which the Share algorithm is defined as

Share : s ; (r 1 , . . . , r N -1 ) → s := r 1 , . . . r N -1 , s - N -1 i=1 r i ,
with randomness space R = F N -1 , and the Reconstruct [1:N ] algorithm simply outputs the sum of all the input shares. Definition 2.4.4 (Shamir's Secret Sharing). The Shamir's Secret Sharing over F is an ( + 1, N )-threshold LSSS for which the Share algorithm builds a sharing s of s ∈ F as follows:

• sample r 1 , . . . , r uniformly in F,

• build the polynomial P as P (X) := s + i=1 r i X i , • build the shares s i as evaluations P (e i ) of P for each i ∈ {1, . . . , N }, where e 1 , . . . , e N are public non-zero distinct points of F.

For any subset J ⊆ [1 : N ], s.t. |J| = + 1, the Reconstruct J algorithm interpolates the polynomial P from the input + 1 evaluation points s J = (P (e i )) i∈J and outputs the constant term s.

In the following chapters, we shall frequently use the following notions:

• Sharing of a tuple. If v is a tuple, a secret sharing v is defined coordinate-wise.

The algorithms Share and Reconstruct further apply coordinate-wise.

• Valid sharing. We say that a sharing v is valid when there exists v such that

∀J s.t. |J| = + 1, Reconstruct J ( v J ) = v.
• Consistent shares. We say that shares v i 1 , . . . , v iz are consistent when there exist other shares v [1:N ]\{i 1 ,...,iz} such that v is a valid sharing.

For a polynomial P ∈ F[X] of degree at most d, we define its sharing P as the sharing of the d-tuple of its coefficients.

Multiparty computation

A multiparty computation (MPC) protocol is an interactive protocol (as formally introduced in Section 2.3.1) involving multiple -possibly more than two-parties P 1 , . . . , P N . Each of these parties receives as input one share of a sharing x . All together, the parties run the MPC protocol to compute f (x) for some function f . At the end of the protocol, each party P i outputs its own computed value of f (x), denoted f i (x). In this paper, we only consider complete protocols for which an execution with honest parties results in all the parties outputting the right value f (x). The view of a party P i is composed of its input share x i , its random tape and all its received messages from the other parties (the sent messages can further be deterministically deduced from the other elements of the view).

We simply recall hereafter the notion of t-privacy for an MPC protocol in the semi-honest model. Definition 2.4.5 (Privacy in the Semi-Honest Model). Let t and N be integers such that 1 ≤ t < N . Let Π f be an MPC protocol with N parties P 1 , . . . , P N , computing a function f . The protocol Π f is t-private in the semi-honest model if for all I ⊂ [N ] such that |I| ≤ t, there exists a PPT algorithm S such that S(I, x I , f I (x)) is perfectly indistinguishable from the joint distributions of the views of the parties in I, where

f I (x) := {f i (x) | i ∈ I}.
As explained above, an N -sharing is usually distributed to N parties, meaning that each party gets one of the N shares. From those shares, the parties can perform distributed computations. Let assume that each party i ∈ [N ] receives the shares x i , y i and P i corresponding to shared values x, y ∈ F and polynomial P ∈ F[X]. If these sharings are linear, they can perform the following operations:

• Addition: the parties locally compute x + y by adding their respective shares:

∀i, x + y i := x i + y i .
This process is denoted x + y = x + y .

• Addition with a constant: for a given constant α, the parties locally compute x+α by doing: ∀i, x + α i :=

x i + α i
where α is a public sharing of α. For example, α can be (α, 0, . . . , 0) when using additive sharings, while it can be (α, . . . , α) when using Shamir's secret sharings. The process to add a constant is denoted x + α = x + α.

• Multiplication by a constant: for a given constant α, the parties locally compute α • x by multiplying their respective shares:

∀i, α • x i := α • x i .
This process is denoted α

• x = α • x .
• Polynomial evaluation: for a given r, the parties can locally compute P (r) by: ∀i, P (r

) i := P i (r) = d j=0 P j i • r j ,
where { P j i } j denotes the coefficients of P i . This process is denoted P (r) = P (r).

Signature Schemes

In this thesis, we focus on signature schemes. Such schemes are formally defined as below.

Definition 2.5.1 (Signature scheme). A signature scheme is a triplet of polynomial-time algorithms (KeyGen, Sign, Verif) such that:

• KeyGen outputs a random pair (pk, sk) where pk is a public key and sk is a secret key;

• given a secret key sk and a message m ∈ {0, 1} * , Sign produces a signature σ;

• given a public key pk, a message m ∈ {0, 1} * and a signature σ, Verif outputs 1 if σ is a valid signature for m under pk (meaning that it is a possible output σ ← Sign(sk, m) for the corresponding sk) and it outputs 0 otherwise.

The standard security property for a signature scheme is the existential unforgeability against chosen message attacks (EUF-CMA): an adversary A given pk and oracle access to Sign(sk, •) should not be able to produce a pair (σ, m) satisfying Verif(pk, σ, m) = 1 (for a message m which was not queried to the signing oracle).

Fiat-Shamir transformation. We can transform a public-coin honest-verifier zero-knowledge proof of knowledge into a signature scheme thanks to the famous Fiat-Shamir transformation [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF]. The latter consists in removing the interactions of the proof systems while binding a proof transcript with the message to sign. The goal is that, even if we remove the interaction, a malicious signer should not be able to control the randomness used to generate the verifier challenges Ch 1 , . . . , Ch n . The Fiat-Shamir heuristic consists in generating the challenge Ch i as (using the same notations as in Protocol 1)

h i ← Hash(m, com, Rsp 1 , . . . , Rsp i-1 ) Ch i ← XOF(h i )
where XOF is an extendable output function (a hash function with an arbitrary output size) and m is the message to sign. Since the output of a hash function looks like random bits, a malicious prover will not be able to forge easily valid signatures.

Chapter 3.

The MPC-in-the-Head Paradigm

Zero-knowledge proofs are an important tool for many cryptographic protocols and applications. To build them, many techniques exist. In this chapter, we will present one of them: the MPC-in-the-Head framework, introduced in 2007 by [START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF], which provides a generic way to build zero-knowledge proofs of knowledge using techniques from secure multiparty computation. Moreover, we will provide a complete overview of the recent techniques in the state of the art of this framework.

Generic Transformations

General Setting

In the seminal work [START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF], Ishai, Kushilevitz, Ostrovsky and Sahai propose a framework to build zero-knowledge proofs for an arbitrary NP relation R using techniques from secure multi-party computation (MPC). More precisely, they show how to use an MPC protocol Π verifying the relation R in a black-box way to get such a proof.

Assume we want to build a zero-knowledge proof of knowledge of a witness w for a statement x such that (x, w) ∈ R for some relation R. To proceed, we shall use an MPC protocol in which N parties P 1 , . . . , P N securely and correctly evaluate a function f x on a secret witness w with the following properties:

• each party P i takes a share w i as input, where w is a sharing of w;

• the function f x on input w outputs Accept when (x, w) ∈ R and Reject otherwise;

• the protocol is t-private in the semi-honest model, meaning that the views of any t parties leak no information about the secret witness (see Definition 2.4.5 for a formal definition).

• the protocol is r-robust in the malicious model, meaning that the protocol outputs the right values as soon as there are at most r dishonest parties.

We can use this MPC protocol to build a zero-knowledge proof of knowledge of a witness w satisfying (x, w) ∈ R. The prover proceeds as follows:

• she builds a random sharing w of w;

• she simulates locally ("in her head") all the parties of the MPC protocol;

• she sends a commitment of each party's view to the verifier, where such a view includes the party's input share, its random tape, and its received messages (the sent messages can further be deterministically derived from those elements);

• she sends the output shares f (w) of the parties, which should correspond to a sharing of Accept.

Then the verifier randomly chooses t parties and asks the prover to reveal their views. After receiving them, the verifier checks that they are consistent with an honest execution of the MPC protocol and with the commitments. Since only t parties are opened, the revealed views leak no information about the secret witness w, which ensures the zero-knowledge property.

On the other hand, the random choice of the opened parties ensures the soundness of the proof system. Indeed, a prover that does not know a witness w satisfying (x, w) ∈ R will need to corrupt the computation of some parties such that the emulated MPC protocol indicates that f x (w) = Accept (while it is not true), but then the verifier will catch the malicious prover as soon as she will ask to open one of these corrupted parties (see Figure 3.1), which occurs with constant probability. The probability that a malicious prover can convince a verifier is named the soundness error of the proof of knowledge and it is usually denoted ε (or in some articles). To decrease A malicious prover does not know a witness such that the MPC protocol outputs Accept, thus she needs to cheat when emulating the MPC protocol. The optimal cheating strategy (when r := 0) is to corrupt the communication between two parties. For example, in the figure, the party P 2 sends the message "4" but the party P 3 gets "-2" as message from P 2 . The verifier will ask to reveal the computation of t := 2 parties. The verifier will catch the malicious behavior as soon as the two parties involved in the corrupted communication are open, implying that the probability that the verifier detects the cheating is

( N -2 t-2 ) ( N t ) := 1 10 .
this cheating probability, the zero-knowledge proof is repeated several times (we denote this number τ in this manuscript) using fresh randomness. The exact security of the IKOS framework1 is analyzed in [START_REF] Giacomelli | ZKBoo: Faster Zero-Knowledge for Boolean Circuits[END_REF]. The soundness error of the construction is given by the following theorem.

Theorem 3.1.1 ([GMO16]

). Let us consider a NP relation R. We assume that we have a t-private and r-robust MPC protocol Π evaluating a function f x such that ∀w, f x (w) = Accept ⇔ (x, w) ∈ R. Then the zero-knowledge protocol built from Π using the MPCitH paradigm has a soundness error

ε := max    r t N t , k j=0 2 j k j N -2k t-j N t    with k = r/2 + 1. Remark 3.1.2.
Let us consider the case where the MPC protocol is only passively-secure, meaning that the protocol is ensured to produce the correct output only when there is no corrupted parties (i.e. r = 0 where r is the robustness threshold). In that case, Theorem 3.1.1

gives that the soundness error of the resulting proof of knowledge is

ε := 1 - t(t -1) N (N -1) .
We can remark that this quantity is minimal when t is maximal, i.e. when t = N -1. In that case, the soundness error is ε = 2 N . Remark 3.1.3. [START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF] considers two cases. The first one corresponds to the setup where the MPC protocol is passively-secure and the privacy threshold is 2. The soundness error of the resulting proof is 1

-1 ( N 2 )
. The second one corresponds the setup where t = r > 0 and N = Ω(t), for which the soundness error ε is in 2 -Ω(t) . When taking a large t, ε can be negligible without any repetition.

Theorem 3.1.1 holds for any MPC protocol. However, the communication cost of the resulting proof system will highly depend on the used protocol. The MPC-in-the-Head framework was introduced in 2007 and has been considered as a theoretical result for almost a decade. It was only in 2016 that the first practical proof system relying on this framework was proposed [START_REF] Giacomelli | ZKBoo: Faster Zero-Knowledge for Boolean Circuits[END_REF]. From then on, the framework has been much more studied and many concrete instantiations have been proposed. For instance, one year later, [START_REF] Chase | Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives[END_REF] proposed the first MPCitH-based signature schemes, Fish and Picnic. Picnic has been then submitted to the NIST call for post-quantum cryptosystems in 2017 [START_REF]Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process[END_REF].

Broadcast-based Multiparty Computation

Submitted at the same conference than [START_REF] Chase | Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives[END_REF], the article [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF] proposes a totally different proof system relying on the MPC-in-the-Head paradigm. The authors restrict the seminal work of [START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF] to the case of multiparty computation using only broadcast as communication (and no peer-to-peer communication anymore). While it can be seen as a subcase of the [START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF] framework, it enables to build more efficient proof systems. Since it relies only on broadcast, all communications are public. The prover thus does not need to commit them and can simply send them to the verifier. Then, when getting a party's view, the verifier will check that the sent messages are consistent with the broadcast communications. In Section 3.1.1, the verifier checked that the open views were consistent between them (and with the commitments), but here the verifier only needs to check that the open views are consistent with the broadcast communications. It implies that the verifier will more efficiently catch the cheating since she just needs to open a party's view with cheating (see Figure 3.2), while in the previous model, the cheating can be on peer-to-peer communication, requiring that the verifier asks the opening of the two concerned parties to detect it (as in Figure 3.1).

To build a zero-knowledge proof of knowledge using a broadcast-based MPC protocol, the prover shall proceed as follows:

• she builds a random sharing w of w;

• she simulates locally ("in her head") all the parties of the MPC protocol;

• she sends a commitment of each party's view to the verifier, where such a view includes the party's input share and its random tape;

• she sends all the broadcast messages; This time, we assume that the parties only use a broadcast channel, meaning that all broadcast values are known by everybody. Since the malicious prover does not know a valid witness, she needs to cheat on the computation of at least one party. Then, the verifier will ask to reveal the computation of t := 2 parties. The verifier will catch the malicious prover with probability 2 N := 2 5 .

• she sends the output shares f (w) of the parties, which should correspond to a sharing of Accept.

Then the verifier randomly chooses t parties and asks the prover to reveal their views. After receiving them, the verifier checks that they are consistent with the given broadcast messages and with the commitments. While the number of messages in a peer-to-peer multiparty computation is in O(N 2 ) with N the number of parties, it is only in O(N ) when using broadcast. The exchanged messages sometimes contain some redundancies. For example, it is the case when the parties broadcast shares of a Shamir's secret sharing, which are evaluations of a polynomial. In that case, the prover can save communication by compressing the broadcast messages. The soundness error of the resulting proof system is given by the following theorem (mix of theorems of [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF] and [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF]).

Theorem 3.1.4 ([AHIV17; DOT21]).

Let us consider a NP relation R. We assume that we have a t-private and r-robust MPC protocol Π evaluating a function f x such that ∀w, f x (w) = Accept ⇔ (x, w) ∈ R. We denote δ the robustness error of Π, i.e. the probability that Π with at most r corrupted parties outputs Accept while parties' input shares do not form a valid sharing of a value w such that (x, w) ∈ R. Moreover, we assume that Π only uses a broadcast channel as communication between parties. Then the zero-knowledge protocol built from Π using the MPCitH paradigm has a soundness error

ε := N -r-1 t N t + δ • 1 - N -r-1 t N t .
Remark 3.1.5. The formula given in Theorem 3.1.4 differs from these in [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF] and [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF]. In [AHIV17, Theorem 3.5], the authors simplify the equation as

ε ≤ N -r-1 t N t + δ ≤ 1 - r + 1 N t + δ ≤ 1 - r N t + δ while [DOT21, Theorem 1] only considers the case r = 0 and t = N -1 to get 1 N + δ • 1 -1 N .
Remark 3.1.6. Let us stress that a malicious prover is not forced to commit a valid input sharing (i.e. a sharing with consistent shares). For example, when using a (t + 1, N )-threshold Shamir's secret sharing, a malicious prover is not forced to commit evaluations of a degree-t polynomial. The MPC protocol should then check that the sharing is valid, e.g. by using a Reed-Solomon proximity test. Let us observe that this issue is irrelevant in the case of the additive sharing scheme since any

N values (v 1 , . . . , v N ) form a valid sharing of N i=1 v i .
The MPCitH-based constructions relying on broadcast-based MPC protocols can be split into two categories:

• sublinear proof systems, relying on multiparty computation which is secure in the malicious model (r > 0),

• linear proof systems targeting small circuits (e.g. to construct efficient signature schemes), relying on passively-secure multiparty computation (r = 0).

Sublinear Proof Systems

In [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF], the authors proposed a proof system fitting this broadcast setting, named Ligero. The latter relies on proximity tests to get a robust MPC protocol. Combined with packed secret sharings2 , it achieves sublinear proof size. More precisely, the communication cost scales in O( |C|) where |C| is the number of gates in the considered circuit. Since it relies on packed secret sharings, the used field must be large enough to enable the existence of such sharings. To support Boolean circuits, it requires embedding the computation in a larger field. In that case, a Boolean value will be represented by a field element and quadratic constraints on the form X 2 -X = 0 will ensure that the field elements really correspond to 0 or 1. A few years later, [START_REF] Gvili | BooLigero: Improved Sublinear Zero Knowledge Proofs for Boolean Circuits[END_REF] proposed a tailored version of Ligero (named Booligero) in this context of Boolean circuits.

Proof Systems for Small Circuits

One year after [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF], [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] proposed a proof system that fits the broadcast setting, but with a totally different construction. The proposed construction only uses additive sharings and has the maximal privacy threshold t := N -1, meaning that the prover will reveal all the parties' views except one. Without optimization, the achieved size would be huge, but [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] proposes several tricks to achieve practical sizes:

• Since the input sharing w is additive, each share except the last one can be derived from a seed using a pseudo-random generator. Thus, revealing an input share simply consists in sending the corresponding seed.

• With the previous point, the prover only needs to reveal N -1 seeds if the last party remains hidden, N -2 seeds and an uncompressed share otherwise. In order to further decrease communication, [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] suggests to generate these seeds using a puncturable pseudo-random function. More precisely, the authors propose to use a GGM tree (see Section 2.2.2), decreasing the number of revealed seeds to log 2 (N ).

This framework (passively-secure broadcast-based protocol with additive sharings) inspires many works such as [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF], [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF] and [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF] (see Section 3.4 for a more complete list).

Here are the main ideas to develop an efficient MPC protocol in this framework:

• [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] relies on a preprocessing phase (independent of the secret) to prepare a set of Beaver triples (a Beaver triple is a triple (a, b, c) such that (a, b) is chosen uniformly at random and c = a • b). Thanks to a cut-and-choose strategy, the verifier has the guarantee that these triples are well-formed (see Section 3.3.1 for details). Then, [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] proposes an MPC protocol that computes the circuit which represents f x and which outputs f x (w).

• Instead of having an MPC protocol which computes f x (w), [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] proposes an MPC protocol which validates the statement f x (w) ? = Accept. It enables us to avoid the time-consuming cut-and-choose phase of [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF].

In this line of research, the prover needs to emulate N parties by repetition, where N is a flexible parameter of the proof system. Since the soundness error of one repetition is greater than 1 N , the prover needs to perform at least λ log 2 N repetitions to achieve a security of λ bits, thus the prover needs to emulate at least λ N log 2 N times the party's computation. Similarly, the verifier needs to re-emulate at least λ(N -1) log 2 N parties. Since emulating the MPC protocol was the computational bottleneck of these schemes, most of the works in this setting proposed several trade-offs of their construction: the larger N , the shorter the proof and the slower the computation.

This state of affairs changed in 2023. [START_REF] Aguilar Melchor | The Return of the SDitH[END_REF] shows that these numbers can be reduced to λ log 2 N +1 log 2 N for the prover and λ log 2 N log 2 N = λ for the verifier without impacting the signature size. With their optimization, N has only a slight impact on the cost of emulating the MPC protocol anymore, but it still has a linear impact on the commitment phase where the prover needs to commit the input shares of all the parties for each repetition.

Linear Broadcast-based Multiparty Computation

The schemes presented in Section 3.1.2.2 achieve very competitive performance mainly thanks to the additive sharing and the tweak of generating shares via GGM trees. The latter is not possible for another type of sharing. The achieved sizes in Section 3.1.2.1 are not competitive when targeting small circuits/statements.

The recent article [START_REF] Feneuil | Threshold Linear Secret Sharing to the Rescue of MPC-in-the-Head[END_REF] proposes a new approach to build MPCitH-based proof systems. It considers a subcase of the broadcast setting: it deals with broadcast-based multiparty computation which only performs linear operations on sharings. For example, given two sharings a and b , it prevents from computing the sharing a • b by multiplying each share a i by the share b i , which would be accurate when using Shamir's secret sharings (it is used in Ligero [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF]). This subclass of MPC protocols satisfies the following property: if Π is a broadcast-based MPC protocol that only performs linear operations on (t + 1, N )-threshold linear secret sharings, then restricting Π to any subset of t + 1 parties forms a valid MPC protocol which computes the same functionality. The procedure to build a zero-knowledge proof is exactly the same as in Section 3.1.2, but this subclass of MPC protocol enables a refined analysis of the soundness, as given by the following theorem. Theorem 3.1.7 [START_REF] Feneuil | Threshold Linear Secret Sharing to the Rescue of MPC-in-the-Head[END_REF]). Let us consider a NP relation R. We assume that we have a t-private (passively-secure) MPC protocol Π evaluating a randomized function f x such that

• for w satisfying (x, w) ∈ R, f x (w) = Accept,
• for w such that (x, w) ∈ R, f x (w) = Reject with high probability.

Moreover, we assume that Π only uses a broadcast channel as communication between parties and only performs linear operations on (t, t + 1 + ∆, N )-threshold ramp linear secret sharings. Let us denote p the probability that f x (w) = Accept when (x, w) ∈ R. Then the zero-knowledge protocol built from Π using the MPCitH paradigm has a soundness error

ε := t+∆ t N t + p • t t + ∆ + 1 • N -t ∆ + 1 .
When considering threshold sharings (∆ := 0), we get a soundness error of

ε := 1 N t + p • t • (N -t) t + 1 .
Remark 3.1.8. When we apply Theorem 3.1.7 to the case of the additive sharing case (t := N -1, ∆ := 0), we obtain the soundness error

ε := 1 N + p • 1 - 1 N ,
which corresponds to the soundness obtained by the schemes in Section 3.1.2.2. Thus, in that setting, we can stress that allowing only linear operations does not impact the soundness.

Theorem 3.1.7 is especially interesting when considering a very-low privacy threshold t. For example, let us consider the case where t := 1 (and with ∆ = 0). The soundness error of the resulting scheme is

ε := 1 N + p • N -1 2 .
When p is negligible, we obtain the same soundness as when using the additive sharing scheme, but here the verifier asks to open only t = 1 party. Since verifying a proof transcript consists in re-emulating the open parties, revealing only t parties (with t small) leads to a very efficient scheme. [START_REF] Feneuil | Threshold Linear Secret Sharing to the Rescue of MPC-in-the-Head[END_REF] shows that the prover also benefits from this small privacy threshold. However, the obtained communication costs in that setting are a bit larger than those of Section 3.1.2.2. Theorem 3.1.7 thus tends to produce faster schemes but with a larger communication cost.

The formalization of this linear broadcast-based multiparty computation model is a contribution of this thesis, which is extensively described in Chapter 8.

Paradigm Usage

In the state of the art, the MPC-in-the-Head paradigm has been studied to achieve two different goals. The first one consists in designing zero-knowledge proofs for a class of circuits, while the second one consists in designing identification schemes (and signature schemes through the Fiat-Shamir transformation).

On one hand, the challenge of the first goal is to design an MPC protocol that can be converted into an efficient proof system for a chosen class of circuits (e.g. an arithmetic circuit). The statement to be proved with the proof scheme is straightforward.

On the other hand, when designing identification schemes, the statement to be proved is often left to the designers as soon as it corresponds to a secure one-way function. The challenge is then to choose a statement and design a dedicated MPC protocol which can be converted into an efficient identification scheme. Many articles explored this setting, searching for the statement which would give the most efficient schemes with the existing MPC-in-the-Head techniques. Three trends can be observed in the state of the art:

• some identification schemes are relying on standard symmetric primitives like AES (e.g. [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF]);

• some are relying on MPC-friendly primitives like LowMC or Rain (e.g. [START_REF] Dobraunig | Shorter Signatures Based on Tailor-Made Minimalist Symmetric-Key Crypto[END_REF]);

• as the last option, some are relying on hard problems that have existed for a long time and are thus well understood, like the syndrome decoding problem.

The first option leads to the more conservative schemes, but the achieved communication costs are quite large. The second option currently gives the shortest communication costs, but since it relies on recent primitives, it is less conservative. The last option is between the two other ones in terms of performance and can be used as a trade-off between performance and security concerns.

Useful techniques

To design an MPC protocol that aims to be used with the MPC-in-the-Head framework, designers can rely on some techniques that have been proposed in the literature. In what follows, we describe some of them.

Protocols with Helper

One can assume that the parties take an auxiliary input which is a sharing y of a random value y satisfying some public equation E(y) = 0 (where E might depend on the public statement x). In practice, this assumption is verified thanks to a cut-and-choose strategy run before the emulation of the MPC protocol. Introduced by [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] using a preprocessing phase, this technique has been formalized in [START_REF] Beullens | Sigma Protocols for MQ, PKP and SIS, and Fishy Signature Schemes[END_REF] as protocols with helper.

Using a "helper" is very powerful. When receiving the shares y of y, the parties can use them to perform advanced computation assuming E(y) = 0, without needing to perform any check on the received shares. For example, [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] uses this technique to produce Beaver triples (i.e. the MPC protocol can take as input three sharings a , b and c for random a, b and c satisfying c = a • b) while [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF] uses it to ensure that some parts of the MPC input encode a random binary vector. This technique presents the advantage that the communication cost is independent of the size of y and the expression of E, since it relies only on seeds. However, it suffers from a high computational cost, implying that the number N of parties involved in the MPC protocol must stay low to obtain a practical scheme.

Statistical checkings

The high-level idea of the MPC-in-the-Head paradigm consists in building a zero-knowledge proof of knowledge of a witness w that satisfies (x, w) ∈ R using a multiparty computation evaluating a functionality f x such that

(x, w) ∈ R ⇔ f x (w) = Accept.
In practice, we can relax this construction. Instead of being a deterministic function, f x could be a randomized function performing a statistical test on w:

• if (x, w) ∈ R, then f x outputs Accept; • if (x, w) ∈ R, then f x outputs Reject with high probability.
It means that some false positive events can occur: f x can sometimes output Accept even if (x, w) ∈ R. The probability that it occurs is called the false positive rate or the false positive probability. To sum up, we can consider a setting in which the output of the protocol has a probability distribution of the form described in Table 3.1. To have a sound proof of knowledge, the randomness of the statistical test should not be controlled by the prover. The solution consists in letting the verifier provide this randomness after the commitment of the input shares of the MPC protocol. Relaxing the definition of f x enables us to use lighter MPC protocols, which leads to more efficient MPCitH-based proofs of knowledge. We could imagine relaxing the definition of f x even more by allowing false negative events (i.e. f x can output Reject when (x, w) ∈ R with small probability), but there is currently no such proposal in the literature, and so it is not sure it would be useful.

Output of f

x Accept Reject w s.t. (x, w) ∈ R 1 0 w s.t. (x, w) ∈ R p 1 -p
In the MPC-in-the-Head state of the art, the first scheme using this relaxation is the [BN20] protocol. To deal with multiplications in MPC (i.e. to compute a sharing x • y from x and y ), a standard technique consists in using Beaver triples [START_REF] Beaver | Efficient Multiparty Protocols Using Circuit Randomization[END_REF]: the protocol takes as inputs a random triple of sharings ( a , b , c ) such that a • b = c and uses them to compute x • y from x and y . When using it in an MPC-in-the-Head paradigm, this technique presents the disadvantage that the verifier should be convinced that a • b = c. Since the desired property is independent of the secret, we can use protocols with helper to proceed. However, it implies that the obtained scheme would not be efficient because of the computational bottleneck of the protocols with helper.

[BN20] proposes an alternative solution. In the MPC-in-the-Head paradigm, the secret is known by the prover. If the MPC protocol involves such a multiplication between two secret values x and y, she can easily compute their product z := x • y. Then, instead of computing a sharing z from x and y , the prover can directly give z as input of the MPC protocol. Then one just needs to check that the sharings x , y and z satisfy z = x • y. Checking this relation is lighter than computing z . [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] proposes an MPC protocol that takes as input the three sharings ( x , y , z ) and a random Beaver triple ( a , b , c ) and which outputs

• Accept when z = x • y and c = a • b, • Reject when z = x • y or c = a • b with high probability.
This alternative solution also uses a Beaver triple as the previous one, however the verifier does not need to be convinced that the Beaver triple is well-formed since the MPC protocol makes the checking itself. While it introduces a false positive rate, it avoids using the protocols with helper and leads to more efficient schemes.

MPCitH with Rejection

Sharing a value x using an additive N -sharing over Z/qZ consists in sampling x 1 , . . . , x N ∈ Z/qZ such that x = x 1 + . . . + x N mod q.

A proof system relying on the MPC-in-the-Head always needs to include some shares in the proof transcript, so the bit size of a share has a direct impact on the proof size. In some contexts, one may want to share a small value (small compared to q). For example, [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF] needs to share a binary vector x while working with q ≈ 2 256 . In that case, sending a share of x is much more expensive than sending x. [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF] proposes to share such a small value in an alternative way: instead of sharing over Z/qZ, one can share over small integers. It consists in sampling x 1 , . . . , x N in some range {-A, . . . , A} such that

x = x 1 + . . . + x N over Z.
Such sharings leak information about the shared value x, but [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF] shows that one can prevent leakage using rejection, i.e. by allowing the prover to abort the protocol in some specific situations. Taking a small A leads to a short proof size but implies a high rejection rate. Thus selecting the parameter A consists in choosing a trade-off between the proof size and the computational performance.

State of the art

Since [START_REF] Giacomelli | ZKBoo: Faster Zero-Knowledge for Boolean Circuits[END_REF], there have been a lot of works dealing with the MPC-in-the-Head paradigm. This section proposes a short overview of the state of the art. Let us stress that it is not an exhaustive list of the existing works, but rather a list of the main results. We can divide the contributions of the works into several categories:

1. works which propose a new MPC-in-the-Head transformation for a class of MPC protocols (or some optimizations of an existing transformation);

2. works which propose a new (optimized) MPC protocol that leads to efficient proof systems when using one of the MPC-in-the-Head transformations;

3. works which find the best specialized MPC protocol for a specific circuit and it often leads to efficient signature schemes;

4. works which aim to produce schemes with advanced functionalities (such as ring signature scheme) thanks to the MPCitH paradigm.

One article can propose contributions in several categories. For example, [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF] introduces the MPC-in-the-Head transformation with broadcast and also proposes Ligero, a sublinear proof of knowledge for the arithmetic circuits. Contributions from the first category have already been presented in Section 3.1. In what follows, we describe the works of the second and third categories. Regarding the contributions of the last category, the literature remains still sparse and it is difficult to provide a clear overview.

Zero-knowledge proofs of knowledge for arbitrary circuits

In 2016, [START_REF] Giacomelli | ZKBoo: Faster Zero-Knowledge for Boolean Circuits[END_REF] proposed ZKBoo, the first practical zero-knowledge proof system relying on the MPC-in-the-Head paradigm.While the achieved proof size was not competitive with the schemes from the SNARK technology, ZKBoo significantly outperformed them in terms of proving time. One year later, [START_REF] Chase | Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives[END_REF] optimized ZKBoo by reducing the proof size by a factor of two at no additional computational cost. This optimized proof system was named ZKB++.

In 2017, [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF] proposed Ligero, a sublinear proof system for arithmetic circuits. It relies on an MPC protocol which is robust in the malicious model thanks to a code proximity test. It achieves sublinear communication costs by packing several witness coordinates in one sharing, which is made possible by the use of Shamir's secret sharing.

From 2018, there is a series of works proposing efficient proof systems for arithmetic circuits for which the communication cost is linear into the number n of multiplicative gates:

• [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] uses Beaver triples to evaluate an arithmetic circuit in MPC and relies on a protocol with helper to generate these triples;

• [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] proposes a solution to avoid the helper from [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] thanks to their sacrificingbased multiplication verification, obtaining a 5-round proof system which achieves a communication cost in around 5n;

• [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF] proposes Banquet3 which uses the polynomial-based technique of [START_REF] Boneh | Zero-Knowledge Proofs on Secret-Shared Data via Fully Linear PCPs[END_REF] to verify multiplications, which is a 7-round proof system achieving a communication cost scaling in n + O( √ n);

• [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF] proposes Limbo which can be considered as a generalization of Banquet for more rounds, which is a Θ(log 2 n)-round proof system achieving a communication cost in n + O(log 2 n);

• [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF] proposes BN++, a highly-optimized version of the [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] scheme achieving a communication cost in around 2n;

• [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF] proposes Helium, which is a 7-round proof system relying on the polynomialbased multiplication verification as Banquet and achieving a communication cost of around 2n.

[KZ22] provides a nice overview of all the existing MPCitH techniques. Currently, there are two main approaches to deal with multiplications:

• The sacrificing-based verification proposed by [START_REF] Lindell | A Framework for Constructing Fast MPC over Arithmetic Circuits with Malicious Adversaries and an Honest-Majority[END_REF][START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF]. It consists in using

Beaver triples to check multiplications, but it does not require that the prover explicitly convinces the verifier that these Beaver triples are well-built. As shown in [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF], this verification can be optimized and batched for a large number of multiplications. It can be also adapted to the matrix setting (see [START_REF] Feneuil | Building MPCitH-based Signatures from MQ, MinRank, Rank SD and PKP[END_REF] for example).

Let us describe the batched version of the MPC protocol. We want to check n multiplication triples ( x i , y i , z i ), i.e. check that z i = x i • y i for all i. To proceed, the MPC protocol takes as input a random dot-product tuple ((

a i , b i ) i∈[n] , c
) verifying c = a, b to sacrifice and runs the following computation:

1. the parties get a random ε ∈ F n (from the verifier in the MPCitH paradigm);

2. the parties locally set α = ε • x + a and β = y + b , where • is the coordinate-wise multiplication;

3. the parties broadcast α and β to obtain α and β;

the parties locally set

v = -c + ε, z + α, b + β, a -α, β ;
5. the parties broadcast v to obtain v;

6. the parties output Accept if v = 0 and Reject otherwise.

If one of the multiplication triples is invalid (or if the dot-product tuple is not well-built), this MPC protocol outputs Reject except with probability 1 |F| . In some settings, we can remove the computation of β and save the associated communication (see [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF] for details).

• The polynomial-based verification proposed by [START_REF] Boneh | Zero-Knowledge Proofs on Secret-Shared Data via Fully Linear PCPs[END_REF][START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF]. Let us assume that, given (x i , y i , z i ), we want to check that z i = x i • y i for all i. The idea is to represent the values (x 1 , . . . , x n ), (y 1 , . . . , y n ) and (z 1 , . . . , z n ) respectively into three polynomials S, T and P such that

S(γ 1 ) = x 1 . . . S(γ n ) = x n , T (γ 1 ) = y 1 . . . T (γ n ) = y n ,
and

P (γ 1 ) = z 1 . . . P (γ n ) = z n
for some distinct public points γ 1 , . . . , γ n . Let us stress that computing these polynomials is communication-free in MPC since the interpolation formula is linear into the secret values. Then, the polynomial-based verification consists in checking that S • T -P is zero over {γ 1 , . . . , γ n } thanks to the Schwartz-Zippel lemma. The communication cost of this verification depends on the number of rounds. If the MPC protocol asks the verifier for randomness only once, then the communication cost due to the verification will be linear into the number n of multiplications we want to check. If we allow an additional round (see [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF]), the communication cost scales in O( √ n). More generally [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF], if the MPC protocol asks the verifier for randomness t times, the cost scales in O(t

• t √ n), which is O(log n) for t := log n.
The two above techniques highly depend on the size of the underlying field. They will be efficient for large fields, but not for small fields. For example, if we work on the binary field, the MPC protocol for sacrificing-based verification has a false positive rate of 1/2, and it will have a high impact on the performance of the produced scheme. [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF] compiles several methods to deal with small fields:

• the simplest idea consists in lifting all the computations in a field extension;

• the second idea consists in repeating the MPC protocol several times to get a small global false positive rate;

• the latter idea consists in using reverse multiplication friendly embedding (RMFE) to lift the computation.

Other techniques are possible, but they are specific to the context. All these techniques enable us to decrease the impact of working over a small field. We refer the reader to [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF] for details.

Zero-knowledge proofs of knowledge for dedicated circuits

If we want to build a proof system for a specific circuit, we can rely on the schemes of the previous subsection. For example, if we want to build a proof of knowledge for an AES key k satisfying y = AES k (0) for a public y, we can transform the statement into an arithmetic circuit and use a generic proof system (as Limbo or Helium) to get the desired scheme. While this approach presents the advantage of not relying on a new construction, it could prevent achieving smaller communication costs because converting a statement into a circuit often does not take advantage of the arithmetic properties of the statement. Another approach would consist in building a proof system from an MPC protocol optimized for the considered statement. The goal is to exploit the arithmetic structure of the statement to produce a more efficient MPC protocol. It does not lead to better schemes when considering a statement which can be naturally written as a circuit (as those derived from some block ciphers), but it is more efficient when considering an arithmetic statement as the syndrome decoding problem (as in Chapter 4 and in Chapter 5).

Let us remark that focusing on a specific statement instead of a large class of statements is interesting to build efficient signature schemes.

Here are the articles proposing dedicated MPC protocols:

• LegRoast and PorcRoast [START_REF] Beullens | LegRoast: Efficient Post-quantum Signatures from the Legendre PRF[END_REF] rely on MPC protocols for Legendre PRF and for higher-power residue characters;

• [START_REF] Feneuil | Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs[END_REF] (described in Chapter 5) proposed an MPC protocol optimized for the syndrome decoding problem in Hamming metric;

• [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF] (described in Chapter 6) proposed several MPC protocols for the subset sum problem;

• [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF] (described in Chapter 6) also proposed an MPC protocol for the [START_REF] Boneh | The Modular Inversion Hidden Number Problem[END_REF] PRF;

• [START_REF] Adj | MinRank in the Head: Short Signatures from Zero-Knowledge Proofs[END_REF] proposed an MPC protocol for the MinRank problem;

• [START_REF] Feneuil | Building MPCitH-based Signatures from MQ, MinRank, Rank SD and PKP[END_REF] (described in Chapter 7) proposed two MPC protocols to check the rank of a matrix which can be used for the MinRank problem and the rank syndrome decoding problem;

• [START_REF] Feneuil | Building MPCitH-based Signatures from MQ, MinRank, Rank SD and PKP[END_REF] (described in Chapter 7) also proposed MPC protocols for the multivariate quadratic problems and the permuted kernel problem.

Chapter 4

Chapter 4.

Shared Permutation for Syndrome Decoding

In 2020, the state of the art regarding the zero-knowledge proofs of knowledge for the syndrome decoding problem was sparse and not competitive (in terms of communication cost). In this chapter, we propose a first proof of knowledge using ideas from the MPC-in-the-Head paradigm. Thanks to the Fiat-Shamir transformation, we get a first signature scheme that outperforms the former code-based schemes based on the same assumption and which is competitive with some quantum-safe schemes.

The results presented in this chapter have been published in collaboration with Antoine Joux and Matthieu Rivain in the journal Designs, Codes and Cryptography [START_REF] Feneuil | Shared permutation for syndrome decoding: new zero-knowledge protocol and code-based signature[END_REF]. Let H, x and y be such that:

1. H is uniformly sampled from F (m-k)×m , 2.
x is uniformly sampled from {x ∈ F m : wt H (x) = w}, 3. y is defined as y := Hx.

From (H, y), find x.

For random linear codes -i.e. for a random matrix H-this problem is widely believed to be robust for practical parameters. In this chapter, we only consider the binary version of the syndrome decoding problem, i.e. we only consider F := F 2 .

In a pioneering work from three decades ago [START_REF] Stern | A New Identification Scheme Based on Syndrome Decoding[END_REF], Stern proposed a zero-knowledge protocol to prove the knowledge of a solution to a syndrome decoding instance. This protocol achieves a soundness error of 2/3 which means that a malicious prover can fool the verifier with probability 2/3. Although an arbitrary security of (2/3) τ can be achieved by repeating the protocol τ times, the induced communication cost is significant, which is partly due to this high soundness error. Since the work of Stern, a few papers have proposed optimizations and implementations (see for instance [Vér96; GG07; AGS11; ACBH13]) but for random linear codes with standard security levels, the communication cost is still heavy.

In this chapter, we propose a new zero-knowledge protocol for the SD problem which achieves a soundness error of 1/N with complexity O(N ) for an arbitrary chosen N . In a nutshell, and as in Stern protocol, the solution x is masked by the application of a random permutation σ. However, instead of revealing either σ(x) or σ, we always reveal σ(x) and prove the existence of a permutation σ. To this purpose, we decompose σ into N masked permutations σ(•)

+ s := (σ 1 (•) + s 1 ) • • • • • (σ N (•) + s N )
which are all committed by the prover and we let the verifier choose N -1 of them to be revealed. This way, we can maintain the privacy of σ while obtaining the desired soundness error of 1/N .

Our construction requires the verifier to trust some of the variables sent by the prover. This can be ensured by a so-called cut-and-choose phase since these variables are independent of the secret solution x. While composing our technique with a cut-and-choose phase, the obtained protocol has a similar structure as the zero-knowledge proof for Boolean circuits proposed by Katz, Kolesnikov and Wang [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] as an efficient instantiation of the MPC-in-the-head paradigm [START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF]. We can therefore apply the same optimizations (such as the merging of the cut-and-choose phase) to obtain a 5-round zero-knowledge protocol with arbitrary soundness error 2 -λ . We further detail how to make our zero-knowledge proof non-interactive and turn it into a signature scheme by applying the Fiat-Shamir transform [FS87; AABN02]. For a 128-bit security level, the scheme achieves a signature size ranging between 17 KB (compact version) and 24 KB (fast version).

As explained in the thesis introduction, there are two different strategies to build codebased signatures: applying the Fiat-Shamir transform to an identification scheme or using hash-and-sign paradigm with a code-based trapdoor function. In the former case, standard techniques result in identification schemes with high communication costs (implying large signatures) because of the non-negligible soundness error. The Schnorr-Lyubashevsky approach [Sch90; Lyu09] is a promising way to mitigate this cost, however in the case of code-based signatures, it does not seem to work as well as for lattice-based signatures. In the rank metric, Durandal [ABG+19] is a code-based scheme that follows this approach. In the hash-and-sign paradigm, existing schemes based on trapdoor functions are more sensitive to structural attacks. Such a signature scheme named Wave [START_REF] Debris-Alazard | Wave: A New Family of Trapdoor One-Way Preimage Sampleable Functions Based on Codes[END_REF] has been proposed in 2018 and is still secured against the current cryptanalysis state of the art, but it suffers a huge public key and a slow signing time. The signature described in this chapter has the advantage of being based on one of the oldest and hardest problems in code-based cryptography: syndrome decoding of random linear codes while still competing with existing schemes based on other (presumably weaker) problems in terms of public key and signature size.

We present the basic protocol (achieving 1 N soundness) in Section 4.2 and an optimized version (achieving arbitrary soundness) in Section 4.3. Then, we describe a signature scheme obtained through the Fiat-Shamir transform in Section 4.4. To conclude, we provide performance estimations for different sets of parameters in Section 4.5 and compare our construction with other zero-knowledge proofs and signature schemes from the state of the art in Section 4.6.

A Zero-Knowledge Protocol for Syndrome Decoding

Let us have an instance (H, y) of the syndrome decoding problem and let us denote x a solution of this instance (i.e. y = Hx and wt H (x) = w). In what follows, we will describe a zero-knowledge proof of knowledge for this problem. More precisely, we will present a two-party protocol where a prover wants to convince a verifier that she knows a solution of the considered SD instance.

General Idea

As in the Stern protocol [START_REF] Stern | A New Identification Scheme Based on Syndrome Decoding[END_REF], the prover first generates a random permutation σ and a random mask r ∈ Ker(H), and reveals

v := σ(x) , x := x + r (4.1)
to the verifier. The verifier can then verify that

• y = H x holds: this ensures that x = x + r for some mask r ∈ Ker(H),

• wt H (v) = w holds: this ensures that x = σ -1 (v) is of weight w for any permutation σ.

In order to complete the proof, the prover then needs to convince the verifier that there exists a pair (σ, r) which jointly satisfies:

1. Hr = 0, and

2. σ(x) = v + σ(r).
The first property is independent of the solution x which makes it provable using a cut-andchoose approach (see details in Section 4.2.4). Our key idea is a way to prove the second property while achieving an arbitrary soundness error 1/N . Our method introduces an affine transformation A(•) = σ(•) + s for a random mask s so that we have:

A(x) = σ(x) + s = σ(x) + σ(r) + s q . (4.2)
If the verifier trusts that the value q equals A(r) for some r ∈ Ker(H), then she only needs to verify the equality A(x) = v + q to be convinced. Since q is independent of x, ensuring a trustworthy q can also be achieved through cut-and-choose (see details in Section 4.2.4). This leaves us with the task of proving A(x) = v + q. Let note u := A(x). If the prover sends u, the verifier can check u = q + v. To prove

A(x) = u, we decompose A into a composition of N affine transformations A i (•) = σ i (•) + s i such that A = A N • • • • • A 1 .
The permutation σ and mask s are then defined as

σ = σ N • • • • • σ 1 and s = s N + σ N (. . . + σ 2 (s 1 )) . (4.3)
The main utility of this decomposition is that revealing all the A i except one gives no information on A, provided that A i is uniformly sampled for every i. In this setting, the prover first commits all the A i and reveals

u 1 := A 1 (u 0 ) u 2 := A 2 (u 1 )
. . .

u N := A N (u N -1 )
where u 0 := x and u N = u by definition. Then, the verifier chooses a random i * such that the prover reveals all the A i except A i * . The verifier can then check u i = A i (u i-1 ) for every i ∈ [1 : N ] \ {i * }. The only chance for the prover to cheat is to guess i * in advance. Therefore, the maximum probability that a malicious prover can convince the verifier that u = A(x) is at most 1/N . To sum up, 1. The prover samples the random mask r from Ker(H) and N affine transformations

A i (•) := σ i (•) + s i . We denote A(•) := σ(•) + s the composition A N • • • • • A 1
, with σ and s satisfying Equation (4.3).

2. The prover reveals q := σ(r) + s, v := σ(x) and x := x + r.

The verifier checks y = H x and wt

H (v) = w.
4. The prover reveals u i := A i (u i-1 ) for i ∈ {1, ..., N }, with u 0 := x;

5. The verifier checks u N = q + v.

6. The prover commits all the A i , i.e all the (σ i , s i ); 7. The verifier generates i * ← [1 : N ] and sends it to the prover as challenge;

8. The prover reveals {A i } i =i * .

The verifier checks u

i = A i (u i-1 ) for all i = i * .
If all the checks have passed, the verifier deduces u = A(x). Moreover, if q is trusted, then a proof that u = A(x) constitutes a proof of knowledge of a solution x to the syndrome decoding instance. This protocol is a zero-knowledge protocol with a soundness error of 1/N under the trust hypothesis on q. As previously mentioned, this trust hypothesis can be fulfilled by using a cut-and-choose approach that we detail in Section 4.2.4.

Description of the Protocol

We give a formal description of our new zero-knowledge proof for syndrome decoding in Protocol 2. For the sake of simplicity, this description assumes that the value q = σ(r) + s is trusted by the verifier. We denote this trust requirement with a star in superscript: q .

Prover P Verifier V x ∈ F m 2 s.t. wt H (x) = w H ∈ F (m-k)×m 2 , y := Hx H, y := Hx For i in [1 : N ]: ρ i ← {0, 1} λ (σ i , s i ) ← S m × F m 2 c i = Com((σ i , s i ); ρ i ) r ← Ker(H) σ = σ N • • • • • σ 1 s = s N + σ N (. . . + σ 2 (s 1 )) q = σ(r) + s v = σ(x) x = x + r u 0 = x For i in [1 : N ]: u i = σ i (u i-1 ) + s i c1,...,c N ------------→ q ------------→ v,x ------------→ u1,...,u N ------------→ i * ← [1 : N ] i * ←------------ (σi,si,ρi) i =i * ------------→ u 0 = x For all i = i * : Check Verif((σ i , s i ), c i , ρ i ) = 1 Check u i = σ i (u i-1 ) + s i Check u N = v + q Check wt H (v) = w Check y = H x Return Success
Protocol 2: Zero-knowledge proof for syndrome decoding -Simplified version with trusted q .

Security Proofs

The following theorems state the completeness, zero-knowledge and soundness (with trusted q) of Protocol 2. We refer the reader to [START_REF] Feneuil | Shared permutation for syndrome decoding: new zero-knowledge protocol and code-based signature[END_REF] for the proofs of Theorems 4.2.2 and 4.2.3. Theorem 4.2.1 (Completeness). Protocol 2 is perfectly complete, i.e. a prover P who knows a solution x to the syndrome decoding instance (H, y) and who follows the steps of the protocol always succeeds in convincing the verifier V.

Proof. For any sampling of the random coins of P and V, if the computation described in Protocol 2 is genuinely performed then all the checks of V pass. Theorem 4.2.2 (Zero-Knowledge). Let the commitment scheme Com used in Protocol 2 be {computationally, statistically, perfectly} hiding. For all malicious PPT verifier Ṽ, there exists a PPT simulator S which, given rewindable black-box access to Ṽ, outputs a simulated transcript which is {computationally, statistically, perfectly} indistinguishable from a real transcript between P and Ṽ.

Theorem 4.2.3 (Soundness). Suppose that there is an efficient prover P that, on input (H, y),

• builds q honestly, i.e. for any {(σ i , s i ), ρ i } i extractable from P and such that

Verif((σ i , s i ), c i , ρ i ) = 1, there exists r ∈ Ker(H) such that q = σ(r) + s with σ = σ N • • • • • σ 1 and s = s N + σ N (. . . + σ 2 (s 1 ));
• convinces the honest verifier V on input H, y to accept with probability

ε := Pr[ P, V (H, y) → 1] > ε
where the soundness error ε is equal to 1/N . Then, there exists an efficient probabilistic extraction algorithm E that, given rewindable black-box access to P, produces with either a witness x such that y = Hx and wt H (x) = w, or a commitment collision, by making in average

4 ε -ε • 1 + ε • 2 • ln(2) ε -ε calls to P.

Producing the Trusted Vector

In order to obtain a sound zero-knowledge proof, we need a procedure to build the trusted vector q. One possible technique is to use the cut-and-choose methodology. Concretely, the prover generates many different vectors q in a verifiable way, i.e., by committing the randomness used for their generation. Then, the verifier will ask the prover to reveal how she built some of the vectors q, namely to open these vectors q. This opening consists in revealing the corresponding r ∈ Ker(H) as well as the (previously committed) randomness used to generate the affine transformation A(•). The verifier can then check the consistency of the commitments, the belonging of r to Ker(H) and the correct computation of q = A(r).

Since the prover's secret (the solution x to the syndrome decoding instance) is not involved, such an opening does not break the zero-knowledge property of the protocol. However the opened vectors q become unusable for the protocol (because the used randomness is revealed). Thus, the prover must use one of the vectors q for which the building was not opened.

Let M be the number of generated and committed vectors. In the case of the simple protocol with soundness error 1/N , one only needs a single trusted vector q. The verifier then asks for the opening of M -1 of the generated pairs before running the "trusted" part of the proof. If the prover cheated for more than one vector, then the verification will always fail. If the prover cheated on one vector, then the probability that the opening of this vector is not requested by the verifier during the cut-and-choose method is 1/M .

The generation of a trusted vector q via the cut-and-choose method is described in Protocol 3.

Prover P Verifier V H ∈ F (m-k)×m 2 H For j in [1 : M ]: For i in [1 : N ]: ρ [j] i ← {0, 1} λ (σ [j] i , s [j] i ) ← S m × F m 2 c [j] i = Com((σ [j] i , s [j] i ); ρ [j] i ) r [j] ← Ker(H) σ [j] = σ [j] N • • • • • σ [j] 1 s [j] = s [j] N + σ [j] N (. . . + σ [j] 2 (s [j] 1 )) q [j] = σ [j] (r [j] ) + s [j] {c [j] i } i∈[1:N ],j∈[1:M ] ------------→ {q [j] } j∈[1:M ] ------------→ j * ← [1 : M ] j * ←------------ r [j] ,(σ [j] i ,s [j] i ,ρ [j] i ) i∈[1:N ] j =j * ------------→
For all j = j * : For all i: Check Verif((σ

[j] i , s [j] i ), c [j] i , ρ [j] i ) = 1 σ [j] = σ [j] N • . . . • σ [j] 1 s [j] = s [j] N + σ [j] N (. . .)
Check Hr [j] = 0 Check q [j] = σ [j] (r [j] ) + s [j] Return Success Protocol 3: Cut-and-choose protocol to produce a trusted vector q. This protocol can be composed with the sound phase (Protocol 2) to obtain a standalone 5-round protocol. This protocol is a zero-knowledge proof for the syndrome decoding problem with a soundness error of max 1 M , 1 N .

Indeed, the prover has two possible ways to cheat: either she cheats for one of the M vectors during the cut-and-choose phase, but if this vector is not selected the protocol is aborted (the cheating is discovered); or she can try to cheat during the sound phase. The prover can thus try to introduce a mistake in the first phase (1 M ) or in the second phase ( 1 N ), but not in both 1 .

For completeness, we depict this standalone version in Protocol 4.

Prover P Verifier V x ∈ F m 2 s.t. wt H (x) = w H ∈ F (m-k)×m 2 , y := Hx H, y := Hx For j ∈ [1 : M ] For i ∈ [1 : N ]: ρ [j] i ← {0, 1} λ (σ [j] i , s [j] i ) ← S m × F m 2 c [j] i = Com((σ [j] i , s [j] i ); ρ [j] i ) r [j] ← Ker(H) σ [j] = σ [j] N • ... • σ [j] 1 s [j] = s [j] N + σ [j] N (... + σ [j] 2 (s [j] 1 )) q [j] = σ [j] (r [j] ) + s [j] {c [j] i } i∈[1:N ],j∈[1:M ] ------------→ {q [j] } j∈[1:M ] ------------→ j * ← [1 : M ] j * ←------------ r [j] ,(σ [j] i ,s [j] i ,ρ [j] i ) i∈[1:N ] j =j * ------------→ For all j = j * : σ [j] = σ [j] N • . . . • σ [j] 1 s [j] = s [j] N + σ [j] N (. . .) Check Hr [j] = 0 Check q [j] = σ [j] (r [j] ) + s [j] v = σ [j * ] (x) x = x + r [j * ] u 0 = x For i ∈ [1 : N ]: u i = σ i (u i-1 ) + s i v,x ------------→ u1,...,u N ------------→ i * ← [1 : N ] i * ←------------ (σ [j * ] i ,s [j * ] i ,ρ [j * ] i ) i =i * ------------→ u 0 = x For all i = i * :
Check Verif (σ

[j * ] i , s [j * ] i ), c [j * ] i , ρ [j * ] i = 1 Check u i = σ [j * ] i (u i-1 ) + s [j * ] i Check u N = v + q [j * ] Check wt H (v) = w Check H x = y Return Success
Protocol 4: Standalone zero-knowledge proof for syndrome decoding Remark 4.2.4. Since the cut-and-choose does not require the prover secret, it can be executed before the prover gets its secret key. This step is hence a preprocessing phase of the sound protocol.

Remark 4.2.5. This idea of protocols requiring some trusted values has been formalized by [START_REF] Beullens | Sigma Protocols for MQ, PKP and SIS, and Fishy Signature Schemes[END_REF] as protocols with helper.

The Five-Round Zero-Knowledge Protocol

In the previous section, we described a new zero-knowledge protocol for the syndrome decoding problem with a soundness error of max{1/N, 1/M } and complexity O N • M • poly(λ) for arbitrary chosen parameters N and M and with λ being the security level of the syndrome decoding instance. In order to obtain a soundness error close to 2 -λ for a target security parameter λ, one can run λ/(log 2 min{N, M }) independent repetitions of the protocol. However using such a simple approach is not optimal in terms of communication.

In this section, we present various optimizations to make our protocol efficient while targeting a standard security level. As a result, we describe a 5-round HVZK protocol that achieves 2 -λ soundness with optimized communication cost. For instance, for λ = 128, the size of the produced proof can be made lower than 15 KB.

Presentation of the Optimizations

We present here various optimizations to make our proof more compact. Our first improvement consists in merging the τ cut-and-choose phases (this was suggested in [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] in a similar context). Then, we show how the pseudorandom generation of the precomputed values from compact seeds can save a lot of communication. This can be further improved by using pseudorandom generation trees for the seeds (as also suggested in [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF]). Finally, we show that some values can be recomputed by the verifier and can hence be trade for commitments in the prover messages. We further describe how to efficiently instantiate the commitment scheme using a collision-resistant hash function.

Merging of the cut-and-choose phase. As suggested in [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF], instead of repeating the cut-and-choose to obtain a trusted vector τ times, we can perform the cut-and-chose to generate τ trusted vectors all at once. Specifically, the prover P generates M vectors (for a large enough M ) and the verifier requests the opening of M -τ of these vectors. After checking that the opened vectors have honestly been generated, the verifier trusts the remaining τ vectors which are then used for the τ independent executions of the sound phase.

Let us assume that a malicious prover correctly builds k vectors and cheats for M -k vectors. Without loss of generality, k satisfies k ≥ M -τ , otherwise the cheating prover will have to open a dishonest vector and the proof will fail. Then, the probability of this malicious prover to successfully passing the merged cut-and-choose phase is at most

k M -τ • M M -τ -1 . Let γ = M -k ≤ τ
= 1 N τ -γ = 1 N k-M +τ .
The soundness error is therefore

ε(M, N, τ ) := max M -τ ≤k≤M k M -τ M M -τ • N k-M +τ .
Some examples of values for M , N and τ to reach a target security λ ∈ {128, 256} are given in the Table 4.1. Note: These parameters have been obtained while minimizing τ for a given N . Then given N and the underlying minimal τ , M is taken to be as small as possible. Other strategies provide different trade-offs.

Working with seeds and PRG. In the basic protocol, the variables σ i and s i are uniformly sampled at random for every i. This imposes the prover to reveal N -1 pairs (σ i , s i ) in its final response which is expensive since s i belongs to F m 2 and σ i is a permutation of [1 : m]. Instead, we can sample a random seed sseed i and use a pseudo-random generator (PRG) to generate the pair (σ i , s i ) from sseed i . This way, whenever the prover wants to reveal (σ i , s i ), she simply reveals seed i . For a target security of λ bits, the seed only needs to make λ bits: we hence trade a message of log 2 (m!) + m bits for one of λ bits. And to avoid revealing the commitment randomness ρ i , the prover can derive it from another seed seed i . But since the prover wants to reveal both ρ i and sseed i (to get the couple (σ i , s i )) when she opens the commitment, she can sample ρ i and sseed i from the same seed seed i .

On the other hand, when a vector q is chosen by the verifier to be opened in the cut-andchoose phase, the prover must reveal (σ i , s i ) for every i ∈ [1 : N ] as well as r. In order to save further communication, all the {seed i } i , as well as the random mask r, can be generated from a master seed: r, (seed i ) i∈[1:N ] ← PRG(mseed). This way, when the vector q must be open, the prover sends mseed instead of r, (seed i ) i∈[1:N ] and replace k + λ • N bits of communication by λ bits.

Let j ∈ {1, ..., M } denote the index of a precomputed set of variables during the cut-andchoose phase. In what follows, the master seed will be denoted mseed [j] , the N intermediary seeds will be denoted seed

[j]

i and the N subseeds will be denoted sseed For j ∈ [1 : M ]:

r [j] , (seed [j] i ) i ← PRG(mseed [j] ) For i ∈ [1 : N ]: ρ j i , sseed j i ← PRG(seed [j] i ) (σ [j] i , s [j] i ) ← PRG(sseed [j] i )

Using GGM trees. The previous optimization enables to reduce the communication by replacing large variables (vectors of F m

2 and [m] → [m] permutations) by compact seeds. As suggested in [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF], we can go one step further by reducing the number of seeds that must be revealed by the prover using the GGM construction as puncturable PRF.

In the above description, we generate N intermediary seeds seed

[j]
i from a master seed mseed [j] . If all the intermediary seeds must be opened, then the prover only reveals the master seed, but if the index j is chosen for the second phase then only N -1 of them must be revealed, which implies (N -1) • λ bits of communication. In order to avoid this factor (N -1) we can use a GGM tree (see description in Section 2.2.2). The principle is to label the root of a binary tree of depth log 2 N with mseed [j] . Then, one inductively labels the children of each node with the output of a PRG applied to the node's label. The subseeds (seed

[j] i ) i∈[1:N ]
are defined as the labels of the N leaves of the tree. To reveal (seed

[j] i ) i =i * , it
suffices to reveal the labels on the siblings of the path from the root of the tree to leaf i * . Those labels allow the verifier to reconstruct (seed

[j] i ) i =i * while still hiding seed [j]
i * . Applying this optimization reduces the communication complexity to λ • log 2 N for revealing the seeds (seed

[j] i ) i =i * .
The same strategy can further be applied to the master seeds (mseed [j] ) j∈[1:M ] in the cut-and-choose phase. By using a generation tree to generate the master seeds from a grandmaster seed, the communication cost of revealing

M -τ master seeds out of M is decreased to λ • τ log 2 M τ bits (instead of λ • (M -τ ) bits).
For the sake of simplicity we shall omit this optimization from the description of our protocol. However, we stress that it can be applied as is without impact on our security statements.

Keeping the bare minimum. In the basic protocol, the prover sends all the vectors {q [j] }. However those are large m-bit vectors which can actually be recomputed by the verifier. Indeed,

• if j is among the opened indexes in the cut-and-choose phase, the verifier has access to the master seed mseed [j] . Thus, she can re-sample the values r [j] , (σ

[j] i , s [j]
i ) i from which q [j] can be recomputed;

• if j is not among the opened indexes, then the verifier has the following relation: u

[j] N = v [j] + q [j]
, so that q [j] can be re-computed as q

[j] = u [j] N -v [j] .
The verifier still needs to check that the prover knew the values of q [j] at the beginning of the interaction. That is, sending q [j] is replaced by sending commitments of q [j] . Another similar optimization can be applied in the second phase of the protocol. In the basic version, the prover sends all the u i to the verifier but since the latter eventually knows (σ i , s i ) i =i * , she can recompute all the u i 's, except u i * , thanks to the relation:

u i = σ(u i-1 )+s i .
Therefore, the prover only needs to send u i * to the verifier. Once again, such a modification implies that the u i must be committed by the prover before receiving i * .

Hash-based commitments. Since we strive at simplicity and efficiency, whenever possible we use a simple hash-based commitment scheme defined by Com : x → Hash(x) and Verif : (x, c) → (c = Hash(x)). Such a scheme is known to be computationally binding under the collision-resistance of Hash, but not computationally hiding.

To keep the zero-knowledge property for the protocol, the commitments c

[j]

i on the pairs (σ

[j] i , s [j]
i ) must be hiding. For those, we must hence keep a hiding commitment scheme. 2However for the other commitments, the inputs are not secret: the vector q [j] is committed with the corresponding (c

[j] i ) i in a common hash-based commitment h j := Hash(q [j] , c [j] 1 , . . . , c [j] N ).
All these h j commitments are further regrouped into a single hash value h := Hash(h 1 , . . . , h M ) which forms the initial commitment of the prover. During the second phase, after receiving the set J ⊆ [M ] of the τ trusted indexes as challenge from the verifier, the prover commits all the values (u

[j] i ) i∈[1:N ],j∈J into a single commitment h := Hash((u [j] i ) i∈[1:N ],j∈J ).

Description of the Protocol

After applying the various optimizations described above, we obtain a 5-round HVZK protocol with much more compact computation which is depicted in Protocol 5. The protocol makes use of one commitment scheme Com and four hash functions Hash 1 , Hash 2 , Hash 3 and Hash 4 , whose output ranges are assumed to be consistent with the protocol description.

Security Proofs

We prove hereafter that Protocol 5 achieves completeness, honest-verifier zero-knowledge, and 2 -λ -soundness (for appropriately chosen parameter M , N and τ ). We refer the reader to [START_REF] Feneuil | Shared permutation for syndrome decoding: new zero-knowledge protocol and code-based signature[END_REF] for the proofs of Theorems 4.3.2 and 4.3.3.

Theorem 4.3.1 (Completeness). Protocol 5 is perfectly complete.

Proof. For any sampling of the random coins of P and V, if the computation described in Protocol 5 is genuinely performed then all the checks of V pass.

Theorem 4.3.2 (Honest-Verifier Zero-Knowledge). Let the PRG used in Protocol 5 be (t, ε PRG )-secure and the commitment scheme Com be (t, ε Com )-hiding. There exists an efficient simulator S which, given random challenges J and L outputs a transcript which is (t, ε PRG + ε Com )-indistinguishable from a real transcript of Protocol 5.

Theorem 4.3.3 (Soundness of Protocol 5). Let

ε := max M -τ ≤k≤M k M -τ M M -τ • N k-M +τ . (4.4)
Suppose there is an efficient prover P such that

ε := Pr[ P, V (H, y) → 1] > ε , (4.5)
where (H, y) is a random syndrome decoding instance. Then, there exists an extraction algorithm E which, given rewindable black-box access to P, produces with either a witness x such that y = Hx and wt H (x) = w, or a commitment collision, by making in average

4 ε -ε • 1 + ε • 8M ε -ε calls to P. Prover P Verifier V x ∈ F m 2 s.t. wt H (x) = w H ∈ F (m-k)×m 2 , y := Hx H, y := Hx mseed [0] ← {0, 1} λ (mseed [j] ) j∈[1:M ] ← PRG(mseed [0] ) For j ∈ [1 : M ]: # r [j] is sampled from Ker(H)
r [j] , (seed

[j] i ) i ← PRG(mseed [j] ) For i ∈ [1 : N ]: sseed [j] i , ρ [j] i ← PRG(seed [j] i ) c [j] i = Com(sseed [j] i ; ρ [j] i ) (σ [j] i , s [j] i ) ← PRG(sseed [j] i ) σ [j] = σ [j] N • ... • σ [j] 1 s [j] = s [j] N + σ [j] N (... + σ [j] 2 (s [j] 1 )) q [j] = σ [j] (r [j] ) + s [j] h j = Hash 1 (q [j] , c [j] 1 , . . . , c [j] N ) h = Hash 2 (h 1 , . . . , h M ) h ------------→ J ← {J ⊂ [M ] ; |J| = τ } J ←------------ For j ∈ J: v [j] = σ [j] (x) x[j] = x + r [j] u [j] 0 = x[j] For i ∈ [1 : N ]: u [j] i = σ [j] i (u [j] i-1 ) + s [j] i h j = Hash 3 (u [j] 1 , . . . , u [j] N ) h = Hash 4 ((h j ) j∈J ) (mseed [j] ) j∈[1:M ]\J h , (v [j] , x[j] ) j∈J ------------→ L = { j } j∈J ← [1 : N ] τ L ←------------ I j = [1 : N ]\{ j } (seed [j] i ) i∈I j , u [j] j , c [j] j j∈J ------------→ For j ∈ [1 : M ]\J: h j ← mseed [j] For j ∈ J: u [j] 0 = x[j] For i ∈ I j : sseed [j] i , ρ [j] i ← PRG(seed [j] i ) c [j] i = Com(sseed [j] i ; ρ [j] i ) (σ [j] i , s [j] i ) ← sseed [j] i u [j] i = σ [j] i (u [j] i-1 ) + s [j] i q [j] = u [j] N -v [j] h j = Hash 1 (q [j] , c [j] 1 , . . . , c [j] N ) h j = Hash 3 (u [j] 1 , . . . , u [j] N ) Check y = H x[j] Check wt H (v [j] ) = w Check h = Hash 2 (h 1 , . . . , h M ) Check h = Hash 4 ((h j ) j∈J ) Return Success
Protocol 5: Five-round HVZK proof for the syndrome decoding problem.

The Signature Scheme

In this section, we show how to turn our 5-round HVZK protocol into a signature scheme using the Fiat-Shamir transform [FS87; AABN02]. After explaining the transformation, we give the description of the signature scheme and then provide a security proof in the random oracle model (ROM).

Transformation into a Non-Interactive Scheme

With a straight application of Fiat-Shamir to Protocol 5, we would compute the challenges J and L as:

J := Hash 1 (m, h)
and

L := Hash 2 m, h, (mseed [j] ) j∈[M ]\J , (v [j] ) j∈J , (x [j] ) j∈J , h ,
where m is the input message and where Hash 1 and Hash 2 are some hash functions. But doing so would imply an overhead on the size of the challenges J and L for the security to hold. Indeed, in [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF], Kales and Zaverucha describe a forgery attack against signature schemes obtained by applying the Fiat-Shamir transform to 5-round protocols. Adapting this attack to our context yields a forgery cost of

cost forge := min M -τ ≤k≤M M M -τ k M -τ + N k-M +τ
which is substantially lower than the target forgery cost ε -1 , for ε being the soundness error of Protocol 5 (see Theorem 4.3.3).

A numerical analysis of the parameters shows that we get a more efficient signature scheme by turning Protocol 5 into a 3-round protocol before applying the Fiat-Shamir transform. Instead of waiting the challenge J from the verifier, the prover can directly commit v [j] , x[j] and {u

[j]

i } for all j ∈ {1, . . . M }. Thus the verifier can send both challenges J and L at the same time. For this purpose, the prover will compute

h j = Hash(v [j] , x[j] , u [j] 1 , . . . , u [j] N )
for all j ∈ {1, . . . , M } and she will send h = Hash(h 1 , . . . , h M ) to the verifier. After receiving challenge (J, L), the prover sends h j for j ∈ J to enable the verifier to rebuild h . In order to decrease the cost of sending all these h j , she can use a Merkle tree: after committing h = Merkle(h 1 , . . . , h M ), proving the consistence of (h j ) j∈J with the hash root h can be done by revealing at most τ • log 2 M τ labels of the Merkle tree (instead of M -τ labels). The resulting 3-round protocol is also an honest-verifier zero-knowledge protocol with the same soundness. It can indeed be checked that the described modification has essentially no impact on the proofs of Theorem 4.3.2 (honest verifier zero-knowledge) and Theorem 4.3.3 (soundness). While the communication cost is slightly greater for this 3-round version than for the original 5-round protocol, the transformation into a non-interactive scheme does not suffer the aforementioned attack, which allows much better parameters. Now the application of Fiat-Shamir applies to compute the challenges J and L as

(J, L) := Hash (m, h, h ) ,
where Hash is a hash function. Moreover since we have h = Hash 2 (h 1 , . . . , h M ) and the h j 's are known by the verifier, we can directly compute the challenges J and L as:

(J, L) := Hash (m, h 1 , . . . , h M , h ) .
On the other hand, since we work in the random oracle model for the signature, we can replace the commitment scheme Com of the Protocol 5 by a single hash function Hash 0 . We can then avoid sampling a commitment randomness and hence we can merge the seeds seed

[j] i and sseed [j] i .
Finally, to avoid that seed collisions produce the commitment collisions in distinct signatures, we add more entropy by using a salt as suggested in [START_REF] Chailloux | On the (In)security of optimized Stern-like signature schemes[END_REF].

Description of the Signature Scheme

In our signature scheme, the key generation algorithm randomly samples a syndrome decoding instance (H, y) of the syndrome decoding problem with solution x, with security parameter λ. In order to make the key pair compact, the matrix H is pseudorandomly generated from a λ-bit seed. Specifically, a call to the KeyGen algorithm outputs a pair (pk, sk) := (seed H , y), mseed generated as follows:

1. mseed ← {0, 1} λ 2. (seed H , x) ← PRG(mseed) where x is sampled in {x ∈ F m 2 | wt H (x) = w} 3. H ← PRG(seed H ) 4. y = Hx; pk = (seed H , y); sk = mseed
For the sake of simplicity, we omit the re-generation of H and x from the seeds in the exposition below and assume pk = (H, y) and sk = (H, y, x).

The signature algorithm Given a secret key sk = (H, y, x) and a message m ∈ {0, 1} * , the algorithm Sign proceeds as follows:

Step 0:

1. Sample a random salt salt ← {0, 1} 2λ . 2. Choose uniform mseed [0] ∈ {0, 1} λ .
3. Compute the seeds mseed [1] , . . . , mseed [M ] with TreePRG(salt, mseed [0] ).

Step 1: For each j ∈ [M ]:

1. Use mseed [j] to generate values seed

[j] 1 , . . . , seed [j]
N and r [j] ∈ Ker(H) with TreePRG(salt, mseed [j] ).

For

i ∈ [1 : N ], sample σ [j] i , s [j] i using seed [j] i and compute c [j] i := Hash 0 (salt, j, i, seed [j] i ). 3. (Cut-and-choose phase) Compute σ [j] := σ [j] N • • • • • σ [j] 1 s [j] := s [j] N + σ [j] N (• • • + σ [j] 2 (s [j] 1 )) q [j] := σ [j] (r [j] ) + s [j] 4. (Sound phase) Compute v [j] := σ [j] (x) x[j] := x + r [j] u [j] 0 := x[j] u [j] i := σ [j] i (u [j] i-1 ) + s [j] i for all i ∈ [1 : N ] 5. Compute h j := Hash 1 (q [j] , c [j] 1 , . . . , c [j] N ) and h j := Hash 2 (v [j] , x[j] , (u [j] i ) i ).
Step

2: Compute (J, L) := Hash (m, salt, h 1 , . . . , h M , h ) with h := Merkle(h 1 , . . . , h M ), where J ⊂ [1 : M ] is a set of size τ and L is a list { j } j∈J with j ∈ [1 : N ].
The signature includes (J, L) and salt.

Step 3: For each j ∈ J, the signer includes v

[j] , x[j] , c [j] j , u [j]
j and nodes [j] := nodes(mseed [j] , [1 : N ]\{l j }), where nodes(•) returns the minimal nodes which enable to rebuild the tree leaves at input indices in the generation tree with input master seed (see Section 2.2.2). Also, the signer includes nodes M := nodes(mseed [0] , [M ]\J) and auth Merkle := auth((h 1 , . . . , h M ), J), where auth(•) returns the Merkle nodes needed to open the paths for the leaves at indices i ∈ J in the corresponding Merkle tree (see Section 2.2.3).

The verification algorithm Given a public key pk = (H, y), a signature s and a message m ∈ {0, 1} * , the algorithm Verif proceeds as follows:

Step 0: Parse the signature s as (salt, J, L, nodes M , auth Merkle , {v [j] , x[j] , nodes [j] , c

[j] j , u [j] j } j∈J ) .
Step 1: Use nodes M to rebuild mseed [j] for each j ∈ J. Then for every j ∈ J, use mseed [j] to compute h j as in the signature algorithm.

Step 2: For every j ∈ J:

1. Use nodes [j] to rebuild seed

[j] i for each i = j . 2. For i = j , set c [j] i := Hash 0 (salt, j, i, seed [j] i ) and get σ [j] i , s [j] i using seed [j] i . 3. Compute u [j] i = σ [j] i (u [j] i-1 ) + s [j] i for all i = j q [j] = u [j] N -v [j] 4. Compute h j := Hash 1 (q [j] , c [j] 1 , . . . , c [j] N ). Chapter 4 4.5. Performance 51 5. Compute h j := Hash 2 (v [j] , x[j] , (u [j] i ) i ). 6. Check H x[j] = y. 7. Check wt H (v [j] ) = w.
Step 3: Rebuild h as MerkleTree(h 1 , . . . , h M ) using {h j } j∈J and auth Merkle . Then check that (J, L) equals Hash (m, salt, h 1 , . . . , h M , h ).

Security Proof

We now state the security of our signature scheme in the following theorem. We refer the reader to [START_REF] Feneuil | Shared permutation for syndrome decoding: new zero-knowledge protocol and code-based signature[END_REF] for the proof.

Theorem 4.4.1. Suppose the PRG used is (t, PRG )-secure and any adversary running in time t has at most an advantage ε SD against the underlying syndrome decoding problem. Model Hash 0 , Hash 1 , Hash 2 and Hash as random oracles where Hash 0 , Hash 1 , Hash 2 have 2λ-bit output length. Then any adaptive chosen-message adversary, running in time t, making q s signing queries, and making q 0 , q 1 , q 2 , q queries, respectively, to the random oracles, succeeds in producing a valid forgery with probability upper bounded as

p f orge ≤ O(q s • τ • ε PRG ) + O (q 0 + q 1 + q 2 + M nq s ) 2 2 λ + SD + q • (M, N, τ ),
where

ε(M, N, τ ) := max M -τ ≤k≤M k M -τ M M -τ • N k-M +τ .

Performance

Communication Cost and Signature Size

In the following analysis, we exclude the challenges from the communication cost since they are of very moderate impact and they do not appear in the signature. The communication then consists into

• Com := h, • Res 1 := (mseed [j] ) j ∈J , h , (v [j] , x[j]
j∈J ) and

• Res 2 := (seed [j] i ) i = j , u [j] j , c [j] j j∈J .
Whereas u So, the total communication cost (in bits) of the protocol is

[j] j are full vectors of F m 2 , v [j]
Cost = Cost Com + Cost Res 1 + Cost Res 2 = 4λ + λ • τ • log 2 M τ + τ • 2λ + (m + k) + log 2 m w + λ • log 2 (N ) .
The signature is composed of the same elements, except on two points:

• We need to add the sibling paths of {h j } j∈J in the Merkle tree to be able to rebuild h . The communication cost for those paths is at most (2λ)

• τ • log 2 M τ bits (for τ • log 2 M τ
intermediate tree labels).

• Since both challenges are merged, there is a single hash value to represent them. And using it and the other components in the signature, it is possible to deduce h and h .

Thus the signature size (in bits) is

Size = 2λ + (3λ) • τ • log 2 M τ + τ • 2λ + (m + k) + log 2 m w + λ • log 2 (N ) .

Choice of the SD Parameters

In order to simplify the analysis, we place ourselves in a parameter range where the Hamming weight of the secret solution x is close but slightly below the Gilbert-Varshamov bound. This ensures the unicity of the solution with high probability while increasing the difficulty of finding solutions. Furthermore, this choice prevents the applicability of GBA methods.

As a consequence, we only need to estimate the complexity of ISD algorithms. Previous studies of such parameters such as [TS16; BBC+19a] have argued that the algorithm of May, Meurer and Thomae [START_REF] May | Decoding Random Linear Codes in Õ(2 0.054n )[END_REF] is the most practical choice in the cryptographic range, as it outperforms algorithms with better asymptotics, e.g. the algorithm from [START_REF] Becker | Decoding Random Binary Linear Codes in 2 n/20 : How 1 + 1 = 0 Improves Information Set Decoding[END_REF]. Since the algorithm is quite sophisticated and involves several levels of recursion, we simplify the analysis by only considering the cost of the ISD loop, the size of lists at the top-level of their matching technique and the cost of merging these lists. More precisely, with m, k and w being given as input we choose two parameters and p and compute the following lower bound on the complexity of the attack:

m w k+ p m-k- w-p • L + L 2 2 -p with L := k+ p/2 2 p .
Optimizing for and p yields a slightly conservative estimate for the security level, which we used while choosing our parameters. Given these considerations, we suggest the following concrete parameters to achieve λ ∈ {128, 192, 256} bits of security:

-

Impact of the Other Parameters

We have fixed the SD parameters, we now need to choose the remaining parameters: N , M and τ . For a given N , the best proof size is achieved by minimizing τ , and then we take the minimal possible value for M . This is illustrated by Figure 4.2. Figure 4.2 gives the proof size and the required parameter M w.r.t. the parameter N for 128-bit and 256-bit security. We observe that the value of M explodes when we try to achieve very compact signature by increasing N . Since M has a direct impact on the computation time, this parameter provides a trade-off between proof size and computation.

For 128-bit security For 256-bit security We implemented the signature scheme in C. To sample the permutations, we choose the Fisher-Yates approach where we sample numbers by groups in order to minimize the pseudo-randomness consumption and the rejection rate. In our implementation, the pseudorandomness is generated using AES in counter mode and the hash function is instantiated with SHAKE. We benchmarked our scheme on a 3.8 GHz Intel Core i7 CPU which supports AVX2 and AES instructions. All the reported timings were measured on this CPU while disabling Intel Turbo Boost.

We instantiate two trade-offs per security level: the first one lowering communication cost to produce short signatures, and the second one lowering computational cost to get a fast signature computation. We obtain the parameters and sizes described in Table 5.3. We provide the measured running times of our signature implementation in Table 5.4.

The overhead in the computation of our implementation is the uniform sampling (and its application) of the M • N permutations. We tried to implement them as efficiently as possible without introducing a bias using AVX instructions set, but it remains quite expensive. A way to improving the running times of the scheme would be to have a very efficient algorithm for random permutations (for example, by restricting the set in which the permutations are sampled). Note: Timings are the averaged over 10 000 measurements. The CPU clock cycles have been measured using SUPERCOP (https://bench.cr.yp.to/supercop.html).

Comparison

In this section, we compare our scheme to different code-based and post-quantum signature schemes.

Comparison with Other Code-Based Signature Schemes

In the state of art, there exists two types of signatures. On one hand, there are schemes based on the Fiat-Shamir transform of identification schemes. However, classical approaches to produce identification schemes from code-based problems, like the famous Stern protocol, give large signatures because of the large soundness error of the underlying identification scheme (2/3 or 1/2). To avoid this issue, a solution consists in relying on different code-based problems. For instance, LESS is a recent scheme for which the security relies on the hardness of the Linear Code Equivalence problem [BMPS20; BBPS21]. Another direction is to find a way to adapt the Schnorr-Lyubashevsky approach to code-based cryptography. Durandal is a recent scheme following this approach [START_REF] Aragon | Durandal: A Rank Metric Based Signature Scheme[END_REF]. More recently, the authors of [START_REF] Shay Gueron | Designing a Practical Code-Based Signature Scheme from Zero-Knowledge Proofs with Trusted Setup[END_REF] propose a zero-knowledge protocol with better soundness using a protocol with helper [START_REF] Beullens | Sigma Protocols for MQ, PKP and SIS, and Fishy Signature Schemes[END_REF] and relying on the syndrome decoding problem on larger fields. On the other hand, the hash-and-sign paradigm using trapdoors is also a popular way to derive signature schemes.

Wave is such a recent code-based signature scheme in this paradigm [START_REF] Debris-Alazard | Wave: A New Family of Trapdoor One-Way Preimage Sampleable Functions Based on Codes[END_REF]. However, such schemes are often more vulnerable to structural attacks. Our proposal is a signature scheme built from a zero-knowledge identification protocol with arbitrary soundness error. In Table 4.4, we compare the performance of our scheme with the current code-based signature state of the art, for the 128-bit security level.

Our scheme is comparable to Durandal, LESS and [START_REF] Shay Gueron | Designing a Practical Code-Based Signature Scheme from Zero-Knowledge Proofs with Trusted Setup[END_REF] for the |sgn| + |pk| metric, and much lighter than Wave which features heavy public keys. Regardless of the key size, Wave currently achieves the shortest signatures (but has a slow signing time). In terms of security, our scheme has the advantage of relying on the hardness of one of the oldest problem of the code-based cryptography: the syndrome decoding of random linear codes in Hamming weight metric. Previous schemes based on this problem are obtained from the Stern identification protocol (and its variants). As we observe from Table 4.4 signatures obtained with our scheme are three times shorter. [GPS22] also relies on the syndrome decoding problem. The technique they use gives a protocol for which the soundness error depends on the size of the base field of the syndrome decoding instance. For this reason, the underlying field must be large enough in order to achieve practical signature sizes. In contrast, the soundness error of our construction is independent of the base field and we can achieve practical signature sizes with the binary field. Let us remark that it would be possible to generalize our protocol to larger fields as well (we simply need to use isometries as in [START_REF] Shay Gueron | Designing a Practical Code-Based Signature Scheme from Zero-Knowledge Proofs with Trusted Setup[END_REF] instead of permutations), but this would tend to increase the size of the obtained signatures.

Comparison with other Post-Quantum Signature Schemes

Finally, we compare in Table 5.6 our construction with some signature schemes aiming at post-quantum security and which are based from symmetric cryptography primitives (either based on hash tree or on the MPC-in-the-Head paradigm). Note: The sizes are in bytes and the timings are in milliseconds. The benchmarks for the other schemes have been obtained on an Intel Xeon W-2133 CPU at 3.60GHz. the values for SPHINCS + and Banquet are extracted from the Banquet article [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF] and the values for Picnic3 are extracted from its original article [START_REF] Kales | Improving the Performance of the Picnic Signature Scheme[END_REF].

All these schemes have short public and private keys (all under 100 bytes for 128-bit security), which is why we omit the key sizes in the comparison table. Compared to our scheme, Picnic3 [START_REF] Kales | Improving the Performance of the Picnic Signature Scheme[END_REF] -which also relies on the KKW scheme [KKW18]-has better performance. On the other hand, our scheme is arguably more conservative in terms of security since Picnic is based on the hardness of inverting LowMC [ARS+15], a cipher with unconventional design choices, while our scheme is based on the hardness of the syndrome decoding problem on linear codes, which has a long cryptanalysis history and is believed to be very robust. BBQ [START_REF] Delpech De Saint | BBQ: Using AES in Picnic Signatures[END_REF] and Banquet [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF] are two other schemes based on the MPC-in-the-Head paradigm and for which the security is based on the hardness of inverting AES (instead of LowMC) which is a more conservative choice. Our signature has better performance than BBQ and is comparable to Banquet. In contrast, it is not competitive with SPHINCS + [BHK+19] which can achieve shorter signature sizes and very efficient verification. Let us stress that our implementation is a proof of concept which has not been deeply optimized and that some speed-up could probably be obtained by a thorough implementation study (in particular for the sampling and application of permutations). This issue is let open to further research.

Conclusion

In this chapter, we proposed a new zero-knowledge proof of knowledge for the syndrome decoding problem. In the latter, the prover decomposes the considered permutation σ into N sub-permutations σ 1 , . . . , σ N such that σ = σ N •. . .•σ 1 and reveals all these sub-permutations except a random one to the verifier.

The construction has been improved in [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF]: the authors show that we can save a few kilobytes by re-arranging the computation. They also show that we can remove the helper when our goal is to build a proof of knowledge for a problem that has some algebraic structure (linearity, cyclicity, ...). For example, they applied their protocol to the case of the permuted kernel problem and achieved competitive performance: their optimized construction currently leads to the shortest signature relying on this problem (with sizes close to 9 KB).

In a more recent work, [START_REF] Baldi | Zero Knowledge Protocols and Signatures from the Restricted Syndrome Decoding Problem[END_REF] shows how to design a new problem which leads to short communication costs with the existing proofs of knowledge. They propose the Restricted Syndrome Decoding Problem and achieve signature sizes of about 7-8 kilobytes for 128-bit security using optimized constructions of [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF].

The technique of the "shared permutation" developed in this chapter leads to very efficient signature schemes as soon as the statement we want to prove in the underlying zero-knowledge protocol has a great affinity with isometries (like the permuted kernel problem or the restricted syndrome decoding problem). When this is not the case (as for the syndrome decoding problem in the Hamming metric or the rank metric), there will be more efficient schemes (see the next chapter for the case of the syndrome decoding problem in the Hamming metric).

Chapter 5.

Syndrome Decoding in the Head

At the end of 2021, the scheme proposed in the previous chapter led to the shortest code-based signatures based on the Fiat-Shamir transformation. However, it was still not competitive with some other post-quantum schemes (as SPHINCS + ). In this chapter, we propose a second zero-knowledge proof for the syndrome decoding problem. Instead of using permutations like most of the existing protocols, we rely on the MPC-in-the-head paradigm in which we reduce the task of proving the low Hamming weight of the SD solution to proving some relations between specific polynomials. Specifically, we propose a 5-round zero-knowledge protocol that proves the knowledge of a vector x such that y = Hx and wt H (x) ≤ w and which achieves a soundness error close to 1/N for an arbitrary N . While turning this protocol into a non-interactive scheme, we get a signature scheme that outperforms all the former code-based signature schemes for the common "signature size + public key size" metric and which is competitive with SPHINCS + , one of the future NIST post-quantum standards.

The results presented in this chapter have been published in collaboration with Antoine Joux and Matthieu Rivain in the proceedings of the international conference Crypto 2022 [START_REF] Feneuil | Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs[END_REF].

Introduction

The zero-knowledge proof proposed in the previous chapter has been inspired by the MPC-inthe-Head paradigm. But, even if it uses a sharing of the secret, it does not fit the MPCitH formalism presented in Chapter 3, in which we have an MPC protocol that checks that the shared secret is a pre-image of the corresponding one-way function (here, the syndrome decoding problem). In the previous chapter, the MPC protocol would only consist in applying the shared permutation in series.

In what follows, we build a new zero-knowledge protocol to prove the knowledge of a syndrome decoding solution using the MPCitH paradigm. We further turn this protocol into an efficient code-based signature scheme. In this chapter, we do not restrict ourselves to the binary field: F represents any finite field.

While proving that y = Hx is communication-free in the MPC-in-the-Head paradigm, the hard part consists in proving that x is a small-weight vector. We propose here an efficient way to prove that wt H (x) ≤ w through a multi-party computation which is simulated by the prover ("in her head"). The key idea is to prove the equality x • v = 0 where • is the component-wise multiplication and where the coefficients of the vector v are the evaluations of a polynomial Q of degree w. By definition, v has at most w zero coordinates, so the relation x • v = 0 proves that x has at most w non-zero coordinates (i.e. wt H (x) ≤ w). The roots of the polynomial Q encode the non-zero positions of the vector x. In order to prove the relation x • v = 0, we use techniques borrowed from the Banquet signature scheme [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF] with further adaptations. To check that all x j • v j are equal to zero, we arrange the input x into a polynomial S, provide a product polynomial F • P as part of the witness, and check that (F • P )(•) indeed equals the product of S(•) and Q(•). This can be done efficiently by only verifying a few products of these polynomials evaluated at some random points. However, instead of revealing the multiplication operands like in [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF], we rely on the product checking protocol proposed in [LN17; BN20] and its batch version recently introduced in [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF].

Let us note that the idea of encoding the non-zero positions in a polynomial to prove a Hamming weight inequality was already used in [START_REF] Damgård | Compact Zero-Knowledge Proofs of Small Hamming Weight[END_REF]. However, their zero-knowledge protocol relies on a linearly homomorphic commitment scheme, and such schemes do not have yet practical proposals in the post-quantum setting.

Thanks to the Fiat-Shamir transform [FS87], we convert our protocol into a signature scheme. Our scheme outperforms all the existing code-based signatures for the "signature size + public key size" metric. When relying on the hardness of the syndrome decoding problem over F 256 , our scheme is below 10 KB for this metric, which makes it competitive with Picnic3 [START_REF] Kales | Improving the Performance of the Picnic Signature Scheme[END_REF] and SPHINCS + [START_REF] Daniel | The SPHINCS + Signature Framework[END_REF]. Compared to other code-based signature schemes (such as Wave [START_REF] Debris-Alazard | Wave: A New Family of Trapdoor One-Way Preimage Sampleable Functions Based on Codes[END_REF] and Durandal [ABG+19]), our scheme has the significant advantage of relying on a non-structured decoding problem which has been widely studied over the last decades. Let H, x and y be such that:

The d-split Syndrome Decoding Problem

1. H is uniformly sampled from F (m-k)×m , 2.
x is uniformly sampled from

(x 1 | . . . | x d ) ∈ F m : ∀i ∈ [1 : d], x i ∈ F m/d , wt H (x i ) = w d ,
3. y is defined as y := Hx.

From (H, y), find x.

By taking d = 1, we get the standard syndrome decoding problem. Let us note that the d-split syndrome decoding problem can be seen as a generalization of the regular syndrome decoding problem introduced by [AFS03], for which the ratio w/d is equal to 1. However, both problems (d-split and regular) do not aim to be used in the same way. In the d-split case, d is a small constant. When selecting parameters for it, we estimate the cost of the standard SD problem and the exact security loss. Thus, d-split SD problem can be considered as conservative as the standard problem (d = 1). In the regular case, using Theorem 5.1.2 would lead to a too large security loss. Instead, we select the parameters for it by relying on it own existing cryptanalysis.

The following theorem gives a way to estimate the difficulty of solving the d-split syndrome decoding problem. We provide a security reduction from this variant to the standard problem which allows us to compensate the security loss by a slight increase of the parameters. This so-called d-split syndrome decoding problem offers us more flexibility to find better size-performance trade-offs for our signature scheme. w . Moreover, a standard syndrome decoding instance can be "randomized" and input to the d-split adversary as much as desired. A formal proof of the above theorem is just after.

Proof. To prove the theorem, we build below an algorithm A 1 to solve the traditional SD problem of parameters (m, k, w) using an algorithm A d which solves the d-split SD problem with the same parameters.

Algorithm A 1 (on input an SD instance (H, y)):

1. Sample a permutation σ of {1, . . . , m}. 2. Permute the columns of H using σ to get Ĥ. 3. Run A d on input ( Ĥ, y) to get x. 4. If x = ⊥, return ⊥. 5. Permute the coordinates of x using σ -1 to get x. 6. Return x.

The probability of transforming an SD instance into a d-split SD instance in Step 2 is

m/d w/d d / m
w . Thus we have

ε 1 := Pr[A 1 (H, y) = ⊥] ≥ Pr[A 1 (H, y) = ⊥ ∩ ( Ĥ, y) is a d-split SD] = m/d w/d d m w • Pr[A 1 (H, y) = ⊥ | ( Ĥ, y) is a d-split SD] = m/d w/d d m w • Pr[A d ( Ĥ, y) = ⊥ | ( Ĥ, y) is a d-split SD] = m/d w/d d m w • ε d
For example, let us assume we want a d-split parameter set with 128-bit security such that m d ≤ 256. We could take the parameters (m, k, w) = (1536, 888, 120) with d = 6 over the binary field. We show in Section 5.3.4 that the standard syndrome decoding problem with the same parameters (but d = 1) has a security of 145 bits and, thanks to the Theorem 5.1.1, we know there is a security loss of at most 16 bits while switching to d = 6.

A Zero-Knowledge Protocol for Syndrome Decoding

Let us consider an instance (H, y) of the (d-split) syndrome decoding problem, and let us denote x a solution of this instance. We denote F SD the field on which the instance is defined. Without loss of generality, we assume that H is in the systematic form, i.e.

that H = (H |I m-k ) for some H ∈ F (m-k)×k SD
. Thus the solution x can be written as (x A |x B ) such that we have the linear relation

y = H x A + x B . (5.1)
This implies that one simply needs to send x A (k • log |F SD | bits) to reveal the solution of the instance (H, y).

In the following sections, we first build an MPC protocol that takes a sharing of x A , builds the corresponding x thanks to Equation (5.1), and checks that x corresponds to a vector with a Hamming weight of at most w/d on each chunk. Since x would satisfy y = Hx by construction, this MPC protocol verifies that x A corresponds to a solution of the syndrome decoding instance (H, y). Then, in Section 5.2.3, we transform it into a zero-knowledge protocol which proves the knowledge of a solution of the syndrome decoding instance (H, y) thanks to the MPC-in-the-Head paradigm.

Standard Case (d = 1)

We first focus on the case where (H, y) is an instance of the standard syndrome decoding problem (i.e. we have d = 1). We will then show how to extend the protocol to the general case of any d. We consider a field extension F poly ⊇ F SD such that |F poly | ≥ m (we recall that m is the length of the secret x, i.e. x ∈ F m SD ). We denote φ : F SD → F poly the usual inclusion of F SD into F poly . Let us take a bijection γ between {1, . . . , |F poly |} and F poly . Then, to ease the notation, we denote γ i for γ(i).

The protocol must check that y = Hx and wt H (x) ≤ w. As explained in the introduction of the section, the input for the MPC protocol will be x A , then it will build the sharing x using the linear Equation (5.1). Thus we directly have that y = Hx. It remains to check that wt H (x) ≤ w.

To prove that wt H (x) ≤ w, the prover builds the three following polynomials:

• The polynomial S ∈ F poly [X] satisfying ∀i ∈ [1 : m], S(γ i ) = φ(x i ) ,
as well as deg S ≤ m -1. This S is unique and can be computed by interpolation.

• The polynomial Q ∈ F poly [X] defined as

Q(X) := i∈E (X -γ i )
for some E ⊂ [1 : m] such that |E| = w and {i ∈ [1 : m] :

x i = 0} ⊂ E, implying deg Q = w.
• The polynomial P ∈ F poly [X] defined as

P := (Q • S)/F with F (X) := m i=1 (X -γ i ) .
We stress some useful properties of these polynomials:

• The polynomial Q is a monic polynomial of degree w. Moreover, for every i ∈ [1 : m], we have

x i = 0 ⇒ i ∈ E ⇒ Q(γ i ) = 0 . • The polynomial F divides Q • S. Indeed, for every i ∈ [1 : m], we have (Q • S)(γ i ) = 0 since S(γ i ) = 0 ⇒ x i = 0 ⇒ Q(γ i ) = 0.
The polynomial P is hence well defined.

• The polynomial P has degree deg P ≤ w -1.

If the prover convinces the verifier that there exists two polynomials P (with deg P ≤ w -1) and Q (with deg Q = w) such that Q • S -P • F = 0 where S and F are built as described above, then the verifier can deduce the following:

∀i ∈ [1 : m], (Q • S)(γ i ) = P (γ i ) • F (γ i ) = 0 ⇒ ∀i ∈ [1 : m], Q(γ i ) = 0 or S(γ i ) = φ(x i ) = 0
Since Q has at most w roots, the verifier concludes that φ(x i ) = 0 in at most w positions. Thus wt H (x) ≤ w.

We now explain how to prove this statement in the MPCitH paradigm. For this purpose, we describe an MPC protocol, which on input x, P and Q outputs Accept if the above condition is verified and Reject otherwise, except with a small false positive probability. The parties' inputs are defined as the shares of x A , Q and P . Let us recall that a sharing of a polynomial is naturally defined as a sharing of its coefficients (see Section 2.4.1). However, for the sharing of Q, we share all of its coefficients except the leading one. Indeed since Q is monic, its leading coefficient is publicly known and is equal to 1. Moreover, it enables to convince the verifier that Q is of degree exactly w, which is important since otherwise, a malicious prover could take Q as the zero polynomial.

From its inputs, the MPC protocol first builds the polynomial S from x A . Then, to verify Q • S = P • F , it evaluates the two sides of the relation on t random points r 1 , ..., r t (sampled by the verifier in the MPCitH setting). If the relation is not verified, the probability to observe Q(r j ) • S(r j ) = P (r j ) • F (r j ) for all j ∈ [1 : t] will be low, which stems from the Schwartz-Zippel Lemma (see Section 2.3.3). The larger the set from which the evaluation points r j are sampled, the smaller the false positive probability p. For this reason, we take these evaluation points in a field extension F points of F poly . Such a field extension allows us to have more points and so to detect more efficiently when Q • S = P • F . In practice, given an evaluation point r j , the parties of the MPC protocol verify the relations Q(r j ) • S(r j ) = (P • F )(r j ) by sacrificing multiplication triples as described in Section 3.4.1. To proceed, the prover must previously build t multiplication triples ( a j , b j , c j ) for random elements a j , b j , c j ∈ F points satisfying a j • b j = c j for j ∈ [1 : t] and include them to the parties' inputs (each party getting its corresponding share from a j , b j and c j ).

The MPC protocol runs as follows:

1. The parties sample t random points r 1 , . . . , r t of F points .

2. The parties locally compute x from x A using Equation (5.1).

3. The parties locally compute S(r j ) , Q(r j ) and (F • P )(r j ) for all j ∈ [1 : t]. Let us remark that S(r j ) can be computed from x by the parties without any interaction thanks to the linearity of Lagrange interpolation formula:

S(r j ) = i∈[1:m] x i ∈[1:m], =i r j -γ γ i -γ .
On the other hand (F • P )(r j ) is computed as F (r j ) • P (r j ) since F is publicly known.

4. For every j ∈ [1 : t], the parties run an MPC verification of the multiplication triple S(r j ) , Q(r j ) , (F • P )(r j ) by sacrificing the triple ( a j , b j , c j ):

• The parties sample a random ε j ∈ F points .

• The parties locally set

α j = ε j • Q(r j ) + a j and β j = S(r j ) + b j .
• The parties broadcast α j and β j to obtain α j and β j .

• The parties locally set

v j = ε j • (F • P )(r j ) -c j + α j • b j + β j • a j -α j • β j .
• The parties broadcast v j to obtain v j .

The parties output

Accept if v = 0 (i.e. if v j = 0 for all j) and Reject otherwise.

Note that we do not need to specify how the random values r j 's and ε j 's are sampled by the parties since they will be provided as challenges from the verifier while turning to the zero-knowledge setting.

The above MPC protocol computes a non-deterministic function f which takes x, Q and P (and t multiplication triples) as input and which outputs Accept or Reject. The randomness of this function comes from the random evaluations points r 1 , . . . , r t and from the random challenges ε 1 , . . . , ε t used by the product checking protocol. Whenever x indeed satisfies wt H (x) ≤ w and the polynomials P and Q are genuinely computed as described above, the protocol outputs Accept with probability one. Whenever the protocol input is not of this form, the protocol shall output Reject except with a small false positive probability p. In other words, the output of the above protocol follows the distribution depicted in Table 3.1 where a good witness here means an x of weight at most w and polynomials P and Q which are correctly built.

Let us make explicit the false positive probability p. We shall denote ∆ := |F points |. Whenever the protocol input is not a good witness, i.e. wt H (x) > w, P or Q are not correctly built, we have Q • S = F • P . In the above protocol, both sides of the relation are evaluated in t random points. The probability to have the equality for i evaluation points among the t points is at most max ≤m+w-1 i

∆- t-i ∆ t since Q • S -F • P
is a polynomial of degree at most m + w -1. This holds from a simple extension of the Schwartz-Zippel Lemma that we provide in Section 2.3.3. When this event occurs, the probability to obtain Accept as output is

1 ∆ t-i
, which corresponds to the probability to get the t -i false positives in the verification of multiplication triples (for the t -i remaining evaluation points r j for which Q(r j ) • S(r j ) = F (r j ) • P (r j )). Thus, the global false positive probability p satisfies

p ≤ t i=0 max ≤m+w-1 i ∆- t-i ∆ t 1 ∆ t-i .
(5.2)

General case (any d)

Let us now assume that (H, y) is an instance of a d-split syndrome decoding problem for some d ≥ 1. We can easily adapt our protocol in that case. Instead of having a unique polynomial Q of degree w, we will have d polynomials Q 1 , . . . , Q d of degree exactly w/d to prove the weight bound wt H (x j ) ≤ w/d for each chunk x j of the SD solution. We then have d polynomials S j (of degree m/d -1) and d polynomials P j (of degree w/d -1) satisfying the

d relations Q j • S j = F • P j with F := m/d j=1 (X -γ j ).
To prove those d relations we evaluate each of them on t random points r 1 , . . . , r t . We stress that the same t random points can be used for each chunk, i.e. for every j ∈ [1 : d].

A malicious prover might try to cheat on a single relation (i.e. on a single chunk of the SD solution), in such a way that there exists j 0 ∈ [1 : d] with

Q j 0 • S j 0 = F • P j 0 , ∀j = j 0 , Q j • S j = F • P j .
So for a given point r, we use the batched sacrificing-based checking of [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF] (described in Section 3.4.1) to check all the equalities Q j (r) • S j (r)=F (r) • P j (r) at once. This saves communication without impacting the soundness error compared to independent checks of the d relations.

Whenever the input x, {P j }, {Q j } is not a good witness (i.e. whenever one x j has a weight greater than w/d or one polynomial P j or Q j is not correctly built), at least one of the relations Let us note that in practice the new communication is not smaller than before, but rather equivalent or higher, since we need to use bigger syndrome decoding instances to compensate the security loss of the d-split version. The main benefit to introduce the d-split version is to work on polynomials of smaller degree and/or on specific fields which provides better performance trade-offs (see Section 5.3.5).

Q j • S j = F • P j is not verified. Since Q j • S j -F • P j is a polynomial of degree at most (m + w)/d -1, the global false positive probability for the d-split variant becomes 1 p ≤ t i=0 max ≤(m+w)/d-1 i ∆- t-i ∆ t 1 ∆ t-i (5.

Description of the Protocol

We now give the formal description of our zero-knowledge protocol (general case) in Protocol 6. For the sake of clarity in the protocol description, we denote #" Q the tuple of polynomials

1 We here use the fact that the optimal strategy for a malicious prover is to build a bad witness such that only one polynomial relation is not satisfied. The resulting soundness error is thus the probability to fail to detect this cheating on this single relation.

(Q 1 , . . . , Q d ). Same for the polynomials #" P and #" S . The additions, substractions and polynomial evaluations of these tuples are component-wise defined. For example, for a point r ∈ F points , #" Q(r) means (Q 1 (r), . . . , Q d (r)). We also use this vectorial notation for #" a j , #" b j , #" α j , #" β j and #" ε j which shall represent vectors of F d points . Let us recall that • denotes the component-wise multiplication. In the scope of this protocol, the polynomial F is defined as

F (X) := m/d i=1 (X -γ i ) with F poly = {γ 1 , γ 2 , . . .}.

Security Proofs

The following theorems state the completeness, zero-knowledge and soundness of Protocol 6. We refer the reader to [START_REF] Feneuil | Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs[END_REF] for the proofs of Theorems 5.2.2 and 5.2.3.

Theorem 5.2.1 (Completeness). Protocol 6 is perfectly complete, i.e. a prover P who knows a solution x to the syndrome decoding instance (H, y) and who follows the steps of the protocol always succeeds in convincing the verifier V.

Proof. For any sampling of the random coins of P and V, if the computation described in Protocol 6 is genuinely performed then all the checks of V pass.

Theorem 5.2.2 (Honest-Verifier Zero-Knowledge). Let the PRG used in Protocol 6 be (t, ε PRG )-secure and the commitment scheme Com be (t, ε Com )-hiding. There exists an efficient simulator S which, given a random challenge i * outputs a transcript which is (t, ε PRG + ε Com )indistinguishable from a real transcript of Protocol 6.

Theorem 5.2.3 (Soundness). Suppose that there is an efficient prover P that, on input (H, y), convinces the honest verifier V on input H, y to accept with probability

ε := Pr[ P, V (H, y) → 1] > ε
where the soundness error ε is equal to

p + 1 N -p • 1 N with p
4 ε -ε • 1 + ε • 2 • ln(2) ε -ε .
By adapting the parameters t and ∆, we can produce a protocol with soundness error arbitrarily close to 1/N .

Performance

In the following analysis, we exclude the challenges from the communication cost since they are of very moderate impact (and do not count whenever making the protocol non-interactive). The communication then consists into

• Com := h, Inputs: Both parties have H = (H |I m-k ) ∈ F (m-k)×m SD and y ∈ F m-k
SD , the prover also holds

x := (x1 | x2 | . . . | x d ) ∈ F m SD such that y = Hx and wtH (xj ) ≤ w/d for j ∈ [1 : d].
Round 1: The prover computes the proof witness: for all chunk j ∈ [1 : d],

1. Choose a set Ej ⊂ [1 : m d ] s.t. |Ej | = w d and { : (xj ) = 0} ⊂ Ej . 2. Compute Qj (X) = ∈E j (X -γ ) ∈ Fpoly[X]. 3. Compute Sj (X) ∈ Fpoly[X] by interpolation s.t. deg Sj ≤ m d -1 and ∀ ∈ [1 : m d ], Sj (γ ) = (xj ) . 4. Compute Pj (X) = Sj (X)Qj (X)/F (X) ∈ Fpoly[X].
Then, the prover prepares the inputs for the multi-party computation as follows:

1. Sample a root seed: seed

$ ← -{0, 1} λ .
2. Compute parties' seeds and commitment randomness (seedi, ρi) i∈[1:N ] with TreePRG(seed).

For each party

i ∈ {1, . . . , N }, • #" a j i, #" b j i ← PRG(seedi), for each j ∈ [1 : t] • If i = N , -{ cj i}j∈[1:t], xA i, #" Q i, #" P i ← PRG(seedi) -statei = seedi • Else, -xA N = xA - =N xA - #" Q N = #" Q - =N #" Q . - #" P N = #" P - =N #" P . -cj N = #" a j , #" b j - =N cj , for each j ∈ [1 : t] -help = ( xA N , #" Q N , #" P N , { cj N } j∈[1:t] ) -stateN = seedN || help • Commit the party's state: comi = Com(statei; ρi).
The prover builds h = Hash(com1, . . . , comN ) and sends it to the verifier.

Round 2:

The verifier uniformly samples, for each j ∈ [1 : t], an evaluation point rj ← Fpoints and a vector #" ε j ← F d points , and sends them to the prover.

Round 3:

The prover simulates the MPC protocol:

1. The parties locally set xB = y -H xA .

The parties locally compute

#" S by interpolation using x := ( xA | xB ).

Then for all j ∈ [1 : t],

• The parties locally compute #" S (rj ) , #" Q(rj ) and #" P (rj ) .

• They locally set #"

α j = #" ε j • #" Q(rj ) + #" a j .
• They locally set #"

β j = #" S (rj ) + #" b j .
• The parties open #" α j and #" β j to get #" α j and #" β j .

• The parties locally set

vj = -cj + #" ε j , F (rj ) • #" P (rj ) + #" α j , #" b j + #" β j , #" a j -#" α j , #" β j .
The prover builds h = Hash( #"

α 1 , #" β 1 , v1 , . . . , #" α t , #" β t , vt
) and sends it to the verifier.

Round 4: The verifier uniformly samples i * ← [1 : N ] and sends it to the prover.

Round 5: The prover sends (statei, ρi

) i =i * , com i * , { #" α j i * } j∈[1:t] and { #" β j i * } j∈[1:t] .
Verification: The verifier accepts iff all the following checks succeed:

1. For each i = i * , she computes all the commitments to the parties' states: comi = Com(statei; ρi). Then she checks that h ? = Hash(com1, . . . , comN ).

2. Using {statei} i =i * , she simulates all the parties except for i * . From the recomputed shares, she checks that h

? = Hash( #" α 1 , #" β 1 , v1 , . . . , #" α t , #" β t , vt ) where vj i * := - i =i * vj i.
Protocol 6: Zero-knowledge proof for syndrome decoding.

Chapter 5

5.2. A Zero-Knowledge Protocol for Syndrome Decoding 69

• Res 1 := h and

• Res 2 := (state i , ρ i ) i =i * , com i * , { #" α j i * } j∈[1:t] , { #" β j i * } j∈[1:t] .
For i = N , state i simply consists in a seed of λ bits. For i = N , state i contains

• a seed of λ bits,

• the share x A N of a plaintext,

• the shares #" Q N and #" P N which are 2 • d polynomials of degree w/d -1,

• and the shares { c j N } j∈[1:t] of t points of F points .

Let us recall that seeds are sampled using a GGM tree (as defined in Section 2.2.2). Instead of sending the N -1 seeds and commitment randomness of (state i , ρ i ) i =i * , we can instead send the sibling path from (state i * , ρ i * ) to the tree root 2 , it costs at most λ • log 2 (N ) bits (we need to reveal log 2 (N ) nodes of the tree). Moreover com i * is a commitment of 2λ bits, and { #"

α j i * } j∈[1:t] , { #" β j i * } j∈[1:t] are elements of F points .
The communication cost (in bits) of the protocol is then

Size = 4λ + k • log 2 |F SD | x A N + (2 • w) • log 2 |F poly | #" Q N , #" P N + (2 • d + 1) • t • log 2 |F points | { #" α j i * , #" β j i * , c j N } j∈[1:t] + λ • log 2 (N ) (seed i ) i =i * + 2λ com i *
As usual, to achieve a targeted soundness error 2 -λ , we can perform τ parallel repetitions of the protocol such that ε τ ≤ 2 -λ . And instead of sending τ values for h and h , we can merge them together to send a single h and a single h . The communication cost (in bits) of the protocol with τ repetitions is

Size = 4λ + τ • k • log 2 |F SD | + (2 • w) • log 2 |F poly | + (2 • d + 1) • t • log 2 |F points | + λ • log 2 (N ) + 2λ
and the obtained soundness error is

p + 1 n -p • 1 n τ .

Comparison

We compare our new protocol with existing zero-knowledge protocols for syndrome decoding (or equivalently for message decoding). We compare these protocols on two SD instances of 128-bit security:

• Instance 1 (from Chapter 4): Syndrome Decoding on F 2 with parameters (m, k, w) = (1280, 640, 132);

2 As in Chapter 4, the seed seedi of a party and the commitment randomness ρi are derived from the same seed, which corresponds to a leaf of the seed tree.

• Instance 2 [START_REF] Cayrel | A Zero-Knowledge Identification Scheme Based on the q-ary Syndrome Decoding Problem[END_REF]: Syndrome Decoding on F 2 8 with parameters (m, k, w) = (208, 104, 78).

The comparison for a soundness error of 2 -128 is given in the Table 5.1. For our protocol, we provide two instantiations for each syndrome decoding instance to give the reader an idea of the obtained performance while changing the number of parties. The first instantiation called "short" corresponds to an instantiation which provides small communication cost. The second one called "fast" corresponds to an instantiation with faster computation but higher communication cost. The used parameters (N, τ, |F poly |, |F points |, t) for our scheme are

• Instance 1:

Short: (N, τ, |F poly |, |F points |, t) = (256, 16, 2 11 , 2 22 , 2) ⇒ ε τ = 2 -128.0 Fast: (N, τ, |F poly |, |F points |, t) = (32, 26, 2 11 , 2 22 , 1) ⇒ ε τ = 2 -129.6
• Instance 2: We can remark that all the previous protocols prove an equality for the Hamming weight by relying on isometries (i.e. permutations if F SD = F 2 ). On our side, we only prove the inequality wt H (w) ≤ w. We stress that both versions (equality or inequality) can be merely equivalent for some SD parameters. Indeed, if w is chosen sufficiently below the Gilbert-Varshamov bound and if we know there exists an SD solution x of Hamming weight w, then proving the knowledge of a solution x with wt H (x ) ≤ w amounts to proving the knowledge of x with overwhelming probability.

Short: (N, τ, |F poly |, |F points |, t) = (256, 16, 2 8 , 2 24 , 2) ⇒ ε τ = 2 -128.0 Fast: (N, τ, |F poly |, |F points |, t) = (32, 26, 2 8 , 2 24 , 1) ⇒ ε τ = 2 -130.0

The Signature Scheme

In this section, we show how to turn our 5-round HVZK protocol into a signature scheme using the Fiat-Shamir transform [FS87; AABN02]. After explaining the transformation, we give the description of the signature scheme and then provide a security proof in the random oracle model (ROM).

Transformation into a Non-Interactive Scheme

To transform our protocol into a non-interactive scheme, we apply the multi-round variant of the Fiat-Shamir transform [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF] (see e.g. [START_REF] Sidi | Extended Security Arguments for Signature Schemes[END_REF][START_REF] Chen | From 5-Pass MQ-Based Identification to MQ-Based Signatures[END_REF]). Concretely, we compute the challenge Ch 1 and Ch 2 as

h 1 = Hash 1 (m, salt, h) Ch 1 ← PRG(h 1 )
and

h 2 = Hash 2 (m, salt, h, h ) Ch 2 ← PRG(h 2 )
where m is the input message, where Hash 1 and Hash 2 are some hash functions (that shall be modeled as random oracles) and where h and h are the Round 1 and Round 3 hash commitments merged for the τ repetitions. We introduce a value salt called salt which is sampled from {0, 1} 2λ at the beginning of the signing process. This value is then used for each commitment to the parties' states. Without it, the security of the signature would be at most 2 λ/2 because of the seed collisions between several signatures. Moreover, since the signature security relies on the random oracle model, we can safely replace the commitment scheme Com of Protocol 6 by a single hash function Hash 0 . The security of the obtained scheme is lower than the soundness error of Protocol 6. Indeed, in [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF], Kales and Zaverucha describe a forgery attack against signature schemes obtained by applying the Fiat-Shamir transform to 5-round protocols. Adapting this attack to our context yields a forgery cost of cost forge := min

τ 1 ,τ 2 :τ 1 +τ 2 =τ 1 τ i=τ 1 τ i p i (1 -p) τ -i + N τ 2
(5.4) with p defined in Equation (5.3). This is substantially lower than the target forgery cost of 1/ε, for ε being the soundness error of Protocol 6 (see Theorem 5.2.3). We therefore need to adapt the parameters to fill this gap.

Description of the Signature Scheme

In our signature scheme, the key generation algorithm randomly samples an instance (H, y) of the d-split syndrome decoding problem with solution x, with security parameter λ. In order to make the key pair compact, the matrix H is pseudorandomly generated from a λ-bit seed. Specifically, a call to the KeyGen algorithm outputs a pair (pk, sk) := (seed H , y), mseed generated as follows:

1. mseed ← {0, 1} λ

Signature Properties

We now state the security of our signature scheme in the following theorem.

Theorem 5.3.1. Suppose the PRG used is (t, PRG )-secure and any adversary running in time t has at most an advantage ε SD against the underlying d-split syndrome decoding problem. Model Hash 0 , Hash 1 and Hash 2 as random oracles where Hash 0 , Hash 1 and Hash 2 have 2λbit output length. Then chosen-message adversary against the signature scheme depicted in Figure 5.1, running in time t, making q s signing queries, and making q 0 , q 1 , q 2 queries, respectively, to the random oracles, succeeds in outputting a valid forgery with probability

Pr[Forge] ≤ SD + ε PRG + (τ N + 2)Q 2 2 2λ + Pr[X + Y = τ ],
with

• Q = q 0 + q 1 + q 2 + q s • (2 + τ (2N -1)),
• X = max i∈[1:q 1 ] {X i } with X i ∼ B(τ, p), and

• Y = max i∈[1:q 2 ] {Y i } with Y i ∼ B(τ -X, 1 N ),
where p is defined in Equation (5.3) and B(n 0 , p 0 ) denotes the binomial distribution with n 0 the number of trials and p 0 the success probability of each trial.

Parameters

In what follows, we propose three parameter sets which achieve a security level of 128 bits for the signature:

• the first one shall rely on the hardness to solve the SD problem on F 2 ;

• the second one shall also rely on the hardness to solve the SD problem on F 2 , but we shall use a d-split version to get polynomials over a chosen field, concretely F 256 ;

• the last one shall rely on the hardness to solve the SD problem on F 256 .

Inputs: A secret key sk = (H, y, x) and a message m ∈ {0, 1} * .

Sample a random salt salt ← {0, 1} 2λ .

Phase 1.0: Building of the proof witness. For all chunk j ∈ [1 : d], N with TreePRG(salt, seed). 3. For each party i ∈ {1, . . . , N },

1. Compute Qj (X) = ∈E j (X -γ ) ∈ Fpoly[X] where Ej = { : (xj ) = 0}. 2. Compute Sj (X) ∈ Fpoly[X] by interpolation s.t. deg Sj ≤ m d -1 and ∀ ∈ [1 : m d ], Sj (γ ) = (xj ) . 3. Compute Pj (X) = Sj (X)Qj (X)/F (X) ∈ Fpoly[X].
• #" a [e] j i, #" b [e] j i ← PRG(salt, seed [e] i ), for each j ∈ [1 : t] • If i = N , -{ c [e] j i}j∈[1:t] , x [e] A i, #" Q [e] i,

#"

P [e] i ← PRG(salt, seed

[e] i ) -state [e] i = seed [e] i • Else, -x [e] A N = xA - j =N x [e] A j - #" Q [e] N = #" Q - =N #" Q [e] . - #" P [e] N = #" P - =N #" P [e] .
c

[e] j N = #" a [e] j , #" b [e] j - =N c [e] j , for each j ∈ [1 : t] -help [e] = ( x [e] A N , #" Q [e] N , #" P [e] N , { c [e] j N } j∈[1:t] ) -state [e] N = seed [e] N || help [e]
• Compute com

[e] i = Hash0(salt, e, i, state [e] i ).
Phase 2: First challenge (randomness for the MPC protocol). A .

1. Compute h1 = Hash1(m, salt, com [1] 1 , com [1] 2 , . . . , com [τ ] N -1 , com [τ ] N ).

Extend hash {r

Then for all j ∈ [1 : t],

• The parties locally compute #" S [e] by interpolation using x [e] := ( x

[e] A | x [e]
B ).

• They locally compute #" S [e] (r

[e] j ) , #" Q [e] (r
[e] j ) and

#" P [e] (r [e] j ) .
• They locally set #" α

[e] j = #" ε [e] j • #" Q [e] (r [e] j ) + #" a [e] j . • They locally set #" β [e] j = #" S [e] (r [e] j ) + #" b [e] j .
• The parties open #" α

[e] j and #" β

v [e] j = -c [e] j + #" ε [e] j , F (r [e] j ) • #" P [e] (r [e] j ) + #" α [e] j , #" b [e] j + #" β [e] j , #" a [e] j -#" α [e] j ,

#" β

[e] j

.

Phase 4: Second challenge (parties to be opened).

1. Compute h2 = Hash2(m, salt, h1, { #" α [e] j , #" β [e] j , v [e] j } j∈[1:t],e∈[1:τ ] ). 2. Expand hash {i * [e] } e∈[1:τ ] ← PRG(h2) where i * [e] ∈ [1 : N ].
Phase 5: Building of the signature. Output the signature σ built as

salt | h1 | h2 | (state [e] i ) i =i * [e] | com [e] i * [e] | { #" α [e] j i * [e] } j∈[1:t] | { #" β [e] j i * [e] } j∈[1:t] e∈[1:τ ] .
Figure 5.1.: Code-based signature scheme -Signing algorithm.

Inputs: A public key pk = (H, y), a signature σ and a message m ∈ {0, 1} * .

1. Parse the signature σ as

salt | h1 | h2 | (state [e] i ) i =i * [e] | com [e] i * [e] | { # " α [e] j i * [e] } j∈[1:t] | { # " β [e] j i * [e] } j∈[1:t] e∈[1:τ ] .
2. Extend hash {r • For each i = i * [e] , computes com

[e] i = Hash0(salt, e, i, state

[e] i ).

• Using {state

[e] i } i =i * [e]
, simulate all the parties except for i * [e] as in the Phase 3 of the signing algorithm and get #" Choice of the SD parameters. Let us first describe how we estimate the security level of a syndrome decoding instance for a random linear code over F 2 . The best practical attack for our parameters is the algorithm of May, Meurer and Thomae [START_REF] May | Decoding Random Linear Codes in Õ(2 0.054n )[END_REF]. As argued in Section 4.5.2, we can lower bound the cost of this attack by only considering the cost of its topmost recursion step:

α 1 , . . . , #" α t , #" β 1 , . . . , #" β t , v for all parties except for i * [e] . • Compute v [e] j i * [e] := - i =i * [e] v [e] j i for all j ∈ [1 : t]. 5. Compute h 1 = Hash1(m, com [1] 1 , com [1] 2 , . . . , com [τ ] N -1 , com [τ ] N ). 6. Compute h 2 = Hash2(m, { #" α [e] j , #" β [e] j , v [e] j } j∈[1:t],e∈[1:τ ] ).
m w k+ p m-k- w-p • L + L 2 2 -p with L := k+ p/2 2 p .
As usual in an ISD algorithm we need to optimize for the parameters (a number of rows) and p (a partial Hamming weight). Since we only account for the cost of the topmost level in the algorithm, this yields a slightly conservative estimate for the security level. We use this estimate to choose the parameters of our scheme. Given these considerations, we suggest the following concrete parameters:

• Variant 1: standard binary syndrome decoding problem. We propose the parameters (q, m, k, w, d) = (2, 1280, 640, 132, 1)

which achieve a security level of 128 bits according to the above formula.

• Variant 2: d-split binary syndrome syndrome decoding problem, where d is taken to have m/d ≤ 256 so that F poly = F 256 . We propose the parameters (q, m, k, w, d) = (2, 1536, 888, 120, 6) which achieve a security of 129 bits. Indeed, the standard SD problem with the same parameters (but d = 1) has a security of 145 bits and we know, thanks to the Theorem 5.1.1, that there is a security loss of at most 16 bits while switching to d = 6.

Let us stress that this choice is conservative since the current state of the art does not contain attacks filling the gap of this reduction. Our aim here was to build a practical signature scheme with conservative security, but searching for more aggressive parameters for the d-split syndrome decoding problem would be an interesting direction for future research.

• Variant 3: syndrome decoding instance defined over F 256 . The cryptanalysis of the syndrome decoding problem on a field which is larger than F 2 has been less studied.

Previous articles [Pet10; CVE11; GPS22] propose parameters sets for syndrome decoding instances over F 2 8 where the code length m is between 200 and 210. In our case, we choose m = 256 in such a way that the polynomial degree is equal to the field size.

Besides being more conservative, this choice has the advantage of easing the use of a Fast Fourier Transform. We propose the following parameters3 for this variant:

(q, m, k, w, d) = (256, 256, 128, 80, 1) .

Choice of the MPC parameters. For each variant, we suggest in Table 5.2 a parameter set for the MPC protocol. To have a short signature, we take the smallest possible field F poly since a signature transcript includes polynomials on that field. As explained in Section 5.2, F poly must be a field extension of F SD which verifies the relation |F poly | ≥ m/d. Then, it remains to choose |F points | and t. These parameters are chosen to make the false positive probability p is negligible compared to 1/N such that the optimal forgery strategy of an attacker is to take τ 1 = 1 in the Equation (5.4). As a result, we just need to increase the number of iterations τ by one compared to the interactive protocol.

Implementation and Performance

For each repetition, in the computation of each party, d polynomial interpolations are involved. Indeed, from x , the parties must compute

S (X) = m/d i=1 x m d +i • m/d j=1,j =i X -w j w i -w j for all ∈ [1 : d].
Then, the parties must evaluate S in t random evaluation points sampled by the verifier, for all ∈ [1 : d]. The natural way to implement that is to compute the coefficients of all the polynomials { S } from x , then to evaluate these polynomials t times. However this implies that the signer must realize τ • N • d interpolations. Instead, the signer can compute the vector u(r) defined as

u(r) =   m/d j=1,j =i r -w j w i -w j   1≤i≤ m d
for each evaluation point r, and then use these vectors in the computation of all the parties as

S (r) = x , u(r)
where x is the th chunk of x . By proceeding this way, the number of (transposed) interpolations done by the signer is of τ • t.

To reduce the computational cost of the interpolations, we can make use of a Fast Fourier Transform (FFT). We are working on field extensions of F 2 , so we can use the Additive FFT independently introduced by Wang-Zhu in 1988 [START_REF] Wang | A fast algorithm for the Fourier transform over finite fields and its VLSI implementation[END_REF] and by Cantor in 1989 [START_REF] Cantor | On arithmetical algorithms over finite fields[END_REF], which was further improved in [GG03; GM10]. Although such additive FFT exists for any extension of F 2 , the algorithms are simpler for a field of size 2 (2 i ) for some i, which is why we chose F poly as F 256 . On such a field F, we indeed have an efficient additive FFT using 1 2 |F| log 2 |F| multiplications to evaluate a polynomial (of degree lower than |F|) in |F| points.

We implemented the signature scheme in C. In our implementation, the pseudo-randomness is generated using AES in counter mode and the hash function is instantiated with SHAKE. We benchmarked our scheme on a 3.8 GHz Intel Core i7 CPU with support of AVX2 and AES instructions. All the reported timings were measured on this CPU while disabling Intel Turbo Boost.

Remark 5.3.2. Another motivation for using F poly = F 256 is that some Intel processors have dedicated instructions for F 256 arithmetic. We therefore expect substantial speed-ups for the instances of our signature scheme using F poly = F 256 on these processors. Optimizing and benchmarking such implementations is left for future research.

We instantiate two trade-offs per variant: the first one lowering communication cost to produce short signatures, and the second one lowering computational cost to get a fast signature computation. We obtain the parameters and sizes described in Table 5.3. We provide the measured running times of our signature implementation in Table 5.4.

Future investigations.

We tried to optimize the implementation using some algorithmetic tricks, but we did not yet investigate the possible software optimizations like vectorization or bitslicing. Although the variants 1 and 2 are more conservative because they rely on the hardness of the binary syndrome decoding problem, variant 3 is more promising in terms of signature size and computation time. While we have investigated parameter sets where F SD is a field extension of F 2 , more cryptanalysis for the SD problem on those fields as well as on non-binary fields would be welcome. An interesting idea would be to instantiate our scheme with a prime field F SD for which the Number-Theoretic Transform (NTT) is defined. If F SD is large enough, we could then take the same field for F poly and F SD , and we would have fast polynomial interpolations and simpler multiplication operations.

Comparison

In this section, we compare our scheme to different code-based and post-quantum signature schemes from the literature.

Comparison with Other Code-Based Signature Schemes

We extend the comparison made in Section 4.6.1 with the scheme proposed in this chapter. We add in the comparison the work [START_REF] Bidoux | Code-based Signatures from New Proofs of Knowledge for the Syndrome Decoding Problem[END_REF] which has been released just before this scheme. Table 5.5 compares the performance of our scheme with the current code-based signature state of the art, for the 128-bit security level. 4 We observe that our scheme outperforms all the existing code-based signatures for the |sgn| + |pk| metric. Depending on the parameters, it can even produce signatures such that |sgn| + |pk| is below the symbolic cap of 10 KB. Note: The sizes are in bytes and the timings are in milliseconds. Reported timings are from the original publications: Wave has been benchmarked on a 3.5 Ghz Intel Xeon E3-1240 v5, Durandal on a 2.8 Ghz Intel Core i5-7440HQ, while [START_REF] Feneuil | Shared Permutation for Syndrome Decoding: New Zero-Knowledge Protocol and Code-Based Signature[END_REF] and our scheme on a 3.8 GHz Intel Core i7.

Regardless of the key size, Wave still achieves the shortest signatures. In terms of security, our scheme has the advantage of relying on the hardness of one of the oldest problems of the code-based cryptography, namely the syndrome decoding for random linear codes in Hamming weight metric.

Comparison with other Post-Quantum Signature Schemes

Finally, we compare in Table 5.6 our construction with other signature schemes aiming at post-quantum security. First of all, let us note that the lattice-based signature schemes (such as Dilithium [START_REF] Shi Bai | CRYSTALS-Dilithium -Algorithm Specifications and Supporting Documentation[END_REF] and Falcon [START_REF] Fouque | Falcon: Fast-Fourier Lattice-based Compact Signatures over NTRU[END_REF]) are currently the most efficient post-quantum signature schemes. They achieve small signature size and efficient running time. However, the goal of our construction is to propose a signature scheme based on an alternative problem for the sake of diversity of security assumptions. All the others schemes have very short public keys and secret keys (less than 150 bytes for 128-bit security), which is hence not a point for comparison. Depending on the chosen parameters, our scheme can be competitive with Picnic3 [START_REF] Kales | Improving the Performance of the Picnic Signature Scheme[END_REF] and an optimized variant of Picnic proposed by [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF] which also rely on the MPC-in-the-Head paradigm. Like this optimized variant, we can produce signatures with a size of around 8 KB. However, our scheme is arguably more conservative in terms of security since Picnic is based on the hardness of inverting LowMC [ARS+15], a cipher with unconventional design choices, while our scheme is based on the hardness of the syndrome decoding problem on linear codes, which has a long cryptanalysis history and is believed to be very robust. Banquet [BDK+21b] is a signature scheme for which the security is based on the hardness of inverting AES (instead of LowMC), which can also be argued to be a conservative choice. Our scheme over F 2 is competitive with Banquet: slightly shorter and slightly slower (but the timing could be optimized). On the other hand, our scheme on F 256 clearly outperforms Banquet. Our scheme can also be competitive with SPHINCS + [BHK+19] depending on the exact criteria. For similar signature sizes, our signature computation is significantly faster while our signature verification is significantly slower than those of SPHINCS + . Note: The sizes are in bytes and the timings are in milliseconds. Reported timings for Falcon have been benchmarked on a 2.3 Ghz Intel Core i5-8259U in [START_REF] Fouque | Falcon: Fast-Fourier Lattice-based Compact Signatures over NTRU[END_REF], and timings for Dilithium and our scheme have been benchmarked on a 3.8 Ghz Intel Core i7. The benchmarks of the other schemes have been realized on a Intel Xeon W-2133 CPU at 3.60GHz, the values for SPHINCS + and Banquet have been extracted from [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF] while the values for Picnic3 have been extracted from its original publication [START_REF] Kales | Improving the Performance of the Picnic Signature Scheme[END_REF].

Conclusion

In this chapter, we showed how we can apply the MPC-in-the-Head paradigm to code-based cryptography. The proposed signature scheme can achieve very competitive sizes (8-9 KB for 128-bit security), which is almost half the size of the best former schemes (with the same security assumption).

The main issue of this scheme is its computational cost. To achieve such interesting sizes, the running times of the signer and of the verifier are in tens of milliseconds. However, some follow-up works propose optimizations of the scheme:

• The Return of the SDitH. C. Aguilar-Melchor, N. Gama, J. Howe, A. Hülsing, D. Joseph, and D. Yue [START_REF] Aguilar Melchor | The Return of the SDitH[END_REF]. This work shows that we can drastically decrease the computational cost of the MPC emulation, achieving running times below 5 milliseconds while keeping the same signature sizes;

• Threshold Linear Secret Sharing to the Rescue of MPC-in-the-Head. T. Feneuil and M. Rivain [START_REF] Feneuil | Threshold Linear Secret Sharing to the Rescue of MPC-in-the-Head[END_REF]. This work (presented in Chapter 8) proposes an alternative MPCitH transformation to get a proof of knowledge from an MPC protocol. When applied to the scheme of this chapter, the construction leads to a running time of a few milliseconds for the signer and of less than 0.5 milliseconds for the verifier. However, the signature size suffers from a 2-kilobyte increase (for 128-bit security).

Before the construction proposed in this chapter, the MPC-in-the-Head paradigm had been used only on symmetric primitives (AES, LowMC, Rain, ...). Our construction demonstrates that this paradigm can also lead to efficient schemes for other types of security assumptions.

Chapter 6.

MPC-in-the-Head with Rejection

Before 2020, the zero-knowledge proofs for code-based cryptography were not efficient. This state of affairs is similar for the subset sum problem. Until recently, the communication cost for proofs relying on this problem was of few hundreds/thousands of kilobytes. In the previous chapters, we showed that the MPC-in-the-Head paradigm enables us to build competitive code-based schemes. In this chapter, we explore how to use the MPCitH paradigm to build efficient zero-knowledge proofs and signature schemes for the subset sum problem. Because of the large underlying modulus, a straightforward application of the paradigm does not give acceptable performance. Therefore, we adapt it by using a secret sharing over small integers (rather than with the modulus) to reduce the size of the arguments. Since this sharing may reveal information on the secret, we introduce the idea of rejection to the MPC-in-the-head paradigm. Special care has to be taken to balance completeness and soundness and preserve the zero-knowledge property of our arguments. By combining this idea with two techniques to prove that the secret vector is well made of binary coordinates, we obtain efficient zeroknowledge proofs for the subset sum problem, enabling us to get a signature scheme relying on the hardness of this problem. We also apply the secret sharing over small integers to build a signature scheme relying on the security of the [START_REF] Boneh | The Modular Inversion Hidden Number Problem[END_REF] pseudo-random function.

Most of the results presented in this chapter have been published in collaboration with Jules Maire, Matthieu Rivain and Damien Vergnaud in the proceedings of the international conference Asiacrypt 2022 [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF].

Introduction

Given integers w 1 , . . . , w n , t and q, the (modular) subset sum problem consists in finding a subset of the w i 's that sum to t modulo q, i.e. to find bits x 1 , . . . , x n ∈ {0, 1} such that n i=1

x i w i = t mod q.

(6.1)

More formally, an instance of this problem is built as explained in the below definition.

Definition 6.1.1 (Subset Sum Problem). Let q and n be positive integers. The subset sum problem with parameters (q, n) is the following problem:

Let w, x and t be such that:

1. w is uniformly sampled from F n q , 2. x is uniformly sampled from {0, 1} n , 3. t is defined as t := n i=1 w i • x i mod q.
From (w, t), find x.

This problem was shown to be NP-complete (in its natural decision variant) in 1972 by Karp [START_REF] Karp | Reducibility among Combinatorial Problems[END_REF] and was considered in cryptography as an interesting alternative to hardness assumptions based on number theory. Due to its simplicity, it was notably used in the 1980s, following [START_REF] Merkle | Hiding information and signatures in trapdoor knapsacks[END_REF], for the construction of several public-key encryption schemes.

Most of these proposals (if not all) were swiftly broken using lattice-based techniques (see [START_REF] Odlyzko | The rise and fall of knapsack cryptosystems[END_REF]), but the problem itself remains intractable for appropriate parameters and is even believed to be so for quantum computers. For instance, when the so-called density d = n/ log 2 (q) of the subset sum instance is close to 1 (i.e. q 2 n ), the fastest known (classical and quantum) algorithms have complexity 2 O(n) (see [START_REF] Bonnetain | Improved Classical and Quantum Algorithms for Subset-Sum[END_REF] and references therein) and one can reach an alleged security level of λ bits with n = Θ(λ). Many cryptographic constructions were proposed whose security relies on the hardness of the subset sum problem: pseudo-random generators [START_REF] Impagliazzo | Efficient Cryptographic Schemes Provably as Secure as Subset Sum[END_REF], bit commitments [START_REF] Impagliazzo | Efficient Cryptographic Schemes Provably as Secure as Subset Sum[END_REF], public-key encryption [AD97; LPS10]

Prior Work

Given integers w 1 , w 2 , . . . , w n , t and q, an elegant zero-knowledge proof system due to Shamir [START_REF] Shamir | A Zero-Knowledge Proof for Knapsacks[END_REF] (see also [START_REF] Ben-Or | Efficient Identification Schemes Using Two Prover Interactive Proofs[END_REF][START_REF] Simmons | Identification of data, devices, documents and individuals[END_REF][START_REF] Blocki | Direct zero-knowledge proofs[END_REF]) allows a prover to convince a verifier that she knows x 1 , . . . , x n ∈ {0, 1} such that Equation (6.1) holds. The proof system is combinatorial in nature and it requires Θ(λ) rounds of communication to achieve soundness error 2 -λ where each round requires Θ(n 2 ) bits of communication. For an alleged security level of λ bits, the overall communication complexity of Shamir's proof system is thus of Θ(λ 3 ). In [START_REF] Ling | Improved Zero-Knowledge Proofs of Knowledge for the ISIS Problem, and Applications[END_REF], Ling, Nguyen, Stehlé, and Wang proposed a proof of knowledge of a solution for the infinity norm inhomogeneous small integer solution (ISIS) problem which is a vectorial variant of the subset sum problem. It is based on Stern's zero-knowledge proof of knowledge for the syndrome decoding problem [START_REF] Stern | A New Identification Scheme Based on Syndrome Decoding[END_REF] and is also combinatorial. It thus requires a large number of rounds of communication and when specialized to the subset sum problem it also yields proofs with Θ(λ 3 )-bit communication complexity. When instantiated with parameters for 128-bit security, these two proofs of knowledge have a communication of few thousands of kilobytes.

Using the MPC-in-the-head paradigm, Baum and Nof [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] proposed an efficient zeroknowledge argument of knowledge of the short integer solution (SIS) problem. Beullens also recently proposed such arguments obtained from sigma protocols with helper [START_REF] Beullens | Sigma Protocols for MQ, PKP and SIS, and Fishy Signature Schemes[END_REF]. When applied to the subset sum problem itself, all (variants of) these protocols yield proofs with Θ(λ 3 )-bit communication complexity for an alleged security level of λ bits. When instantiated with parameters for 128-bit security, they have a communication of at least few hundreds of kilobytes.

Contributions

In the MPC-in-the-head paradigm, the prover wants to convince a verifier that she knows a pre-image x of y = f (x) for some one-way function f where the function f is represented as an arithmetic circuit. For the subset sum problem, the function f is defined via Equation (6.1) and it is thus natural to consider the simple inner-product arithmetic circuit defined over Z q . The prover's secret input is the binary vector x = (x 1 , . . . , x n ) ∈ {0, 1} n and she has to perform some secret-sharing of x in Z q in such a way that the shares of any unauthorized set of parties should reveal no information about the secret. This approach has the major disadvantage that sharing a single bit requires several elements of Z q each of size Θ(λ) bits.

We adapt the paradigm using a secret sharing scheme done directly over the integers. This approach was already used in cryptography (e.g. for multi-party computation modulo a shared secret modulus [START_REF] Catalano | Computing Inverses over a Shared Secret Modulus[END_REF]). To additively share a secret t in a given interval [-T, T ] for T ∈ N, among N ≥ 2 parties, a dealer may pick uniformly at random t 1 , . . . , t N ∈ [-T 2 ρ , T 2 ρ ] under the constraint that t = t 1 + • • • + t N (over the integers), for some parameter ρ. However, given (N -1) shares, t 2 , . . . , t N for instance, the value

t 1 = t -(t 2 + • • • t N ) is not randomly distributed in [-T 2 ρ , T 2 ρ
] and this may reveal information on the secret t. It is thus necessary to sample the shares in an interval sufficiently large in such a way that their distributions for distinct secrets are statistically indistinguishable. For a security level λ, this requires ρ = Ω(λ) and thus the additive sharing of bits involves shares of size Ω(λ). To overcome this limitation and use additive secret sharing over small integers, we will rely on rejection. The computation being actually simulated by the prover, they can abort the protocol whenever the sharing leaks information on the secret vector x = (x 1 , . . . , x n ) ∈ {0, 1} n . In some cases, the prover cannot respond to the challenge from the verifier and must abort the protocol. A similar idea was used for lattice-based signatures by Lyubashevsky [Lyu08; Lyu09] but using different methods.

Our technique also allows us to overcome the second disadvantage of the previous attempts to use the MPC-in-the-head paradigm for lattice-based problems. Using our additive secret sharing over the integers, we can prove the knowledge of some integer vector x = (x 1 , . . . , x n ) satisfying Equation (6.1) (for any q) and further prove that x i ∈ {0, 1} for i ∈ {1, . . . , n}. This is achieved by emulating a non-linear MPC operation modulo some arbitrary prime number q (independent from q and much smaller than q). We also introduce another technique to prove that the solution x = (x 1 , . . . , x n ) indeed lies in {0, 1} n using some masking and a cut-and-choose strategy. Both methods yield zero-knowledge proofs with Θ(λ 2 )-bit communication complexity for an alleged security level of λ bits. This improvement is not only of theoretical interest since for q 2 256 , our protocol can produce proof of size 13KB where Shamir's protocol [START_REF] Shamir | A Zero-Knowledge Proof for Knapsacks[END_REF] (updated with modern tips) produces proof of size 1186KB and [START_REF] Ling | Improved Zero-Knowledge Proofs of Knowledge for the ISIS Problem, and Applications[END_REF] produces proofs of size 2350KB.

Our method with the sharing over small integers is not specific to the subset sum problem and can be interesting as soon as we must deal with small secret values in a context where the modulus is large. As another illustration, we use our technique to construct an efficient digital signature scheme based on a pseudo-random function due to Boneh, Halevi, and Howgrave-Graham [START_REF] Boneh | The Modular Inversion Hidden Number Problem[END_REF]. Remark 6.1.2. In this introduction, we insisted on the fact that former zero-knowledge proofs for the subset sum problem achieve communication in Θ(λ 3 ) bits and, in this chapter, we present a scheme with Θ(λ 2 )-bit communication. Searching to achieve communication in Θ(λ 2 ) is very natural. For other hard problems (syndrome decoding, multivariate quadratic, ...), all the zero-knowledge proofs with non-negligible soundness error have communication in Θ(λ 2 ) bits because

• the communication of a single repetition of these zero-knowledge proofs scales linearly with the size of the problem instance, which scales itself in Θ(λ) bits,

• we need to repeat the protocol Θ(λ) times to have a λ-bit security.

Preliminaries

In Section 2.4.1, we defined the additive sharing scheme such that, to share a secret s, we choose s 1 , . . . , s N satisfying

s = s 1 + . . . + s N .
In this chapter, we will use a slightly different definition. To share a secret s among N parties, we choose uniformly at random s 1 , . . . , s N and we set a sharing offset ∆s such that

s = s 1 + . . . + s N + ∆s.
The sharing offset is a public part of the sharing that every party of the MPC protocol knows, while the i th share s i is known only by the i th party. We use this slightly different definition since ∆s will not have the same definition domain as the shares s 1 , . . . , s N in this chapter.

General Idea

We consider an instance (w, t) ∈ Z n q × Z q of the subset sum problem (SSP) and denote x one solution. We have x ∈ {0, 1} n and n j=1 x j • w j = t mod q. We want to use the MPCitH paradigm to build a zero-knowledge protocol that proves the knowledge of a solution for the instance (w, t). To proceed, we need to build an MPC protocol taking as inputs shares of the secret x, and possibly shares of other data, and which outputs Accept when x is a valid solution of the SSP instance. As a first ingredient, we need a method to share the secret x between the different parties.

The Naive Approach

The SSP instance is defined on Z q , so a natural sharing of x would be defined as:

x i ← (Z q ) n for all i ∈ [1 : N ], ∆x ← x -N i=1 x i mod q .
In the MPCitH paradigm with additive sharings (c.f. Section 3.1.2.2), the communication cost induced by a sharing is the cost to send the sharing offset, i.e. the vector ∆x. Here, the natural sharing of x costs n • log 2 (q) bits.

If we take n = 256 and q = 2 256 , the cost is about 2 16 bits = 8 KB. To achieve a soundness error of 2 -128 with N = 256, we need to repeat the protocol at least 16 times, so the communication cost of the protocol would be already more than 128 KB for the sole sharing of x (some communication being further required for the MPCitH protocol). Asymptotically, the parameters for the subset sum problem are chosen such that n = Θ(λ) and log 2 q = Θ(λ), the communication cost of this sharing is thus about Θ(λ 2 ) bytes per protocol repetition.

Since we need to repeat the protocol about Θ(λ) times to achieve a 2 -λ soundness error the global communication cost is then of at least Θ(λ 3 ) (for the sharing only). We present hereafter an alternative strategy for the sharing of x, which achieves better practical and asymptotic communication costs.

Sharing on the Integers and Opening with Abort

We propose another way to share the secret x to achieve lower communication. We know that x is a binary vector (i.e. x ∈ {0, 1} n ), so instead of the natural sharing, we suggest to use a sharing defined on the integers, that is

x i ← {0, . . . , A -1} n for all i ∈ [1 : N ], ∆x ← x -N i=1
x i with A some positive constant. However, this sharing leaks information about the secret x. The distribution ∆x j is not the same depending on whether x j = 0 or x j = 1 as illustrated on Figure 6.1. To solve this issue, the prover must abort the protocol in some cases.

To see how this leakage can be effectively exploited to (partly) recover x, let us recall that at the end of the protocol, the verifier shall ask the prover to open the views of all parties except one. Let us denote i * the index of the unopened party. It means the verifier will have access to { x i } i =i * and ∆x .

For the sake of simplicity, let us first consider the case n = 1, i.e. x ∈ {0, 1} and x is the sharing of a single integer. With the opened values, the verifier can compute

x -x i * as ∆x + i =i * x i .
Now let us denote Y = x -x i * the underlying random variable over the uniform random sampling of x i * . We have

Pr(Y = -A + 1) = 1 A if x = 0 0 if x = 1
and Pr(Y = 1) = 0 if x = 0 So by observing x -x i * = -A + 1 one learns (x, x i * ) = (0, -A + 1). Similarly, by observing x -x i * = 1 one learns (x, x i * ) = (1, 0). To avoid this flaw, the prover must abort the protocol before revealing { x i } i =i * and ∆x whenever one of these two cases occurs. This notably implies that ∆x must not be revealed before receiving the challenge i * , but it should still be committed beforehand in order to ensure the soundness of the protocol. Doing so, we modify the distribution of the revealed sharing offset which does not leak any information about x anymore as illustrated in Figure 6.1, and the probability to abort does not leak information about x since it is 1/A in the both cases (x = 0 and x = 1).

1 A if x = 1
Let us now come back to the general case of n ≥ 1. The prover applies the above abort strategy for all the coordinates of x, namely

• if there exists j ∈ [n] such that x j = 0 and x j i * = A -1, the prover aborts;

• if there exists j ∈ [n] such that x j = 1 and x j i * = 0, the prover aborts;

• otherwise the prover proceeds.

The probability to abort, which we call rejection rate, is

1 -1 - 1 A n ≤ n A .
We note that the rejection rate can be tightly approximated by the n/A upper bound when A is sufficiently large. In order to achieve a small (constant) rejection rate, we should hence choose A greater than n. Asymptotically, we then have A = Θ(n) = Θ(λ), which represents an exponential improvement compared to q = 2 Θ(λ) .

Let us now analyze the computation cost of our strategy for sharing x. Let us assume that the verifier chose i * and there was no rejection. Then, the prover needs to reveal ∆x (to enable the verifier to re-emulate the MPC protocol). ∆x j belongs to {-N • (A -1) + 1, . . . , 0}, therefore sending the sharing offset ∆x would cost n • log 2 (N • (A -1)) bits. However, the prover can save communication by sending x -x i * instead, which is strictly equivalent in terms of revealed information by the relation x -x i * = ∆x + i =i * x i . Since each coordinate of x -x i * is uniformly distributed over {-A + 2, . . . , 0}, sending it only costs n • log 2 (A -1) bits. With x -x i * , the verifier can recover ∆x by computing ∆x = (x -x i * )i =i * x i . The cost of this sharing has the advantage of being independent of the modulus q on which the SSP instance is defined. The value of A will be chosen according to the desired trade-off between communication cost and rejection rate. If n = 256 and A = 2 16 , we have a cost of 0.5 KB for a rejection rate of 0.0038, which is much better than the 8 KB of the naive approach.

Let us remark that adding an abort event does not impact the soundness of the protocol. A malicious prover can abort as many times she wants claiming that it would leak information, but an abort does not help to convince the verifier. The soundness theorem will state that someone who does not know the secret can only answer with a probability smaller than the constant value called soundness error, and adding an abort event cannot increase this probability. The prover could sample a random party i and give to i a wrong share and she may indeed decide to abort if the verifier challenge is not i , but this does not change the fact that the probability for the prover to convince the verifier is the probability that the prover guesses the verifier's challenge a priori. Now that we have defined the sharing of x, we need to demonstrate two properties of the shared SSP instance through multi-party computation. The first one is the SSP relation which in the shared setting translates to n j=1

x j • w j = t mod q for a sharing t of t. The linearity of this relation makes it easy to deal with: the share t i can simply be computed as t i := n j=1 x j i • w j mod q and committed to the verifier by the i th party. The verifier can then check that the opened parties have correctly computed their shares t i and that the relation N i=1 t i = t mod q well holds. The second property which must be demonstrated through multi-party computation is that the solution x corresponding to the sharing x is a binary vector. This is not a priori guaranteed to the verifier since the shares of the coordinate of x are defined over {0, . . . , A -1} and the correctness of the linear relation does not imply that x is indeed binary. We present two different solutions to this issue in the following.

Binarity Proof from Batch Product Verification

Our first solution to prove that the vector x is binary relies on standard MPC-in-the-Head techniques by checking the relation

x • (x -1) = 0
where • denotes the coordinate-wise product, 0 and 1 are to be interpreted as the all-0 and all-1 vectors. It consists in checking n multiplication triples, and so we can use one of the two multiplication verification protocols described in Section 3.4.1:

• the sacrificing-based verification [LN17; BN20; KZ22], or • the polynomial-based verification [BDK+21b; FJR22b; KZ22]. However, we can do better than a straight application of those techniques.

The relation x • (x -1) = 0 is defined in Z q and the above protocols imply to send at least one field element per product 1 , that is n elements from Z q . To save communication and since the sharing x is defined on the integers, we can work on a smaller field. We previously explained that the verifier receives { x i } i =i * and ∆x from the prover, so she can check that, for all j ∈ [n],

-A + 2 ≤ x j -x j i * ≤ 0 .

She further trusts x j i * ∈ {0, . . . , A -1} (which is verified for the open parties). Thus the verifier can deduce that, for all j ∈ [n],

-A + 2 ≤ x j ≤ A -1 . (6.2)
Let q be a prime such that q ≥ A. If the prover convinces the verifier that x j (x j -1) = 0 mod q , then the latter deduces that x j ∈ {0, 1} because q |x j (x j -1) ⇒ (q |x j ) or (q |x j -1) ⇒ (x j = 0) or (x j = 1) by Equation (6.2).

So, the prover just needs to prove x • (x -1) = 0 mod q for some prime q such that q ≥ A.

To this purpose, we apply one of the two batch product verifications.

Using sacrificing-based verification. The prover first samples a ∈ (Z q ) n with its sharing

a i ← (Z q ) n for i ∈ [1 : N ] .
The value a is hence defined as a uniform random element of (Z q ) n and no sharing offset ∆a is necessary (∆a := 0). The prover then computes c = a, x and its sharing as

c i ← Z q for all i ∈ [1 : N ], ∆c ← c -N i=1 c i mod q .
The prover gives the shares of x, a and c as input to the parties and runs the following MPC protocol:

1. the parties get a random challenge ε ∈ (Z q ) n from the verifier; Besides the input shares and commitments, the prover-to-verifier communication cost of the corresponding MPCitH zero-knowledge protocol only results from the size of α i * (the broadcasted vector of the unopened party i * ), which is of around n • log 2 (q ) bits.

We stress that the prover does not need to send v i * because the verifier knows that v must be zero and will deduce

v i * = -∆v -i =i * v i .
The sacrificing-based multiplication verification produces false positives with probability 1/q . Thus the soundness error of the obtained zero-knowledge protocol is

1 -1 - 1 N 1 - 1 q ≈ 1 N + 1 q .
On the other hand, the resulting protocol has a rejection rate of 1 -(1 -1 A ) n and a proverto-verifier communication cost (in bits) of

2 • (2λ) + n • log 2 (A -1) x-x i * + n • log 2 (q ) ∆α + log 2 (q ) ∆c +λ log 2 N + 2λ .
Using polynomial-based verification. Let us consider some distinct public points γ 1 , . . . , γ n ∈ F q and an additional scheme parameter ν. The prover first computes the degree-(n -1) polynomial S by interpolation such that S(γ i ) = x i for all i. Since x • (x -1) = 0, we have that there exists a degree-(n -2) polynomial P such that

S(X) • (S(X) -1) = P (X) • n i=1 (X -γ i ). ( 6.3)
The prover computes this polynomial P with its sharing P . The prover also samples a ∈ (Z q ν ) with its sharing a . The value is defined as a uniform random element of (Z q ν ), so no sharing offset ∆a is necessary. The prover then computes c = a 2 and its sharing c . The prover gives the shares of x, P , a and c as input to the parties and runs the following MPC protocol:

1. the parties get random challenges r, ε ∈ (Z q ν ) n from the verifier; 2. the parties locally compute S by interpolation: false positive from Schwartz-Zippel

S = n i=1 x i n j=1,j =i X -γ j γ i -γ j
+ 1 - 2n -1 q ν • 2 q ν false positive from [BN20]
.

Thus the soundness error of the obtained zero-knowledge protocol is

1 -1 - 1 N 1 - 2n -1 q ν 1 - 2 q ν ≈ 1 N + 2n + 1 q ν .
On the other hand, the protocol has a rejection rate of 1 -(1 -1 A ) n and a prover-to-verifier communication cost (in bits) of

2 • (2λ) + n • log 2 (A -1) x-x i * + (n -1) • log 2 (q ) ∆P + ν • log 2 (q ) ∆α + ν • log 2 (q ) ∆c +λ log 2 N + 2λ .

Comparison between both multiplication checking MPC protocols. In a context

where the false positive rate just needs to be negligible compared to 1 N , the sacrificing-based approach will provide better results: it leads to slighly smaller sizes and a much simpler implementation (it does not require interpolation). In a context where the false positive rate must be close to the security level, the polynomial-based approach will be better: it can achieve very small false positive rate by increasing ν without degrading too much the communication (with the sacrificing-based approach, it would require to take a larger q but it directly impacts the obtained sizes). So in practice,

• when we want to build an interactive proof of knowledge, we should consider the sacrificing-based verification;

• when we want to build a non-interactive argument (e.g. a signature scheme), we should consider the polynomial-based verification.

Binarity Proof from Masking and Cut-and-Choose Strategy

Our second solution to prove that x encodes a binary vector relies on a masking of x and a cut-and-choose strategy (see Section 3.3.1). The idea is to generate a random vector r from {0, 1} n and to apply the sharing described in Section 6.2.2 to r. In addition, the prover computes (and commits) x := x ⊕ r ∈ {0, 1} n where ⊕ represents the XOR operation. Instead of giving the shares x of x as inputs of the MPC protocol, the idea is now to send the shares r of r. Then using x, the parties can locally deduce a sharing of x as

x = (1 -x) • r + x • (1 -r )
which is a linear relation in r , and the verifier can further deduce the sharing offset ∆x from ∆r as ∆x = (1 -x) • ∆r + x • (1 -∆r) .

By replacing x with r the parties' input is made independent of the secret. The interest of doing so is to enable a cut-and-choose strategy to prove that r encodes a binary vector, which in turns implies that x = x⊕r is a binary vector. More precisely, at the beginning of the zero-knowledge protocol, the prover produces M binary vectors r [ ] and their corresponding shares r [ ] (in practice these vectors and their sharings are pseudo-randomly derived from some seeds). Then the prover commits those sharings r [ ] as well as the corresponding masked vectors x[ ] := x ⊕ r [ ] . Then the verifier asks to open all the sharings r [ ] except one and checks that they correspond to binary vectors. The verifier will hence trust that the unopened sharing encodes also a binary vector with a soundness error of 1/M . We stress that all the values x[ ] for which r [ ] is opened must remain hidden (otherwise x could be readily recovered). The obtained zero-knowledge protocol has a soundness error of

max 1 M , 1 N , a rejection rate of 1 -(1 -1 A )
n and a prover-to-verifier communication cost (in bits) of

2 • (2λ) + λ log 2 M Cost of C&C + n • log 2 (A -1) r-r i * + n x +λ log 2 N + 2λ .

Asymptotic Analysis

We analyze hereafter the asymptotic complexity of the two variants of our protocol. We show that for a security parameter λ both variants have an asymptotic communication cost of Θ(λ 2 ) and an asymptotic computation time of Θ(λ 4 ).

For the binarity proof based on masking and cut-and-choose, we assume M = N (which is optimal for the communication cost given the soundness error). For the other parameters, let us recall that • for a security parameter λ, one must take n ≈ log 2 q = Θ(λ),

• the prime q can be chosen as the smallest prime greater than A, which implies q ≈ A.

For both variants, the asymptotic communication cost for one repetition of the protocol is then of Θ(λ log 2 A + λ log 2 N ) .

Since each repetition has a soundness error of Θ(1/N ), the protocol must be repeated τ = Θ(λ/log 2 N ) times to reach a global soundness error of 2 -λ . The probability that any of these τ repetitions aborts is given by

1 -1 - 1 A n•τ ≈ n • τ A
where the approximation is tight when A is sufficiently large. Thus for a small constant rejection probability, one must take A = Θ(n • τ ) = Θ(λ 2 / log 2 N ). We have a communication cost for the τ iterations in

Θ λ 2 log 2 A log 2 N + λ 2 = Θ λ 2 log 2 N log 2 λ 2 log 2 N + λ 2
and we hence obtain a minimal asymptotic communication cost of Θ(λ 2 ) by taking N = Θ(λ). The asymptotic computation time for one repetition of the protocol is of Θ(N n(log 2 q)(log 2 A)), where the term (log 2 q)(log 2 A) arises from the complexity of the multiplication between an element of Z q and a value smaller than A. We hence get a computation time of Θ(λ 3 log 2 λ) per repetition which makes Θ(λ 4 ) for τ repetitions.

Protocols and Security Proofs

In this section, we formally describe our two protocols and state their security. We further introduce a method to decrease the rejection rate.

Protocol with Batch Product Verification

Protocol description. In Section 6.2.3, we proposed two MPC protocols that proves that the sharing x encodes a binary vector. We then add the checking of the linear relation as described in Section 6.2.2 and we transform the multi-party computation into a zeroknowledge protocol which proves the knowledge of a solution of an SSP instance. We give the formal description of our protocol in Protocol 7: the instructions in blue correspond to those of the sacrificing-based verification, while the instructions in orange correspond to those of the polynomial-based verification. The protocol makes use of a pseudo-random generator PRG, a GGM tree as puncturable PRF, two collision-resistant hash functions Hash i for i ∈ {1, 2} and a commitment scheme (Com, Verif).

Security proofs.

The following theorems state the completeness, zero-knowledge and soundness of Protocol 7. We refer the reader to [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF] for the proofs of Theorems 6.3.1, 6.3.2 and 6.3.3. Theorem 6.3.1 (Completeness). A prover P who knows a solution x to the subset sum instance (w, t) ∈ Z n q × Z q and who follows the steps of Protocol 7 convinces the verifier V with probability

1 - 1 A n .
Theorem 6.3.2 (Zero-Knowledge). Let the PRG used in Protocol 7 be (t, ε PRG )-secure and the commitment scheme Com be (t, ε Com )-hiding. There exists an efficient simulator S which outputs a transcript which is (t, ε PRG + ε Com )-indistinguishable from a real transcript of Protocol 7.

Theorem 6.3.3 (Soundness). Suppose that there is an efficient prover P that, on input (w, t), convinces the honest verifier V on input H, y to accept with probability

ε := Pr[ P(w, t), V(w, t) = 1] > ε for a soundness error ε equal to p + 1 N -p • 1 N ,

with

• p is equal to 1 q when relying on the sacrificing-based verification, For each party i ∈ {1, . . . , N }: -----------The parties locally set t = w, x .

Prover P Verifier V x ∈ {0, 1} n w ∈ Z n q , t = w,
a i , x i , c i ← PRG(seed i ) a ∈ Z n q , c ∈ Z q , x i ∈ {0, . . . , A -1} n a i , P i , x i , c i ← PRG(seed i ) a ∈ Z q ν , P ∈ Z q [X] <n-1 , com i = Com(seed i ; ρ i ) c ∈ Z q , x i ∈ {0, . . . , A -1} n ∆x = x -i x i ∆c = a, x -i c i ∆c = a 2 -i c i Compute P as in Equation (6.3) ∆P = P -i P i h = Hash 1 (∆x, ∆P,∆c, com 1 , . . . , com N ) h ------------→ ε $ ← -Z n q ε ←-
t ∈ Z q The parties run the MPC protocol.

computation in

Z q h = Hash 2 ( t , α , v ) h ------------→ i * $ ← -{1, . . . , N } i * ←------------ If there exists j ∈ [n] such that:
-either x j i * = 0 with x j = 1 -or

x j i * = A -1 with x j = 0, then abort. y = x -x i * (seed i , ρ i ) i =i * , com i * , y, ∆P, ∆c, α ------------→ For all i = i * , a i , x i , c i ← PRG(seed i ) a i , P i , x i , c i ← PRG(seed i ) ∆x = y -i =i * x i ∆α = ε • (1 -∆x) ∆S(r) = i ∆x i j =i r-γj γi-γj ∆α = ε • ∆S(r) For all i = i * ,
Rerun the party i as the prover and compute the commitment

com i . ∆t = w, ∆x ∆v = α, ∆x -∆c ∆v = ε 2 ((∆P )(r) i (r -γ i ) + ∆S(r)) -α • ε • ∆S(r) -∆c α i * = α -i =i * α i t i * = t -∆t -i =i * t i v i * = -∆v -i =i * v i Check h = Hash 1 (∆x, ∆c, com 1 , . . . , com N ) Check h = Hash 2 ( t , α , v ) Return Success
Protocol 7: Zero-knowledge argument for Subset Sum Problem via MPC-in-the-head with rejection, using batch product verification to prove binarity (using sacrificingbased verification in blue, using polynomial-based verification in orange).

• p is equal to 2n-1 q ν + (1 -2n-1 q ν ) 2 q ν when relying on the polynomial-based verification. Then, there exists an efficient probabilistic extraction algorithm E that, given rewindable black-box access to P, produces either a witness x such that t = w, x and x ∈ {0, 1} n , or a commitment collision, by making an average number of calls to P which is upper bounded by

4 ε -ε • 1 + ε • 2 • ln(2) ε -ε .
Proof size. To achieve a targeted soundness error 2 -λ , we can perform τ parallel executions of the protocol such that ε τ ≤ 2 -λ . Such parallel repetition does not preserve (general) zero-knowledge and the resulting scheme achieves honest verifier zero knowledge. And instead of sending τ values for h and h , the prover can merge them together to send a single h and a single h . Moreover, instead of sending the N -1 seeds and commitment randomness of (seed i , ρ i ) i =i * for each execution, we can send the sibling path from (seed i * , ρ i * ) to the tree root in the GGM tree, it costs at most λ • log 2 (N ) bits (we need to reveal log 2 (N ) nodes of the tree) by execution. The communication cost (in bits) of the protocol with τ repetitions is (with ν = 1 when considering the sacrificing-based polynomial)

Size = 4λ + τ • n • (log 2 (A -1) + log 2 (q )) + (2ν -1) log 2 (q ) + λ log 2 N + 2λ
while the soundness error and rejection rate scale as

p + 1 N -p • 1 N τ and 1 -1 - 1 A τ •n
respectively, with p defined as in Theorem 6.3.3. Let us stress that the obtained size is independent of the modulus q (and of the size of the integers {w j }, t).

Protocol with Cut-and-Choose Strategy

Protocol description. As described in Section 6.2.4, we can also use a cut-and-choose strategy to prove that the vector x is binary. It is possible since we can remplace the input x of the multi-party computation by a sharing r independent of the secret, where r is a mask uniformly sampled in {0, 1} n . To achieve a targeted soundness error 2 -λ , we can perform τ parallel executions of the protocol such that ε τ ≤ 2 -λ . Like [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF], instead of performing τ independent cut-and-choose phases each resulting in trusting one sharing r among M , we can perform a global cut-and-choose phase resulting in τ trusted sharings r among a larger M (see [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] for more details). We give the formal description of this zero-knowledge protocol in Protocol 8. The protocol makes use of a pseudo-random generator PRG, a GGM tree as puncturable PRF, four collision-resistant hash functions Hash i for i ∈ {1, 2, 3, 4} and a commitment scheme (Com, Verif).

Security proofs.

The following theorems state the completeness, zero-knowledge and soundness of Protocol 8. We refer the reader to [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF] for the proofs of Theorems 6.3.4, 6.3.5 and 6.3.6. Theorem 6.3.4 (Completeness). A prover P who knows a solution x to the subset sum instance (w, t) ∈ Z n q × Z q and who follows the steps of Protocol 8 convinces the verifier V with probability

1 - 1 A τ •n . Prover P Verifier V x ∈ {0, 1} n w ∈ Z n q , t = w, x w, t mseed [0] ← {0, 1} λ (mseed [e] ) e∈[M ] ← TreePRG(mseed [0] )
For each e ∈ {1, . . . , M }:

r [e] ← PRG(mseed [e] ) r [e] ∈ {0, 1} n (seed

[e] i , ρ [e] i ) i∈[1:N ] ← TreePRG(mseed [e] )
For each i ∈ {1, . . . , N }:

r [e] i ← PRG(seed

[e] i ) r [e] i ∈ {0, . . . , A -1} n com [e] i = Com(seed [e] i ; ρ [e] i )
∆r [e] = r [e] i r [e] i h e = Hash 1 (∆r [e] , com

[e] 1 , . . . , com [e] n ) h = Hash 2 (h 1 , . . . , h M ) h ------------→ J ← {J ⊂ [M ] ; |J| = τ } J ←------------
For each e ∈ J:

x[e] = x ⊕ r [e]
⊕ is the XOR operation (x ∈ {0, 1} n ) The parties locally set

x

[e] = (1 -x[e] ) • r [e]
+x [e] • (1 -r [e] ) and they set t [e] = w, x [e] . h e = Hash 3 (x [e] , t [e] ) h = Hash 4 ((h e ) e∈J )

h , (mseed [e] ) e∈[M ]\J ------------→ L = { e } e∈J ← {1, . . . , N } τ L ←------------ If there exists (e, j) ∈ J × [n] such that:
-either r

------------→

For each e ∈ J:

Compute h e using mseed [e] For each e ∈ J:

For all i = e com [e] i = Com(seed [e] i ; ρ [e]
i ) Rerun the party i as the prover to get t [e] i ∆r [e] = yi = e r [e] h e = Hash 1 (∆r [e] , com

[e] 1 , . . . , com [e]
n ) From ∆r [e] , deduce ∆t [e] .

t [e] = t -∆t [e]i = e t [e] i h e = Hash 3 (x [e] , t [e] ) Check h = Hash 2 (h 1 , . . . , h M ) Check h = Hash 4 ((h e ) e∈J ) Return Success Protocol 8: Zero-knowledge argument for Subset Sum Problem via MPC-in-the-head with rejection, using cut-and-choose strategy to prove binarity.

M -τ ≤k≤M k M -τ M M -τ • N k-M +τ .
Then, there exists an efficient probabilistic extraction algorithm E that, given rewindable black-box access to P, produces either a witness x such that t = w, x and x ∈ {0, 1} n , or a commitment collision, by making an average number of calls to P which is upper bounded by

4 ε -ε • 1 + ε • 8 • M ε -ε .
Proof size. Let us recall that the couples (seed i , ρ i ) are sampled using a GGM seed tree, sending

i ) i = e costs at most λ • log 2 (N ) bits by iteration. The communication cost (in bits) of the protocol is then

Size = 4λ + λ • τ • log 2 M τ + τ • [n • log 2 (A -1) + n + λ log 2 N + 2λ] .
Here again, the obtained size is independent of the modulus q (and of the size of the integers {w j }, t).

Decreasing the Rejection Rate

The two above protocols have a rejection rate around τ n/A which implies that we must take A = Θ(τ n) to obtain a constant (small) rejection rate. In practice, this results in a significant increase in the communication cost. Let us for instance consider Protocol 7 with (τ, N, A) = (16, 280, 2 13 ) using (n, q) = (256, q 256 ). For this setting, the proof size is about 15.6 KB for a rejection rate of 0.394. If we want a rejection rate below 0.003 (by increasing A), we should take A = 2 21 and the proof size would be 23.6 KB.

A better strategy consists in allowing the prover to abort a few of the τ iterations. Let us assume that the verifier accepts the proof if the prover can answer to τ -η challenges among the τ iterations. This slightly increases the soundness error, but it can also significantly decrease the global rejection rate. If we denote p rej the probability that an iteration aborts, then the global rejection rate of this strategy is given by 1 -

η i=0 τ i • (1 -p rej ) τ -i • p i rej . (6.4)
Chapter 6

Instantiations and Performance 97

At the same time, the soundness error for Protocol 7 becomes

η i=0 τ i • (1 -ε) i • ε τ -i
where ε = 1 N + p -p • 1 N is the soundness error of a single iteration. Using this strategy with τ = 20 and η = 3, the proof size is of 16.7 KB for a rejection rate of 0.003 (instead of 23.6 KB with the naive strategy).

The same strategy also applies to Protocol 8. The rejection rate is also given by Equation Equation (6.4) while the soundness error becomes max

M -τ ≤k≤M k M -τ M M -τ • η i=0 k -M + τ i 1 - 1 N i 1 N k-M +τ -i .
In any case, the prover always answers to at most τ -η challenges of the verifier (even if the prover aborts less than η among the τ iterations) so that the communication cost is roughly that of τ -η iterations. Additionally, for each unanswered challenge, the prover must further send two hash digests to enable the verifier to recompute and check h and h . Thus the new proof size (in bits) for Protocol 7 is

Size η = 4λ+η •4λ+(τ -η)• n • (log 2 (A -1) + log 2 (q )) + (2ν -1) log 2 (q ) + λ log 2 N + 2λ ,
while the new proof size (in bits) for Protocol 8 is

Size η = 4λ + η • 4λ + λ • τ • log 2 M τ + (τ -η) • [n • log 2 (A -1) + n + λ log 2 N + 2λ] .
We note that in practice, given a target security level and a target rejection probability, one needs to use a slightly increased τ (or N ) to compensate for the loss in terms of soundness. While this shall slightly increase the proof size, the above approach (with η > 0) still provides better trade-offs than the original approach (η = 0).

Instantiations and Performance

Subset Sum Instances

We recall in this section known techniques to solve the modular subset sum problem (SSP) defined by Equation (6.1). It is well-known that the hardness of an SSP instance depends greatly on its density defined as d = n/ log 2 q. If the SSP instance is too sparse (e.g. d < 1/n) or too dense (e.g. d > n/ log 2 n) then the problem can be solved in polynomial time (see e.g. [START_REF] Matthijs | Improved Low-Density Subset Sum Algorithms[END_REF] and references therein). We shall therefore only consider SSP instances with density d 1 (i.e. q 2 n ) which are arguably the hardest ones [START_REF] Impagliazzo | Efficient Cryptographic Schemes Provably as Secure as Subset Sum[END_REF].

In this case, simple algorithms exist based on brute force enumeration at O(2 n ) time and constant space, or time-space tradeoff [START_REF] Horowitz | Computing Partitions with Applications to the Knapsack Problem[END_REF] with O(2 n/2 ) time and space complexities. The first non-trivial algorithm was published by Schroeppel and Shamir [START_REF] Schroeppel | A T=O(2 n/2 ), S=O(2 n/4 ) Algorithm for Certain NP-Complete Problems[END_REF] with time complexity O(2 n/2 ) and space complexity O(2 n/4 ). Later, faster algorithms were proposed with similar time and space complexities, e.g. Õ(2 0.337n ) by Howgrave-Graham and Joux [START_REF] Howgrave | New Generic Algorithms for Hard Knapsacks[END_REF] and Õ(2 0.283n ) by Bonnetain, Bricout, Schrottenloher and Shen [START_REF] Bonnetain | Improved Classical and Quantum Algorithms for Subset-Sum[END_REF]. The latter algorithms neglect the cost to access an exponential memory but even with this optimistic assumption, for n = 256, all known algorithms require at least a time complexity lowerbounded by 2 128 operations or memory of size at least 2 72 bits. There also exists a vast literature on quantum algorithms for solving the SSP (see [START_REF] Bonnetain | Improved Classical and Quantum Algorithms for Subset-Sum[END_REF] and references therein). The best (heuristic) quantum complexity from [START_REF] Bonnetain | Improved Classical and Quantum Algorithms for Subset-Sum[END_REF] has time complexity Õ(2 0.216n ) and thus requires about 2 64 quantum operations and quantum memory for n = 256. In the following, we, therefore, consider the efficiency of our protocols for n = 256.

Zero Knowledge Protocols

Let us consider the subset sum problem with n = 256. We propose in Table 6.1 several sets of parameters for our two protocols which target a security of 128 bits. We provide two kinds of instantiations to give the reader an idea of the obtained performance while changing the number of parties. The first ones correspond to instantiations with fast computation. The second ones correspond to instantiations that achieve smaller communication costs but slower computation. For each setting, we suggest two parameter sets: one achieving a rejection rate around 0.4 and the other one achieving a rejection rate between 0.001 and 0.004. We provide in Table 6.1 the performance of the other zero-knowledge protocols proving the knowledge of an SSP solution. The only other protocol designed for the subset sum problem is Shamir's one [START_REF] Shamir | A Zero-Knowledge Proof for Knapsacks[END_REF]. We can also compare these protocols with [START_REF] Ling | Improved Zero-Knowledge Proofs of Knowledge for the ISIS Problem, and Applications[END_REF] which is an adaptation of Stern's protocol to the ISIS (inhomogeneous short integer solution) problem. The remaining articles in the literature about proofs for the ISIS problem are restricted to the case where the modulus q is prime. We add Beullens' protocol [START_REF] Beullens | Sigma Protocols for MQ, PKP and SIS, and Fishy Signature Schemes[END_REF] for ISIS with prime q to the comparison.

Signature Schemes with Subset Sum Problem

For each of our two protocols, we explain how to apply the Fiat-Shamir transform [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF] to get signature schemes.

Signature from Protocol 7. We compute the challenges {ε [e] } e∈[τ ] and {i * [e] } e∈ [τ ] for τ executions as:

{ε [e] } e∈[τ ] := Hash 1 (m, h)

and {i * [e] } e∈[τ ] := Hash 2 (m, h, h )
where m is the message to sign, Hash 1 and Hash 2 are some hash functions, and h (resp. h ) is the hash value corresponding to the merged inputs of Hash 1 (resp. Hash 2 ) from the τ executions.

Since the protocol has 5 rounds, we must take into account the forgery attack described in [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF] to estimate the security of the resulting signature. When we adapt the attack for Protocol 7, its cost is given by cost forge = min

τ 1 ,τ 2 :τ 1 +τ 2 =τ 1 τ i=τ 1 PMF(i, τ, 1 q ) + 1 η i=0 PMF(i, τ 2 , 1 -1 N )
, with PMF(i, τ, p) := τ i p i (1 -p) τ -i . When selecting the signature parameters, we must choose τ such that cost forge ≥ 2 λ .

Signature from Protocol 8. The challenges J and L are computed as

J := Hash 1 (m, h)
and L := Hash 2 (m, h, h , (mseed [j] )

j∈[M ]\J )
where m is the message to sign and where Hash 1 and Hash 2 are some hash functions.

Since the protocol has 5 rounds, the security of the resulting signature scheme is given by the attack of [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF] which has, in the context of the Protocol 8, a forgery cost of cost forge = min

M -τ ≤k≤M M M -τ k M -τ + 1 η i=0 PMF(i, k -M + τ, 1 -1 N )
.

Another approach consists in turning the 5-round protocol into a 3-round protocol (before applying the Fiat-Shamir). We refer to [KKW18; FJR23] for the details of such an approach. The soundness error of this variant is the same as for the original protocol (see Theorem 6.3.6). When we apply the Fiat-Shamir to this variant, the security of the obtained signature scheme is equal to the soundness security of the protocol (since the protocol has now only 3 rounds) and its size (in bits) is

Size η = 4λ + η • 4λ + 3λ • τ • log 2 M τ + (τ -η) • [n • log 2 (A -1) + n + λ log 2 N + 2λ] .
Performance. We selected some parameter sets to instantiate the resulting signature schemes while targeting a security of 128 bits and a rejection rate of 0.01. We obtained the performance of Table 6.2.

Digital Signatures from Boneh-Halevi-Howgrave-Graham PRF

As illustrated on the subset sum problem, our technique of sharing over the integers with rejection is -more generally -instrumental to a context of a secret vector s ∈ Z n q with small coefficients. Since the communication cost of our protocols is independent of the size q of the ring Z q , the gain in communication is higher when the modulus q is high. But it does not need to have a modulus as high as in the subset sum problem to be interesting. In what follows, we present another application of our technique: a short and efficient candidate post-quantum signature scheme based on an elegant pseudo-random function (PRF) proposed by Boneh, Halevi, and Howgrave-Graham in 2001 [START_REF] Boneh | The Modular Inversion Hidden Number Problem[END_REF].

Let p be a public m-bit prime number that defines the PRF message space as Z p . A secret key for the PRF is an element x ∈ Z p picked uniformly at random. We denote MSB δ (t) the δm most significant bits of an m-bit element t ∈ Z p . 2 The value of the PRF on the message m ∈ Z p for the secret-key x ∈ Z p is F x (m) = MSB δ ((x + m) -1 mod p).

Our signature scheme follows the blueprint of most signatures based on the MPCitH paradigm since the proposal of Picnic [START_REF] Chase | Post-Quantum Zero-Knowledge and Signatures from Symmetric-Key Primitives[END_REF]: the public key is made of the outputs of Boneh et al.'s PRF on t public messages in {1, . . . , t}, i.e. the δm-bit elements y 1 , . . . , y t such that y i := MSB δ ((x + i) -1 mod p) for i ∈ {1, . . . , t} and the signature consists of a non-interactive proof of knowledge of x, z 1 , . . . , z t (parametrized by the signed message using the Fiat-Shamir heuristic) such that

(x + 1)(2 (1-δ)m y 1 + z 1 ) ≡ • • • ≡ (x + t)(2 (1-δ)m y t + z t ) ≡ 1 mod p (6.5) and z 1 , . . . , z t ∈ {0, . . . , 2 (1-δ)m -1} (6.6)
where z 1 , . . . , z t are the (1 -δ)m least significant bits of (x + 1) -1 mod p, . . . , (x + t) -1 mod p. Note that the condition (6.6) on the size of the z i 's is fundamental since otherwise, it is easy for an attacker to find a witness. In our applications, the values of t and δ are chosen to prevent all known classical attacks and target a 128-bit security level.

Let us fix t, the number of outputs of the PRF. Then, to ensure that the equations (6.5) and (6.6) have a unique witness, we add the constraint δ ≥ 1/t so that the t PRF outputs define (heuristically) the secret x uniquely. To avoid brute-force attacks from a single output of the PRF, at least 128 bits should remain hidden for each output, thus m := log p ≥ 128 1-δ . Otherwise, an attacker could reconstruct a possible PRF key matching with the first output and then test it by evaluating the other outputs with this candidate.

It is possible to apply generically the MPCitH paradigm to prove (6.5) and (6.6), but proving (6.6) seems inefficient (e.g. by using a binary decomposition and proving consistency). Instead, we can use our secret sharing over the integers for proving the knowledge of small z i 's by sharing them as a sum of "small" integers which directly proves that the z i 's are indeed small. Proving Equation (6.5). Instead of proving the t products of (6.5) separately, the prover can batch them into a linear combination where coefficients γ 1 , ..., γ t are provided by the verifier, i.e. the prover proves the equation

t i=1 γ i • (x + i)(2 (1-δ)m y i + z i ) -1 = 0 mod p, or equivalently, x • t i=1 γ i z i = - t i=1 γ i x • 2 (1-δ)m y i + i • 2 (1-δ)m y i + i • z i -1 mod p.
(6.7)

If one of the products is not equal to 1 in (6.5), then (6.7) is satisfied only with a probability of 1 p . And to prove (6.7), one can use the [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] protocol with a single multiplication on Z p (for the left-hand side of (6.7), the right-hand side being a linear combination of the witness). The resulting MPC protocol produces false positives with probability 1/p + (1 -1/p) • 1/p := 2/p -1/p 2 , and thus the obtained zero-knowledge argument has a soundness error of

ε = 1 N + 1 - 1 N 2 p - 1 p 2 .
Proving Equation (6.6). It remains to prove that z i is in {0, . . . , B -1} with B = 2 (1-δ)m in (6.6) for i ∈ {1, . . . , t}. To share z i , we use our secret sharing over the integers of Section 6.2.2. Since the z i are not binary but in a larger range, we need to adapt the rejection rules. Following exactly the same reasoning as in Section 6.2.2, we get that the prover must abort if there exists an index j ∈ [t] for which z j -

z j i * ≥ 1 or z j -z j i * ≤ -A + B -1.
The resulting rejection rate is given by

p rej = 1 -1 - B -1 A t•τ ≈ t • τ • B -1 A .
Even without proving anything on the range of z j , the verifier knows that ∀j ∈ [t], -A + B ≤ z j ≤ A -1 thanks to Equation (6.2) (generalized). In practice, we settle for this range, implying that there is a slack between the underlying hard problem and the proven statement. A malicious prover can use bigger values for z i , and this is equivalent to ignoring some bits of y i . A malicious prover can ignore up to log 2

A B ≈ log 2 t•τ
p rej bits for each PRF output, and thus it reduces the security of t • log 2 t•τ p rej bits. A way to fix this security loss without increasing the size of p (and of the key) is to reveal a few more PRF outputs to guarantee that the key is still heuristically unique. In theory, this decreases the security but for state-of-the-art algorithms, this stays beyond the capacity of the best-known algorithms for small t. In fact, we need to reveal t ≥ t outputs of the PRF such that

t • δ • m -t • log t • τ p rej > m.
In other words, we replace the constraint δ ≥ 1 t by

δ ≥ 1 t + 1 m log 2 t • τ p rej .
This leads to the scheme described as Protocol 9 with the communication cost (in bits):

4λ + τ • (log 2 p ∆x + t • log 2 A ∆a i + log 2 p ∆c + log 2 p ∆α +λ • log 2 N + 2λ),
with soundness error (if interactive)

ε = 1 N + p • 1 - 1 N ,
and with forgery security (if non-interactive)

cost forge = min τ 1 ,τ 2 :τ 1 +τ 2 =τ 1 τ i=τ 1 τ i p i (1 -p ) τ -i + N τ 2 , with p := 2/p + 1/p 2 .
We propose in Table 6.3 some parameters which target 128-bit security (based on the hardness of the so-called modular inverse hidden number problem) according to the current cryptanalysis state-of-the-art for Boneh et al.'s PRF. We can remark that the achieved signature sizes are competitive with Rainier scheme [START_REF] Dobraunig | Shorter Signatures Based on Tailor-Made Minimalist Symmetric-Key Crypto[END_REF] (which can produce signatures that are around 5 KB in size too) and outperform all the other signatures based on MPC-inthe-Head paradigm (Picnic4 [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF], PorcRoast [START_REF] Beullens | LegRoast: Efficient Post-quantum Signatures from the Legendre PRF[END_REF], SDitH [START_REF] Feneuil | Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs[END_REF], . . . ).

Regarding the cryptanalysis, the security of Boneh et al.'s PRF has been extensively analyzed since 20 years [BHH01; LSSW12; BVZ12; XSH+19] and relies strongly on δ and the number of known PRF outputs. The first natural attack is the brute-force search on one output of the PRF as explained previously. We choose our parameter sets such that (1 -δ)m > 128 (6.8) For each party i ∈ {1, . . . , N }:

Prover P Verifier V x ∈ {0, 1} n (z 1 ,
x i , a i , c i ← PRG(seed i ) x , a i , c i ∈ Z p #" z i ← PRG(seed i ) #" z i ∈ {0, . . . , A -1} t com i = Com(seed i ; ρ i ) ∆x = x -i x i ∆c = a • x -i c i ∆ #" z = #" z -i #" z i h = Hash 1 (∆x, ∆c, ∆ #" z , com 1 , . . . , com N ) h ------------→ γ 1 , . . . , γ t , ε $ ← -Z p #" γ ,ε ←------------ The parties locally set -α = ε • #" γ , #" z + a mod p -r = "right part of Equation 6.7
The parties open α to get α.

The parties locally set

v = ε • r -α • x + c mod p h = Hash 2 ( α , v ) h ------------→ i * $ ← -{1, . . . , N } i * ←------------ #" µ = #" z -#" z i *
If there exists j ∈ [t] such that:

-either µ j ≥ 1 -or µ j ≤ -A + B -1, then abort.

(seed i , ρ i ) i =i * , com i * , #" µ , ∆c, α i * ------------→ For all i = i * , x i , a i , c i ← PRG(seed i ) #" z i ← PRG(seed i ) ∆ #" z = #" µ -i =i * #" z i ∆α = ε • #" γ , ∆ #" z For all i = i * ,
Rerun the party i as the prover and compute the commitment com i . ∆r = deduces from the right part of Eq 6.7

∆v = ε • ∆r -α • ∆x -∆c v i * = -∆v -i =i * v i Check h = Hash 1 (∆x, ∆c, ∆ #" z , com 1 , . . . , com N ) Check h = Hash 2 ( α , v ) Return Success
Protocol 9: Relaxed zero-knowledge argument for Boneh et al's PRF. to prevent this attack. [START_REF] Boneh | The Modular Inversion Hidden Number Problem[END_REF] and [START_REF] Bauer | Inferring Sequences Produced by Nonlinear Pseudorandom Number Generators Using Coppersmith's Methods[END_REF] describe the best known lattice-based attacks with a small number of PRF outputs and require larger δ's than the ones we use. In order to mount them, an adversary has to perform an exhaustive search on the missing bits on several outputs. Let us focus on the attack of [START_REF] Boneh | The Modular Inversion Hidden Number Problem[END_REF]. The attacker first chooses n > 1 arbitrary ouputs among the t ones. To run the attack, they need to have at least 2n+1 3n+1 • m bits for each output, thus they can exhaustively search the n • 2n+1 3n+1 -δ • m missing bits. For each candidate, the attacker applies the attacks of [START_REF] Boneh | The Modular Inversion Hidden Number Problem[END_REF] which consists in reducing a lattice of dimension O(n). To prevent this attack against our parameter sets, we select m, t and δ such that

∀1 < n ≤ t, n • 2n + 1 3n + 1 -δ • m ≥ 128. (6.9)
Similarly, we can build an attack based on [START_REF] Bauer | Inferring Sequences Produced by Nonlinear Pseudorandom Number Generators Using Coppersmith's Methods[END_REF] with an exhaustive search to get the missing bits. To prevent this attack, we select m, t and δ such that

∀1 < n ≤ t, n • 2 n-1 2 n -1 -δ • m ≥ 128. (6.10)
Following this discussion, we chose our parameters as follows: by taking N = 256 and τ = 16, we first choose t, then we take m minimal such that there exists δ which satisfies the constraints (6.8), (6.9) and (6.10) together with the constraint ensuring the uniqueness of the secret (as described previously)

t • δ • m -t • log t • τ p rej > m.
For all parameters provided in Table 6.3 an exhaustive search on (at least) 128 bits has to be performed by the adversary in order to run the attacks from [START_REF] Boneh | The Modular Inversion Hidden Number Problem[END_REF][START_REF] Bauer | Inferring Sequences Produced by Nonlinear Pseudorandom Number Generators Using Coppersmith's Methods[END_REF].

We should care about another kind of attack based on Coppersmith's method. Indeed, [START_REF] Xu | New Results on Modular Inversion Hidden Number Problem and Inversive Congruential Generator[END_REF] presented a heuristic attack that breaks Boneh et al.'s PRF (for a sufficiently large modulus p) if the number of outputs of the PRF is large enough (depending on δ). However, this polynomial-time attack is not practical and hides galactic constant factors. For instance, for δ = 2/3, this attack requires 45 outputs of the PRF and uses a lattice of dimension 209899 in Coppersmith's method. We have checked that for 3 outputs, the attack requires δ > 5/6, for 4 outputs δ > 7/10, and for 5 outputs δ > 5/8. We can observe that our sets of parameters are secure against these values. More generally, for a small number of outputs, the other Coppersmith's style attacks are ineffective if 1-δ ≥ 1/2. Indeed, [START_REF] Ling | On the modular inversion hidden number problem[END_REF] need δ to be at least 2/3 and [BHH01] proposed a second attack (not described) which needs a large number of outputs to get a δ close to 1/2.

To the best of our knowledge, the quantum security of Boneh et al.'s PRF has not been analyzed yet. Our signature protocol is thus a post-quantum candidate and requires further analysis of its security by quantum algorithm specialists.

Conclusion

In this chapter, we have developed an MPCitH technique to deal with small secret values living modulo a large value. It enables us to propose two new signature schemes:

• the first one relying on the subset sum problem, achieving sizes around 20 KB (for 128-bit security),

• the second one relying on the Boneh-Halevi-Howgrave-Graham PRF, achieving sizes around 5 KB (also for 128-bit security).

The SSP-based scheme could be considered as a conservative post-quantum scheme since the subset sum problem has been extensively studied in the state of the art. Unfortunately the obtained signature sizes are not competitive among the post-quantum schemes. It is the opposite situation for the scheme relying on the [BHH01] PRF. While it is one of the shortest MPCitH-based signature schemes, there exists no literature about the quantum cryptanalysis of this pseudo-random function.

Let us remark that the technique of the sharings over integers is not limited to signature schemes. It is useful for any MPCitH proof of knowledge as soon as we need to deal with small values in large modulus. This manuscript focuses on the context of the post-quantum signatures, but other applications have been analyzed in [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF]:

• Proving the knowledge of a solution of an inhomogeneous short integer solution problem instance. It improves the state of the art when the modulus q is not an NTT-friendly prime.

• Proving the knowledge of a secret key and plaintext(s) matching a (set of) FHE ciphertext(s).

Introduction

The security of the MPCitH-based signature schemes only depends on the security of commitment/hash functions and the security of a one-way function. As explained in Section 3.2, the choice of this one-way function is left to the signature designers. A first research line [ARS+15; DKR+21] has focused on the design of MPC-friendly primitives and their use with the MPCin-the-Head paradigm to get short signatures. This methodology has the disadvantage of requiring deep cryptanalysis of the introduced primitives. Another strategy would be to use standard symmetric primitives like AES as security assumptions for the MPCitH-based signatures, but it tends to produce larger signatures [DDOS19; BDK+21b; DOT21]. As a last option, we can rely on a hard problem that exists for a long time and thus which is well understood. In the previous chapters, we succeeded in designing efficient signature schemes using the syndrome decoding problem (with the Hamming metric) and the subset sum problem. These two cases have been covered, but a natural question is

Which performance can we get when using the MPC-in-the-Head paradigm with other hard problems? Some articles [Wan22; BG22; BESV22] already apply this paradigm to hard problems (multivariate quadratic problem, MinRank problem, ...). One of the drawbacks of almost all the schemes is that, when there is no structure to exploit, they need to rely on protocols with helper [START_REF] Beullens | Sigma Protocols for MQ, PKP and SIS, and Fishy Signature Schemes[END_REF], and thus they suffer from a high computational cost. Recently, [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF] succeeds in leveraging the structure when considering a structured hard problem (as the ideal rank syndrome decoding problem) and thus achieves smaller sizes by removing the helper from [START_REF] Feneuil | Shared Permutation for Syndrome Decoding: New Zero-Knowledge Protocol and Code-Based Signature[END_REF].

The present chapter aims to complete the state of the art of the MPC-in-the-Head applied to hard problems. Table 7.1 overviews schemes producing the shortest signatures for some hard problems in 2022 (the year of this work). First, we propose a new zero-knowledge proof of knowledge for the multivariate quadratic problem. The resulting signature scheme outperforms [START_REF] Wang | Shorter Signatures from MQ[END_REF] only when the base field is large enough (e.g. F 256 ).

Hard

Secondly, we propose two efficient MPC protocols which take as input a matrix M ∈ F n×m q and which check that the rank of M is upper bounded by r, where r is a public positive integer:

Chapter 7

Methodology 109

• the first one decomposes M as a product T R where T ∈ F n×r q and R ∈ F r×m q , and uses an MPC protocol that checks the correctness of a matrix multiplication;

• the second one relies on the fact that the rows of M (represented as elements of F q m ) are roots of a q-polynomial of degree q r and on the fact that computing a q-polynomial is efficient in MPC while exploiting the linearity of the Frobenius endomorphism v → v q .

We then use those protocols to build efficient signatures relying on the MinRank problem or on the rank syndrome decoding problem. Our schemes outperform all the previous proposals, by achieving sizes below 7 KB. They also outperform the [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF]'s proposals which use structured problems (as the ideal rank syndrome decoding problem) to achieve small sizes.

Methodology

In each of the following sections, we focus on a specific hard problem which is supposed quantum-resilient: For each of them, we will use the MPC-in-the-Head paradigm to build a new zero-knowledge protocol. To proceed, we will first describe the MPC protocol we use. This MPC protocol will have the same form as the one from Chapter 5:

• it takes as input an additive sharing of a candidate solution of the studied problem, and eventually an additive sharing of auxiliary data;

• the MPC parties get (only once) a common random value (sampled by the verifier);

• when the tested solution is valid (i.e. a solution of the studied hard problem) and when the auxiliary data are genuinely computed, the MPC protocol always outputs Accept; otherwise, it outputs Accept with probability at most p, where p is called the false positive rate;

• the views of all the parties except one leak no information about the candidate solution.

By applying the MPC-in-the-Head paradigm to this MPC protocol, we get a 5-round zeroknowledge proof of knowledge of a solution of the studied problem, with soundness error

1 N + 1 - 1 N • p
where N is the number of parties involved in the multi-party computation. We do not exhibit the obtained proof of knowledge since the transformation is standard.

To obtain a signature scheme, we apply the Fiat-Shamir transform [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF] to the previous protocol. Since this protocol has 5 rounds, the security of the resulting scheme should take into account the attack of [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF]. More precisely, the forgery cost of the signature scheme is given by cost forge := min

τ 1 ,τ 2 :τ 1 +τ 2 =τ 1 τ i=τ 1 τ i p i (1 -p) τ -i + N τ 2
where τ is the number of parallel executions. Finally, we compare the resulting scheme with all the former schemes which are noninteractive identification schemes based on the same security assumption. To proceed, we first list all these schemes with their formulae of the forgery security and of the communication cost. Since some quantities occur several times, we define some notations to ease the readability. For the forgery cost, we introduce the two following notations:

• ε helper (τ, M, ε) is the soundness error of a protocol with helper [START_REF] Beullens | Sigma Protocols for MQ, PKP and SIS, and Fishy Signature Schemes[END_REF] when the helper entity is emulated by a cut-and-choose phase. M is the total number of repetitions in the cut-and-choose phase, ε is the soundness of the unitary protocol relying on the helper, and τ is the number of repetitions of this unitary protocol. We have

ε helper (τ, M, ε) := max M -τ ≤k≤M k M -τ M M -τ • ε k-(M -τ ) .
• KZ(p 1 , p 2 ) is the forgery cost of [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF] for a 5-round protocol1 . We have

KZ(p 1 , p 2 ) := min τ 1 ,τ 2 :τ 1 +τ 2 =τ 1 τ i=τ 1 τ i p i 1 (1 -p 1 ) τ -i + 1 p τ 2 2 .
For the communication cost (i.e. the signature size), we introduce the following notations:

• µ seed is the cost of sending a λ-bit seed;

• µ dig is the cost of sending a 2λ-bit commitment/hash digest;

• µ helper is the cost (per repetition) of using the helper technique of [START_REF] Beullens | Sigma Protocols for MQ, PKP and SIS, and Fishy Signature Schemes[END_REF], this cost satisfies

µ helper ≤ (µ seed + µ dig ) • log 2 M τ
where M is the number of repetitions involved in the cut-and-choose phase emulating the helper. It corresponds to the cost of revealing M -τ leaves among M in a GGM tree, with the cost of sending the authentication paths of τ leaves among M in a Merkle tree.

• µ MPCitH is the fixed cost (per repetition) of using the MPC-in-the-Head paradigm, we have

µ MPCitH = µ seed • log 2 N + µ dig .
It corresponds to the cost of revealing all the leaves but one in a seed tree of N leaves (plus a commitment digest).

Then, to get a numerical comparison, we select one or two instances of the studied hard problem and we compare all these schemes for these precise instances.

To proceed, we need to select the parameters of the schemes when relevant. The signature schemes based on the MPC-in-the-Head paradigm have as parameter the number N of parties involved in the multi-party computation. When taking a small N , we get a faster scheme, but when taking a large N , we get shorter signature sizes. To have a fair comparison between the different schemes, we will always take the same N :

• when the protocol relies on a helper, we take N = 8 to have a fast scheme and N = 32 to have short sizes.

• otherwise, we take N = 32 to have a fast scheme and N = 256 to have short sizes.

Matrix Multiplication Checking Protocol

In our constructions, we need an MPC protocol that checks that three matrices X, Y, Z satisfy Z = X • Y . We describe in Figure 7.1 such a protocol Π η MM which has a positive parameter η. This protocol is a matrix variant of the multiplication checking protocol of [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] (optimized in [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF]).

Inputs: Each party takes a share of the following sharings as inputs: X where X ∈ F m×p q , Y where Y ∈ F p×n q , Z where F m×n q , A where A has been uniformly sampled from F p×η q , and C where C ∈ F m×η q satisfies C = XA.

MPC Protocol:

1. The parties get a random Σ ∈ F n×η q .

2. The parties locally set D = Y Σ + A . Proof. We have

V = XD -C -ZΣ = X(Y Σ + A) -C -ZΣ = (XY -Z)Σ -(C -XA).
If Z = XY and C = XA, V is equal to zero and thus the parties will always output Accept.

In contrast, if Z = XY , then there exists (i

* , j * ) ∈ [m] × [n] such that Z i * ,j * -(X • Y ) i * ,j * = 0.
Given k ∈ {1, . . . , η}, Σ j * ,k is uniformly sampled in F q and then ((Z -X •Y )Σ) i * ,k is uniformly random in F q (because one term of the sum is uniformly random). Thus, the probability that

V is zero is at most the probability that (Z -X • Y )Σ is equal to (C -XA) on the row i * whereas the row i * of (Z -X • Y )Σ is uniformly random in F η q , i.e. the probability that V is zero (at row i * ) is at most 1 q η .

MPCitH Optimizations

It is often possible to optimize the communication cost of a scheme relying on the MPC-inthe-Head paradigm. The common optimization tricks are the following:

• Except for the last party, the input share of a party can be derived from a seed using a pseudo-random generator. Thus, when we need to reveal the input share, we just need to reveal a seed. In practice, a prover must reveal the input shares of N -1 parties, so it would imply revealing N -1 seeds. To save more communication, we can generate the seeds using a GGM tree, decreasing the number of revealed seeds to log 2 (N ) (see [KKW18, Sec. 2.3] for details).

• We do not need to reveal shares for shared random values (as A in Figure 7.1) since they can be entirely derived from the seeds of the previous point.

• We do not need to reveal shares for shared publicly-known values (see [KZ22, Sec. 2.4] for details). For example, we do not need to reveal the share of V broadcasted by the hidden party in Figure 7.1. Indeed, this share can be deduced from the shares of the other parties and knowing that V must be equal to zero (otherwise the verification fails).

Signature Scheme from MQ

We want to build a zero-knowledge proof of knowledge for the multivariate quadratic problem:

Definition 7.3.1 (Multivariate Quadratic Problem -Matrix Form). Let (q, m, n) be positive integers. The multivariate quadratic problem with parameters (q, m, n) is the following problem:

Let (A i ) i∈[1:m] , (b i ) i∈[1:m] ,
x and y be such that:

1. x is uniformly sampled from F n q , 2. for all i ∈ [1 : m], A i is uniformly sampled from F n×n q , 3. for all i ∈ [1 : m], b i is uniformly sampled from F n q , 4. for all i ∈ [1 : m], y i is defined as

y i := x T A i x + b T i x.
From

((A i ) i∈[1:m] , (b i ) i∈[1:m] , y), find x.
The prover wants to convince the verifier that she knows x ∈ F n q such that

     y 1 = x T A 1 x + b T 1 x . . . y m = x T A m x + b T m x
To proceed, she will rely on the MPC-in-the-Head paradigm: she will first share the secret vector x and then use an MPC protocol which verifies that this vector satisfies the above relations.

MPC Protocol. Instead of checking the m relations separately, we batch them into a linear combination where coefficients γ 1 , . . . , γ m are uniformly sampled in the field extension F q η . The MPC protocol will check that

m i=1 γ i (y i -x T A i x -b T i x) = 0. (7.1)
If one of the relations was not satisfied, then Equation (7.1) would be satisfied only with a probability 1 q η . We can write the equality as

m i=1 γ i (y i -b T i x) = m i=1 γ i (x T A i x) = x T m i=1 γ i A i x = x, w where w := m i=1 γ i A i x.
By defining z :=

m i=1 γ i (y i -b T i x) and w := ( m i=1 γ i A i ) x, proving Equation (7.1) is equivalent to proving that z = x, w .
And to prove the above equality, we can rely on the subprotocol Π MM described in Section 7.2.1 (assuming that all the scalars live in F q η ). Thus, the MPC protocol proceeds as follows:

1. The parties get random γ 1 , . . . , γ m ∈ F q η .

The parties locally set

z = m i=1 γ i (y i -b T i x ).

The parties locally set

w = ( m i=1 γ i A i ) x .
4. The parties execute the protocol Π MM to check that z = w, x .

Since this sub-protocol Π MM produces false positive events with a rate of 1 q η , if x does not satisfy the m MQ relations, the complete MPC protocol outputs Accept only with a probability of at most 1 q η + 1 -

1 q η 1 q η = 2 q η - 1 q 2η .
The complete MPC protocol is described in Figure 7.2.

Proof of Knowledge.

Using the MPC-in-the-Head paradigm, we transform the above MPC protocol into an interactive zero-knowledge proof of knowledge which enables to convince a verifier that a prover knows the solution of a MQ problem. The soundness error of the resulting protocol is

ε := 1 N + 1 - 1 N 2 q η - 1 q 2η .
By repeating the protocol τ times, we get a soundness error of ε τ . To obtain a soundness error of λ bits, we can take τ = -λ log 2 ε . We can transform the interactive protocol into a non-interactive argument / signature thanks to the Fiat-Shamir transform [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF]. According to [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF], the security of the resulting scheme is

cost forge := min τ 1 ,τ 2 :τ 1 +τ 2 =τ 1 τ i=τ 1 τ i p i (1 -p) τ -i + N τ 2 where p := 2 q η -1 q 2η .
Public values: The matrices A1, . . . , Am ∈ F n×n q , the vectors b1, . . . , bm ∈ F n q , and the outputs y1, . . . , ym ∈ Fq.

Inputs: Each party takes a share of the following sharings as inputs: x where x ∈ F n q , a where a has been uniformly sampled from F n q η , and c where c ∈ Fqη satisfies c = -a, x . MPC Protocol:

1. The parties get random γ1, . . . , γm ∈ Fqη and a random ε ∈ Fqη . The communication cost of the scheme (in bits) is

4λ + τ •   (n • log 2 (q) x + n • η • log 2 (q) α + η • log 2 (q) c + λ • log 2 N + 2λ MPCitH   
where λ is the security level, η is a scheme parameter and τ is computed such that the soundness error is of λ bits in the interactive case and such that cost forge is of λ bits in the non-interactive case.

Performance and comparison.

In what follows, we compare our scheme with the state of the art on two MQ instances:

Instance 1. Multivariate Quadratic equations over a small field:

(q, m, n) = (4, 88, 88), Instance 2. Multivariate Quadratic equations over a larger field:

(q, m, n) = (256, 40, 40).

Both of these instances are believed to correspond to a security of 128 bits [START_REF] Bellini | An Estimator for the Hardness of the MQ Problem[END_REF]. We provide in Tables 7.2 and 7.3 a complete comparison of our scheme with the state of the art. In the comparison we put MQ-DSS [START_REF] Chen | From 5-Pass MQ-Based Identification to MQ-Based Signatures[END_REF] which corresponds to the non-interactive version of the 5-round identification scheme of [START_REF] Sakumoto | Public-Key Identification Schemes Based on Multivariate Quadratic Polynomials[END_REF]. In the sake of completeness, we also put how the 3-round identification scheme of [START_REF] Sakumoto | Public-Key Identification Schemes Based on Multivariate Quadratic Polynomials[END_REF] would perform when applying the Fiat-Shamir transform on it.

Over a small field, the Mesquite [START_REF] Wang | Shorter Signatures from MQ[END_REF] scheme has the smallest communication cost, even if our scheme produces competitive signature size. Over a larger field, we can produce signature size close to 7 KB, and thus we outperform all the former schemes.

Remark 7.3.2. In constrast with the former state of the art, the communication cost of our scheme is independent to the number m of MQ relations.

(3/2) τ µ dig + τ [2µvar + µout + 2µ dig ] MQ-DSS [CHR+16] KZ( 1 q , 1 2 ) 2µ dig + τ [2µvar + µout + 2µ dig ] MudFish [Beu20] ε helper (τ, M, 1 q ) -1 µ dig + τ [2µvar + µout + 2µ seed + µ dig • log 2 (q ) + µ helper ] Mesquite [Wan22] ε helper (τ, M, 1 N ) -1 µ dig + τ [µvar + µout + µ MPCitH + µ helper ]
Our scheme

KZ( 2 q η -1 q 2η , 1 N ) 2µ dig + τ [(1 + η) • µvar + η • log 2 q + µ MPCitH ]
Note: the used notations are µvar := n log 2 q, µout := m log 2 q, plus all the notations defined in Section 7.2. In what follows, we denote wt R (M ) the rank of a matrix M .

Matrix Rank Checking Protocols

We want to build MPC protocols which check that a matrix has a rank of a most r. Such MPC protocols will be used for arguments of knowledge with the MPC-in-the-Head paradigm.

We propose two protocols:

• the first one relies on the rank decomposition of matrices. It has the advantage to be quite simple, but its false positive rate is large.

• the second one relies on linearized polynomials. It has the advantage to have a very small false positive rate, but it sometimes requires to manipulate field extensions of large degrees.

Using Rank Decomposition.

Let us design an MPC protocol which checks that a matrix M ∈ F m×n has a rank of at most r, i.e. wt R (M ) ≤ r. To proceed, we will rely on the rank decomposition:

a matrix M ∈ F n×m q
has a rank of at most r if and only if there exists T ∈ F n×r q and R ∈ F r×m q such that M = T R.

In practice, our MPC protocol that we will denote Π η RC-RD takes as input such matrices T and R (in addition to M ) and simply executes the matrix multiplication checking protocol Π η MM (see Section 7.2.1), for some positive integer η.

Theorem 7.4.1. If wt R (M ) ≤ r and if T, R are genuinely computed, then Π η RC-RD always outputs Accept. If wt R (M ) > r, then Π RC-RD outputs Accept with probability at most 1 q η . More precisely, if wt R (M ) = w + δ with δ ≥ 1, then Π η RC-RD outputs Accept with probability at most 1 q δ•η .

Proof. The final broadcast matrix

V in Π η MM satisfies V = (T R -M )Σ -(C -T A)
where matrices A and C have been built before receiving the random Σ. We have

wt R (M -T R) ≥ wt R (M ) -wt R (T R) ≥ (r + δ) -r = δ
It means that T R -M has at least δ non-zero coefficients (i 1 , j 1 ), . . . , (i δ , j δ ) which are over δ different rows and over δ different columns, i.e.

∀k 1 , k 2 ∈ [δ], (i k 1 = i k 2 ) ∧ (j k 1 = j k 2 ).
Let us consider k ∈ [δ]. The j k th row of Σ is uniformly sampled in F η q and thus the i k th row of (M -T R)Σ is uniformly random in F η q (because one of the sum term is uniformly random). Thus, the probability that the i k th row of V is zero is the probability that (M -T R)Σ is equal to (C -T A) on the row i k whereas the row i k of (M -T R)Σ is uniformly random in F η q , i.e. the probability that the i k th row of V is zero is 1 q η . By taking a union bound over all k, we get that the probability that V is zero is at most 1 q δ•η .

Using Linearized Polynomials.

In what follows, we represent a matrix of F m×n q as an element of (F m q ) n . We want to design an MPC protocol which checks that a matrix M = (x 1 , . . . , x n ) ∈ (F q m ) n has rank at most r. Equivalently, it means that all x i belongs to an F q -linear subspace U of F q m of dimension r. Let us define the polynomial L U (X) as

L U (X) := u∈U (X -u) ∈ F q m [X].
The degree of L U is q r since U has q r elements. Showing that wt(M ) ≤ r can be done by showing that all x i 's are roots of L U .

According to [LN96, Theorem 3.52], L U is a q-polynomial over F q m , meaning that it is of the form

L U (X) = X q r + r-1 i=0 β i X q i .
Such polynomials are convenient for multi-party computation since the Frobenius endomorphism X → X q is a linear application in field extensions of F q and thus it is communication-free to compute x q , x q 2 , . . . from x .

The core idea of the rank checking protocol is to check that L U (x 1 ) = L U (x 2 ) = . . . = L U (x n ) = 0. To proceed, the MPC protocol will batch these checkings by uniformly sampling γ 1 , . . . , γ n ∈ F q m and checking that n j=1

γ j • L U (x j ) = 0. (7.2)
If one x i is not a root of the polynomial L U , then Equation (7.2) is satisfied only with probability 1 q m . Let us rewrite the left term of (7.2):

n j=1 γ j • L U (x j ) = n j=1 γ j • x q r j + r-1 i=0 β i x q i j = n j=1 γ j • x q r j :=-z + r-1 i=0 β i • n j=1 γ j x q i j :=w i .
By defining z := -n j=1 γ j • x q r j and w i := n j=1 γ j x q i j for i ∈ {0, . . . , r -1}, proving Equation (7.2) is equivalent to proving z = β, w .

Our MPC protocol that we will denote Π η RC-LP takes as input x 1 , . . . , x n and L U := X q r + r-1 i=0 β i X q i proceeds as follows:

1. The parties get random γ 1 , . . . , γ n ∈ F q m•η .

2. The parties locally set z = -n j=1 γ j x j q r .

3. The parties locally set w i = n j=1 γ j x j q i for all i ∈ {0, . . . , r -1}.

4. The parties execute the protocol Π MM to check that z = β, w over F q m•η .

Theorem 7.4.2. If wt R (M ) ≤ r and if L U is genuinely computed, then Π η RC-LP always outputs Accept. If wt R (M ) > r, then Π η RC-LP outputs Accept with probability at most

1 q m•η + 1 -1 q m•η 1 q m•η .
Proof. L U is a q-polynomial over F q m of degree exactly q r . It means that its number of roots is at most q r . According to [LN96, Theorem 3.50], the roots form an F q -linear subspace V of the field extension F q s of F q m . Since F q m is also a linear subspace of F q s , V ∩ F q m is a linear subspace of F q s (and of F q m ). Its dimension is at most r (since it has at most q r elements). If wt R (M ) > r, there exist i * such that

L U (x i * ) = 0.
We then have two options resulting in Π η RC-LP outputing Accept: • Either n j=1 γ j • L U (x j ) = 0, which occurs with probability 1 q m•η ; • Or n j=1 γ j • L U (x j ) = 0, i.e. z = β, w and Π MM outputs Accept, which occurs with probability 1 q m•η since Π MM has a false positive rate of 1 q m•η .

Signature Scheme from MinRank

We want to build a zero-knowledge proof of knowledge for the MinRank problem:

Definition 7.4.3 (MinRank Problem). Let (q, m, n, k) be positive integers. The MinRank problem with parameters (q, m, n, k) is the following problem:

Let M 0 , M 1 , . . . , M k , E and x such that:

-x is uniformly sampled from F k q , -for all i ∈ [k], M i is uniformly sampled from F n×m q , -E is uniformly sampled from {E ∈ F n×m q : wt R (E) ≤ w}, -M 0 is defined as M 0 = E -k i=1 x i M i . From (M 0 , M 1 , . . . , M k ), find x.
The prover wants to convince the verifier that she knows such an x. To proceed, the prover will first share the secret vector x and then use an MPC protocol which verifies that this vector satisfies the above property.

MPC Protocol. We want to build an MPC protocol which takes as input (a sharing of) x and which outputs

Accept if wt R (E) ≤ r Reject otherwise.
where E := M 0 + k i=1 x i M i . Given x , the parties can locally build E as M 0 + k i=1 x i M i . It remains to check that E corresponds to the sharing of a matrix of rank at most r. It can be done using one of the two rank checking protocols described in Section 7.4.1: Π η RC-RD relying on the rank decomposition or Π η RC-LP relying on linearized polynomials, for some parameter η. The complete MPC protocol is described in Figure 7.3 when relying on the rank decomposition and in Figure 7.4 when relying on linearized polynomials. In the second case, the rows of the matrix E are rewritten as elements of F q m , but when m = n, it can be more convenient to work on the columns (depending of the values of m and n). Inputs: Each party takes a share of the following sharings as inputs: x where x ∈ F k q , T where T ∈ F n×r q , R where R ∈ F r×m q , a where a has been uniformly sampled from F r×η q , and c ∈ F n×η q , such that M0 +

Proof of Knowledge.

Using the MPC-in-the-Head paradigm, we transform the above MPC protocol into an interactive zero-knowledge proof of knowledge which enables to convince a verifier that a prover knows the solution of a MinRank problem. The soundness error of the resulting protocol is

ε := 1 N + 1 - 1 N p η
where p η := 1 q η when using Π η RC-RD and p η := 2 q m•η -1 q 2•m•η when using Π η RC-LP . By repeating the protocol τ times, we get a soundness error of ε τ . To obtain a soundness error of λ bits, we can take τ = -λ log 2 ε . We can transform the interactive protocol into a non-interactive proof / signature thanks to the Fiat-Shamir transform [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF]. According to [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF], the security of the resulting scheme is

cost forge := min τ 1 ,τ 2 :τ 1 +τ 2 =τ 1 τ i=τ 1 τ i p i η (1 -p η ) τ -i + N τ 2 .
When using Π RC-RD , the communication cost of the scheme (in bits) is

4λ + τ •   ( k x + r × m R + r × n T + r × η α + n × η c ) • log 2 q + λ • log 2 N + 2λ MPCitH    Public values: M0, M1, . . . , Mk ∈ F n×m q .
Inputs: Each party takes a share of the following sharings as inputs: x where x ∈ F k q , LU := X q r + r-1 i=0 βi X q i where LU (X) := u∈U (X -u) ∈ Fqm [X], a where a has been uniformly sampled from F r q m•η , and c ∈ Fqm•η , such that c = -β, a .

MPC Protocol:

1. The parties get random γ1, . . . , γn ∈ Fqm•η . 6. The parties locally set wi = n j=1 γj ej q i for all i ∈ {0, . . . , r -1}. which verifies that the given input corresponds to a solution of a MinRank problem. U is a F q -linear subspace of F q m of dimension r which contains the rows (e 1 , . . . , e n ) of

The parties locally set

α = ε • w + a . 8. The parties open α ∈ F r q m•η . 9. The parties locally set v = ε • z -α, β -c .
E := M 0 + k i=1 x i M i ∈ F n×m q represented as elements of F q m .
where λ is the security level, r is a scheme parameter and τ is computed such that the soundness error is of λ bits in the interactive case and such that cost forge is of λ bits in the non-interactive case.

And when using Π RC-LP , the communication cost of the scheme (in bits) is

4λ + τ •   ( k x + r × m L U + r × m × η α + m × η c ) • log 2 q + λ • log 2 N + 2λ MPCitH    .

Performance and comparison.

In what follows, we compare our scheme with the state of the art on the MinRank instance [BESV22]:

(q, m, n, k, r) = (16, 16, 16, 142, 4).

We provide in Tables 7.4 and 7.5 a complete comparison of our scheme with the state of the art. To provide a fair comparison, we propose two variants for [START_REF] Courtois | Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank[END_REF] and [START_REF] Santoso | Three-Pass Identification Scheme Based on MinRank Problem with Half Cheating Probability[END_REF]: the first one corresponds to the scheme as described in the original article and the second one is an optimized version. This optimized version includes the following tricks:

• Instead of revealing all the commitments during the first round, the prover just sends a hash digest of them. Then, to enable the verifier to recompute this digest, the prover just needs to send the commitment digests that the verifier can not compute herself.

(see [START_REF] Feneuil | Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs[END_REF] for the case of the Hamming weight). To proceed, the prover will first share the secret vector x and then use an MPC protocol which verifies that this vector satisfies the above property.

Remark 7.4.6. In the above definition, the parity-check matrix is in standard form. It does not decrease the hardness of the problem (since the transformation into a standard form is a polynomial transformation), but it enables to simplify the contruction we propose.

MPC Protocol. We want to build an MPC protocol which takes as input (a sharing of) x and which outputs

Accept if y = Hx and wt R (x) ≤ r Reject otherwise.

Since H is in standard form, having the equality y = Hx is equivalent to define x as

x A y -H x A
for some x A ∈ F k q . Therefore, we will build an MPC protocol which takes as input (a sharing of) x A and which outputs

     Accept if wt R (x) ≤ r where x := x A y -H x A Reject otherwise.
Given x A , the parties can locally build x B as x B := y -H x A , and so they can deduce a sharing x of x (simply by concatenating the shares of x A with the shares of x B ). It remains to check that x corresponds to the sharing of a vector of F n q m of rank at most r. The latter can be done using one of the two rank checking protocols described in Section 7.4.1: Π η RC-RD relying on the rank decomposition or Π η RC-LP relying on linearized polynomials, for some parameter η.

The complete MPC protocol is described in Figure 7.5 when relying on the rank decomposition and in Figure 7.6 when relying on linearized polynomials.

Proof of Knowledge.

Using the MPC-in-the-Head paradigm, we transform the above MPC protocol into an interactive zero-knowledge proof of knowledge which enables to convince a verifier that a prover knows the solution of a rank syndrome decoding problem. The soundness error of the resulting protocol is

ε := 1 N + 1 - 1 N p η
where p η := 1 q η when using Π η RC-RD and p η := 2 q m•η -1 q 2•m•η when using Π η RC-LP . By repeating the protocol τ times, we get a soundness error of ε τ . To obtain a soundness error of λ bits, we can take τ = -λ log 2 ε . We can transform the interactive protocol into a non-interactive proof / signature thanks to the Fiat-Shamir transform [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF]. According to [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF], the security of the resulting scheme is

cost forge := min τ 1 ,τ 2 :τ 1 +τ 2 =τ 1 τ i=τ 1 τ i p i η (1 -p η ) τ -i + N τ 2 . Public values: H = (H |In-k) ∈ F (n-k)×n q m
and y ∈ F n-k q m . Inputs: Each party takes a share of the following sharings as inputs: xA where xA ∈ F k q m , T where T ∈ F n×r q , R where R ∈ F r×m q , a where a has been uniformly sampled from F r×η q , and c where c ∈ F n×η q , such that c = T a and X = T R where X is the matrix form of x.

MPC Protocol:

1. The parties get a random Σ ∈ F m×η q .

2. The parties locally set xB = y -H xA . Public values:

H = (H |In-k) ∈ F (n-k)×n q m and y ∈ F n-k q m .
Inputs: Each party takes a share of the following sharings as inputs:

xA where x ∈ F k q m , LU := X q r + r-1 i=0 βi X q i where LU (X) := u∈U (X -u) ∈ Fqm [X]
, a where a has been uniformly sampled from F r q m•η , and c ∈ Fqm•η , such that c = -β, a . MPC Protocol:

1. The parties get random γ1, . . . , γn ∈ Fqm•η .

2. The parties get a random ε ∈ Fqm•η . 5. The parties locally set wi = n j=1 γj xj q i for all i ∈ {0, . . . , r -1}.

6. The parties locally set α = ε • w + a . which verifies that the given input corresponds to a solution of a rank syndrome decoding problem. U is a F q -linear subspace U of F q m of dimension r which contains x 1 , . . . , x n .

The parties open

α ∈ F r q m•η . 8. The parties locally set v = ε • z -α, β -c .
When using Π RC-RD , the communication cost of the scheme (in bits) is

4λ + τ •   (k • m x A + r × m R + r × n T + r × η α + n × η c ) • log 2 q + λ • log 2 N + 2λ MPCitH   
where λ is the security level, η is a scheme parameter and τ is computed such that the soundness error is of λ bits in the interactive case and such that cost forge is of λ bits in the non-interactive case. And when using Π RC-LP , the communication cost of the scheme (in bits) is

4λ + τ •   (k • m x A + r × m L U + r × m × η α + m × η c ) • log 2 q + λ • log 2 N + 2λ MPCitH    .

Performance and comparison.

In what follows, we compare our scheme with the state of the art on the Rank Syndrome Decoding instance [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF]:

(q, m, n, k, r) = (2, 32, 30, 14, 9).

We provide in Tables 7.6 and 7.7 a complete comparison of our scheme with the state of the art. To get a more complete comparison, we include the schemes [START_REF] Stern | A New Identification Scheme Based on Syndrome Decoding[END_REF], [START_REF] Véron | Improved identification schemes based on error-correcting codes[END_REF] and [START_REF] Feneuil | Shared Permutation for Syndrome Decoding: New Zero-Knowledge Protocol and Code-Based Signature[END_REF] which can be easily adapted for the rank metric (by replacing the permutations by rank isometries). Moreover, we put in Table 7.7 the achieved performance of [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF] when relying on structured rank syndrome decoding problem (the parameters of the structured problem come from the original article). The first schemes [START_REF] Stern | A New Identification Scheme Based on Syndrome Decoding[END_REF] and [START_REF] Véron | Improved identification schemes based on error-correcting codes[END_REF] can achieve signature sizes of around 30 KB (let us remark that some optimization tricks have been used to achieve these sizes). Then, using the MPC-in-the-Head technique of the "shared permutation", [START_REF] Feneuil | Shared Permutation for Syndrome Decoding: New Zero-Knowledge Protocol and Code-Based Signature[END_REF] and [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF] divide this size by half, achieving communication cost around 15 KB (13 -19 KB). Finally, our new schemes outperform all these schemes by achieving sizes around 6 -11 KB. The scheme using a q-polynomial even outperforms the [BG22]'s proposals3 which rely on structured rank syndrome decoding problems.

(3/2) τ µ dig + τ 1 3 (2µmat + µ rank + 2µ seed ) + µ dig [Vér96] (3/2) τ µ dig + τ 1 3 (µmat + µptx + µ rank + 2µ seed ) + µ dig [FJR21] ε helper (τ, M, 1 N ) -1 µ dig + τ [µmat + µptx + µ rank + µ MPCitH + µ helper ] [BG22] ε helper (τ, M, 1 N ) -1 µ dig + τ [µmat + µ rank + µ MPCitH + µ helper ]
Our scheme (RD)

KZ( 1 q η , 1 N ) 2µ dig + τ [µptx + µ rank + η(n + r) log 2 q + µ MPCitH ]
Our scheme (LP) KZ( 2

q m•η -1 q 2•m•η , 1 N ) 2µ dig + τ [µptx + rm log 2 q + η(r + 1)m log 2 q + µ MPCitH ]
Note: the used notations are µmat := mn log 2q, µ rank := r(m + n) log 2 q, µptx := mk log 2 q, plus all the notations defined in Section 7.2.

Running times

We implement our schemes thanks to the library described in Section 9.2. Until 2022, the only way to implement an MPCitH-based proof system was by emulating all the parties of the underlying MPC protocol, implying that we would need to emulate N times a party per repetition. The recent work [START_REF] Aguilar Melchor | The Return of the SDitH[END_REF] changes this drastically. The authors suggest generating the input shares of the parties in a correlated way using a hypercube approach. This optimization enables to emulate only 1 + log 2 (N ) parties per repetition. For example, in Section 7.3, we propose to take τ = 25 and N = 256 for the "short" trade-off of our scheme. Without the optimization of [START_REF] Aguilar Melchor | The Return of the SDitH[END_REF], we would need to emulate τ • N = 6400 times a party per signing. With it, we just need to emulate τ • (1 + log 2 N ) = 225 times a party, reducing the computational cost of the MPC emulation by a factor of 28. We integrated the [START_REF] Aguilar Melchor | The Return of the SDitH[END_REF] optimization in our implementations. The obtained signing times are given in Table 7.8. The pseudo-randomness is generated using AES in counter mode, the used hash function is SHA3, and the MPC challenge is sampled using SHAKE. We benchmarked our scheme on a 3.8 GHz Intel Core i7 CPU with the support of AVX2 and AES instructions. All the reported timings were measured on this CPU while disabling Intel Turbo Boost.

In Table 7.8, we give the computational contribution of two subparts of the signing algorithm:

• the running time for preparing and committing all the input shares of the MPC protocol,

• and the running time for emulating the MPC protocol.

4.41

Note: All the timings are given in milliseconds.

We optimized the implementation of the first part which mainly relies on symmetric primitives (pseudo-randomness, commitments, ...) since the code is the same for all the schemes. For example, we rely on fourfold calls of Keccak (for SHA3) using AVX instructions. However, the arithmetic components used by the MPC protocols have not been optimized, since it would require dedicated work for each scheme (and is out of the scope of this chapter4 ).

In this chapter, we proposed two MPC protocols to check that a matrix has a small rank: one based on rank decomposition (RD), one based on q-polynomials (LP). The second protocol leads to smaller signature sizes, but it tends to be less efficient in running timing since it involves computation in a field extension. From the benchmark, we can observe that both protocols give similar running times when applied to the rank syndrome decoding problem. However, when applied to MinRank, the MPC protocol based on q-polynomials gives a slow scheme. As explained previously, the arithmetics of the implementations have not been optimized. The scheme "MinRank (with LP)" suffers from this lack of optimizations. An open question would be: can an optimized implementation of the field extension erase this difference in running times between both variants (RD and LP)? This question will probably be answered during the NIST standardization process for post-quantum cryptography since both approaches have been submitted in the NIST call (c.f. the schemes MIRA and MiRitH).

Conclusion

In this chapter, we studied the application of the MPC-in-the-Head paradigm to the multivariate quadratic problem, the MinRank problem and the rank syndrome decoding problem. The main contribution was to reduce the task of proving the low rank of a matrix to proving that some field elements are roots of a q-polynomial. Such polynomials are MPC-friendly thanks to the linearity of the Frobenius endomorphism. Using this reduction, we can produce signatures relying on the MinRank problem and on the rank syndrome decoding problem with sizes below 6 KB. We also proposed the first signature scheme relying on the multivariate quadratic problem which fits the MPC-in-the-Head paradigm as described in Chapter 3. This scheme outperforms the former ones when working on large fields such as F 256 .

The ideas introduced in this chapter have been used in several submissions to the NIST call (see Chapter 9 for details).

Introduction

As explained in Chapter 3, proof systems built from the MPCitH paradigm can be divided into two categories:

• Schemes targeting small circuits (e.g. to construct efficient signature schemes), such as [KKW18; BN20; KZ22]. In these schemes, the considered MPC protocol only needs to be secure in the semi-honest model, enabling efficient constructions, but the resulting proof is linear in the circuit size. Before the work in this chapter, the schemes in this category were all based on additive secret sharing.

• Schemes such as [AHIV17; GSV21] in which the considered MPC protocol is secure in the malicious model and the proof is sublinear in the circuit size (in O( |C|) with |C| being the circuit size). Due to their sublinearity, these schemes are more efficient for middle-size circuits (while the formers remain more efficient for smaller circuits arising e.g. in signature schemes).

We note that other quantum-resilient proof systems exist (a.k.a. SNARK, STARK) which do not rely on the MPCitH paradigm and which achieve polylogarithmic proof size (w.r.t. the circuit size), see e.g. [BCR+19; BBHR19]. These schemes are hence better suited for large circuits.

The results of this chapter belong to the first category of MPCitH-based schemes (i.e. targeting small circuits). In 2022, the best MPCitH-based schemes in this scope relied on (N -1)-private passively-secure MPC protocols with N parties [KKW18; BN20; DOT21; KZ22], where the parameter N provides different trade-offs between communication (or signature size) and execution time. In these schemes, the proof is composed of elements of size solely depending on the target security level λ (the "incompressible" part) and other elements of size O(λ 2 / log N ) bits (the "variable" part). To obtain short proofs or signatures, one shall hence take a large number of parties N . On the other hand, the prover and verifier running times scale linearly with N (because of the MPC emulation) and hence quickly explode while trying to minimize the proof size.

In this chapter, we first describe a general model of multiparty computation protocol (with additive secret sharing) which captures a wide majority of the protocols used in the MPCitH context. (To the best of our knowledge, our model applies to all the MPCitH schemes except those derived from ZKBoo or Ligero.) As stated by Theorem 3.1.4, a zero-knowledge proof resulting from the transformation of a multiparty computation using only broadcast communication has a soundness error of

1 N + p • 1 - 1 N ,
where N is the number of parties and p is the false-positive rate of the MPC protocol (see Section 3.3.2). We then show how to apply an arbitrary threshold linear secret sharing scheme (LSSS) to our general MPC model and how to transform the obtained MPC protocol into a zero-knowledge proof achieving the following soundness error:

1 N + p • • (N -) + 1 ,
where is the threshold of the LSSS (any shares leak no information while the secret can be reconstructed from any + 1 shares). Our theorems cover all the MPC protocols complying with our general model, and for any threshold LSSS (covering additive sharing as a particular case). Besides improving soundness, using an LSSS with a small threshold implies significant gains in terms of timings. Indeed, the prover and the verifier do not need to emulate all the N parties anymore, but only a small number of them ( + 1 for the prover and for the verifier). For instance, when working with Shamir's secret sharing [START_REF] Shamir | How to Share a Secret[END_REF] with polynomials of degree = 1, the prover only needs to emulate 2 parties (instead of N ) and the verifier only needs to emulate 1 party (instead of N -1) while keeping a soundness error about 1 N (assuming a small false positive rate p). On the other hand, the proof size is slightly larger than in the standard case (with additive sharing) since one needs to use a Merkle tree for the commitments (and include authentication paths for the opened commitments in the proof transcript). Overall, our approach provides better trade-offs between proof size and performance for MPCitH schemes while drastically reducing the verification time in particular.

We further generalize our approach to threshold ramp LSSS, for which a gap ∆ exists between the number of parties which leak no information and the number of parties + 1 + ∆ necessary to reconstruct the secret. We particularly analyze algebraic geometric threshold ramp schemes [START_REF] Chen | Algebraic Geometric Secret Sharing Schemes and Secure Multi-Party Computations over Small Fields[END_REF] but our result is mostly negative: we show that using such schemes does not bring a direct advantage to our framework. We then show that our result on ramp schemes is still useful in the context of batched proofs (i.e. proving simultaneously several statements with a single verification process). We propose a batching technique based on Shamir's secret sharing which enables us to efficiently batch proofs in our framework (for a subset of the existing MPCitH schemes).

Finally, we describe some applications of our techniques. We first adapt the SDitH signature scheme (presented in Chapter 5) to our framework with Shamir's secret sharing. We obtain a variant of this scheme that achieves new interesting size-performance trade-offs. For instance, for a signature size of 10 KB, we obtain a signing time of around 3 ms and a verification time lower than 0.5 ms, which is competitive with SPHINCS + [ABB+22] in terms of size and verification time while achieving much faster signing. We further apply our batching technique to two different contexts: batched proofs for the SDitH scheme and batched proofs for general arithmetic circuits based on the Limbo proof system [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF]. In both cases and for the considered parameters, we obtain an amortized proof size lower than 1/10 of the baseline scheme when batching a few dozen statements, while the amortized running times are also significantly improved (in particular for the verifier).

Related works.

The MPC-in-the-Head paradigm was introduced in the seminal work [START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF]. The authors propose general MPCitH constructions relying on MPC protocols in the semi-honest model and in the malicious model. In the former case (semi-honest model), they only consider 2-private MPC protocols using an additive sharing as input (they also propose an alternative construction with 1-private protocols). In the latter case (malicious model), they are not restricted to any type of sharing. The exact security of [START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF] is analyzed in [START_REF] Giacomelli | ZKBoo: Faster Zero-Knowledge for Boolean Circuits[END_REF]. As other previous works about the MPCitH paradigm, our work can be seen as a specialization of the IKOS framework. In particular, we restrict the considered MPC model, optimize the communication in this model and provide a refined analysis for the soundness (in the exact security setting) to achieve good practical performance. transformation of a general MPC model. The scope of the transformation differs from ours, since it covers (N -1)-private MPC protocols using broadcast.

In Table 8.1, we sum up all the MPC models considered in the state of the art of the MPC-in-the-Head paradigm with the soundness errors and limitations of the general schemes.

Formalizing the MPCitH-Friendly MPC Protocols

Several simple MPC protocols have been proposed that yield fairly efficient zero-knowledge proofs and signature schemes in the MPC-in-the-Head paradigm, see for instance [KZ20b; BD20; BDK+21b; FJR22b]. These protocols lie in a specific subclass of MPC protocols in the semi-honest model which we formalize hereafter.

General Model of MPC Protocol

We consider a passively-secure MPC protocol that performs its computation on a base finite field F so that all the manipulated variables (including the witness w) are tuples of elements from F. In what follows, the sizes of the different tuples involved in the protocol are kept implicit for the sake of simplicity. The parties take as input an additive sharing w of the witness w (one share per party). Then the parties compute one or several rounds in which they perform three types of actions:

Receiving randomness: the parties receive a random value (or random tuple) ε from a randomness oracle O R . When calling this oracle, all the parties get the same random value ε. This might not be convenient in a standard multi-party computation setting (since such an oracle would require a trusted third party or a possibly complex cointossing protocol), but in the MPCitH context, these random values are provided by the verifier as challenges.

Receiving hint: the parties can receive a sharing β (one share per party) from a hint oracle O H , which is sometimes called the dealer in the MPC literature. The hint β can depend on the witness w and the previous random values sampled from O R . Formally, for some function ψ, the hint is sampled as β ← ψ(w, ε1 , ε 2 , . . . ; r) where ε 1 , ε 2 , . . . are the previous outputs of O R and where r is a fresh random tape.

Hints enable to build more efficient MPC protocols. For example, instead of computing a product of two shared values, the parties can get this product using O H and simply check that the product is correct, which is cheaper in communication [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF].

Computing & broadcasting: the parties can locally compute α := ϕ(v) from a sharing v where ϕ is an F-linear function, then broadcast all the shares α 1 , . . . , α N to publicly reconstruct α

:= ϕ(v). If ϕ is in the form v → Av + b, then the parties can compute ϕ(v) from v by letting ϕ(v) i := A v i + b i for each party i
where b is a publicly-known sharing of b. 1 This process is usually denoted ϕ(v) = ϕ( v ). The function ϕ can depend on the previous random values {ε i } i from O R and on the previous broadcasted values.

After t rounds of the above actions, the parties finally output Accept if and only if the publicly reconstructed values α 1 , . . . , α t satisfy the relation g(α 1 , . . . , α t ) = 0 for a given function g.

Protocol 10 gives a general description of an MPC protocol in this paradigm, which we shall use as a model in the rest of the chapter. In general, the computing & broadcasting step can be composed of several iterations, which is further depicted in Protocol 11. For the sake of simplicity, we shall consider a single iteration in our presentation (as in Protocol 10) but we stress that the considered techniques and proofs equally apply to the multi-iteration setting (i.e. while replacing step (c) of Protocol 10 by Protocol 11).

1. The parties take as input a sharing w .

2. For j = 1 to t, the parties: a) get a sharing β j from the hint oracle O H , such that β j ← ψ j (w, ε 1 , . . . , ε j-1 ; r j ) for a uniform random tape r j ; b) get a common random ε j from the oracle O R ; c) for some F-linear function ϕ j (ε i ) i≤j ,(α i ) i<j , compute

α j := ϕ j (ε i ) i≤j ,(α i ) i<j w , ( β i ) i≤j ,
broadcast α j , and then publicly reconstruct α j . Note: This step can be composed of several iterations as described in Protocol 11.

3. The parties finally accept if g(α 1 , . . . , α t ) = 0 and reject otherwise.

Note: In the above description w, β j , ε j , α j are elements from the field F or tuples with coordinates in F (whose size is not made explicit to keep the presentation simple).

Protocol 10: General MPC protocol.

Output distribution. In the following, we shall denote #" ε := (ε 1 , . . . , ε t ), #" β := (β 1 , . . . , β t ), #" α := (α 1 , . . . , α t ) and #" r := (r 1 , . . . , r t ). From the above description, we have that the output of the protocol deterministically depends on the broadcasted values #" α (through the function g), which in turn deterministically depend on the input witness w, the sampled random values #" ε , and the hints #" β (through the functions ϕ's). It results that the functionality computed (c) for k = 1 to η j :

• compute a sharing α j,k := ϕ j,k

(ε i ) i≤j ,(α i ) i<j ,(α j,i ) i<k w , ( β i ) i≤j ,
for some F-linear function ϕ j,k

(ε i ) i≤j ,(α i ) i<j ,(α j,i ) i<k ;
• broadcast their shares α j,k ;

• publicly reconstruct α j,k ;

We denote α j := (α j,1 , . . . , α j,η j ).

Protocol 11: General MPC protocol -Iterative computing & broadcasting step for iteration j (with η j denoting the number of inner iterations).

by the protocol can be expressed as:

f (w, #" ε , #" β ) = Accept if g( #" α) = 0, Reject otherwise, with #" α = Φ(w, #" ε , #" β ) , (8.1)
where Φ is the deterministic function mapping (w, #" ε , #" β ) to #" α (defined by the coordinate functions ϕ 1 , . . . , ϕ t ). We shall restrict our model to MPC protocols for which the function f satisfies the following properties:

• If w is a good witness, namely w is such that (x, w) ∈ R, and if the hints #" β are genuinely sampled as β j ← ψ j (w, (ε i ) i<j ; r j ) for every j, then the protocol always accepts. More formally:

Pr #" ε , #" r f (w, #" ε , #" β ) = Accept (x, w) ∈ R ∀j, β j ← ψ j (w, (ε i ) i<j ; r j ) = 1.
• If w is a bad witness, namely w is such that (x, w) / ∈ R, then the protocol rejects with probability at least 1 -p, for some constant probability p. The latter holds even if the hints #" β are not genuinely computed. More formally, for any (adversarially chosen) deterministic functions χ 1 , . . . , χ t , we have:

Pr #" ε , #" r f (w, #" ε , #" β ) = Accept (x, w) ∈ R ∀j, β j ← χ j (w, (ε i ) i<j ; r j ) ≤ p.
We are in the setting where the MPC protocol performs a statistical test on the given witness w, as described in Section 3.3.2. We thus say that a false positive occurs whenever the MPC protocol outputs Accept on input a bad witness w, and we call p the false positive rate. The general MPC model introduced above captures a wide majority of the protocols used in the MPCitH context. To the best of our knowledge, all the practical instantiations of the MPCitH paradigm comply with this model except the ZKBoo [START_REF] Giacomelli | ZKBoo: Faster Zero-Knowledge for Boolean Circuits[END_REF] and Ligero [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF] proof systems. In particular, our model captures:

• the KKW18 protocol [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF] which computes arbitrary arithmetic circuits (used in Picnic2 and Picnic3),

• the product checking protocols in [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] and BN++ [KZ22],

• the product checking protocols in Limbo [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF] and Helium [KZ22],

• the MPC protocols in BBQ [START_REF] Delpech De Saint | BBQ: Using AES in Picnic Signatures[END_REF] and Banquet [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF],

• the MPC protocols in LegRoast [START_REF] Beullens | LegRoast: Efficient Post-quantum Signatures from the Legendre PRF[END_REF] and PorcRoast [BD20],

• the MPC protocol in SDitH [START_REF] Feneuil | Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs[END_REF],

• the MPC protocols in [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF].

Example. As an illustration, we recall BN20 protocol to show how it fits our model. This MPC protocol takes as inputs three sharings x , y and z where x, y, z ∈ F and aims to check that z = x • y. It proceeds as follows:

• The parties get from O H three hint sharings a , b and c such that a, b ← F and c = a • b.

• The parties get from O R a common random point ε ← F.

• The parties locally compute and broadcast

α = ε • x + a and β = y + b .
• The parties publicly reconstruct α and β from α and β .

• The parties locally compute and broadcast

v = ε • z -c + α • b + β • a -α • β.
• The parties publicly reconstruct v from v .

• The parties output Accept if v = 0 and Reject otherwise.

The idea of this protocol is to take (as hint) a multiplicative triple (a, b, c) satisfying c = a • b and to "sacrifice" it using the randomness ε to check that z = x • y. If z = x • y (or if the hint is not well-constructed), the protocol will output Reject with probability 1 -1 |F| , thus its false positive rate is p = 1 |F| . This protocol (that checks a multiplication triple) fits our model. Indeed, the number of round is t := 1 and we have

• ψ 1 is a randomized function that returns a triple (a, b, c) such that (a, b) is random and c = a • b;
• 1 is a random field element;

• ϕ 1 is split in two subfunctions ϕ 1,1 and ϕ 1,2 , as described in Protocol 11 when η 1 = 2:

ϕ 1,1 (x, y, z, a, b, c, ) := (x + • a, y + b) ϕ 1,2 (x, y, z, a, b, c, , α, β) := • z -c + α • b + β • a + α • β
where (α, β) := ϕ 1,1 (x, y, z, a, b, c, ).

Application of the MPCitH Principle

Any MPC protocol complying with the above description gives rise to a practical shortcommunication zero-knowledge protocol in the MPCitH paradigm. The resulting zeroknowledge protocol is described in Protocol 12: after sharing the witness w, the prover emulates the MPC protocol "in her head", commits the parties' inputs, and sends a hash digest of the broadcast communications; finally, the prover reveals the requested parties' inputs as well as the broadcast messages of the unopened party, thus enabling the verifier to emulate the computation of the opened parties and to check the overall consistency.

Soundness. Assuming that the underlying MPC protocol follows the model of Section 8.2.1 with a false positive rate p, the soundness error of Protocol 12 is (see Theorem 3.1.4)

1 N + 1 - 1 N • p.
The above formula results from the fact that a malicious prover might successfully cheat with probability 1/N by corrupting the computation of one party or with probability p by making the MPC protocol produce a false positive.

Performance. The communication of Protocol 12 includes:

• the input shares ( w i , β 1 i , . . . , β t i ) of the opened parties. In practice, a seed seed i ∈ {0, 1} λ is associated to each party so that for each committed variable v (among the witness w and the hints β 1 , . . . , β t ) the additive sharing v is built as

v i ← PRG(seed i ) for i = N v N = v -N -1 i=1 v i .
Thus, instead of committing ( w i , β 1 i ), the initial commitments simply include the seeds for i = N , and com j i becomes useless for j ≥ 2 and i = N . Formally, we have:

com j i =             
Com(seed i ; ρ 1 i ) for j = 1 and i = N Com( w N , β 1 N ; ρ 1 N ) for j = 1 and i = N ∅ for j > 1 and i = N Com( β j N ; ρ j N ) for j > 1 and i = N Some coordinates of the β j might be uniformly distributed over F (remember that the β j are tuples of F elements). We denote β unif the sub-tuple composed of those uniform coordinates. In this context, the last share β unif N can be built as β unif N ← PRG(seed N ) so that a seed seed N can be committed in com 1 N (instead of committing β unif N ). This way the prover can save communication by revealing seed N instead of β unif N whenever the latter is larger;

• the messages α 1 i * , . . . , α t i * broadcasted by the unopened party. Let us stress that one can sometimes save communication by sending only some elements of α 1 i * , . . . , α t i * and use the relation g(α 1 , . . . , α t ) = 0 to recover the missing ones;

• the hash digests h 1 , . . . , h t+1 and the unopened commitments com 1 i * , . . . , com t i * (as explained above, we have com j i * = ∅ for j > 1 if i * = N ).

1. The prover shares the witness w into a sharing w .

2. The prover emulates "in her head" the N parties of the MPC protocol.

For j = 1 to t: a) the prover computes

β j = ψ j (w, (ε i ) 1≤i<j ),
shares it into a sharing β j ; b) the prover computes the commitments

com j i := Com( w i , β 1 i ; ρ 1 i ) if j = 1 Com( β j i ; ρ j i ) if j > 1
for all i ∈ {1, . . . , N }, for some commitment randomness ρ j i ; c) the prover sends

h j := Hash(com 1 1 , . . . , com 1 N ) if j = 1 Hash(com j 1 , . . . , com j N , α j-1 ) if j > 1
to the verifier; d) the verifier picks at random a challenge ε j and sends it to the prover; e) the prover computes

α j := ϕ j (ε i ) i≤j ,(α i ) i<j w , ( β i ) i≤j
and recomposes α j . Note: This step is computed according to Protocol 11 in case of an iterative computing & broadcasting step.

The prover further computes h t+1 := Hash( α t ) and sends it to the verifier.

3. The verifier picks at random a party index i * ∈ [1 : N ] and sends it to the prover.

4. The prover opens the commitments of all the parties except party i * and further reveals the commitments and broadcast messages of the unopened party i * . Namely, the prover sends ( w i , ( a) the views of the opened parties are consistent with each other, with the committed input shares and with the hash digest of the broadcast messages, i.e. for j = 1 to t + 1, Moreover, instead of revealing the (N -1) seeds of the opened parties, one can generate them from a GGM tree as suggested in [START_REF] Katz | Improved Non-Interactive Zero Knowledge with Applications to Post-Quantum Signatures[END_REF]. One then only needs to reveal log 2 N λ-bit seeds. We finally obtain a total communication cost for Protocol 12 of

β j i , ρ j i ) j∈[1:t] ) i =i * ,
h j ? =      Hash(com 1 1 , . . . , com 1 N ) if j = 1 Hash(com j 1 , . . . , com j N , α j-1 ) if j > 1 Hash( α t ) if j = t + 1 b) the output
• when i * = N , Cost = (t + 1) • 2λ h 1 ,h 2 ,...,h t+1 +( inputs w N , β 1 N ,..., + comm α 1 i * ,..., α t i * + λ • log 2 N seed i for i =i * + 2λ com 1 i *
).

• when i * = N ,

Cost = (t + 1) • 2λ h 1 ,h 2 ,...,h t+1 +( comm α 1 i * ,..., α t i * + λ • log 2 N seed i for i =i * + t • 2λ com 1 i * ,...,com t i *
).

where inputs denote the bitsize of (w, β 1 , . . . , β t ) excluding the uniformly distributed elements β unif , and where comm denotes the bitsize of (α 1 , . . . , α t ) excluding the elements which can be recovered from g(α 1 , . . . , α t ) = 0.

To achieve a soundness error of 2 -λ , one must repeat the protocol τ = λ log 2 N times. The resulting averaged cost is the following:

Cost = (t + 1) • 2λ + τ • N -1 N • inputs + comm + λ • log 2 N + N -1 + t N • 2λ .
Several recent works based on the MPCitH paradigm [BD20; KZ22; FJR22b] provides zero-knowledge identification protocols with communication cost below 10 KB for a 128-bit security level. Unfortunately, to obtain a small communication cost, one must take a large number of parties N , which induces an important computational overhead compared to other approaches to build zero-knowledge proofs. Indeed, the prover must emulate N parties in her head for each of the τ repetitions of the protocol, which makes a total of λN log 2 N party emulations to achieve a soundness error of 2 -λ . Thus, increasing N has a direct impact on the performance. For instance, scaling from N = 16 to N = 256 roughly halves the communication but increases the computation by a factor of eight. Given this state of affairs, a natural question is the following:

Can we build zero-knowledge proofs in the MPC-in-the-head paradigm while avoiding the computational overhead of emulating all the parties of the multiparty computation?

In what follows, we show how applying (low-threshold) linear secret sharing to the MPCitH paradigm provides a positive answer to this question.

MPC-in-the-Head with Threshold LSS

General Principle

Let and N be integers such that 1 ≤ < N . We consider an ( + 1, N )-threshold linear secret sharing scheme (LSSS), as formally introduced in Definition 2.4.1, which shares a secret s ∈ F into N shares s ∈ F N . In particular, the vector spaces of Definition 2.4.1 are 1. The parties take as input an ( + 1, N )-threshold linear sharing w .

2. For j = 1 to t, the parties: a) get an ( + 1, N )-threshold linear sharing β j from the hint oracle O H , such that β j ← ψ j (w, ε 1 , . . . , ε j-1 ; r j ) for a uniform random tape r j ; b) get a common random ε j from the oracle O R ; c) for some F-linear function ϕ j

(ε i ) i≤j ,(α i ) i<j , • compute α j := ϕ j (ε i ) i≤j ,(α i ) i<j w , ( β i ) i≤j ,
• broadcast α j ,

• compute α j := Reconstruct J 0 ( α j J 0 ) for some J 0 of size + 1,

• verify that Expand J 0 ( α J 0 ) is consistent with α j (i.e. that α j forms a valid sharing) and reject otherwise.

Note: This step can be composed of several iterations as described in Protocol 11.

3. The parties finally accept if g(α 1 , . . . , α t ) = 0 and reject otherwise.

Note: In the above description w, β j , ε j , α j are elements from the field F or tuples with coordinates in F (whose size is not made explicit to keep the presentation simple).

Protocol 13: General MPC protocol Π LSSS with LSSS.

Conversion to Zero-Knowledge Proofs

We can convert the MPC protocol using threshold linear secret sharings into a zero-knowledge protocol using the MPC-in-the-Head paradigm. Instead of requesting the views of N -1 parties, the verifier only asks for the views of parties. Since the MPC protocol is -private, we directly get the zero-knowledge property. One key advantage of using a threshold LSSS is that only + 1 parties out of N need to be computed by the prover, which we explain further hereafter.

Besides the commitments on the input sharing w , and the hints' sharings β 1 , . . . , β t , the prover must send to the verifier the communication between the parties, which for the considered MPC model (see Protocol 13) consists in the broadcast sharings α 1 , . . . , α t . Observe that such a sharing α j is also an LSSS sharing of the underlying value α j since it is computed as

α j := ϕ j (ε i ,α i ) i≤j w , ( β i ) i≤j
where w , β 1 , . . . , β t are LSSS sharings and ϕ j is an affine function. This notably implies that, for all i, the broadcast sharing α j = ( α j 1 , . . . , α j N ) contains redundancy. According to Lemma 8.3.2, in order to uniquely define such a sharing, one only needs to commit + 1 shares of α j . In other words, we can choose a fixed subset S of + 1 parties and only commit the broadcast shares from these parties, which then acts as a commitment of the full sharing α j . For all j ∈ [1 : t], the prover needs to send the broadcast share α j i * of an arbitrary unopened party i * . To verify the computation of the opened parties I = {i 1 , . . . , i } ⊆ [N ], the verifier can recompute the shares α j i 1 , . . . , α j i . Then, from these shares together with α j i * , the verifier can reconstruct the shares α j S using Expand {i * ,i 1 ,...,i } and check their commitments.

By committing the broadcast messages of only a subset S of parties, the proof becomes independent of the computation of the other parties. It means that the prover must commit the input shares of all the parties but only need to emulate + 1 parties to commit their broadcast shares. When is small with respect to N , this has a great impact on the computational performance of the prover. The resulting zero-knowledge protocol is described in Protocol 14.

Soundness

Consider a malicious prover P who does not know a correct witness w for the statement x but still tries to convince the verifier that she does. We shall say that such a malicious prover cheats for some party i ∈ [1 : N ] if the broadcast shares α 1 i , . . . , α t i recomputed from the committed input/hint shares w i , β 1 i , . . . , β t i are not consistent with the committed broadcast shares ( α 1 S , . . . , α t S ). Let us first consider the simple case of false positive rate p = 0. If a malicious prover cheats on less than N -parties, then at least + 1 parties have broadcast shares which are consistent with ( α 1 i , . . . , α t i ) i∈S and give rise to broadcast values α 1 , . . . , α t for which the protocol accepts, i.e. g(α 1 , . . . , α t ) = 0. Since p = 0, the input shares of those + 1 parties necessarily define a good witness w (i.e. satisfying (x, w) ∈ R), which is in contradiction with the definition of a malicious prover. We deduce that in such a zero-false-positive scenario, a malicious prover (who does not know a good witness) has to cheat for at least N -parties. Then, if the malicious prover cheats on more than N -parties, the verifier shall always discover the cheat since she shall necessarily ask for the opening of a cheating party. We deduce that a malicious prover must necessarily cheat on exactly N -parties, and the only way for the verifier to be convinced is to ask for the opening of the exact parties which have been honestly emulated. The probability of this event to happen is

1 N N - = 1 N ,
which corresponds to the soundness error of the protocol, assuming p = 0.

Let us now consider a false positive rate p which is not zero. A malicious prover can then rely on a false positive to get a higher probability to convince the verifier. In case the committed input shares w 1 , . . . , w N were consistent (i.e. they formed a valid secret 1. The prover shares the witness w into an ( + 1, N )-threshold linear secret sharing w .

2. The prover emulates "in her head" a (public) subset S of + 1 parties of the MPC protocol.

For j = 1 to t: a) the prover computes

β j = ψ j (w, (ε i ) i<j ),
shares it into an ( + 1, N )-threshold linear secret sharing β j ; b) the prover computes the commitments

com j i := Com( w i , β j i ; ρ j i ) if j = 1 Com( β j i ; ρ j i ) if j > 1 for all i ∈ [N ],
for some commitment randomness ρ j i , and computes the Merkle root

hj := MerkleTree(com j 1 , . . . , com j N ).

c) the prover sends

h j := hj if j = 1
Hash( hj , α j-1 S ) if j > 1 to the verifier; d) the verifier picks at random a challenge ε j and sends it to the prover; e) the prover computes, for i ∈ S,

α j i := ϕ j (ε k ) k≤j ,(α k ) k<j w i , ( β k i ) k≤j
and recomposes α j . This step is repeated as many times as in the MPC protocol (cf Protocol 11).

The prover further computes h t+1 := Hash( α t S ) and sends it to the verifier.

3. The verifier picks at random a subset I ⊂ [N ] of parties (i.e. |I| = ) and sends it to the prover.

4. The prover opens the commitments of all the parties in I, namely she sends ( w i , ( β j i , ρ j i ) j∈ [t] ) i∈I to the verifier. The prover further sends the authentication paths auth 1 , . . . , auth t to these commitments, i.e. auth j is the authentication path for {com j i } i∈I w.r.t. Merkle root hj for every j ∈ [t]. Additionally, the prover sends broadcast shares α 1 i * , . . . , α t i * of an unopened party i * ∈ S \ I.

5. The verifier recomputes the commitments com j i and the broadcast values α j i for i ∈ I and j ∈ [t] from ( w i , ( β j i , ρ j i ) j∈ [t] ) i∈I . Then she recovers α 1 , . . . , α t , by α j = Reconstruct I∪{i * } ( α j I∪{i * } ) for every j ∈ [t].

The verifier accepts if and only if:

a) the views of the opened parties are consistent with each other, with the committed input shares and with the hash digest of the broadcast messages, i.e. for j = 1 to t + 1,

h j ? =      hj if j = 1 Hash( hj , α j-1 S ) if 2 ≤ j ≤ t Hash( α j-1 S ) if j = t + 1
where hj is the Merkle root deduced from {com j i } i∈I , auth j and α j-1 S are the shares in subset S deduced from α j-1 = Expand I∪{i * } α j-1 I∪{i * } ; b) the output of the opened parties are Accept, i.e. g(α 1 , . . . , α t ) ? = 0.

Protocol 14: Zero-knowledge protocol: application of the MPCitH principle to Protocol 13 with an ( + 1, N )-threshold linear secret sharing scheme.

sharing), the soundness error would be

1 N + 1 - 1 N • p.
However, we cannot enforce a malicious prover to commit a valid secret sharing w since the verifier never sees more than the shares of parties. More precisely, let us denote

J := {J ⊂ [1 : N ] : |J| = + 1}
and let w (J) be the witness corresponding to the shares w J for some subset J ∈ J , formally w (J) := Reconstruct J ( w J ). Then we could have

w (J 1 ) = w (J 2 )
for distinct subsets J 1 , J 2 ∈ J . A malicious prover can exploit this degree of freedom to increase the soundness error.

Soundness attack. Let us take the example of the [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] protocol on a field F. In this protocol, the MPC functionality f outputs Accept for a bad witness w (i.e. such that (x, w) ∈ R) with probability p = 1 |F| , i.e. if and only if the oracle O R samples a specific element ε w of F. In this context, a possible strategy for the malicious prover is the following:

1. Build the shares w 1 , . . . , w N such that

∀J 1 , J 2 ∈ J , ε w (J 1 ) = ε w (J 2 ) .
We implicitly assume here that N +1 ≤ |F| and that constructing such collision-free input sharing is possible. We assume that (x, w (J) ) ∈ R for every J (otherwise the malicious prover can recover a good witness by enumerating the w (J) 's).

2. After receiving the initial commitments, the verifier sends the challenge ε.

3. If there exists J 0 ∈ J such that ε = w (J 0 ) , which occurs with probability N +1 • p since all the ε (J) are distinct, then the malicious prover defines the broadcast values α 1 , . . . , α t (and the broadcast shares in the set S) according to the broadcast shares of the parties in J 0 . It results that the computation of the parties in J 0 is correct and the prover will be able to convince the verifier if the set I of opened parties is a subset of J 0 (I ⊂ J 0 ). 4. Otherwise, if no subset J 0 ∈ J is such that ε = w (J 0 ) , the malicious prover is left with the option of guessing the set I. Namely, she (randomly) chooses a set I 0 of parties as well as broadcast values α 1 , . . . , α t such that g(α 1 , . . . , α t ) = 0, and then she deduces and commits the broadcast shares α j S from the α j I 0 (computed from the committed input shares) and the chosen α j 's. The malicious prover will be able to convince the verifier if and only if the challenge set I matches the guess I 0 . Remark 8.3.6. The above theorem includes the MPCitH setting with additive sharing as a particular case. Indeed, when = N -1, we obtain the usual formula for the soundness error, that is:

= N -1 =⇒ ε = 1 N + p • 1 - 1 N .
Remark 8.3.7. When = 1, we have ε ≈ 1 N (assuming p is small). It can look as surprising that we can have such soundness error by revealing a single party's view. Since the communication is only broadcast, a verifier does not need to check for inconsistency between several parties, she just needs to check that the revealed views are consistent with the committed broadcast messages. Moreover, the verifier has the guarantee that the shares broadcast by all the parties form a valid sharing of the open value. It means that even if the prover reveals only one party's view, the latter can be inconsistent with the committed broadcast. Assuming we use Shamir's secret sharing, committing to a valid broadcast sharing consists in committing a degree-polynomial such that evaluations are the broadcast shares. By interpolating the broadcast shares of honest parties (and given the plain value of the broadcast message), one shall entirely fix the corresponding Shamir's polynomial, and the other parties can not be consistent with this polynomial without being consistent with the honest parties (and the latter can only occur if there is a false positive).

Performance

The advantage of using a threshold LSSS over a standard additive sharing mainly resides in a much faster computation time, for both the prover and the verifier. Indeed, according to the above description, the prover only emulates + 1 parties while the verifier only emulates parties, which is particularly efficient for a small . For example, assuming that p is negligible and taking = 1, the soundness error is 1/N (which is similar to standard MPCitH with additive sharing) and the prover only needs to emulate + 1 = 2 parties (instead of N ) while the verifier only needs to emulate = 1 party (instead of N -1).

When targeting a soundness error of λ bits, one needs to repeat the protocol τ := -λ log 2 ε times and thus the number of times that a prover emulates a party is multiplied by τ . Table 8.2 summarizes the number of party emulations for the prover and the verifier for the standard case (additive sharing) and for the case of an ( +1, N )-threshold LSSS. Interestingly, we observe that the emulation phase is more expensive when increasing N for the additive sharing case while it becomes cheaper for the threshold LSSS case (with some constant ). The computational bottleneck for the prover when using an LSSS with low threshold and possibly high N becomes the generation and commitment of all the parties' input shares, which is still linear into N . Moreover the sharing generation for a threshold LSSS might be more expensive than for a simple additive sharing. On the other hand, the verifier does not suffer from this bottleneck since she only has to verify opened commitments (per repetition). One trade-off to reduce the prover commitment bottleneck is to increase , which implies a smaller τ (for the same N ) and hence decreases the number of commitments.

In terms of communication, using a threshold LSSS implies a slight overhead. In particular, since only parties out of N are opened, we use a Merkle tree for the commitments and include the authentication paths in the communication.

Let us recall the notations defined in Section 8.2.2:

• inputs: the bitsize of (w, β 1 , . . . , β t ) excluding the uniformly-distributed elements β unif , and

With additive sharing With threshold LSSS = 1 Any

Prover ≈ λ N log 2 N ≈ λ 2 log 2 N ≈ λ +1 log 2 ( N ) Verifier ≈ λ N -1 log 2 N ≈ λ 1 log 2 N ≈ λ log 2 ( N )
Table 8.2.: Number of party emulations to achieve a soundness error of 2 -λ (assuming a negligible false positive rate p).

• comm: the bitsize of ( α 1 i * , . . . , α t i * ) excluding the elements which can be recovered from g(α 1 , . . . , α t ) = 0.

We denote unif the bitsize of the uniformly-distributed elements β unif . Then, the proof size (in bits) when repeating the protocol τ times is

Cost = (t + 1) • 2λ h 1 ,h 2 ,...,h t+1 +τ • ( • (inputs + unif) { w i , β 1 i ,..., β t i } i∈I + comm α 1 i * ,..., α t i * + 2λ • t • • log 2 N auth 1 ,...,autht
).

Let us remark that the bitsize unif appears here while it was not the case for additive sharings. This comes from the fact that, even if β unif is uniformly sampled, β unif has some structure (i.e. some redundancy) when using an arbitrary linear secret sharing scheme.

Remark 8.3.8. As in the additive case, the prover can generate the input shares from seeds for parties, and those seeds can be built using a seed tree. However, this tweak will improve (significantly) the communication cost only when the underlying LSSS has a high threshold (as e.g. in the case of additive sharing).

Let us illustrate the overhead in communication cost when = 1 and t = 1 and negligible unif (which is often small in practice). In this setting, we obtain an average overhead of ∆Cost ≈ τ • λ • (log 2 N -2). When targeting a λ-bit security, we have τ ≈ λ log 2 N , which gives

∆Cost ≈ λ 2 • 1 - 2 log 2 N .
We can observe that the communication overhead due to the use of a LSSS is fixed2 for a given security parameter, and roughly independent on the underlying MPC protocol. When targeting a 128-bit security, this base cost is around 2 KB (for the case = 1 and t = 1).

Further Improvements

In this section, we suggest potential ways to generalize our approach.

Using Threshold Ramp Linear Secret Sharing

Theorem 8.3.5 only considers linear secret sharing schemes, but we can generalize the result to any threshold ramp linear secret sharing scheme (see Definition 2.4.2). In such schemes, shares leak no information about the secret and + 1 + ∆ shares are necessary to reconstruct the secret, with ∆ > 0, namely we have a gap between the two thresholds. In our context, this gap shall impact the soundness of the protocol. Indeed, the prover just needs to cheat for N --∆ parties (such that there is less than + ∆ honest parties), but the verifier asks to open only parties. Considering threshold ramp schemes bring more versatility to our approach and opens the door to techniques that are not possible with tight threshold schemes (e.g. batching such as proposed below).

Let us remark that the set S of emulated parties in Protocol 14 must be chosen such that v S enables to deduce all the shares v [1:N ] . In the tight threshold case, such a set S is always of size + 1 (see Lemma 8.3.2), but in the case of threshold ramp LSSS, this set S might be larger than + ∆ + 1. Moreover, sending shares α 1 i * , . . . , α t i * for one non-opened party i * ∈ S might not be enough to enable the verifier to recompute α j S for all j. Therefore the size of S and the number of additional shares α j i to be revealed depend on the underlying threshold ramp linear secret sharing, which impacts the communication cost. On the other hand, the soundness error of the obtained proof of knowledge is not impacted. Theorem 8.4.1. Let us consider an MPC protocol Π QT-LSSS complying with the protocol format described in Protocol 13, but using an ( , + ∆ + 1, N )-threshold ramp LSSS in place of an ( + 1, N )-threshold LSSS, and such that Π QT-LSSS is -private in the semi-honest model and of false positive rate p. Then, Protocol 14 built from Π QT-LSSS satisfies the three following properties:

• Completeness. A prover P who knows a witness w such that (x, w) ∈ R and who follows the steps of the protocol always succeeds in convincing the verifier V.

• Soundness. Suppose that there is an efficient prover P that, on input x, convinces the honest verifier V to accept with probability

ε := Pr[ P, V (x) → 1] > ε
where the soundness error ε is equal to

+∆ N + p • + ∆ + 1 • N - ∆ + 1 .
Then, there exists an efficient probabilistic extraction algorithm E that, given rewindable black-box access to P, produces with either a witness w satisfying (x, w) ∈ R, or a commitment collision, by making an average number of calls to P which is upper bounded by

4 ε -ε • 1 + ε • 8 • (N -) ε -ε .
• Honest-Verifier Zero-Knowledge. There exists an efficient simulator S which, given random challenge I outputs a transcript which is indistinguishable from a real transcript of Protocol 14.

implying that such sharing schemes could only have a limited interest to optimize the soundness error. We show hereafter that the above generalization to threshold ramp LSSS is useful for another purpose, namely an efficient batching technique in our framework.

Batching Proofs with Shamir's Secret Sharing

Principle. Shamir's secret sharing is traditionally used to share a single element of the underlying field, but it can be extended to share several elements simultaneously. To share v 1 , v 2 , . . . , v u ∈ F, we can sample random elements r 1 , . . . , r of F and build the polynomial P of degree + u -1 such that, given distinct fixed field elements e 1 , . . . , e u+ ,

           P (e 1 ) = v 1 P (e 2 ) = v 2
. . .

P (e u ) = v u and     
P (e u+1 ) = r 1 . . .

P (e u+ ) = r
The shares are then defined as evaluations of P on fixed points of F\{e 1 , . . . , e u }. Revealing at most shares does not leak any information about the shared values v 1 , . . . , v u , while one needs at least + u shares to reconstruct all of them. In other words, this is an ( , + u, N )threshold ramp linear secret sharing scheme for the tuple (v 1 , . . . , v u ). Thus, while applying such a sharing to our context, the soundness error is given by (see Theorem 8.4.1)

+u-1

N + p • + u • N - u .
When running an MPC protocol on such batch sharing, the operations are simultaneously performed on all the shared secrets v 1 , . . . , v u . It means that we can batch the proof of knowledge of several witnesses which have the same verification circuit (i.e. the same functions ϕ j in our MPC model -see Protocol 10). Using this strategy, the soundness error is slightly larger, but we can save a lot of communication by using the same sharing for several witnesses. Specifically, the proof size while batching u witnesses is impacted as follows. The parties' input shares are not more expensive, but to open the communication, the prover now needs to send u field elements by broadcasting (instead of a single one). Thus the communication cost for τ executions is given by

Cost = (t + 1) • 2λ h 1 ,h 2 ,...,h t+1 +τ • ( • (inputs + rtapes) { w i , β 1 i ,..., β t i } i∈I + u • comm α 1 ,...,α t + 2λ • t • • log 2 N auth 1 ,...,autht
).

Unfortunately, the scope of application of this batching technique is limited. In particular, while we can multiply the batched shared secrets by the same scalar, with

   γ • v 1 . . . γ • v u    := γ •    v 1 . . . v u   
for some γ ∈ F, we cannot compute

   γ 1 • v 1 . . . γ u • v u    from    v 1 . . . v u   
for distinct scalars γ 1 , . . . , γ u (whenever at least two scalars are distinct). This restriction implies that the scalar factors used in the verification circuit must be independent of the different witnesses which are batched together. More precisely, it implies that the functions ϕ j in our MPC model (Protocol 10) must be of the form

ϕ j (ε i ) i≤j ,(α i ) i<j • = φj (ε i ) i≤j • Linear function with ε i -dependent coefficients + b j (ε i ) i≤j ,(α i ) i<j
Constant offset which depends on the ε i 's and α i 's

This restriction prevents the use of this batching strategy for several MPCitH protocols.

For example, all the protocols using the multiplication checking protocol from [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] as a subroutine cannot use this batching strategy. To the best of our knowledge, the only protocols in the current state of the art which support this batching strategy are Banquet [START_REF] Baum | Banquet: Short and Fast Signatures from AES[END_REF] and Limbo [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF].

Batching strategies.

In what follows, we propose three strategies to batch MPCitH proofs relying on the same verification circuit:

Naive strategy: The naive way to batch u MPCitH proofs is to emulate u independent instances of MPC protocol, one for each input witness. Compared to sending u independent proofs, one can save communication by using the same seed trees and the same commitments for the u instances. This strategy can be applied for standard MPCitH schemes based on additive sharing as well as for our framework of threshold LSSS-based MPCitH. When using additive sharings, the main drawback of this strategy is that the prover and the verifier need to emulate the party computation a large number of times, i.e. N times (or N -1 times for the verifier) per iteration and per statement. When batching u ≥ 25 statements with N = 256, the prover and the verifier must emulate more than 100 000 parties to achieve a security of 128 bits. When using a low-threshold LSSS, the emulation cost is much cheaper, but the proof transcript is larger. While batching u statements, the emulation cost and the soundness error are given by the following table:

# Emulations Soundness Error Prover τ • ( + 1) • u 1 ( N ) + p • (N -)• +1 Verifier τ • • u

SSS-based strategy:

We can use the batching strategy based on Shamir's secret sharing (SSS) described above. Instead of having u independent input sharings (one per witness), we have a single input sharing batching the u witnesses. The number of MPC emulations is lower than for the naive strategy. The proof size is also smaller and (mostly) below that of the standard setting for small u, but it grows exponentially when considering a small field F. Each batched statement consumes one evaluation point (in F), the Table 8. All the signature sizes are in kilobytes and target a security of 128 bits. The original signature sizes correspond to values given by the underlying articles. The normalized signature sizes are given for a range of 8 -32 parties (in the underlying MPC protocol) when there is a preprocessing phase and for a range of 32 -256 parties otherwise. The column "Model" indicates whether the underlying MPC protocol fits our general model.

where N is the number of MPC parties, τ the number of executions and λ is the security level. Its security is given by the attack of [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF] and is equal to

cost forge := min τ 1 ,τ 2 :τ 1 +τ 2 =τ 1 τ i=τ 1 τ i p i (1 -p) τ -i + N τ 2
where p is the false positive rate of the SDitH MPC protocol satisfying

p ≤ t i=0 max ≤(m+w)/d-1 i |F points |- t -i |F points | t 1 |F points | t -i .
In Chapter 5, we presented the SDitH scheme with several parameter sets: some of them with F SD := F 2 and the others with F SD := F 256 , some of them aiming for short signatures and the others aiming for fast signature/verification time.

We apply the ideas of Section 8.3 to this scheme using Shamir's secret sharing. Since the number N of parties is limited by the field size, N ≤ |F SD |, 3 we consider the instance with F SD := F 256 as base field. As explained previously, our MPCitH strategy with ( + 1, N )threshold LSSS does not make the signature smaller but substantially improves the signing and verification times. According to Section 8.3.4, we obtain signatures of size (in bits):

Size = 6λ + τ • • (inputs + unif) + comm + 2λ • • log 2 N
In Chapter 5, we chose p a bit lower than 2 -64 which implies that the number of executions τ just needs to be increased by one while turning to the non-interactive case. Here, by taking > 1, we decrease τ and each execution has more impact on the communication cost. Therefore we take p negligible in order to avoid to increase τ while turning to the noninteractive setting. At the same time, it means that we can apply an idea from Limbo [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF] which consists in using the same first challenge for all parallel executions of the underlying MPC protocol to save communication (due to the fact that the plain broadcasted values will be the same across all the parallel executions).

As explained in Section 8.3.3 and formally analyzed in our proof of soundness (see Appendix B), in case of a non-negligible false positive rate, an adversary can try to forge a proof of knowledge by committing an invalid sharing of the witness (which is not possible in the case of additive sharing). This ability is also exploitable in the non-interactive setting while considering the attack of [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF]. In order to thwart this type of attack on our variant of the SDitH scheme, we make the conservative choice of taking a false positive rate p satisfying

τ • N + 1 • p ≤ 2 -128 .
This way, the probability that a single witness encoded by a subset of + 1 shares among N leads to a false positive (in at least one of the τ iterations) is upper bounded by 2 -128 so that any attack strategy which consists in guessing (even partially) the first challenge shall cost at least 2 128 operations. Then, we simply need to take τ such that N τ ≥ 2 128 in order to achieve a 128-bit security in the non-interactive setting. We propose three possible instances of our scheme for ∈ {1, 3, 7} and N = 256 (the maximal number of parties). We have implemented this variant of the SDitH signature scheme in C. In our implementation, the pseudo-randomness is generated using AES in counter mode and the hash function is instantiated with SHAKE. We have benchmarked our implementation on a 3.8 GHz Intel Core i7 CPU with support of AVX2 and AES instructions. All the reported timings were measured on this CPU while disabling Intel Turbo Boost. Instead of emulating + 1 parties as described in Protocol 14, the implementation runs the MPC protocol directly on the coefficients of the degree-polynomials of the Shamir's secret sharing, thus avoiding costly polynomial evaluations and interpolations.

Table 8.4 summarizes the obtained performance for the different sets of parameters. We observe that the verification time is significantly smaller -between one and two orders of magnitude-than for the original scheme. This was expected since the verifier only emulates the views of parties instead of N -1. The gain in signing time is more mitigated: even if the signer emulates only few parties, she must still commit the input shares of N parties. Nevertheless, the number of executions τ decreases while increasing the threshold , which further improves the signing time. The resulting signatures are slightly larger than for the original scheme with the same number of parties (the short version), but our scheme gains a factor 10 in signing and verification time. Compared to the fast version of the original signature scheme (which uses a lower number of parties N = 32) and for similar signature size, our scheme gains a factor 3 in signing time and a factor 10 in verification time. Table 8.4 further compares our scheme with recent MPCitH schemes based on AES (both AES and SD for random linear codes being deemed as a conservative assumption) as well as with SPHINCS + [ABB+22] as a baseline conservative scheme. We can observe that our scheme outperforms AES-based candidates for comparable signature sizes (around 10 KB). In particular, compared to Helium+AES [START_REF] Kales | Efficient Lifting for Shorter Zero-Knowledge Proofs and Post-Quantum Signatures[END_REF], signing is 5 times faster with our scheme while verification is 40 times faster. Fast versions of those schemes have signatures about twice larger, while being still slower than ours in signing and verification. Compared to SPHINCS + , our scheme achieves slightly better verification time and much better trade-offs for signature size vs. signing time. Some other MPCitH signature schemes reported in Table 8.3 achieve smaller signature sizes (down to 5KB) but they are based on less conservative assumptions (LowMC, Rain, BHH PRF). Yet none of these schemes achieve fast verification as SPHINCS + or our scheme.

Let us remark that, as in Chapter 5, we did not investigate software optimizations (like vectorization or bitslicing), so there is room for improvement in the reported performance.

Application of the Batching Strategy

Application to SDitH.

As the first application of the batching strategy described in Section 8.4.2, we show how to batch proofs of knowledge for the syndrome decoding problem. Specifically, we consider a context where, from a public parity-check matrix H ∈ F (m-k)×m SD and vectors y 1 , . . . , y u ∈ F m-k SD , one wants to batch proofs of knowledge for u small-weight syndromes x 1 , . . . ,

x u ∈ F m SD such that ∀i ∈ [1 : u], y i = H • x i .
For this purpose, we apply our batching strategy to the SDitH scheme (see Chapter 5). However, in its original version, this scheme is not compatible with the application of batched Shamir's secret sharing (on which rely our batching strategy) since it involves multiplications by witness-dependent scalars. Those appear in the final product verification based on the [BN20] protocol. To overcome this issue, we propose a tweak of the SDitH scheme to verify the final multiplication triple without relying on [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF]. Specifically, to prove that three sharings a , b and c verify c = a • b (a, b, c ∈ F points ), the parties proceed as follows:

• they get as hints r 1 where r 1 ← F points r 2

where r 2 ← F points h 1

where

h 1 = r 1 • b + r 2 • a h 2 where h 2 = r 1 • r 2 ,
• they get a random point ξ ← F points \{0},

• they locally compute and broadcast

     v 1 = ξ • r 1 + a v 2 = ξ • r 2 + b v 3 = ξ 2 • h 2 + ξ • h 1 + c , • they output Accept if v 1 • v 2 = v 3 , Reject otherwise.

Application to Limbo.

We now apply our batching strategy to Limbo [DOT21], a proof system for general arithmetic circuits. In Limbo, sharings are multiplied by scalars in three different contexts:

• After sampling a random challenge {r i } m i=1 , a set of multiplicative triples ( x i , y i , z i ) m i=1 is verified as an inner product a, b = c where

a =    r 1 • x 1 . . . r m • x m    , b =    y 1 . . . y m    , c = m i=1 r i • z i .
If a, b = c for a random choice of {r i } m i=1 , then we can deduce that x i • y i = z i for every i ∈ [1 : m] with high probability. 4

• To interpolate a polynomial f of degree d such that f (e i ) = x i for i ∈ {0, . . . , d} where e 0 , . . . , e d are fixed distinct public points. With the Lagrange interpolation formula, we get that

f (X) = d i=0 x i • m j=0,j =i X -e j e i -e j i (X)
where { i (X)} i are public constant polynomials.

• To evaluate a polynomial f (X) := d i=0 a i X i in a challenge point s:

f (s) = d i=0 a i • s i .
In all those three contexts, the scalars which multiply the shares are constant or derived from random challenges. In particular, they are witness-independent which makes our batching strategy applicable (see Section 8.4.2 for details). Let us briefly explain the high-level idea of the MPC protocol underlying Limbo. This protocol aims to check a list of m multiplicative triples. To proceed, it first converts the list into an inner product of dimension m (as recalled above), and then repeats a compression step that reduces the inner product dimension until reaching a small enough instance. Given a compression parameter k, the compression step works as follows (the process is illustrated in Figure 8.2):

1. it splits the current inner product into k smaller inner products, 2. it compresses the k inner products into a single inner product. Let us consider the k values v (1) , ..., v (k) of these inner products in the same position. To compress these k values into a single one v, it builds the polynomial P of degree k -1 such that ∀i ∈ {1, . . . , k}, P (i) = v (i) and it computes v as P (ξ) where ξ is a random verifier challenge.

                x (1) 1 . . . x (1)
. . .

x (k) 1 = z (1) + . . . + z (k)
Step 1 Splitting

    x (1) 1 . . . x (1)     ,     y (1) 1 . . . y (1)     = z (1) , . . . ,     x (k) 1 . . . x (k)     ,     y (k) 1 . . . y (k)     = z (k)
Step 2 Compression

   x 1 . . . x    ,    y 1 . . . y    = z where v = k i=1 v (i) • k j=1,j =i ξ-j i-j
with x u , y u or z for v and with ξ a verifier challenge. Let us consider the case where Limbo will always finish on a final inner product of dimension 1, after ρ := log k (m) compression steps. Using the same notations as in Section 8.3, the proof size involves the following quantities:

• inputs = (|w| + |C|) • log 2 F Protocol inputs + ρ • (k -1) • log 2 G Splitting cost + (ρ • (k -1) + 2) • log 2 G Compression cost , • unif = 2 • log 2 G, • comm = 2 • log 2 G,
where |w| is the size of the witness (i.e. the circuit input), |C| is the number of multiplications in the circuit, F is the base field of the circuit, G is a field extension of F and k is the compression factor (see [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF] for more details). Limbo's proof size (in bits) is then given by:

Size = (ρ + 2) • 2λ + τ • inputs + comm + λ • log 2 (N ) + 2λ
where N is the number of MPC parties, τ is the number of executions and λ is the security level. Limbo's soundness error is given by: Let us assume that we want to batch u proofs for an arbitrary arithmetic circuit C defined over a base field F. We use the Limbo proof system in interactive mode targeting a security of 40 bits, which is one of the considered use-cases of the original paper [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF]. If F is large enough, we can apply our batching strategy described in Section 8.4.2. Tables 8.5 and 8.6 summarize the achieved performance for the base fields F 2 8 and F 2 32 and for circuit sizes 2 8 and 2 16 . While for F 2 8 we are limited in the number of parties since N ≤ |F| + 1 -u, this is not an issue for F 2 32 . From these tables, we can observe that our batching strategy drastically reduces the amortized cost in terms of proof size. Considering a batching of u = 100 statements, the amortized proof size is more than 10 times smaller than the standard version in all the considered settings and this ratio is closer to 1/20 for the larger circuit or field. Note: The compression factor k of Limbo is 16 and the extension field G is F 2 64 when = 1 and F 2 96 when = 4. All the sizes are given in kilobytes. #P and #V correspond respectively to the number of emulated parties for the prover and the verifier. The first row ( = add) is the baseline Limbo scheme with additive sharing.

1 N + p k • (1 - 1

Conclusion

In this chapter, we have proposed a new way to transform an MPC protocol into a zeroknowledge proof of knowledge. We have shown how using low-threshold LSSS enables us to produce faster schemes. When building signature schemes, it tends to give larger signatures compared to the standard approach based on additive sharings. In other contexts (larger circuits, batching), it can also achieve shorter communication.

In November 2022 (one month after the release of this work), a concurrent and independent work [START_REF] Aguilar Melchor | The Return of the SDitH[END_REF] proposes a computational optimization of the MPCitH transformation based on additive sharing (see Section 3.1.2.2). Using the so-called hypercube technique, the authors show that the prover can emulate the entire MPC protocol by performing the computation of only log 2 N + 1 parties instead of N , while keeping the same communication cost. While both the hypercube approach and our work enable us to significantly speed up MPCitH-based schemes, they provide different interesting trade-offs and their relative performance depends on the context.

NIST Call for Additional Signatures

In September 2022, the NIST released a call for additional digital signature proposals to be considered in the PQC standardization process [START_REF]Call for Additional Digital Signature Schemes for the Post-Quantum Cryptography Standardization Process[END_REF].

NIST is primarily looking to diversify its signature portfolio, so signature schemes that are not based on structured lattices are of greatest interest. NIST would like submissions for general-purpose signature schemes, as well as those which have short signatures and fast verification. Submissions should not significantly overlap with signature schemes that have already been selected by NIST for standardization. At a minimum:

• lattice-based schemes should provide at least one large performance advantage over both Dilithium and Falcon.

• non-lattice-based algorithms should provide at least one large performance advantage over SPHINCS+.

-NIST, September 2022

Since the schemes proposed in this thesis are competitive with the existing post-quantum state of the art, we decided to submit some of them to the NIST call, in collaboration with several teams. More precisely, we submitted four signature schemes, each of them relying on a specific hard problem:

• SD-in-the-Head, relying on the syndrome decoding problem for random linear codes in Hamming metric;

• MIRA, relying on the MinRank problem;

• RYDE, relying on the syndrome decoding problem for random linear codes in rank metric;

• MQOM, relying on the unstructured multivariate quadratic problem.

There are two reasons why we submitted several submissions:

• Each of these schemes has its own specificities leading to different advantages:

-MIRA and RYDE produce the shortest signatures;

-SD-in-the-Head could be considered as the more conservative scheme;

-RYDE has the shortest uncompressed public key (which is more convenient for embedded systems);

-SD-in-the-Head (threshold variant) has the fastest verification algorithm;

-MQOM has sizes close to those of MIRA and RYDE, without relying on the rank metric.

• The MPC-in-the-Head state of the art remains an active research field and it is not stable yet. There will probably be new results leading to more efficient schemes (in term of sizes and/or running times). Each submission could be impacted differently by them. Currently, the shortest sizes are achieved by MIRA and RYDE, but this could change in the future.

In what follows, we briefly present the design choices made for each of these submissions.

We also consider the two fields for the syndrome decoding problem: F 251 and F 256 . The prime field will lead to a more efficient scheme for the fast variant since the computational bottleneck of the used MPCitH transformation is due to the arithmetics. However, F 256 will lead to a more efficient scheme for the short variant since its computational bottleneck is the usage of the symmetric primitives (as the pseudo-random generation). Even if it would arguably give a more conservative code-based scheme, we did not consider the binary field F 2 since the resulting signature sizes are not competitive.

We refer the reader to the scheme's specification [START_REF] Aguilar Melchor | The Syndrome Decoding in the Head (SD-in-the-Head) Signature Scheme -Algorithm Specifications and Supporting Documentation[END_REF] for the precise description of the submitted scheme.

MIRA Signature Scheme

The MIRA signature scheme has been submitted to the NIST in collaboration with Nicolas Aragon, Magali Bardet, Loïc Bidoux, Jesús-Javier Chi-Domínguez, Victor Dyseryn, Philippe Gaborit, Romaric Neveu, Matthieu Rivain, and Jean-Pierre Tillich.

The security of this scheme relies on the hardness of the MinRank problem (see Definition 7.4.3). The used MPC protocol is the one in Section 7.4.2 based on linearized polynomials.

We propose two variants of our signature scheme. Both rely on the MPCitH transformation for the broadcast-based multiparty computation model with additive sharing (see Section 3.1.2.2, optimized by the hypercube technique [START_REF] Aguilar Melchor | The Return of the SDitH[END_REF]). The short variant lowers the communication cost to produce short signatures by taking N := 256 parties, while the fast variant lowers the computational cost to get a fast signature computation by taking N := 32 parties. We did not design the fast variant with low-threshold LSSS as SD-in-the-Head, since it would require to work on larger fields (for which the MinRank cryptanalysis is much less mature).

We refer the reader to the scheme's specification [START_REF] Aragon | MIRA Specifications[END_REF] for the precise description of the submitted scheme.

RYDE Signature Scheme

The RYDE signature scheme has been submitted to the NIST in collaboration with Nicolas Aragon, Magali Bardet, Loïc Bidoux, Jesús-Javier Chi-Domínguez, Victor Dyseryn, Philippe Gaborit, Antoine Joux, Matthieu Rivain, Jean-Pierre Tillich, and Adrien Vinçotte.

The security of this scheme relies on the hardness of the rank syndrome decoding problem (see Definition 7.4.4). The used MPC protocol is a variant of the one in Section 7.4.3 based on linearized polynomials. We slightly change the underlying hardness assumption by assuming that 1 is in the linear subspace U generated by the coordinates of the secret vector. It implies that the q-polynomial L U of Section 7.4.3 satisfies L U (1) = 0, and we can use this relation to decrease the communication cost.

We propose two variants of our signature scheme. As for MIRA, both rely on additive sharings and use the hypercube technique. The short variant lowers the communication • mpc.h. This file describes the prototypes of the functions that emulate a party in the MPC protocol (and which generate the verifier challenges used in the MPC protocol).

4. MPCitH Transformation. The highest layer implements the signature schemes relying on the previous layers. The key generation uses the generation of the couple instance-solution provided by witness.h, while the signing and the verification use the party emulation provided by mpc.h. At the time of writing, the library provides the source code of several variants (i.e. MPCitH transformations):

• Traditional 5R: transformation of an MPC protocol using additive sharings into a 5-round proof of knowledge, without the hypercube optimization.

• Hypercube 5R: transformation of an MPC protocol using additive sharings into a 5-round proof of knowledge, with the hypercube optimization.

• Threshold 5R: transformation of an MPC protocol using threshold LSSS into a 5-round proof of knowledge.

• Threshold 5R NFPR: transformation of an MPC protocol using threshold LSSS into a 5-round proof of knowledge, assuming that the false positive rate of the MPC protocol is negligible.

• Hypercube 7R: transformation of an MPC protocol using additive sharings into a 7-round proof of knowledge, with the hypercube optimization. To implement a new MPCitH-based scheme, one needs to 1. implement the field operations in the folder arithmetic, if they are not already available;

2. implement the generation of the couple instance-solution of the underlying hard problem, with respect to the API described by witness.h;

3. implement the emulation of a party of the MPC protocol, with respect to the API described by mpc.h; 4. build the configuration file of the scheme to select the desired symmetric primitives and the MPCitH variant.

Here is a (simplified) configuration file for a scheme implemented in the library: This configuration indicates that:

• the files implementing witness.h and mpc.h are in the folder mpc/sd/sdith_any,

• the scheme needs the files in arithmetic/gf251 (meaning that it works over F 251 ),

• the scheme uses the variant THRESHOLD_NFPR,

• it uses the hash function (and XOF) available at sym/hash/sha3/sha3-several,

• it uses the pseudo-random bit generator available at sym/drbg/hash,

• the scheme can rely on the fourfold implementation of the symmetric primitives when available.

Moreover, the flags GF251 and L1 enable us to select the desired parameter sets.

Some benchmarks

We used the library to implement the schemes proposed in Chapter 7. All these schemes rely on the variant "Hypercube 5R". The library has been configured such that the pseudorandomness is generated using AES in counter mode, the hash function is SHA3, and the extendable output function (used for the MPC challenge) is sampled using SHAKE. We benchmarked our schemes on a 3.8 GHz Intel Core i7 CPU with the support of AVX2 and AES instructions. All the reported timings were measured on this CPU while disabling Intel Turbo Boost. The obtained signing times are given in Table 9.1. As explained previously, the library can produce detailed benchmarks. It enables the developer to estimate the computational contribution of each part of the implemented signature scheme. In Table 9.1, we decompose the running time of our schemes in six parts: the expansion of the seed trees, the commitments of the input shares, the expansion of the input shares from seeds, the remaining operations to prepare input shares (e.g. the computation of the shares of the "main" parties of the hypercube technique), the emulation of the MPC protocol and the rest of the computation.

Here is an analysis of the obtained running times: • Tree Expansion: it consists in deriving N seeds from a master seed using the structure of a binary tree. This operation only depends on the number of parties N , and it is repeated at each repetition (i.e. τ times). Thus, when we fix N , the computation contribution is linear into τ . It can be observed from the benchmark: when N = 32, it takes 0.0073 • τ ms, and when N = 256 it takes 0.055 • τ ms.

• Commitment: it consists in committing the input shares of N parties. In practice, it consists in committing a λ-bit seed for all the parties except the last one. The cost of committing the entire input share of the last party tends to be negligible compared to the cost of committing N -1 seeds. The computation contribution of the commitments is thus roughly linear into N • τ . From the benchmark, we get that it takes 0.0575 • τ ms when N = 256 and 0.0082 • τ ms when N = 32 (committing a seed with a salt takes around 220 nanoseconds).

• Randomness Expansion: it consists in expanding seeds to get input shares. The computational cost depends on the number τ of repetitions, the size of the input shares, and the field from which elements should be sampled. When the field is an extension of F 2 , the sampling can be efficient. However, sampling in another field is less efficient since we need to deal with rejection. This explains why the cost of this step is larger for MQ over F 251 than for MQ over F 256 .

• Share Preparation: it consists in getting the input share of the last party from the other ones and computing the shares of the "main" parties of the hypercube technique (see [START_REF] Aguilar Melchor | The Return of the SDitH[END_REF] for details). It depends on τ , the size of the input shares, and the additive law of the underlying field. This step is very efficient when working in characteristic two since the addition is the bitwise XOR. When working in prime fields, we need to deal with reduction.

• MPC Emulation: it consists in emulating the MPC protocols. Thanks to the hypercube technique, it consists in emulating 1 + log 2 (N ) parties by repetition. The important point to remark here is that the choice of N does not much impact the emulation cost. It comes from the fact that τ ≈ λ log 2 (N ) , so the total computation cost of the emulation corresponds 2 to the cost of emulating τ

• (1 + log 2 (N )) ≈ λ + λ log 2 (N )
parties.

• Misc: it corresponds to the rest of the signing computation (decompression of the public key, building of the signature, ...).

We can observe that the running time due to the symmetric primitives (the three first columns) is not negligible compared to the emulation of the MPC protocol. For 256 parties, it takes at least 2.5 milliseconds. Let us stress that the factorized code of the library, which mainly relies on symmetric primitives, has been optimized. For example, it relies on fourfold calls of Keccak (for SHA3) using AVX instructions. However, the arithmetic parts used by the MPC protocols have not been optimized. When the MPC protocol is heavy (as for the scheme based on the MinRank problem with linearized polynomials), this is the computational bottleneck. However, for light MPC protocols (for example, those based on the rank syndrome decoding problem), the timing contribution of the MPC emulation is similar to the one of symmetric primitives. We could expect that the latter becomes the computational bottleneck when using an optimized implementation of the MPC protocols. In fact, that can be observed in the implementations of the NIST candidate SD-in-the-Head (see Section 9.1.1). 2 We omit here that τ is larger than λ log 2 (N ) to be secure against the forgery attack of [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF], but the conclusion would be the same.

Chapter 10

Chapter 10.

Conclusion and Open Questions

In this thesis, we have investigated the MPC-in-the-Head paradigm to build post-quantum signature schemes. Prior works only applied this paradigm to symmetric primitives (such as LowMC or AES). We demonstrated that it can also be applied to other hardness assumptions, e.g. from code-based cryptography. Most of the proposed schemes achieve sizes between 5 KB and 10 KB while relying on unstructured assumptions. They are thus competitive with the existing schemes in the post-quantum literature. They outperform SPHINCS + by achieving smaller sizes with faster signing algorithms, while staying conservative (even though their security assumptions do not only rely on hash functions as in SPHINCS + ). The MPC-in-the-Head framework currently leads to the best code-based schemes for the common "signature size + public key size" metric. These good sizes have been achieved by designing very efficient MPC protocols for the considered problems. An open question would be: Question 10.1. Do there exist MPC protocols which would lead to better schemes for those hardness assumptions (while working in the broadcast-based multiparty computation model with additive sharing)? However, we can already conjecture that we should not observe big improvements. We can indeed exhibit lower bounds for the size of MPCitH-based signatures with additive sharing (using the fact that one uses GGM trees and one needs to share the secret). For example, for the rank syndrome decoding problem, we can show that the signature size is at least (in bits)

4λ + τ • (k • m • log 2 q + λ • log 2 N + 2λ)
where λ is the security level in bits, N is the number of parties involved in the underlying MPC protocol, τ is the number of repetitions and (q, m, k) are RSD parameters. For the RSD instance used in Section 7.4.3, we get a lower bound of 3.6 KB for 128-bit security with N = 256, while our scheme achieves sizes of 5.9 KB.

The most promising direction to improve the schemes proposed in this thesis consists in proposing new MPCitH transformations. In Chapter 8, we showed that we can use low-threshold linear secret sharings to build faster schemes. The approach leads to the MPCitH-based schemes with the fastest verification. However, it suffers from an increase of the signature size, which can be important depending on the used MPC protocol. In the state of the art, there are only two MPCitH works dealing with Shamir's secret sharings: [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF] and the work described in Chapter 8. We can observe that there is a gap between them.

[AHIV17] considers a more general setting, but it does not achieve competitive performance -175 -when building signature schemes, and Chapter 8 considers a restricted setting (it allows only linear operations on sharings) preventing to use more efficient MPC protocols to build signatures. A natural question would thus be: Question 10.2. Could we improve [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF] to get small sizes even when considering small arithmetic circuits (as those in signature schemes)? Could we extend the setting of Chapter 8 while keeping small sizes?

Finally, as mentioned in Chapter 3, the state of the art about schemes with advanced functionalities (as ring/group signatures, multi-signatures, threshold signatures, ...) are sparse. Now that we have efficient signature schemes, an interesting research direction would consist in adding features to them.

Question 10.3. How can we build efficient schemes with advanced functionalities thanks to the MPC-in-the-Head paradigm?

In what follows, we show that the above simulator outputs a distribution which is perfectly indistinguishable from the views of the same parties in a real execution setting, which proves the -privacy of the protocol Π LSSS .

Let us fix a set I ⊂ [N ] such that |I| = . Let us also take w and #" β and share them as w = Share LSSS (w; r 1 ) #" β = Share LSSS ( #" β ; r 2 ) using some random tapes r 1 , r 2 . Finally, let us sample a random #" ε .

We propose below three experiments. We denote Exp 1 , Exp 2 and Exp 3 the distribution of their respective outputs. The first experiment corresponds to the simulation of the joint view of the parties in I.

Experiment 1. We compute the output y ∈ {Accept, Reject} of the protocol using w , #" β and #" ε :

y = Accept if g( #" α) = 0,
Reject otherwise, with #" α = Φ(w, #" ε , #" β ) .

Then, we output the views returned by Sim LSSS (I, w I , #" β I , #" ε , y) together with y.

Experiment 2. The difference with the previous experiment is that w and #" β are respectively defined as w and #" β (instead of being random). Thanks to the privacy of the additive sharing we get that w I and #" β I are perfectly indistinguishable from w I and #" β I which implies Exp 1 ≡ Exp 2 .

(Here Exp 1 ≡ Exp 2 means that the two distributions are perfectly indistinguishable).

Experiment 3. The difference with the previous experiment is that #" α is defined as #" α = Φ(w, #" ε , #" β ) (where Φ is defined as in Equation (8.1)) instead of #" α = #" α . Thanks to the (N -1)-privacy of the protocol Π add , we get that the joint views view add returned by the simulator are perfectly indistinguishable from the same views in real-world protocol execution. In particular, #" α is identically distributed in the two experiments, which implies

Exp 2 ≡ Exp 3 .
Finally, it is not hard to check that the output of Experiment 3 corresponds to the real-world joint views of the parties in I, which concludes the proof.

B. Proof of Soundness

This appendix provides a proof for the soundness property in the following theorem: Theorem 8.3.5. Let us consider an MPC protocol Π LSSS complying with the protocol format described in Protocol 13 using an ( + 1, N )-threshold LSSS, such that Π LSSS is -private in the semi-honest model and of false positive rate p. Then, Protocol 14 built from Π LSSS satisfies the three following properties:

• Completeness. A prover P who knows a witness w such that (x, w) ∈ R and who follows the steps of the protocol always succeeds in convincing the verifier V. Proof. The first equality comes from the fact the underlying events form a partition. The second equality can be proved by induction on the integer M . The case M = 1 is trivial:

B.2. When restraining to only bad witnesses

Let r h be a possible realization of R h . Given R h = r h , we have a unique hash commitment h 1 in the transcript. This hash commitment uniquely defines the shares of the witness w 1 , . . . , w N (by assumption on the absence of hash/commitment collisions). In the following, we shall denote w (J) the witness corresponding to the shares { w i } i∈J , for |J| = + 1. We have a total of N +1 possibly-distinct witnesses w (J) . We shall say that w (J) is a good witness whenever (x, w (J) ) ∈ R, otherwise we call w (J) a bad witness.

For any transcript produced by P (with h 1 as first hash commitment), the hash commitments h 2 , . . . , h t uniquely define the shares { α j i } i∈S , for j ∈ [t]. In the following, we shall denote by α j = ( α j 1 , . . . , α j N ) the full ( + 1, N )-sharing consistent with the shares { α j i } i∈S . The hash commitments h 2 , . . . , h t also uniquely define the shares { β j i } i∈[N ] , for j ∈ [t]. We shall denote H the set of honest parties, i.e. the set of the parties for which the committed shares α 1 i , . . . , α t i , are consistent with the committed input shares w i and β 1 i , . . . , β t i . More formally,

H = i : ∀j, α j i = ϕ j (ε i ) i≤j ,(α i ) i<j ( w i , ( β k i ) k≤j ) .
We further denote Y the random variable which corresponds to the number of honest parties, i.e. Y = |H|. We stress that α 1 , . . . , α t , H and Y depend on the randomness of the (malicious) prover and the randomness of the verifier used before Step 3 of Protocol 14.

For every i ∈ [N ] and j ∈ [t], we shall further denote ᾱj i the share obtained through an honest computation from the committed input shares, that is:

ᾱj i = ϕ j (ε i ) i≤j ,(α i ) i<j ( w i , ( β k i ) k≤j ) .
We stress that ᾱj i might not be equal to α j i . We actually have i ∈ H if and only if ᾱj i = α j i for every j ∈ [t]. In the following, we shall say that witness w (J) gives rise to a false positive in the MPC protocol Π, and denote this probability event E J , whenever We will show that, if {w (J) } J∈J are all bad witnesses, then the probability Pr [succ P ] is upper bounded by

Pr [succ P ] ≤ N N • ε (1)
where ε is the soundness error defined in the theorem statement, which is

ε := 1 N + p • • (N -) + 1 .
The rest of this subsection is devoted to the demonstration of Equation (1).

≤ 1 N + N • |J | • p = N N •         1 N + N • N + 1 ≤( N +1 ) p         ≤ N N • ε .
Thus we obtain the desired inequality (1).

B.3. Building of the extractor

In the previous subsection, we proved that the probability that a malicious prover P produces a valid transcript when the opened parties are restricted to a set of N parties for which the shares only encode bad witnesses is upper-bound by N N • ε .

We now show how to build an extractor which outputs a witness w satisfying (x, w) ∈ R (if not a hash or commitment collision) when giving rewindable black-box access to a malicious prover P which produces successful transcripts with a probability ε > ε.

Let us fix an arbitrary value δ ∈ (0, 1) such that (1 -δ)ε > ε (such δ exists since ε > ε). Let r h be a possible realization of R h . We will say that r h is good if it is such that (4)

Pr[succ P | R h = r h ] ≥ (1 -δ) • ε . ( 3
Our extractor first runs the P with honest verifier requests until obtaining a successful transcript T 0 by running. If this T 0 corresponds to a good r h , then we can obtain further successful transcripts with "high" probability (i.e. probability greater than (1 -δ) • ε) by rewinding the protocol just after the initial commitment h 1 . Based on the assumption that r h is good, a sub-extractor E 0 will build a list of successful transcripts T , all with same initial commitment. We denote P (T ) the set of the parties which have been open in at least one transcript of T , i.e. P (T ) := T ∈T I T where I T is the set of opened parties of the transcript T .

For a certain number N 1 of iterations, the sub-extractor E 0 tries to feed the list T until there exist a good witness among the open input shares. We formally describe the sub-extractor routine in the following pseudocode: Sub-extractor E 0 (on input a successful transcript T 0 ):

1. T = {T 0 } 2. Do N 1 times: 3.

Run P with honest V and same r h as T 0 to get transcript T 4.

If T is a successful transcript, 5.

T ← T ∪ {T }.

6.

If T contains a good witness w, return w. 7. Return ∅.

Let us evaluate the probability that the stop condition is reached in a given number of iteration N 1 . Consider a loop iteration in E 0 at the beginning of which we have a list T of successful transcripts (which does not contain a good witness since the stop condition has not been reached) and a transcript T sampled at Step 3. We denote Z the event that a new party is open (a party which is not in P (T )) in the transcript T . This event is defined with respect to the randomness of the verifier challenges in T .

Let us lower bound the probability to have a successful transcript T and the event Z occurring in the presence of a good R h :

p g := Pr[succ P ∩ Z | R h good] .
We have:

p g = Pr[succ P | R h good] -Pr[succ P ∩ Z | R h good] = Pr[succ P | R h good] -Pr[succ P | R h good, Z] • Pr[ Z | R h good] ≥ (1 -δ) • ε -Pr[succ P | R h good, Z] • Pr[ Z | R h good]
The inequality (6) holds from the Bienaymé-Techbychev inequality. Thus, using N 1 = 4(N -) p 0 , the probability to reach the stop condition assuming a good R h is at least 1/2. Without assumption on R h , the probability to reach the stop condition satisfies:

Pr[E 0 (T 0 ) = ∅ | succ T 0 P ] ≥ Pr[R h good | succ T 0 P ] • Pr[E 0 (T 0 ) = ∅ | succ T 0 P ∩ R h good] ≥ δ 2 .
Let us now describe the complete extractor procedure:

Extractor E:

1. Repeat +∞ times: 2.

Run P with honest V to get transcript T 0 3.

If T 0 is not a successful transcript, go to the next iteration 4.

Call E 0 on T 0 to get list of transcripts T 5.

If T = ∅, return T

Let C denotes the number of calls to P made by the extractor before ending. While entering a new iteration:

• the extractor makes one call to P to obtain T 0 ,

• if T 0 is not successful, which occurs with probability (1 -Pr[succ T 0 P ]), • the extractor continues to the next iteration and makes an average of E[C] calls to P,

• if T 0 is successful, which occurs with probability Pr[succ T 0 P ],

• the extractor makes at most N 1 calls to P in the loop of E 0 ,

• then E 0 returns an empty list (the stop condition is not reached), which occurs with probability Pr[E 0 (T 0 ) = ∅ | succ T 0 P ], the extractor continues to the next iteration and makes an average of E[C] calls to P,

• otherwise, if E 0 (T 0 ) returns a non-empty list, the extractor stops and no more calls to P are necessary.

The mean number of calls to P hence satisfies the following equality:

E[C] = 1 + (1 -Pr[succ T 0 P ]) • E[C] T 0 unsuccessful + Pr[succ T 0 P ] • N 1 + Pr[E 0 (T 0 ) = ∅ | succ T 0 P ] • E[C]
T 0 successful which gives 2. Share the witness w into an ( + 1, N )-threshold linear secret sharing w [e] :

E[C] ≤ 1 + (1 -ε) • E[C] + ε • N 1 + 1 - δ 2 • E[C] ≤ 1 + ε • N 1 + E[C] 1 - ε • δ 2 ≤ 2 δ • ε • (1 + ε • N 1 ) = 2 δ • ε • 1 + ε • 4 • (N -) (1 -δ) • ε -ε Inputs: A secret
w [e] ← Share(w; r [e] w ).

Compute

β [e] ← ψ x (w; r 2. Expand h 1 as (ε [e] ) e∈[1:τ ] ← Expand(h 1 ).

Phase 3: Simulation of the MPC protocol. For each iteration e ∈ [1 : τ ],

1. Computes, for i ∈ S, α [e] i := ϕ x,ε [e] w [e] i , β [e] i and recomposes α [e] .

This step is repeated as many times as in the MPC protocol (cf Protocol 11).

Phase 4: Second challenge (parties to be opened).

1. Compute h 2 = Hash 2 (salt, h 1 , α [1] S , . . . , α [N ] S ). where auth [e] is the authentication path for {com • Computes the commitments com Protocol 16: Signature Scheme -Verification algorithm

We first consider the notion of unforgeability against key-only attacks (EUF-KO). In this setting, the adversary is only given a public key x and she attempts to generate a pair (m, σ) such that σ is a valid signature of m with respect to x. The following lemma shows the EUF-KO of the signature scheme in the random oracle model and with respect to the OWF security of the function F . Lemma C.1. Let Hash 0 , Hash 1 , Hash 2 , Hash m and Expand be modeled as random oracles, and let (N, τ, λ, p) be parameters of the signature scheme. Let A be an adversary against the EUF-KO security of the scheme running in time t A and making a total of Q random oracle queries. Assuming that F is an (t A , owf )-hard one-way function, then A's advantage in the EUF-KO game is

EUF-KO ≤ OWF + (τ N + 1)Q 2 2 2λ + Pr[X + Y = τ ],
with • X = max q 1 ∈Q 1 {X q 1 } with X q 1 ∼ B τ, N +1 p and

• Y = max q 2 ∈Q 2 {Y q 2 } with Y q 2 ∼ B τ -X, 1/ N ,
where B (n 0 , p 0 ) denotes the binomial distribution with n 0 the number of trials and p 0 the success probability of each trial.

The following proof is highly inspired (and carbon copied where relevant) from the proofs of [BDK+21b, Lemma 2] and [KZ22, Lemma 5].

Proof. We give an algorithm B (the reduction) which uses the EUF-KO adversary A to compute a pre-image for the key generation function F .

Algorithm B simulates the EUF-KO game using the random oracles Hash 0 , Hash 1 , Hash 2 and Hash m and query lists Q c , Q 1 , Q 2 and Q m . In addition, B maintains two tables T sh and T wit which respectively store the shares of the parties and the corresponding witnesses (for a given set of + 1 shares J) that B recovers from A's RO queries. B also maintains a set Bad to keep track of the outputs of all four random oracles. We also ignore calls to Expand in our analysis, since they are used to expand outputs from Hash 1 and Hash 2 : when Expand is a random function this is equivalent to increasing the output lengths of Hash 1 and Hash 2 .

Behavior of B. On input x, a OWF challenge, algorithm B forwards it to A as a signature public key for the EUF-KO game. It lets A run and answer its random oracle queries in the following way. We assume (wlog.) that Algorithm 1, Algorithm 2, Algorithm 3 and Algorithm 4 only consider queries that are correctly formed, and ignore duplicate queries. In these algorithms, the notation v → Q is used to mean Q ← Q ∪ {v}.

• Hash 0 : When A queries the commitment random oracle, B records the query to learn which commitment corresponds to which input share. See Algorithm 1.

• Hash m : As Hash 0 , it records the query to link the commitment with the Merkle roots. See Algorithm 2.

• Hash 1 : When A sends the Merkle roots for the share commitments, B checks whether these roots were output by a right use of a Merkle tree simulated by Hash m and for which the leaves were output by its simulation of Hash 0 . If any were for some e and i, then B is able to reconstruct the shares for party i in repetition e. If B is able to reconstruct the shares for a subset J of + 1 parties for an execution e, then it can extract the corresponding witness value w [e](J) used by A (for this execution e and this subset of parties J). See Algorithm 3. Note: The algorithm description also include the computation of further values that are part of the protocol which are useless to Algorithm 3 and only included for notation purpose in order to make the analysis of the case Pr[A wins | B outputs ⊥] easier to follow.

• Hash 2 : No extraction takes place during this random oracle simulation. See Algorithm 4.

Algorithm 1 Hash function Hash 0 Hash 0 (q 0 = (salt, e, i, w i , β i )): com $ ← -{0, 1} 2λ . If com ∈ Bad, then abort. com → Bad. (q 0 , com) → Q 0 . Return com.

Algorithm 2 Hash function Hash m

Hash m (q m = (h 1 , h 2 )):

h 1 → Bad h 2 → Bad h m $ ← -{0, 1} 2λ . If h m ∈ Bad, then abort. h m → Bad. (q m , h m ) → Q m . Return h m .
In the rest of the proof, we assume that A returns a pair (m, σ) if and only if it is valid (with probability 1). This is wlog. since A can check that (m, σ) passes the verification before returning it without any degradation of her success probability. As a consequence, the hash h 1 in the returned (valid) signature has necessarily been obtained through a query q 1 to Hash 1 of the form q 1 = (m, salt, h[1] , . . . , h[1:τ] ). Moreover, all the hash computations from the commitments com

[e] i , with i ∈ I [e] , to the Merkle root h[e] must have been obtained through valid requests to Hash m (otherwise the verification of auth [e] would fail with overwhelming probability). Similarly, all the commitments com [e] i , with i ∈ I [e] , must have been obtained through valid calls to Hash 0 . This notably implies that the table T sh filled by Algorithm 3 satisfies T sh [q 1 , e, i] = ∅ for every (e, i) such that i ∈ I [e] .

When A terminates, B checks the T wit table for any entry where the extracted w [e](J) is consistent with x. If a match is found, B outputs w [e](J) as a pre-image for the OWF, otherwise B outputs ⊥.

Algorithm 3 Hash function Hash 1

Hash 1 (q 1 ): Parse q 1 as (m, salt, h[1] , . . . , h[1:τ] ) For e ∈ [1 : τ ], i ∈ [1 : N ], do h[e] → Bad.

For (e, i) ∈ [1 : τ ] × [1 : N ] such that ∃com i ) ∈ Q 0 , then ( w i , β i ) → T sh [q 1 , e, i].

For each e ∈ [1 : τ ] and J ⊂ [1 : N ], do If T sh [q 1 , e, i] = ∅, ∀i ∈ J, then w [e](J) ← Reconstruct J ( w J ).

β [e](J) ← Reconstruct J ( β J ).

w [e](J) → T wit [q 1 , e, J].

h 1 $ ← -{0, 1} 2λ . If h 1 ∈ Bad, then abort. h 1 → Bad. (q 1 , h 1 ) → Q 1 .
This gray block is for notation purpose only (ε [e] ) e∈[1:τ ] ← Expand(h 1 ) For each e ∈ [1 : τ ] and J ⊂ [1 : N ]:T wit [q 1 , e, J] = ∅, do α [e](J) = ϕ ε [e] w [e](J) , β [e](J) For each (e, i) ∈ [1 : τ ] × [1 : N ]:T sh [q 1 , e, i] = ∅, do ᾱ[e] i = ϕ ε [e] w [e] i , β [e] Return h 1 .

Algorithm 4 Hash function Hash 2 Hash 2 (q 2 ): Parse q 2 as (salt, h 1 , ( α [e] S ) e∈[1:τ ] ). h 1 → Bad.

h 2 $ ← -{0, 1} 2λ . If h 2 ∈ Bad, then abort. h 2 → Bad. (q 2 , h 2 ) → Q 2 . Return h 2 .
Advantage of the reduction. Given the behavior presented above, we have the following by the law of total probability:

≤ (Q com + Q m + Q 1 + Q 2 ) • max |Bad| 2 2λ = (Q com + Q m + Q 1 + Q 2 ) • Q com + 3Q m + (τ N + 1)Q 1 + 2Q 2 2 2λ ≤ (τ N + 1)(Q com + Q m + Q 1 + Q 2 ) 2 2 2λ (8)
By definition, we also have Pr[B ouputs w] ≤ OWF .

It remains to deal with the term Pr[A wins | B ouputs ⊥]. Namely, we now analyze the probability of A winning the EUF-KO experiment conditioned on the event that B outputs ⊥, i.e., no pre-image to x was found on the query lists. For the rest of the proof, we assume that B outputs ⊥.

Cheating in the first round. For any query (q 1 , h 1 ) ∈ Q 1 , and its corresponding expanded answer (ε [e] ) e∈[1:τ ] , let G 1 (q 1 , h 1 ) be the set of indices e ∈ [1 : τ ] of "good executions" where there exists J such that both T wit [q 1 , e, J] is non-empty and g(α [e](J) ) = 0, namely a false positive occurs for at least one set J for execution e (since w [e](J) cannot satisfy (x, w [e](J) ) ∈ R since B outputs ⊥). We then have, for every e ∈ [1 : τ ],

Pr[e ∈ G 1 (q 1 , h 1 ) | B outputs ⊥] ≤ N + 1 p where p is the false-positive rate of the underlying MPC protocol, given that h 1 is distributed uniformly at random (which holds since Hash 1 and Expand are random functions).

As the response h 1 is uniform, each e ∈ [1 : τ ] has the same independent probability of being in G 1 (q 1 , h 1 ). We therefore have that #G 1 (q 1 , h 1 ) ∼ X q 1 where X q 1 = B τ, N +1 p , the binomial distribution with τ trials, each with success probability N +1 p. Letting (q 1best , h 1best ) denote the query-response pair which maximizes #G 1 (q 1 , h 1 ), we then have that #G 1 (q 1best , h 1best ) ∼ X = max

q 1 ∈Q 1 {X q 1 }.
Cheating in the second round. Let (q 2 , h 2 ) ∈ Q 2 be the query such that h 2 is used in the valid signature returned by the adversary. Since the returned signature is valid (with probability 1), there must also exist (q 1 , h 1 ) ∈ Q 1 such that h 1 is used in the signature and q 2 is of the form q 2 = (h 1 , . . .). Then for each "bad" first-round execution e ∈ [1 : τ ]\G 1 (q 1 , h 1 ), either the verification failed, in which case A couldn't have won, or the verification passed, despite ∀J, g(α [e](J) ) = 0. We shall denote H [e] (q 2 ) the set of honest parties, i.e. the set of the parties for which the committed shares α [e] i , are consistent with the committed input shares w [e] i and β [e] i . More formally,

H [e] (q 2 ) = i : α [e] i = ϕ ε [e] ( w [e] i , β [e] i ) .

Let us consider three cases:

• there is strictly less than honest parties, i.e. |H [e] (q 2 )| < , but as parties are opened, verification would fail;

• there is strictly more than honest parties, i.e. |H [e] (q 2 )| > , but it would imply that there exists a set J of + 1 honest parties (J ⊂ H [e] (q 2 ), |J| = + 1). In that case, we get that α [e](J) = α [e] where α [e] is the value encoded by α [e] S in q 2 . However, since e ∈ [1 : τ ]\G 1 (q 1 , h 1 ), g(α [e](J) ) = 0 implies that g(α [e] ) = 0, and so verification would fail;

• there is exactly honest parties, i.e. |H [e] (q 2 )| = , which is the only possible case given that A wins with q 2 .

Since the expanded h 2 = (I [e] ) e∈[1:τ ] ∈ {I ⊂ [1 : N ] : |I| = } τ is distributed uniformly at random, the probability that the verification passes while cheating for all such "bad" first-round executions e is

1 N τ -#G 1 (q 1 ,h 1 ) ≤ 1 N τ -#G 1 (q 1best ,h 1best )
.

The probability that this happens for at least one of the Q 2 queries made to Hash 2 is

Pr A wins | B outputs ⊥ #G 1 (q 1best , h 1best ) = τ 1 ≤ 1 -   1 - 1 N τ -τ 1   Q 2 .
Finally conditioning on B outputting ⊥ and summing over all values of τ 1 , we have that

Pr[A wins | B outputs ⊥] ≤ Pr[X + Y = τ ] ( 9
)
where X is as before, and Y = max q 2 ∈Q 2 {Y q 2 } where the Y q 2 variables are independently and identically distributed as B(τ -X, 1/ N ).

Conclusion.

Bringing Equation (7), Equation (8) and Equation (9) together, we obtain the following:

Pr[A wins] ≤ (τ N + 1)(Q com + Q m + Q 1 + Q 2 ) 2 2 2λ + Pr[X + Y = τ ] + Pr[B outputs w].
Assuming KeyGen is an owf -secure OWF and setting

Q = Q com + Q m + Q 1 + Q 2
gives the required bound and concludes the proof.

We now consider the notion of unforgeability against chosen message attacks (EUF-CMA). In this setting, the adversary is given a public key x and she can ask an oracle (called the signature oracle) to sign messages (m 1 , . . . , m r ) that she can select at will. The goal of the adversary is to generate a pair (m, σ) such that m is not one of requests to the signature oracle and such that σ is a valid signature of m with respect to x. The following theorem shows the EUF-CMA of the signature scheme in the random oracle model. Theorem C.2. Let Hash 0 , Hash 1 , Hash 2 , Hash m and Expand be modeled as random oracles, and let (N, τ, λ, p) be parameters of the signature scheme. Let A be an adversary against the EUF-CMA security of the scheme running in time t A and making a total of Q RO random oracle queries and Q sign signing queries. Assuming that F is an (t A , owf )-hard one-way function and that PRG is a (t A , prg )-secure pseudorandom generator then A's advantage in the EUF-CMA game is

EUF-CMA ≤ OWF + prg + (τ N + 2)Q 2 2 2λ + Pr[X + Y = τ ],
where Q = Q RO + N Hash • Q Sig with N Hash = 2 + τ (2N -1) the number of hash computations in a signature generation, and where X, Y are defined as in Lemma C.1.

Proof. We consider the reduction algorithm B described in the proof of Lemma C.1 which we extend to answer to the signing queries of the adversary A. We consider three different games:

• Game 0: B uses a signature oracle O Sig (w, x, •) which perfectly answers signing queries from A;

• Game 1: the signature oracle is replaced by O Sig (w, x, •) which perfectly answers signing queries from A except that the calls to the PRG are replaced with true randomness;

• Game 2: the signature oracle is replaced by a simulator S Sig (x, •) answering signing queries from A without being given the secret witness as input.

In Game 0, B behaves exactly as in the proof of Lemma C.1 while additionally answering the signing queries from A using O Sig (w, x, •). The signing oracle O Sig (w, x, •) makes queries to the random oracles Hash 0 , Hash 1 , Hash 2 and Hash m which are answered by B as in the proof of Lemma C.1, and it computes the signature from the input message and the key pair (w, x) as described in Protocol 15. The total number of random oracle queries is hence of Q = Q RO + N Hash • Q Sig . The signing queries being perfectly answered, A produces a valid signature with probability EUF-CMA . Then, by the proof of Lemma C.1, B interacting with A and O Sig (w, x, •) recovers w with probability Game0 such that

EUF-CMA ≤ Game0 + (τ N + 1)Q 2 2 2λ + Pr[X + Y = τ ] .
We note that this is insufficient to prove our security statement since the reduction B should not have access to the oracle O Sig (w, x, •), which is why we need to transit to Game 2.

Game 1 is similar to Game 0 but the signing oracle O Sig (w, x, •) is replaced by an oracle O Sig (w, x, •). The latter works in the exact same way as the original signing oracle except that the the pseudo-randomness (r ψ ) of Phase 1, i.e. the outputs of PRG(salt, e, ρ), is replaced by true randomness (independent of the root seed ρ). This is indistinguishable from the previous reduction given that PRG is a secure pseudorandom generator. We deduce that the success probability Game1 of B to recover w while interacting with A and O Sig (w, x, •)

satisfies | Game0 -Game1 | ≤ prg .
Finally, Game 2 is similar to the previous games but the signing oracle is replaced by a simulator S Sig (x, •) which does not take the secret key w as input. Additionally, B keeps a list Sl of all the salts appearing in random oracle queries. Namely, Algorithm 1 (Hash 0 ), Algorithm 3 (Hash 1 ) and Algorithm 4 (Hash 2 ) further perform salt → Sl on any query with salt as salt. This simulator is depicted in Algorithm 5. Whenever S Sig aborts, B also aborts.

Algorithm 5 Signing simulator.

S Sig (x, m):

Sample a random salt salt ← {0, 1} 2λ If salt ∈ Sl, then abort Sample random hashes h 1 ← {0, 1} 2λ and h 2 ← {0, 1} 2λ If h 1 ∈ Bad or h 2 ∈ Bad then abort Expand h 1 as (ε [e] ) e∈[1:τ ] ← Expand(h 1 ) Expand h 2 as (I [e] ) e∈[1:τ ] ← Expand(h 2 ) Randomly generate α [e] for every e ∈ [1 : τ ] s.t. g(α [e] ) = 0 Randomly generate the shares w [e] i , β [e] i for every e ∈ [1 : τ ] and i ∈ I [e] Compute α [e] i := ϕ x,ε [e] w [e] i , β [e] i for every e ∈ [1 : τ ] and i ∈ I [e] From α [e] I [e] and α [e] , reconstruct the shares α [e] S for every e ∈ [1 : τ ] Compute com

[e] i := Hash 0 (salt, e, i, w [e] i , β [e] i ) for every e ∈ [1 : τ ] and i ∈ I [e] Sample random commitments com N ) for every e ∈ [1 : τ ] For q 1 = (m, salt, h[1] , . . . , h[1:τ] ), let (q 1 , h 1 ) → Q 1 For q 2 = (salt, h 1 , ( α [e] S ) e∈[1:τ ] ), let (q 2 , h 2 ) → Q 2 Let auth [e] the authentication path for {com Let us stress that the random generation of α [e] such that g(α [e] ) = 0 is done according to the real distribution of α [e] in a valid signature. This distribution depends on the MPC protocol and is independent of w (by the zero-knowledge property).

The signing simulator follows the same principle as the zero-knowledge simulator of the proof-of-knowledge protocol. By knowing the challenges beforehand, it can generate a signature with perfect distribution without knowing the secret witness. In the random oracle model, this simply means randomly generating the answers h 1 and h 2 of the oracles Hash 1 and Hash 2 before they are actually queried. In the absence of aborts, we thus get that an answer of S Sig on input (x, m) is identically distributed to an answer of O Sig on input (w, x, •).

We have to deal with an additional subtlety. By randomly generating the commitments com

[e]

i for every e ∈ [1 : τ ] and i / ∈ I [e] , the simulator implicitly define some outputs of the Hash 0 oracle for which she does not know the input. Since the sharing w [e] is fully defined by the shares w [e] I [e] and the witness w, and the sharing β [e] is fully defined by the shares β [e] I [e] and the plain value β [e] = ψ x (w; r

[e] ψ ), Hash 0 should be constrained to answer a future request q 0 = (salt, e, i, w [e] i , β [e] i ) by the com i randomly sampled by the simulator whenever a match occurs, i.e., whenever 1. (salt, e, i) are such that salt corresponds to a previous signing request for which i = I [e] , 2. the shares w [e] i , β [e] i in the request q 0 are consistent with the full sharings w [e] and β [e] defined by the shares w [e] I [e] and β [e] I [e] of this previous signing request together with the witness w.

To deal with this, we simply modify Algorithm 1 (Hash 0 ) in the following way. If a new request q 0 = (salt, e, i, w [e] i , β [e] i ) is made for which condition 1 above is satisfied, the algorithm reconstructs a candidate witness w * from the shares w [e] I [e] from the previous signing query and the share w [e] i from the current q 0 query. In case w * is a valid witness, i.e. F (w * ) = x, B returns w * . We thus have that such event can only occur if B outputs w and does not affect the event (A wins | B ouputs ⊥) that we are considering here.

The probability to abort due to collisions in Bad is the same for O Sig and S Sig . Indeed, they both do the same amounts of queries to the random oracles, the simulator just do them in a different order and handle the queries for h 1 and h 2 directly. S Sig may further aborts in case of salt collision, which happens with probability at most (Q RO + Q Sig )/2 2λ . We deduce that the success probability Game2 = euf-cma of B to recover w while interacting with A and simulating signing queries with S Sig (x, •) satisfies

| Game1 -Game2 | ≤ Q Sig (Q RO + Q Sig ) 2 2λ ≤ Q 2 2 2λ
which concludes the proof.

  [1 : N ] is a set of functions {F k : [1 : N ] → {0, 1} * } kindexed by a key k such that

  Return out ∈ {Accept, Reject}Protocol 1: Structure of a m-round interactive proof with m = 2n + 1.

Definition 2 . 3 . 1 (

 231 Proof of Knowledge). Let x be a statement of language L in NP, and W (x) the set of witnesses for x such that the following relation holds: R = {(x, w) : x ∈ L, w ∈ W (x)} .

Lemma 2 .

 2 3.4 (Schwartz-Zippel). Let P ∈ F[X] be a polynomial of degree d > 0; for any S ⊂ F, Pr r←S [P (r) = 0] ≤ d |S| .

Contents 3 . 1 . 3 . 3 .

 3133 Generic Transformations . . . . . . . . . . . . . . . . . . . . . . . . . 20 3.2. Paradigm Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Useful techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 3.4. State of the art . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 -19 -

Figure 3 .

 3 Figure 3.1.: Let us assume that we have a 2-private MPC protocol involving N := 5 parties.A malicious prover does not know a witness such that the MPC protocol outputs Accept, thus she needs to cheat when emulating the MPC protocol. The optimal cheating strategy (when r := 0) is to corrupt the communication between two parties. For example, in the figure, the party P 2 sends the message "4" but the party P 3 gets "-2" as message from P 2 . The verifier will ask to reveal the computation of t := 2 parties. The verifier will catch the malicious behavior as soon as the two parties involved in the corrupted communication are open,

Figure 3 .

 3 Figure 3.2.: Let us assume that we have a 2-private MPC protocol involving N := 5 parties.This time, we assume that the parties only use a broadcast channel, meaning that all broadcast values are known by everybody. Since the malicious prover does not know a valid witness, she needs to cheat on the computation of at least one party. Then, the verifier will ask to reveal the computation of t := 2 parties. The verifier will catch the malicious prover with probability 2 N := 2 5 .

Contents

  the relation between the three types of seeds and the sampled variables.

Figure 4

 4 Figure 4.1.: Pseudorandom generation in the cut-and-choose phase.

  are only vectors of weight w and x[j] are vectors from {x | H x = y}, which can be respectively encoded in log 2 m w bits and k bits. Thanks to the use of GGM trees, the communication cost for master seeds is at most τ • log 2 M τ • λ bits (for τ • log 2 M τ intermediate tree seeds instead of M -τ leaf seeds) and the communication cost for subseeds is log 2 (N ) • λ bits (for log 2 (N ) intermediate tree seeds instead of N -1 leaf seeds).

  for λ = 128: (m = 1280 , k = m/2 , w = 132) -for λ = 192: (m = 1920 , k = m/2 , w = 200) -for λ = 256: (m = 2432 , k = m/2 , w = 258)

Figure 4

 4 Figure 4.2.: Best proof size (and the used M ) according to the parameter N .

Contents 5. 1 .

 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 5.2. A Zero-Knowledge Protocol for Syndrome Decoding . . . . . . . . 62 5.3. The Signature Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . 71 5.4. Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 5.5. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 -59 -

  To provide more flexibility, we introduce a parameter d in the definition of the syndrome decoding problem. The idea is, instead of having a constraint for the global weight of the secret vector x, to split x into d chunks x := (x 1 | . . . | x d ) and to have a constraint on the weight of each chunk. We call this alternative problem the d-split syndrome decoding problem. Definition 5.1.1 (d-Split Syndrome Decoding Problem). Let F be a finite field. Let m, k, w be positive integers such that m > k, m > w, d | w and d | m. The d-split syndrome decoding problem with parameters (F, m, k, w) is the following problem:

Theorem 5.1. 2 .

 2 Let F be a finite field. Let m, k, w be positive integers such that m > k, m > w, d | w and d | m. Let A d be an algorithm that solves a random (F, m, k, w)-instance of the d-split syndrome decoding problem in time t with success probability ε d . Then there exists an algorithm A 1 which solves a random (F, m, k, w)-instance of the standard syndrome decoding problem in time t with probability ε 1 , where ε 1 ≥ m/d w/d d m w • ε d . Informally, an instance of the standard syndrome decoding problem is an instance of the d-split syndrome decoding problem with probability m/d w/d d / m

  3) with ∆ := |F points |. (This upper bound is equivalent to Equation (5.2) where the max degree m + w -1 is replaced by (m + w)/d -1). The constraint on the size of F poly now becomes |F poly | ≥ m d since we only need m/d points for the interpolation of the polynomials S 1 , . . . S d . Thus using the d-split version allows us to use smaller fields for F poly and F points .

Phase 1. 1 :

 1 Preparation of the MPC-in-the-Head inputs. For each iteration e ∈ [1 : τ ], 1. Sample a root seed: seed [e] $ ← -{0, 1} λ . 2. Compute parties' seeds seed [e] 1 , . . . , seed [e]

Phase 3 :

 3 j } e∈[1:τ ],j∈[1:t] ← PRG(h1) where r [e] j ∈ Fpoints and #" εj [e] ∈ F d points . Simulation of the MPC protocol. For each iteration e ∈ [1 : τ ], 1. The parties locally set x [e] B = y -H x [e]

j 3 .

 3 } e∈[1:τ ],j∈[1:t] ← PRG(h1) where r [e] j ∈ Fpoints and #" εj [e] ∈ F d points . Extend hash {i * [e] } e∈[1:τ ] ← PRG(h2) where i * [e] ∈ [1 : N ]. 4. For each iteration e ∈ [1 : τ ],

7. Output Accept iff h 1 ?= h1 and h 2 ?

 12

Figure 5 . 2 .

 52 Figure 5.2.: Code-based signature scheme -Verification algorithm.

Contents 6. 1 .

 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 6.2. General Idea . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 6.3. Protocols and Security Proofs . . . . . . . . . . . . . . . . . . . . . . 92 6.4. Instantiations and Performance . . . . . . . . . . . . . . . . . . . . . 97 6.5. Digital Signatures from Boneh-Halevi-Howgrave-Graham PRF . . 100 6.6. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 -81 -

Figure 6

 6 Figure 6.1.: Probability mass function of ∆x j when x j = 0 and when x j = 1 (on the left) and of ∆x j with abort (on the right), for N = 3 and A = 9.

2 .

 2 the parties locally set α = ε • (1 -x ) + a , where • denotes the coordinate-wise product; 3. the parties open α to get α; 4. the parties locally set v = α, x -c ; 5. the parties open v to get v; 6. the parties accept iff v = 0.

3 .

 3 the parties locally set S(r) = S (r) and P (r) = P (r) 4. the parties locally set α = ε • S(r) + a ; 5. the parties open α to get α; 6. the parties locally set v = ε 2 • P (r) • n i=1 (r -γ i ) + S(r) -α • (ε • S(r) -a ) -c ; 7. the parties open v to get v; 8. the parties accept iff v = 0. The polynomial-based multiplication verification produces false positives with probability 2n -1 q ν

  y = r [e] -r[e]

3 .

 3 The parties broadcast D to obtain D ∈ F p×η q . 4. The parties locally set V = X D -C -Z Σ.5. The parties openV to obtain V ∈ F m×η q .6. The parties outputs Accept if V = 0 and Reject otherwise.

Figure 7

 7 Figure 7.1.: The MPC protocol Π η MM which checks that Z = X • Y .

2 .

 2 The parties locally set z = m i=1 γi(yi -b T i x ). 3. The parties locally set w = m i=1 γiAi x . 4. The parties locally set α = ε • w + a . 5. The parties open α ∈ F n q η . 6. The parties locally set v = ε • z -α, x -c . 7. The parties open v ∈ Fqη . 8. The parties outputs Accept if v = 0 and Reject otherwise.

Figure 7 . 2 .

 72 Figure 7.2.: An MPC protocol that verifies that the given input corresponds to a solution of an MQ problem.

  Public values: M0, M1, . . . , Mk ∈ F n×m q .

k. 2 .

 2 i=1 xiMi = T R and c = T a. MPC Protocol: 1. The parties get a random Σ ∈ F m×η q The parties locally set E = M0 + k i=1 xi Mi. 3. The parties locally set α = R Σ + a . 4. The parties open α ∈ F r×η q . 5. The parties locally set v = T α -c -E Σ. 6. The parties open v ∈ F n×η q . 7. The parties outputs Accept if v = 0 and Reject otherwise.

Figure 7 . 3 .

 73 Figure 7.3.: An MPC protocol based on the rank decomposition technique (Π RC-RD ) which verifies that the given input corresponds to a solution of a MinRank problem.

2 .

 2 The parties get a random ε ∈ Fqm•η . 3. The parties locally set E = M0 + k i=1 xi Mi. 4. The parties locally write the rows of E as elements (e1, . . . , em) of Fqm 5. The parties locally set z = -n j=1 γj ej q r .

  10. The parties openv ∈ Fqm•η .11. The parties outputs Accept if v = 0 and Reject otherwise.

Figure 7

 7 Figure 7.4.: An MPC protocol based on the technique using linearized polynomials (Π RC-LP )which verifies that the given input corresponds to a solution of a MinRank problem. U is a F q -linear subspace of F q m of dimension r which contains the rows (e 1 , . . . , e n ) ofE := M 0 + k i=1 x i M i ∈ F n×m

3 .

 3 The parties locally write x := ( xA , xB ) as a matrix X . 4. The parties locally set α = R Σ + a . 5. The parties open α ∈ F r×η q . 6. The parties locally set v = T α -c -X Σ. 7. The parties open v ∈ F m×η q . 8. The parties outputs Accept if v = 0 and Reject otherwise.

Figure 7

 7 Figure 7.5.: An MPC protocol based on the rank decomposition technique (Π RC-RD ) which verifies that the given input corresponds to a solution of a rank syndrome decoding problem.

3 .

 3 The parties locally set xB = y -H xA . 4. The parties locally set z = -n j=1 γj xj q r .

9.

  The parties open v ∈ Fqm•η . 10. The parties outputs Accept if v = 0 and Reject otherwise.

Figure 7

 7 Figure 7.6.: An MPC protocol based on the technique using linearized polynomials (Π RC-LP )which verifies that the given input corresponds to a solution of a rank syndrome decoding problem. U is a F q -linear subspace U of F q m of dimension r which contains x 1 , . . . , x n .

  Scheme Name

  (a) Naive strategy: proof size (b) Naive strategy: # party emul. (c) SSS-based strategy: proof size (d) SSS-based strategy: # party emul. (e) Hybrid strategy: proof size (f) Hybrid strategy: # party emul.

Figure 8

 8 Figure 8.1.: Performance of the three batching strategies applied to our tweaked SDitH scheme.

Figure 8 . 2 .

 82 Figure 8.2.: Limbo's compression step -from dimension k to dimension

N )τ

  where p k is the false positive rate of the underlying MPC protocol (which depends on k)see [DOT21, Proposition 5].

Figure 9

 9 Figure 9.1.: Structure of the MPC-in-the-Head library. The yellow components are the parts that a user must implement when working on a new signature scheme, while the blue components are managed by the library.

  export L I B M P C I T H _ S C H E M E _ P A T H = sd / sdith_any export L I B M P C I T H _ A R I T H _ L I B S = gf251 export L I B M P C I T H _ C O N F I G _ F L A G S = THRESHOLD_NFPR , GF251 , L1 export L I BM P C IT H _ HA S H _P A T H = sha3 / sha3 -several export L I BM P C IT H _ DR B G _P A T H = hash export L I BM P C IT H _ AD D _ FL A G S = HASHX4 , XOFX4 , PRGX4

  x∈{0,1} wt H (x) • Pr[A x 1 1 ] = 0 • Pr[ Ē1 ] + 1 • Pr[E 1 ] = Pr[E 1 ]Let assume the relation for a positive integer M . By noting for some x ∈ {0,1} M A x := {A x 1 1 , . . . , A x M M }, we have x∈{0,1} M +1 wt H (x) • Pr[A x 1 1 , A x 2 2 , . . . , A x M +1 M +1 ] = x∈{0,1} M wt H (x) • Pr[A x , ĒM+1 ] + x∈{0,1} M (wt H (x) + 1) • Pr[A x , E M +1 ] = x∈{0,1} M wt H (x) • (Pr[A x , ĒM+1 ] + Pr[A x , E M +1 ]) + x∈{0,1} M Pr[A x , E M +1 ] = x∈{0,1} M wt H (x) • Pr[A x ] + Pr[E M +1 ] = (Pr[E 1 ] + . . . + Pr[E M ]) + Pr[E M +1 ].

  g( ᾱ1 J , . . . , ᾱt J ) = 0 where ᾱ1 J , . . . , ᾱt J are the plain values corresponding to the sharings { ᾱ1 i } i∈J , . . . , { ᾱt i } i∈J . By definition of the MPC protocol Π, we have: ∀J s.t. |J| = + 1, Pr[E J ] ≤ p. For the first step of the proof, we shall consider a subset D of parties, i.e. D ⊂ {1, . . . , N }, and we denote N := |D| and J = {J ⊂ D : |J| = + 1}. We shall further denote Pr [ • ] := Pr[ • | R h = r h , I ⊂ D].

)

  By the Splitting Lemma B.1, we have Pr[R h good | succ P ] ≥ δ .

  key w, a public key x := F (w) and a message m ∈ {0, 1} * . Phase 0: Initialization. 1. Sample a random salt salt ← {0, 1} 2λ . 2. Sample a root seed ρ ← {0, 1} 2λ . Phase 1: Preparation of the MPC-in-the-Head inputs. For each iteration e ∈ [1 : τ ], 1. Derive randomness r ψ ← PRG(salt, e, ρ).

Phase 2 :

 2 share it: β[e] ← Share(β[e] ; r[e] β ).4. Compute the commitments com [e]i := Hash 0 (salt, e, i, w[e] i , β [e] i ) for all i ∈ [1 : N ], and compute the Merkle root h[e] := MerkleTree(com First challenge (randomness for the MPC protocol). 1. Compute h 1 = Hash 1 (m, salt, h[1] , . . . , h[τ] ).

2 .

 2 Expand h 2 as (I[e] ) e∈[1:τ ] ← Expand(h 2 ) where, for every e,I [e] ⊂ [1 : N ] is a subset of parties (i.e. |I [e] | = ).Phase 5: Building of the signature. Output the signature σ built assalt | h 1 | h 2 | ( w [e] i , β [e] i ) i∈I , auth [e] , α [e] i * [e]e∈[1:τ ]

iσ 2 .

 2 } i∈I w.r.t. Merkle root h[e] and i * [e] ∈ S \ I [e] . Protocol 15: Signature Scheme -Signing algorithm Inputs: A public key x, a signature σ and a message m ∈ {0, 1} * . 1. Parse the signature σ assalt | h 1 | h 2 | ( w [e] i , β [e] i ) i∈I , auth [e] , α [e] i * [e] e∈[1:τ ] ← Expand h 1 as (ε [e] ) e∈[1:τ ] ← Expand(h 1 ).3. Expand h 2 as (I [e] ) e∈[1:τ ] ← Expand(h 2 ) where, for every e, I [e] ⊂ [1 : N ] is a subset of parties (i.e. |I [e] | = ). 4. For each iteration e ∈ [1 : τ ],

i?= h 1 , h 2 ?= h 2 ?

 22 and the broadcast values α[e] i for i ∈ I[e] from ( w[e] i , β[e] i ) i∈I : for all i ∈ I [e] ,com[e] i = Hash 0 (salt, e, i, w [e] i , β [e] i ) α [e] i = ϕ x,ε [e] w [e] i , β [e] i • Recover α [e] , by α [e] = Reconstruct I [e] ∪{i * [e] } ( α [e]I∪{i * [e] } ).• Compute the Merkle root h[e] using {com [e]i } i∈I , auth[e] . • Compute the shares α[e] S using α[e] = Expand I∪{i * } α [e] I∪{i * } ; 5. Compute h 1 = Hash 1 (m, salt, h[1] , . . . , h[h] ). 6. Compute h 2 = Hash 2 (salt, h 1 , α [1] S , . . . , α [N ] S ).7. Output Accept iff h 1 and ∀e ∈ [1 : τ ], g(α[e] )

i

  is the i th leaf of the Merkle tree with root h[e] where nodes are in Q m , do If ∃( w i , β i ) s.t. ((salt, e, i, w i , β i ), com [e]

  Pr[A wins] = Pr[A wins ∧ B aborts] + Pr[A wins ∧ B ouputs ⊥] + Pr[A wins ∧ B ouputs w] ≤ Pr[B aborts] + Pr[A wins | B ouputs ⊥] + Pr[B ouputs w]. (7) Let Q com , Q m , Q 1 and Q 2 denote the number of queries made by A to each respective random oracle. Given the way in which values are added to Bad, we have: Pr[B aborts] = (#times a digest is sampled) • Pr[B aborts at that digest]

  , 1} 2λ for every e ∈ [1 : τ ] and i / ∈ I [e] If com [e] i ∈ Bad for some e ∈ [1 : τ ] and i / ∈ I [e] , then abort Compute h[e] := MerkleTree(com [e] 1 , . . . , com [e]

i

  } i∈I w.r.t. Merkle root h[e] Let i * [e] ∈ S \ I [e] Return σ := salt | h 1 | h 2 | ( w [e] i , β [e] i ) i∈I , auth [e] , α [e]i * [e] e∈[1:τ ]

  Published in the proceedings of Asiacrypt 2022. Content of this work appears in Chapter 6. • [Fen22] T. Feneuil. Building MPCitH-based Signatures from MQ, MinRank, Rank SD and PKP. To appear in the proceedings of the 22nd International Conference on Applied Cryptography and Network Security, ACNS 2024. Content of this work appears in Chapter 7.

, A. Joux, and M. Rivain. Shared Permutation for Syndrome Decoding: New Zero-Knowledge Protocol and Code-based Signature. Des. Codes Cryptogr. 91, 563-608 (2023). Content of this work appears in Chapter 4. • [FJR22b] T. Feneuil, A. Joux, and M. Rivain. Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs. Published in the proceedings of Crypto 2022. Content of this work appears in Chapter 5. • [FMRV22b] T. Feneuil, J. Maire, M. Rivain, and D. Vergnaud. Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection.

Table 3

 3

.1.: Probability distribution of the output of the MPC protocol, where p is the false positive rate.

4.1. Introduction

  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

36 4.2. A Zero-Knowledge Protocol for Syndrome Decoding

  . . . . . . . .

37 4.3. The Five-Round Zero-Knowledge Protocol

  . . . . . . . . . . . . . .

43 4.4. The Signature Scheme

  . . . . . . . . . . . . . . . . . . . . . . . . . .

48 4.5. Performance

  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

51 4.6. Comparison

  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

54 4.7. Conclusion

  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

57 -35 - 4.1. Introduction

	One of the few directions for post-quantum technologies is (error correcting) code-based
	cryptography. The generic decoding problem, or equivalently the (computational) syndrome
	decoding (SD) problem is a classic problem:
	Definition 4.1.1 (Syndrome Decoding Problem). Let F be a finite field. Let m, k and
	w be positive integers such that m > k and m > w. The syndrome decoding problem with
	parameters (F, m, k, w) is the following problem:

Table 4 .

 4 1.: Example values of M , N and τ to achieve statistical security λ ∈ {128, 256}.

			For 128-bit security				For 256-bit security
	N	4	8	16	32	64	128	4	8	16	32	64	128
	M	256	293	512	606	842	1291	512	583	1024	1199	2144	3379
	τ	64	43	32	26	22	19	128	86	64	52	43	37

Table 4 .

 4 2.: Parameters (n, M, τ ) with the achieved communication costs (in bytes).

			Parameters		Protocol	Signature
	λ	Aim	n	M	τ	|pk| |proof| (max) |sgn| (max) |sgn| (avg, std)
	128 Fast	8 187 49	96	21 232	24 372	23 102, 196
	128 Short	32 389 28	96	13 952	17 540	16 344, 236
	192 Fast	8 283 73	144	47 400	54 396	51 635, 364
	192 Short	32 578 42	144	31 344	39 396	36 639, 434
	256 Fast	8 379 97	184	80 832	93 220	88 412, 559
	256 Short	32 767 56	184	53 888	68 196	63 165, 655

Note: The average signature size and standard deviation has been measured over 10 000 experiments.

Table 4 .

 4 3.: Benchmarks of our signature implementation.

	λ	Aim	Keygen		Sign		Verify
			Mcycles	ms	Mcycles	ms	Mcycles	ms
	128	Fast	0.08	0.02	51	12.9	47	12.2
	128	Short	0.08	0.02	249	62.3	221	56.6
	192	Fast	0.14	0.04	133	33.9	125	32.5
	192	Short	0.14	0.04	570	142.9	492	125.6
	256	Fast	0.23	0.06	249	64.2	241	62.7
	256	Short	0.22	0.06	1 029	259.4	896	229.9

Table 4 .

 4 4.: Comparison of our scheme with signatures from the literature (128-bit security).

	Scheme Name	Year	|sgn|	|pk|	t sgn	t verif
	Stern	1993	62.5 KB	0.09 KB	-	-
	Wave	2019	2.07 KB	3.2 MB	300 ms	-
	Durandal -I	2018	3.97 KB	14.9 KB	4 ms	5 ms
	Durandal -II	2018	4.90 KB	18.2 KB	5 ms	6 ms
	LESS-FM -I	2020	15.2 KB	9.77 KB	-	-
	LESS-FM -II	2020	5.25 KB	206 KB	-	-
	LESS-FM -III	2020	10.39 KB	11.57 KB	-	-
	[GPS22]-256	2021	22.2 KB	114 B	-	-
	[GPS22]-1024	2021	19.5 KB	122 B	-	-
	Our scheme (fast)	2021	22.6 KB	96 B	13 ms	12 ms
	Our scheme (short)	2021	16.0 KB	96 B	62 ms	57 ms

Note: The performance of Stern protocol is computed for the same SD parameters as us. Reported timings are from the original publications: Wave has been benchmarked on a 3.5 Ghz Intel Xeon E3-1240 v5, while Durandal on a 2.8 Ghz Intel Core i5-7440HQ.

Table 4 .

 4 5.: Comparison of our scheme with some post-quantum signature based on symmetric cryptography primitives.

		For 128-bit security		For 256-bit security
	Scheme Name	|sgn|	t sgn	t verif	|sgn|	t sgn	t verif
	Our scheme (short)	16.0 K	62	57	61.7 K	259	230
	Our scheme (fast)	22.6 K	13	12	86.3 K	64	62
	SPHINCS + (short)	7.7 K	239	0.7	29.1 K	310	1.5
	SPHINCS + (fast)	16.7 K	14	1.7	48.7 K	39	2.9
	Picnic3	12.3 K	5.2	4.0	47.6 K	18	13
	BBQ	31.6 K	-	-	133.7 K	-	-
	Banquet (short)	13.0 K	44	40	52.8 K	191	175
	Banquet (fast)	19.3 K	6	5	81.5 K	28	22

Table 5 .

 5 1.: Comparison of our protocol with state-of-the-art zero-knowledge protocols for syndrome decoding.

	Protocol Name	Year	Instance 1	Instance 2	Proved statement
	[Ste94]	1993	37.4 KB	46.1 KB	y = Hx, wt H (x) = w
	[Vér96]	1997	31.7 KB	38.7 KB	message decoding
	[CVE11]	2010	-	37.4 KB	y = Hx, wt H (x) = w
	[AGS11]	2011	24.8 KB	-	y = Hx, wt H (x) = w
	[GPS22] (short)	2021	-	15.2 KB	y = Hx, wt H (x) = w
	[GPS22] (fast)	2021	-	19.9 KB	y = Hx, wt H (x) = w
	Chapter 4 (short)	2021	12.9 KB	15.6 KB	y = Hx, wt H (x) = w
	Chapter 4 (fast)	2021	20.0 KB	24.7 KB	y = Hx, wt H (x) = w
	This chapter (short)	2022	9.7 KB	6.9 KB	y = Hx, wt H (x) ≤ w
	This chapter (fast)	2022	14.4 KB	9.7 KB	y = Hx, wt

H (x) ≤ w Note: The formulae for the communication costs of the different protocols and the used parameters are detailed in [FJR22b, Appendix B].

Table 5 .

 5 2.: SD and MPC parameters.

	Scheme		SD Parameters			MPC Parameters
		q	m	k	w	d	|F poly |	|F points |	t	p
	Variant 1	2	1280	640	132	1	2 11	2 22	6	≈ 2 -69
	Variant 2	2	1536	888	120	6	2 8	2 24	5	≈ 2 -79
	Variant 3	2 8	256	128	80	1	2 8	2 24	5	≈ 2 -78

Table 5 .

 5 3.: Parameters (N, τ ) with the achieved communication costs (in bytes).

	λ	Scheme	Aim	Parameters		Signature
				N	τ	|pk| |sgn| (max) |sgn| (avg, std)
	128 128	Variant 1	Fast Short	32 256	27 17	96 96	16 422 11 193	16 006, 446 11 160, 127
	128 128	Variant 2	Fast Short	32 256	27 17	97 97	17 866 12 102	17 406, 494 12 066, 141
	128 128	Variant 3	Fast Short	32 256	27 17	144 144	12 115 8 481	11 835, 302 8 459, 86
		Table 5.4.: Benchmarks of our signature implementation.
	λ	Scheme	Aim	Keygen		Sign	Verify
				ms	cycles	ms	cycles	ms	cycles
	128 Variant 1 128	Fast Short				n/a †
	128 Variant 2 128	Fast Short	0.03 0.03	114k 114k	13.4 64.2	52M 251M	12.7 60.7	50M 243M
	128 Variant 3 128	Fast Short	0.01 0.01	49k 49k	6.4 29.5	25M 114M	5.9 27.1	24M 109M

Note: Timings are averaged over 10 000 measurements. The CPU clock cycles have been measured using SUPERCOP (https://bench.cr.yp.to/supercop.html).

† We only have a proof of concept implementation with irrelevant timings.

Table 5 .

 5 5.: Comparison of our scheme with signatures from the literature (128-bit security).

	Scheme Name	Year	|sgn|	|pk|	t sgn	t verif
	Wave	2019	2.07 K	3.2 M	300	-
	Durandal -I	2018	3.97 K	14.9 K	4	5
	Durandal -II	2018	4.90 K	18.2 K	5	6
	LESS-FM -I	2020	15.2 K	9.77 K	-	-
	LESS-FM -II	2020	5.25 K	206 K	-	-
	LESS-FM -III	2020	10.39 K	11.57 K	-	-
	[GPS22]-256	2021	24.0 K	114	-	-
	[GPS22]-1024	2021	19.8 K	122	-	-
	Chapter 4 (fast)	2021	22.6 K	96	13	12
	Chapter 4 (short)	2021	16.0 K	96	62	57
	[BGKM22] -Sig1	2022	23.7 K	91	-	-
	[BGKM22] -Sig2	2022	20.6 K	171	-	-
	Our scheme -Var1f	2022	15.6 K	96	-	-
	Our scheme -Var1s	2022	10.9 K	96	-	-
	Our scheme -Var2f	2022	17.0 K	97	13	13
	Our scheme -Var2s	2022	11.8 K	97	64	61
	Our scheme -Var3f	2022	11.5 K	144	6	6
	Our scheme -Var3s	2022	8.26 K	144	30	27

Table 5 .

 5 6.: Comparison of our scheme with signatures from the literature (128-bit security).

	Scheme Name	|sgn|	|pk|	t sgn	t verif
	Dilithium2	2.4 K	1.3 K	0.065	0.024
	Falcon-512	0.65 K	0.88 K	0.168	0.036
	SPHINCS + -128f	16.7 K	32	14	1.7
	SPHINCS + -128s	7.7 K	32	239	0.7
	Picnic3	12.3 K	32	5.2	4.0
	Picnic4	7.8 K	32	≈ 20	≈ 20
	Banquet (fast)	19.3 K	32	6	5
	Banquet (short)	13.0 K	32	44	40
	Our scheme -Var1f	15.6 K	96	-	-
	Our scheme -Var1s	10.9 K	96	-	-
	Our scheme -Var2f	17.0 K	97	13	13
	Our scheme -Var2s	11.8 K	97	64	61
	Our scheme -Var3f	11.5 K	144	6	6
	Our scheme -Var3s	8.3 K	144	30	27

  Theorem 6.3.5 (Honest-Verifier Zero-Knowledge). Let the PRG used in Protocol 8 be (t, ε PRG )-secure and the commitment scheme Com be (t, ε Com )-hiding. There exists an efficient simulator S which, given random challenges J and L outputs a transcript which is (t, τ • ε PRG + τ • ε Com )-indistinguishable from a real transcript of Protocol 8.

	Theorem 6.3.6 (Soundness). Suppose that there is an efficient prover P that, on input
	(w, t), convinces the honest verifier V on input H, y to accept with probability
	ε := Pr[ P(w, t), V(w, t) = 1] > ε
	for a soundness error ε equal to
	max

Table 6 .

 6 1.: Comparison of state-of-the-art zero-knowledge protocols for proving the knowledge of an SSP instance (with n = 256 and q ≈ 2 256 ).

	Protocol			Parameters			Proof size Rej. rate
		τ	η	N	A	M	ν
	Shamir [Sha86]	219 -	-	-	-	-	1186 KB	-
	[LNSW13]	219 -	-	-	-	-	2350 KB	-
	Beullens [Beu20]	14 -1024	-	4040 -	122 KB	-
	Prot. 7 (batching sacr.)	26 0	32	2 14	-	-	25.7 KB	0.334
	Prot. 7 (batching sacr.)	31 3	32	2 14	-	-	27.9 KB	0.001
	Prot. 7 (batching poly.)	26 0	32	2 14	-	2	25.8 KB	0.334
	Prot. 7 (batching poly.)	31 3	32	2 14	-	2	28.0 KB	0.001
	Prot. 8 (C&C)	27 0	32	2 14 462 -	17.4 KB	0.344
	Prot. 8 (C&C)	33 3	32	2 14 470 -	19.6 KB	0.002
	Prot. 7 (batching sacr.)	17 0 256 2 13	-	-	16.6 KB	0.412
	Prot. 7 (batching sacr.)	21 3 256 2 13	-	-	17.7 KB	0.004
	Prot. 7 (batching poly.)	17 0 256 2 13	-	2	16.6 KB	0.412
	Prot. 7 (batching poly.)	21 3 256 2 13	-	2	17.8 KB	0.004
	Prot. 8 (C&C)	19 0 256 2 13 954 -	13.0 KB	0.448
	Prot. 8 (C&C)	24 3 256 2 14 952 -	15.4 KB	0.001

Table 6 .

 6 2.: Performance of the obtained signatures. The public keys (w, t) of those schemes have a size of λ+n 8 = 48 bytes, since w can be derived from a λ-bit seed and t is an integer of log 2 q ≈ n bits.

	Signature		Parameters			Sig. size Rej. rate
		τ η N	A	M ν
	Protocol 7 (batching sacr.)	29 2 256 2 14	-	-	28.1 KB	0.010
	Protocol 7 (batching sacr.)	42 3 32 2 14	-	-	38.7 KB	0.004
	Protocol 7 (batching poly.)	20 2 256 2 14	-	6	19.1 KB	0.004
	Protocol 7 (batching poly.)	32 3 32 2 14	-	6	29.3 KB	0.002
	Protocol 8 (C&C), 5 rounds	46 3 256 2 14 993 -	30.3 KB	0.006
	Protocol 8 (C&C), 5 rounds	71 3 32 2 14 452 -	42.5 KB	0.025
	Protocol 8 (C&C), 3 rounds	28 2 64 2 14 514 -	21.1 KB	0.009
	Protocol 8 (C&C), 3 rounds	53 3	8	2 14 253 -	33.2 KB	0.009

  y 1 ), . . . , (z t , y t ) y 1 , . . . , y t

	mseed	$ ← -{0, 1} λ
	Compute parties' seeds
	(seed 1 , ρ 1 ), . . . , (seed N , ρ N )
	with TreePRG(mseed)

Table 6 .

 6 3.: Parameter sets and achieved performance of the signature based on Boneh et al.'s PRF, for a 128-bit security.

	p ≈ 2 m	t	δ	Parameters B	A	N	τ	Size	p rej
	≈ 2 229	3	88/229	2 141	2 141+12	256	16	4 916 B	0.012
	≈ 2 186	4	58/186	2 128	2 128+12	256	16	4 860 B	0.016
	≈ 2 175	5	47/175	2 128	2 128+12	256	16	5 074 B	0.019

Table 7 .

 7 1.: State of the art of the MPCiH-based signatures, including this work.

	Problem	Best scheme	Achieved sizes
	Multivariate Quadratic	Over F 4 , [Wan22] Over F 256 , Section 7.3	8.4 -9.4 KB 6.9 -8.3 KB
	Min Rank	Section 7.4.2	5.4 -7.0 KB
	Permuted Kernel	[BG22]	8.6 -9.7 KB
	Subset Sum	[FMRV22a]	21.1 -33.2 KB
	Syndrome Decoding (Hamming)	[FJR22b]	Over F 2 , 10.9 -15.6 KB Over F 256 , 8.3 -11.5 KB
	Syndrome Decoding (Rank)	Section 7.4.3	5.8 -7.2 KB

Table 7 .

 7 2.: Sizes of the signatures relying on the MQ problem (restricting to the schemes using the FS heuristics).

	Scheme Name	Security	Signature Size
	[SSH11] (3 rounds)

Table 7 .

 7

	Instance	Protocol Name	Variant		Parameters		Signature Size
				N	M	τ	η
		[SSH11] (3 rounds)	-	-	219	-	-	28 502 B
		MQ-DSS [CHR+16]	-	-	316	-	-	41 444 B
	q = 4 m = 88	MudFish [Beu20]	-	4	191	68	-	14 640 B
	n = 88	Mesquite [Wan22]	Fast Short	8 32	187 389	49 28	--	9 578 B 8 609 B
		Our scheme	Fast Short	32 256	--	40 25	6 8	10 764 B 9 064 B
		[SSH11] (3 rounds)	-	-	219	-	-	40 328 B
		MQ-DSS [CHR+16]	-	-	156	-	-	28 768 B
	q = 256 m = 40	MudFish [Beu20]	Fast Short	8 16	176 250	51 36	--	15 958 B 13 910 B
	n = 40	Mesquite [Wan22]	Fast Short	8 32	187 389	49 28	--	11 339 B 9 615 B
		Our scheme	Fast Short	32 256	--	36 25	2 2	8 488 B 7 114 B

3.: Sizes of the signatures relying on the MQ problem (restricting to the schemes using the FS heuristics). Numerical comparison.

Signature Scheme from MinRank and Rank SD In

  this section, we propose arguments of knowledge for the MinRank problem (Section 7.4.2) and the Rank SD problem (Section 7.4.3). But before that, in Section 7.4.1, we propose two efficient MPC protocols which check that a matrix M has a rank of at most r.

Table 7 .

 7 6.: Sizes of the signatures relying on the rank syndrome decoding problem (restricting to the schemes using the FS heuristics).

	Scheme Name	Security	Signature Size
	[Ste94]

Table 7 .

 7 7.: Sizes of the signatures relying on the rank syndrome decoding problem (restricting to the schemes using the FS heuristics). Numerical comparison.

	Instance	Protocol Name	Variant		Parameters		Signature Size
				N	M	τ	η
		Stern [Ste94]	-	-	-	219	-	31 358 B
		Véron [Vér96]	-	-	-	219	-	27 115 B
	q = 2 m = 31 n = 30 k = 15 r = 9	[FJR21] [BG22]	Fast Short Fast Short	8 32 8 32	187 389 187 389	49 28 49 28	----	19 328 B 14 181 B 15 982 B 12 274 B
		Our scheme (RD)	Fast Short	32 256	--	33 21	19 24	11 000 B 8 543 B
		Our scheme (LP)	Fast Short	32 256	--	30 20	1 1	7 376 B 5 899 B
	Ideal RSD	[BG22]	Fast Short	32 256	--	37 26	--	12 607 B 10 126 B
	Ideal RSL	[BG22]	Fast Short	32 256	--	27 17	--	9 392 B 6 754 B

Table 7 .

 7 8.: Benchmark of our implementations of the proposed signature schemes.

	Chapter 7

  of the MPC protocol is Accept, i.e.

	8.3. MPC-in-the-Head with Threshold LSS	139
	g(α 1 , . . . , α t ) Protocol 12: Zero-knowledge protocol -Application of the MPCitH principle to Protocol 10. ? = 0.	Chapter 8

Table 8 .

 8 4.: Parameters, performance and comparison. The parameters for[START_REF] Feneuil | Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs[END_REF] and our scheme are (m, k, w) = (256, 128, 80) and F SD = F poly = F 256 .

	Scheme	N	τ		t	|F points |	|sgn|	t sgn	t verif
		256 16 1	3	2 64	10.47 KB	7.1 ms	0.46 ms
	Our scheme	256	6	3	3	2 64	9.97 KB	3.2 ms	0.38 ms
		256	3	7	4	2 64	11.10 KB 2.5 ms	0.47 ms
	[FJR22b] -Var3f	32	27 -	5	2 24	11.5 KB	6.4 ms	5.9 ms
	[FJR22b] -Var3s	256 17 -	5	2 24	8.26 KB	30 ms	27 ms
	Banquet (AES)	16 255 21 -41 -	1 1	2 32 2 48	19.3 KB 13.0 KB	6.4 ms 44 ms	4.9 ms 40 ms
	Limbo-Sign (AES)	16 255 24 -40 -	--	2 48 2 48	21.0 KB 14.2 KB	2.7 ms 29 ms	2.0 ms 27 ms
	Helium+AES	17 256 16 -31 -	1 1	2 144 2 144	17.2 KB 9.7 KB	6.4 ms 16 ms	5.8 ms 16 ms
	SPHINCS + -128f	-	-	-	-	-	16.7 KB	14 ms	1.7 ms
	SPHINCS + -128s	-	-	-	-	-	7.7 KB	239 ms	0.7 ms
	Note: Timings for SDitH and our scheme have been benchmarked on a 3.8 GHz Intel Core i7. Timings
	for Banquet, Helium and SPHINCS + have been benchmarked on a 3.6 GHz Intel Xeon W-2133 CPU
	[BDK+21b; KZ22]. Timings for Limbo have been benchmarked on a 3.1 GHz Intel i9-9900 CPU [DOT21].

Table 8 .

 8 5.: Performance of batched Limbo proofs for arithmetic circuits on F 2 8 in the interactive setting (40-bit of security).Note: The compression factor k of Limbo is 16 and the extension field G is F 2 64 when = 1 and F 2 96 when = 4. All the sizes are given in kilobytes. #P and #V correspond respectively to the number of emulated parties for the prover and the verifier. The first row ( = add) is the baseline Limbo scheme with additive sharing.

	u			|w| + |C| = 2 8				|w| + |C| = 2 16
			N	u/ν	τ	size	size/u	N	u/ν	τ	size	size/u
	1	ADD	256	-	6	5.5	5.55	256	-	6	389.4	389.42
		1	256	1	6	9	9.22	256	1	6	398	397.59
	100	1	223	34	16	61	0.61	207	50	21	2762	27.62
		4	223	34	4	58	0.58	223	34	4	3151	31.51
	10000	1	225	32	15 5865	0.59	203	54	22 269290	26.93
		4	210	47	5	5434	0.54	200	57	6	277894	27.79

Table 8 .

 8 6.: Performance of batched Limbo proofs for arithmetic circuits on F 2 32 in the interactive setting (40-bit of security).

	u			|w| + |C| = 2 8				|w| + |C| = 2 16
			N	u/ν	τ	size	size/u	N	u/ν	τ	size	size/u
	1	ADD	256	-	6	10.0	10.03	256	-	6	1536.9 1536.92
		1	256	1	6	14	13.72	256	1	6	1550	1549.59
	100	1	256	50	18	96	0.96	256 100 31	8053	80.53
		4	256 100	8	91	0.91	256 100	8	8284	82.84
	10000	1	256	55	19 8170	0.82	256 100 31 801486	80.15
		4	256	74	6	7130	0.71	256	88	7	823455	82.35

Table 9 .

 9 1.: Benchmark of the signature schemes proposed in Chapter 7.

	Scheme		Detailed Benchmark			High-level Benchmark
		Tree	Commit.	Rand. Expan.	Share Prep.	MPC Emul.	Misc	Total signing time	Size
			Variant "Short" -256 parties (N = 256)
	MQ over F 256	1.37	1.42	0.53	0.40	6.25	0.59	10.56	7 114 B
	MQ over F 251	1.37	1.42	1.24	1.77	2.17	0.59	8.56	7 114 B
	MinRank (with RD)	1.06	1.11	1.52	0.51	3.75	0.44	8.39	7 122 B
	MinRank (with LP)	0.99	1.05	1.12	0.45	13.23	0.38	17.22	5 518 B
	Rank SD (with RD)	1.16	1.22	0.69	0.27	2.36	0.42	6.12	8 543 B
	Rank SD (with LP)	1.10	1.14	0.51	0.24	3.72	0.38	7.09	5 899 B
			Variant "Fast" -32 parties (N = 32)
	MQ over F 256	0.26	0.28	0.10	0.05	6.9	0.24	7.83	8 488 B
	MQ over F 251	0.26	0.28	0.22	0.23	2.15	0.28	3.42	8 488 B
	MinRank (with RD)	0.24	0.27	0.28	0.07	2.68	0.16	3.70	9 288 B
	MinRank (with LP)	0.20	0.23	0.21	0.12	13.63	0.15	14.54	7 204 B
	Rank SD (with RD)	0.24	0.27	0.13	0.07	2.30	0.18	3.19	11 000 B
	Rank SD (with LP)	0.22	0.24	0.09	0.03	3.71	0.12	4.41	7 376 B

2 .

 2 Pr (x, y) ∈ B | (x, y) ← A ≥ α . Proof. See [PS00] for the proof. Lemma B.2. Let E 1 , . . . , E M be arbitrary events. For i ∈ {1, . . . , M } and a bit b ∈ {0, 1}, let us define We have those following relations, where wt H (x) denotes the Hamming weight of x (i.e. the number of non-zero coordinates of x):wt H (x) • Pr[A x 1 1 , A x 2 2 , . . . , A x M M ] = Pr[E 1 ] + . . . + Pr[E M ]

	A b i :=	E i if b = 1, Ēi if b = 0.
	Pr[A x 1 1 , A x 2 2 , . . . , A x M M ] = 1
	x∈{0,1} M
	x∈{0,1} M

  Case 2: y max = + 1, it means that wt(x) ≥ 1, thenPr [succ P | {A x J J } J∈J ] ≤ max ≥ + 2, then Pr [succ P | {A x J J } J∈J ] ≤In any case, we have the relationPr [succ P | {A x J J } J∈J ] ≤ wt H (x) • + 1 Pr [succ P | {A x J J } J∈J ] • Pr [{A x J

		ymax N		=	+ 1
		ymax			+1	ymax
		N		=	ymax-N	+1
	≤	+ 1 2	•	wt H (x)
					N	.	(2)
	for any x ∈ {0, 1} |J | . And so, we have
	Pr [succ P ] =
	x∈{0,1} J

N ≤ wt H (x) • + 1 N Case 3: y N ≤ wt H (x) • + 1 N J } J∈J ] ≤ x∈{0,1} J wt H (x) • + 1 N • Pr [{A x J J } J∈J ] using (2) = 1 N + N • x∈{0,1} J wt H (x) • Pr [{A x J J } J∈J ] using Lemma B.2 ≤ 1 N + N • J∈J Pr [E J ] using Lemma B.2

Technically, some quantum computers already exist, but are not powerful enough to be a threat to the current cryptography.

And of course, nobody should be able to find the secret key from the public key and the produced signatures.

2.2. Cryptographic Building Blocks

2.4. Secure Multiparty Computation

The authors of[START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF] only made an asymptotic analysis.

The packed secret sharing scheme is a generalization of the Shamir's secret sharing scheme: to share simultaneously s1, . . . , s |s| ∈ F, it samples a random polynomial P such that P (e j ) = sj for all j, and evaluates it into the parties' evaluation points {ei}i, where {ei}i and {e j }j are public distinct points of F.

3.4. State of the art

Banquet can be easily adapted to a generic proof system even if it has not been proposed as such.

4.2. A Zero-Knowledge Protocol for Syndrome Decoding

If the malicious prover cheats on the first phase and that the cheating is not discovered, then she wins and she does not need to cheat on the second phase.

4.3. The Five-Round Zero-Knowledge Protocol

We might for instance use a computationally hiding hash-based commitment scheme defined as Com : (x, ρ) → Hash(x ρ) for a long-enough random nonce ρ.

4.7. Conclusion

5.2. A Zero-Knowledge Protocol for Syndrome Decoding

More cryptanalysis of the SD problem over F256 would be welcome to get more confidence in the choice of the parameters. Such research is out of the scope of this chapter.

We did not include "Sig 3" from[START_REF] Bidoux | Code-based Signatures from New Proofs of Knowledge for the Syndrome Decoding Problem[END_REF] since it is similar to[START_REF] Feneuil | Shared Permutation for Syndrome Decoding: New Zero-Knowledge Protocol and Code-Based Signature[END_REF] with slight differences (message decoding setting) which do not improve the scheme.

We assume hereafter that δm ∈ Z. Otherwise, one should take the nearest integer δm instead.

in the case where the verifier can not perform some checks after receiving the first response (see[START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF] for details).

7.2. Methodology

They express the m -r last columns w.r.t. the r first ones.

Theses sizes are larger than the ones in[START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF] because they take N = 1024, but here to have a fair comparison with the other schemes, we take N = 256.

Such optimized implementations have been built for the schemes submitted to the NIST call, see Section 9.1.

Usually, b is chosen as (b, 0, . . . , 0) in the case of the additive sharing.

Let us stress that this fact is true only when the false positive rate p is negliglible compared to 1 N , to not impact the soundness error of the zero-knowledge protocol.

8.5. Applications

The Shamir's secret sharing over a field F can have at most |F| -1 shares (one share by non-zero evaluation point), but we can have an additional share by defining it as the leading coefficient of the underlying polynomial (i.e. using the point at infinity as evaluation point).

In Limbo, the challenge is of the form {ri} m i=1 := {r i } m i=1 for a random r ∈ F.

9.2. MPC-in-the-Head Library

relying on the pseudo-random bit generator of the lower layer.

Chapter 7

Chapter 7.

Building MPCitH-based Signatures from MQ, MinRank and Rank SD

We have shown that the MPC-in-the-Head paradigm improves the state of the art of signature schemes relying on the syndrome decoding problem and the subset sum problem. A natural follow-up work consists in generalizing this approach to other hard problems. Given a problem, the goal is to design the most efficient MPC protocol which verifies a solution to this problem. In this chapter, we investigate the cases of the multivariate quadratic problem, the MinRank problem and the rank syndrome decoding problem.

The results presented in this chapter were released in November 2022 on the cryptology ePrint archive [START_REF] Feneuil | Building MPCitH-based Signatures from MQ, MinRank, Rank SD and PKP[END_REF] and will be published in the proceedings of the international conference ACNS 2024.

• The random combination used in the schemes (usually denoted β) is derived from a seed. Then, instead of sending the coefficients of β, the prover can just send this seed. Moreover, this seed and the masks involved in the schemes (usually denoted T , S and X) are also derived from a common seed.

• Instead of revealing two matrices such that the difference are of rank (at most) r, the prover send one of the matrices and directly the difference (which is cheaper to send), and thus the verifier can deduce the non-sent matrix.

In the comparison we put how [BG22, Section 2] would perform if we apply the same technique for MinRank problem ( [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF] does not consider the MinRank problem in their article).

First, let us remark that [START_REF] Santoso | Three-Pass Identification Scheme Based on MinRank Problem with Half Cheating Probability[END_REF] presents no advantage compared to [START_REF] Courtois | Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank[END_REF]. The soundness error of each iteration is 1/2 instead of 2/3, but each iteration is more expensive. The achieved communication cost is thus equivalent to [START_REF] Courtois | Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank[END_REF]. [START_REF] Bellini | MR-DSS -Smaller MinRank-Based (Ring-)Signatures[END_REF] is a protocol with helper [START_REF] Beullens | Sigma Protocols for MQ, PKP and SIS, and Fishy Signature Schemes[END_REF]. The components in the proof transcript are the same as for [START_REF] Courtois | Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank[END_REF] (and [START_REF] Santoso | Three-Pass Identification Scheme Based on MinRank Problem with Half Cheating Probability[END_REF]), but it succeeds in achieving a bit smaller signature size just by sending a smaller number of seeds and digests. The MPC-in-the-Head paradigm enables to obtain much smaller sizes. Using techniques from [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF], the resulting size is around 10 KB. In an independent (and parallel) work, [START_REF] Adj | MinRank in the Head: Short Signatures from Zero-Knowledge Proofs[END_REF] proposes a new scheme using techniques which are similar to our protocol with Π RC-RD : they are working on another matrix relation 2 but use a less efficient matrix multiplication checking protocol. They succeed in producing signature with sizes below 8 KB. Our scheme with Π RC-RD achieves similar sizes than [START_REF] Adj | MinRank in the Head: Short Signatures from Zero-Knowledge Proofs[END_REF], but our scheme with Π RC-LP outperforms all the previous ones achieving sizes below 6 KB. For the sake of completeness, we put in the comparison tables how [START_REF] Adj | MinRank in the Head: Short Signatures from Zero-Knowledge Proofs[END_REF] would perform if we use Π MM as subroutine.

Table 7.4.: Sizes of the signatures relying on the MinRank problem (restricting to the schemes using the FS heuristics).

Scheme Name Security Signature Size [START_REF] Courtois | Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank[END_REF] (3/2) τ 3τ • µ dig + τ 2 3 µmat + 2 3 µ combi + 2 3 µ seed [START_REF] Courtois | Efficient Zero-Knowledge Authentication Based on a Linear Algebra Problem MinRank[END_REF], opt.

(3/2) τ µ dig + τ 1 3 (µmat + µ rank + µ combi + 2µ seed ) + µ dig

[SINY22]

2 τ 6τ • µ dig + τ µmat + 1 2 µ combi + 10 4 µ seed [START_REF] Santoso | Three-Pass Identification Scheme Based on MinRank Problem with Half Cheating Probability[END_REF], opt.

2 τ µ dig + τ 1 2 (µmat + µ rank + µ combi + 3µ seed ) + 2µ dig [START_REF] Bellini | MR-DSS -Smaller MinRank-Based (Ring-)Signatures[END_REF] ε helper (τ, M, 1 2 ) -1 µ dig + τ 1 2 (µmat + µ rank + µ combi + µ seed ) + µ dig + µ helper [START_REF] Bidoux | Compact Post-Quantum Signatures from Proofs of Knowledge leveraging Structure for the PKP, SD and RSD Problems[END_REF]

Our scheme (RD)

Our scheme (LP) KZ( 2q mη -1 q 2mη , 1 N ) 2µ dig + τ [µ combi + rm log 2 q + η(r + 1)m log 2 q + µ MPCitH ] Note: the used notations are µmat := mn log 2q, µ rank := r(m + n) log 2 q, µ combi := k log 2 q, plus all the notations defined in Section 7.2.

Chapter 7. Building Signatures from MQ, MinRank and Rank SD

Signature Scheme from Rank SD

We want to build a zero-knowledge proof of knowledge for the rank syndrome decoding problem:

Definition 7.4.4 (Rank Syndrome Decoding Problem -Standard Form). Let F q m be the finite field with q m elements. Let (n, k, r) be positive integers such that k ≤ n. The rank syndrome decoding problem with parameters (q, m, n, k, r) is the following problem:

Let H, x and y be such that:

x is uniformly sampled from {x ∈ F n q m : wt R (x) ≤ r}, 3. y is built as y := Hx.

From (H, y), find x.

Remark 7.4.5. The rank wt R (x) of an element x of F n q m is the dimension of the F q -linear subspace spanned by x 1 , . . . , x n . Equivalently, it is the rank of the matrix M for which the rows are x 1 , . . . , x n represented as vectors of F m q .

The prover wants to convince the verifier that she knows such an x, i.e. a vector x ∈ F n q m such that y = Hx and wt R (x) ≤ r. Previous works propose proofs of knowledge where the constraint on the weight is an equality, but it is sometimes easier to just prove an inequality Chapter 8.

MPC-in-the-Head with Threshold Linear Secret Sharing

While the MPC-in-the-Head paradigm is not restricted to a particular secret sharing scheme, all the efficient instantiations for small circuits proposed before 2022 rely on additive secret sharings.

In this chapter, we show how using a threshold linear secret sharing scheme (threshold LSSS) can be beneficial to the MPC-in-the-Head paradigm. For a general passively-secure MPC protocol model capturing most of the existing MPCitH schemes, we show that our approach improves the soundness error of the underlying proof system from 1/N down to 1/ N , where N is the number of parties and is the privacy threshold of the sharing scheme.

Applying our approach with a low-threshold LSSS boosts the performance of the proof system by making the MPC emulation cost independent of N for both the prover and the verifier. The gain is particularly significant for the verification time which becomes logarithmic in N (while the prover still has to generate and commit to the N input shares). We further generalize our result to any threshold ramp LSSS and propose an efficient batching technique relying on Shamir's secret sharing.

The results presented in this chapter were released in October 2022 on the cryptology ePrint archive [START_REF] Feneuil | Threshold Linear Secret Sharing to the Rescue of MPC-in-the-Head[END_REF] in collaboration with Matthieu Rivain and will be published in the proceedings of the international conference Asiacrypt 2023. To the best of our knowledge, besides [START_REF] Ishai | Zeroknowledge from secure multiparty computation[END_REF], the only previous work which considers MPCitH without relying on an additive secret sharing scheme is Ligero [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF]. Ligero is a practical MPCitH-based zero-knowledge proof system for generic circuits which uses Shamir's secret sharing (or Reed-Solomon codes). The authors consider a particular type of MPC protocol in the malicious model and analyze the soundness of the resulting proof system. Ligero achieves sublinear communication cost by packing several witness coordinates in one sharing which is made possible by the use of Shamir's secret sharing.

In comparison, this chapter formalizes the MPC model on which many recent MPCitHbased schemes (with additive sharing) rely and shows how using LSSS in this model can be beneficial. We consider a slightly more restricted MPC model than the one of Ligero: we impose that the parties only perform linear operations on the sharings. On the other hand, we only need the MPC protocol to be secure in the semi-honest model and not in the malicious model as Ligero. In fact, this difference of settings (semi-honest versus malicious) makes our techniques and Ligero's different in nature. While Ligero makes use of proximity tests to get a robust MPC protocol, we can use lighter protocols in our case (since we do not need robustness). Moreover, for a given number of parties and a given privacy threshold, the soundness error of our work is smaller than the one of [START_REF] Ames | Ligero: Lightweight Sublinear Arguments Without a Trusted Setup[END_REF]. On the other hand, we consider MPC protocols which only performs linear operations on shares which, in the current state of the art, cannot achieve sublinearity. For this reason, our work targets proofs of knowledge for small circuits (for example, to build efficient post-quantum signature schemes) while Ligero remains better for middle-size circuits (thanks to the sublinearity).

Finally, let us cite [START_REF] Delpech De Saint | Limbo: Efficient Zero-knowledge MPCitH-based Arguments[END_REF] which is another article providing a refined analysis for the simply defined as V 1 = V 2 = F hereafter (other definitions of these sets will be considered in Section 8.4). We recall that such a scheme implies that the secret can be reconstructed from any + 1 shares while no information is revealed on the secret from the knowledge of shares.

The following lemmas shall be useful to our purpose. The first lemma holds assuming the MDS conjecture [START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF] and every subset

where s := Reconstruct J 0 (v 0 ). Moreover, there exists an efficient algorithm Expand J 0 which returns this unique sharing from s J 0 .

Remark 8.3.3. In the case of the additive sharing scheme, we have + 1 = N so that the algorithm Expand is trivial (it simply consists of the identity function). In the case of Shamir's secret sharing scheme (see Definition 2.4.4), the algorithm Expand builds the underlying polynomial and evaluates it into each party' point.

Application to the MPCitH paradigm. We apply a threshold LSSS to the MPCitH paradigm instead of a simple additive sharing scheme. Let us consider a protocol Π add complying with the MPC model introduced in the previous section (Protocol 10). We can define a protocol Π LSSS similar to Π add with the following differences:

• the parties initially receive an ( + 1, N )-threshold linear secret sharing of the witness w,

• when invoked for a hint β j , the oracle O H returns an ( + 1, N )-threshold linear secret sharing of β j ,

• when the shares of α j are broadcasted, the value α j is reconstructed using the algorithm Reconstruct. Namely, the parties choose an arbitrary subset ( α j i ) i∈J 0 of size + 1 from the set of broadcasted shares, run the algorithm Reconstruct J 0 to get α j , and check that all the broadcast shares are consistent with the output of Expand J 0 . If the check fails, the protocol returns Reject.

The resulting MPC protocol, formally described in Protocol 13, is well-defined and -private in the semi-honest model (meaning that the views of any parties leak no information about the secret, see Definition 2.4.5). This is formalized in the following theorem (see proof in Appendix A). Theorem 8.3.4. Let us consider an MPC protocol Π add complying with the protocol format described in Protocol 10. If Π add is well-defined and (N -1)-private, then the protocol Π LSSS corresponding to Π add with an ( + 1, N )-threshold linear secret sharing scheme (see Protocol 13) is well-defined and -private.

The probability p attack that the malicious prover convinces the verifier using the above strategy satisfies

Soundness error if the committed sharing is well-formed.

Soundness proof. We can prove that the above strategy to forge successful transcripts for the [START_REF] Baum | Concretely-Efficient Zero-Knowledge Arguments for Arithmetic Circuits and Their Application to Lattice-Based Cryptography[END_REF] protocol is actually optimal and that it further applies to other protocols complying with our model. This is formalized in the following theorem (together with the completeness and HVZK property of the protocol).

Theorem 8.3.5. Let us consider an MPC protocol Π LSSS complying with the protocol format described in Protocol 13 using an ( + 1, N )-threshold LSSS, such that Π LSSS is -private in the semi-honest model and of false positive rate p. Then, Protocol 14 built from Π LSSS satisfies the three following properties:

• Completeness. A prover P who knows a witness w such that (x, w) ∈ R and who follows the steps of the protocol always succeeds in convincing the verifier V.

• Soundness. Suppose that there is an efficient prover P that, on input x, convinces the honest verifier V to accept with probability

where the soundness error ε is defined as

Then, there exists an efficient probabilistic extraction algorithm E that, given rewindable black-box access to P, outputs either a witness w satisfying (x, w) ∈ R, or a commitment/hash collision, by making an average number of calls to P which is upper bounded by

• Honest-Verifier Zero-Knowledge. There exists an efficient simulator S which, given the random challenge I outputs a transcript which is indistinguishable from a real transcript of Protocol 14.

Proof. The completeness holds from the completeness property of the underlying MPC protocol. The zero-knowledge property directly comes from the -privacy property of the MPC protocol with an ( + 1, N )-threshold linear secret sharing scheme. See Appendix B for the soundness proof.

Proof. The completeness holds from the completeness property of the underlying MPC protocol. The zero-knowledge property directly comes from the -privacy property of the MPC protocol with an ( , + ∆ + 1, N )-threshold linear secret sharing scheme. We refer the reader to [START_REF] Feneuil | Threshold Linear Secret Sharing to the Rescue of MPC-in-the-Head[END_REF] for the proof of the soundness (this proof is similar to the threshold case in Appendix B).

Using algebraic geometric secret sharing?

One drawback while using a tight threshold LSSS is that the number N of parties is limited by the size of the underlying field F, specifically we have N ≤ |F| (see Lemma 8.3.1). Some sharing schemes on algebraic curves, which are not (tight) threshold but quasi-threshold, have been proposed in [START_REF] Chen | Algebraic Geometric Secret Sharing Schemes and Secure Multi-Party Computations over Small Fields[END_REF] to handle this issue.

Assuming a negligible false positive rate p, the soundness error is +∆ / N for a threshold ramp scheme instead of 1/ N for a tight threshold scheme. Let us focus on the case = 1. The soundness error for a threshold ramp scheme then satisfies

In order to gain in soundness (and hence in performance), the above formula should be lower than 1/|F| which is the minimal achievable soundness error for a (tight) threshold scheme (since N ≤ F).

In [START_REF] Chen | Algebraic Geometric Secret Sharing Schemes and Secure Multi-Party Computations over Small Fields[END_REF], the gap ∆ is 2g where g is the genus of the underlying curve. We must then search for threshold ramp sharing schemes such that

while for such sharing, we have N ≤ |C(F)| where |C(F)| is the order of the underlying curve over the field F. However, according to the Hasse-Weil inequality [START_REF] Washington | Elliptic Curves. Number Theory and Cryptography[END_REF], we have

which shows the impossibility of finding an algebraic geometric secret sharing scheme satisfying the above constraint. We deduce that a direct application of algebraic geometric secret sharing schemes [START_REF] Chen | Algebraic Geometric Secret Sharing Schemes and Secure Multi-Party Computations over Small Fields[END_REF] does not achieve better soundness (and hence better performance) than standard threshold sharing schemes in our context. We stress that the above argument focuses on the case = 1 for simplicity (and since it is relevant to optimize the performance with our approach), but it also holds for any ≥ 1.

While the above analysis discards the interest in using threshold ramp LSSS based on algebraic geometry to improve the soundness-performance trade-off of our scheme, we let this question open for other types of threshold ramp schemes. However, [CDN15, Theorem 11.121] gives that an ( , + ∆ + 1, N )-threshold ramp F-linear secret-sharing scheme satisfies

Thus, we get a lower bound on the soundness error (on the case = 1):

number N of parties is hence limited by N ≤ |F| + 1 -u. Because of this limitation together with the security loss due to the use of a ramp sharing scheme, the soundness error of this batched protocol degrades rapidly as u grows. While batching u statements using Shamir's secret sharings, the emulation cost and the soundness error are given by the following table:

Hybrid strategy: In the previous strategy, the proof size is convex w.r.t. the number u of batched proofs and, for small some u, the curve slope is flatter than the slope in the additive case (see Figure 8.1 from Section 8.5 for illustration). It means that using a hybrid approach can achieve smaller proof sizes (as well as better performance) than with the two above strategies. Specifically, instead of having one input sharing encoding the u witnesses (one per batched statement) and a single emulation of the MPC protocol, we can use ν input sharings each of them encoding u ν witnesses and have then ν emulations of the MPC protocol. Using this hybrid strategy, the emulation cost and the soundness error are given by the following table:

Section 8.5.2 presents some application results for these batching strategies. In particular Figure 8.1 compares the three strategies for batched proofs of the SDitH scheme [START_REF] Feneuil | Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs[END_REF].

Remark 8.4.2. In our analysis, we use the number of emulated parties as an indicator of the computational performance. As explained in Section 8.3, we would also need to take into account the computation cost for computing and committing the input sharings (and hints' sharings) which is not negligible, but this cost is hard to estimate without a concrete implementation. We yet remind that the latter cost only impacts the prover and not the verifier. The verification time is soundly predicted by the number of party emulations.

Applications

In the past few years, many proof systems relying on the MPC-in-the-Head paradigm have been published. Table 8.3 provides a tentatively exhaustive list of these schemes while indicating for each scheme:

• the base field (or ring) of the function computed by the underlying MPC protocol,

• whether the underlying MPC protocol fits our general model (see Section 8.2.1),

• the hard problem (or one-way function) for which the witness knowledge is proved.

In column Base Ring, the notation "F (K)" means that the function computed by the underlying MPC protocol is composed of F-linear functions and multiplications over K. For example, the schemes for AES use F 2 -linear functions and F 256 -multiplications.

Applying our framework with an arbitrary (low-)threshold linear secret sharing scheme instead of an additive sharing scheme is possible whenever • the underlying MPC protocol fits the model introduced in Section 8.2.1,

• the underlying MPC protocol is defined over a field (and not only a ring),

• this base field is large enough (since the number of parties N is limited by the size of the field).

Because of this last condition, all the proof systems for Boolean circuits and/or one-way functions with F 2 operations (e.g. AES, Rain, SDitH over F 2 ) do not support our framework of MPCitH based on (low-)threshold LSSS. Same for the scheme recently proposed in [START_REF] Feneuil | Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection[END_REF] and which achieves short communication using secret sharing over the integers: this idea is not compatible with our approach.

In the following, we present two applications of our strategy with Shamir's secret sharing as threshold LSSS:

• we first apply our general strategy to the SDitH signature scheme [START_REF] Feneuil | Syndrome Decoding in the Head: Shorter Signatures from Zero-Knowledge Proofs[END_REF] to obtain a new variant with faster signing and verification times;

• we then apply our batching technique (see Section 8.4.2) to the SDitH scheme (batch proofs for syndrome decoding) and to the Limbo proof system [DOT21] (batched proofs for general arithmetic circuits).

Application to the SDitH Signature Scheme

We can transform the zero-knowledge proofs of knowledge described in Section 8.3 into signature schemes using the Fiat-Shamir heuristic [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF]. We describe the signature scheme obtained when following this approach for the 5-round case (i.e. for t = 1 iteration in the MPC protocol) in Appendix C and further prove that this scheme achieves EUF-CMA security in the random oracle model.

In the following, we focus on the signature scheme obtained when applying this approach to the SDitH protocol, presented in Chapter 5. The underlying MPC protocol involves three fields F SD ⊆ F poly ⊆ F points which are extensions of each other and such that F SD is the base field of the SD instance. This MPC protocol fits the model introduced in Section 8.2.1 (see Protocol 10), with the number t of loop iterations equal to 1. Using the same notation as in Section 8.3, the proof size involves the following quantities:

where (m, k, w) are the syndrome decoding parameters and (d, t ) are additional parameters (see Chapter 5 for more details). The signature size (in bits), including the 2λ-bit salt, is then given by

If c = a • b and the hints are correctly computed, then the polynomial

0 and the parties accept. If c = a • b, then P (X) is different from zero. Thus according to the Schwartz-Zippel Lemma, the probability that the parties accept is at most 2 |F points |-1 (for any adversarial choice of the hints). Replacing the BN20 protocol with the above one in the SDitH scheme increases the number of rounds in the underlying zero-knowledge protocol from 5 to 7. Indeed the challenge ξ cannot be sent at the same time as the evaluation point anymore, since h 1 and h 2 must be committed before receiving ξ. We then restrict our variant of the SDitH protocol to a single evaluation point (t = 1) to ease the analysis of the [START_REF] Kales | An Attack on Some Signature Schemes Constructed from Five-Pass Identification Schemes[END_REF] attack while turning to the non-interactive setting. Using the same notations as Section 8.3, the new proof size involves the following quantities:

We apply the three batching strategies described in Section 8.4.2 for the syndrome decoding parameters (m, k, w) = (256, 128, 80) and using the field extension F points := F 2 192 . Figure 8.1 illustrates the resulting performance in terms of proof size and number of party emulations. Batching with additive sharings (using the naive strategy) with N = 256 is represented by the dashed line for which the achieved amortized cost per statement is around 6 KB.

Naive strategy: When using the naive strategy with low-threshold Shamir's secret sharing (for N = 256), the proof size is a bit larger than for the additive case, but the number of emulations is divided by more than 100.

SSS-based strategy:

When the number u of batched proofs is small enough (u ≤ 80), this strategy outperforms the additive case in terms of proof size. But it grows exponentially as u increases (slower when is larger). As explained in Section 8.4.2, this behavior is amplified when the underlying field is small. Here the number N of parties is limited by N ≤ |F 256 | + 1 -u = 257 -u. For instance, when u = 110 and = 2, the soundness error ε is approximately 0.57 with N maximal (N = 147), requiring a high number of executions τ ≥ 150.

Hybrid strategy: As expected, for such a context with limited N , the hybrid approach gives the best results. We get an amortized proof size of around 2.3 KB when = 1 and around 0.83 KB when = 8.

Chapter 9.

From Research to Specification

After the transition to the fourth round of the NIST PQC standardization process, NIST decided to re-open a call for additional digital signature proposals. The deadline for this call was the 1 st of June 2023. In the context of this thesis, we submitted several schemes that we will briefly describe in this chapter.

Moreover, in the last months of the thesis, we built a library to ease the development of the MPCitH-based schemes. We will also present this library in this chapter.

SD-in-the-Head Signature Scheme

The SD-in-the-Head signature scheme has been submitted to the NIST in collaboration with Carlos Aguilar Melchor, Nicolas Gama, Shay Gueron, James Howe, David Joseph, Antoine Joux, Edoardo Persichetti, Tovohery H. Randrianarisoa, Matthieu Rivain, and Dongze Yue.

The security of this scheme relies on the hardness of the syndrome decoding problem for random linear codes in Hamming metric (see Definition 4.1.1). The used MPC protocol is a variant of the one presented in Chapter 5:

• The original protocol needs to compute a Lagrange interpolation to build the polynomial S from the secret x. We can avoid this interpolation by tweaking the definition of y in the public key. Instead of defining y := Hx, we can define:

where V is the matrix satisfying:

for s the vector of coefficients of S. Let us remark that, for a uniformly random linear code C H represented by the matrix H as parity-check matrix, the linear code C HV represented by HV is also uniformly random. This is because V is an invertible m × m matrix. This trick enables us to avoid all the polynomial interpolations in the signing and verification algorithms.

• In the original protocol, the random points r 1 , . . . , r t ∈ F points sent by the verifier to check the polynomial relation S • Q = F • P should be distinct. Here we remove this constraint on #" r to make the scheme simpler and less prone to implementation errors. While this tweak slightly increases the false positive probability p (i.e. the probability that the protocol outputs Accept for an invalid input witness), this increase is small enough and does not impact much the security. The false positive probability of this tweaked protocol (taking r uniformly at random from F t points ) is:

We propose two variants of our signature scheme: • The fast variant (also named as the threshold variant) lowers the computational cost to get a fast signature computation. It relies on the transformation for the low-threshold broadcast-based multiparty computation model (see Section 3.1.3), with N := q parties where q is the size of the base field.

cost to produce short signatures by taking N := 256 parties, while the fast variant lowers the computational cost to get a fast signature computation by taking N := 32 parties. As explained in [START_REF] Feneuil | Building MPCitH-based Signatures from MQ, MinRank, Rank SD and PKP[END_REF], it would be possible to design the fast variant with low-threshold sharings even when working on the binary field F 2 . However, the obtained size would be around 9.3 KB, while the proposed fast variant is around 7.4 KB. We could achieve smaller sizes with low-threshold if we work on larger fields, but as for MIRA, the corresponding cryptanalysis is much less mature on such fields.

We refer the reader to the scheme's specification [START_REF] Aragon | RYDE Specifications[END_REF] for the precise description of the submitted scheme.

MQOM Signature Scheme

The MQOM signature scheme has been submitted to the NIST in collaboration with Matthieu Rivain. The security of this scheme relies on the hardness of the unstructured multivariate quadratic problem (see Definition 7.3.1). The used MPC protocol is an improvement of the protocol described in Section 7.3. As the construction in Section 7.3, it batches all the m equations into a single one. However, it differs in how the MPC protocol checks the batched equations: it uses a polynomial-based multiplication verification which asks the verifier for randomness twice (while the scheme in Section 7.3 used the sacrificing-based technique), obtaining a 7-round zero-knowledge proof.

We propose two variants of our signature scheme. As for MIRA and RYDE, both rely on additive sharings and use the hypercube technique, with N := 256 for the short variant and with N := 32 for the fast variant. Since we work on large fields (as F 251 ), it would be possible to use low-threshold sharings. Unfortunately, the size degradation is large: while we have sizes below 7 KB with additive sharings, we get sizes of at least 14 KB with low-threshold sharings.

We refer the reader to the scheme's specification [START_REF] Feneuil | MQOM: MQ on my Mind -Algorithm Specifications and Supporting Documentation[END_REF] for the precise description of the submitted scheme.

MPC-in-the-Head Library

Introduction

The MPC-in-the-Head paradigm has been an active research field for the last few years. Many signature schemes based on it have been proposed, including those of this thesis. Since the source codes of these schemes are similar except for the part about the MPC protocols, we decided to develop a unified MPC-in-the-Head library. The idea is to factorize as much as possible the common code of the MPCitH-based signatures. As long as they respect the expected API, users just need to implement some specific parts of the scheme and they can then rely on the library to get the desired signature scheme. It enables us to speed up the development of the MPCitH-based schemes. For example, we used this library to implement all the signatures proposed in Chapter 7. The library presents some other advantages:

• Comparison: it is not always easy to fairly compare the running times of two schemes in the literature since their implementations do not necessarily use the same primitives and/or the same level of optimizations. When two schemes are implemented via this library, all the common primitives rely on the same code, and it thus provides a fairer comparison.

• Detailed benchmark: the library integrates some benchmark tools. The latter can provide a detailed benchmark of the schemes, which includes for example the timings due to the commitments, the pseudo-randomness... Thanks to them, we can easily estimate the running times of implemented schemes and identify their computational bottlenecks.

• Versatility: all the code blocks respect some API. It is thus easy to replace a primitive with another one and compare the impact on the running time, just by changing the configuration file.

Remark 9.2.1. For the NIST call described in Section 9.1, the source code of MQOM and of the fast variant of SD-in-the-Head came from the library.

Structure and configuration

The structure of the library is described in Figure 9.1. It is implemented through four layers:

1. Symmetric Primitives. The lowest layer provides implementations for hash functions, extendable output functions (XOFs) and pseudo-random bit generators. At the time of writing,

• the available hash function and XOF are respectively SHA3 and SHAKE (their source codes come from the XKCP library, see https://github.com/XKCP/XKCP),

• the two available pseudo-random bit generators are an XOF-based generator and an AES-based one.

These three primitives are implemented in a sym folder.

Arithmetics.

The arithmetic folder provides the implementation of operations over many fields. At the time of writing, the available fields are the fields with the following sizes: For all the fields, the implemented operations are at least the addition, the subtraction, the multiplication and the pseudo-random number generation 1 . In some cases, other operations have been implemented (when they were needed to implement one of the schemes of this thesis), as the inversion.

3. MPC Protocols. The mpc folder contains all the source files that depend on the underlying MPC protocols. For each scheme, it should contain the implementation for the two following APIs:

• witness.h. This file describes the prototypes of the functions that generate a couple instance-solution of the underlying hard problem. For example, in the case of MQOM, it should generate an instance of the multivariate quadratic problem with its solution.

Appendices A. Proof of Privacy

This appendix provides a proof for the following theorem:

Theorem 8. Proof. In the MPC protocol Π LSSS using an ( +1, N )-threshold LSSS, all the values computed by the parties are shares from the underlying LSSS. The parties take such sharings as input and the latters are stable by the operations performed in Π LSSS (since the computation over the shares is linear). Therefore, the MPC protocol Π LSSS is well-defined.

By assumption, we have that the MPC protocol Π add is (N -1)-private when using an additive sharing. This implies that there exists a simulator Sim add which takes as inputs a set I ⊂ [N ] of size N -1, w I , #" β I and the outcome (Accept or Reject) of the real-world execution and which outputs views for parties in I whose joint distribution is perfectly indistinguishable from the joint views of the same parties in a real-world execution of the MPC protocol (with the same outcome).

We first describe the simulator Sim LSSS (I, w I , #" β I , #" ε , y):

1. Sample w and #" β randomly.

2. Compute w ← Share add (w ; r w ) for some fresh randomness r w .

Compute

#" β ← Share add ( #" β ; r #" β ) for some fresh randomness r #" β .

Choose a set

5. Call the simulator view add ← Sim add (I , w I , #" β I , #" ε , y).

6. Extract #" α from view add and let #" α := #" α .

7. For j = 1 to t:

• Deduce α j from α j I and α j .

8. Output #" α , w I , #" β I .

-177 -

• Soundness. Suppose that there is an efficient prover P that, on input x, convinces the honest verifier V to accept with probability

where the soundness error ε is defined as

Then, there exists an efficient probabilistic extraction algorithm E that, given rewindable black-box access to P, outputs either a witness w satisfying (x, w) ∈ R, or a commitment/hash collision, by making an average number of calls to P which is upper bounded by

• Honest-Verifier Zero-Knowledge. There exists an efficient simulator S which, given the random challenge I outputs a transcript which is indistinguishable from a real transcript of Protocol 14.

For any set T of successful transcripts corresponding to the same commitment,

• either the revealed shares of w are not unique, and then we find a commitment collision or a hash collision,

• or the openings are unique.

Along this proof, we consider that the extractor only gets transcripts with unique revealed shares since otherwise the extractor would find directly a commitment collision or a hash collision.

We shall denote by R h the randomness of P which is used to generate the initial commitment h 1 (which determines the witness sharing w ), and we denote r h a possible realization of R h . Throughout the proof, we denote succ P the event that P succeeds in convincing V. By hypothesis, we have Pr[succ P ] = ε.

B.1. Technical Lemmas

In our proof, we shall make use of the following lemmas:

Lemma B.1 (Splitting Lemma [PS00]). Let X and Y be two finite sets, and let

For any α ∈ [0, 1), let

We have:

For J ∈ J and b ∈ {0, 1}, let us introduce the notation

and let y ∈ {0, . . . , N }. Let us assume that succ P , Y = y and {A x J J } J∈J jointly occur. Because succ P occurs, we have that g(α 1 , . . . , α t ) = 0 where α 1 , . . . , α t are the values corresponding to the sharings α 1 , . . . , α t . Then for each set J ∈ J (w (J) is a bad witness) such that J ⊂ H (the parties in J are honest), we have that ᾱj i = α j i for every i ∈ J and every j ∈ [t], which implies

Namely, a false positive necessarily occurs for w (J) , i.e. x J = 1, whenever J ∈ J with J ⊂ H. Thus wt H (x) ≥ J∈J :J⊂H

x J = y + 1 .

By defining

The only way for the transcript to be successful is that the set I of challenged opened parties only contains honest parties, i.e. I ⊂ H. Thus,

Since wt(x) is a non-negative integer, we have y max ≥ . Let us consider three cases:

Case 1: y max = , it means that wt(x) = 0, then

where the last inequality holds by [START_REF]H ← PRG(seed H ) 4. y = Hx; pk = (seed H , y); sk = mseed For the sake of simplicity, we omit the re-generation of H and x from the seeds in the algorithms below and assume pk =[END_REF]. The probability that a new party is not opened corresponds to the probability that the set I of opened parties is a subset of P (T ), i.e.

Pr[ Z

The success probability knowing that that no new party is open corresponds to the success probability when restricting to the |P (T )| parties which have been already open. By assumption (T does not contain a good witness), the shares of those parties only correspond to bad witnesses. Thus, this probability can be upper bounded using the inequality (1) of Section B.2 with N = |P (T )|:

To summarize, in the presence of a good R h , the probability of the event succ P ∩ Z (i.e. getting a successful transcript T which opens a new party) is lower bounded by (1-δ)• ε-ε > 0. Moreover, the event succ P ∩ Z can occur at most N -times, because T 0 already opens parties and there are N parties in total. We deduce that after N -occurrences of succ P ∩ Z, the list T contains a good witness.

Let us now define

And let X ∼ B(N 1 , p 0 ) a binomial distributed random variable with parameters (N 1 , p 0 ). The probability that E 0 reaches the stop condition and returns a (good) witness for a successful transcript T 0 with good R h satisfies:

To obtain an δ-free formula, let us take δ such that (1 -δ) • ε = 1 2 (ε + ε). We have δ = 1 2 1 -ε ε and the average number of calls to P is upper bounded as

which concludes the proof.

C. Signature Scheme and Proof of Unforgeability

We can transform the zero-knowledge proofs of knowledge described in Section 8.3 into signature schemes using the Fiat-Shamir heuristic [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF]. Protocols 15 and 16 describe the signing and verification algorithms obtained when following this approach for the 5-round case (i.e. for t = 1 iteration in the MPC protocol).

When applying the Fiat-Shamir transform, we compute the verifier challenges (ε [e] ) e∈[1:τ ] and (I [e] ) e∈[1:τ ] as: where m is the input message, Hash 1 and Hash 2 are cryptographic hash functions, Expand is an extendable output hash function, and ( h[e] , α [e] S ) e∈[1:τ ] are the commitments and the broadcast shares merged for the τ repetitions. We introduce a value salt called salt which is sampled from {0, 1} 2λ at the beginning of the signing process. This value is then used for each commitment to the parties' states. Since the signature security relies on the random oracle model, we can safely replace the commitment scheme Com of Protocol 14 by a single hash function Hash 0 . Moreover, we derive all the randomness used in the scheme from a root seed for performance reason and to make the scheme easily turnable into a deterministic signature scheme. In particular, the randomness used for the sharings is derived from this root seed using a pseudo-random generator PRG which is made explicit in the description (while it was implicit in the description of the zero knowledge protocol). Finally, we denote Hash m the hash function involved for the Merkle trees.

In this signature scheme, a secret key is a witness w and a public key is a statement x, with (x, w) ∈ R for the considered relation R. We assume the existence of a function F which maps every witness to the corresponding statement:

We further assume that F is an (t owf , owf )-hard one-way function, namely an adversary A receiving a random statement x has a probability at most owf to output the corresponding witness w in time at most t owf .

The zero-knowledge protocol for relation R which we transform into the present signature scheme depends on two functions: ψ which computes the hints and ϕ which corresponds to the party computation. In practice, those two functions depend on the statement x (i.e., on the public key in the case of a signature scheme), so for the sake of completeness, we will index them with x in this section: ψ x and ϕ x .