Questions tagged [dilithium]

Dilithium is a digital signature algorithm based which uses the FIat-Shamir with aborts technique based on the Decisional Compact Knapsack (DCK) and Short Integer Solution (SIS) problems in module lattices. It is an example of lattice-based cryptography and is part of the Crystals family together with the KEM scheme Kyber. It was selected for standardisation as part of the NIST post-quantum cryptography process in 2022. The standard is in progress.

Filter by
Sorted by
Tagged with
1 vote
0 answers
40 views

The correctness of NTT algorithm

When directly invoking the ntt and invntt function in Dilithium's code with any polynomial $a \in R_q$, I get a unexpected running result: $NTT(a) \neq iNTT(NTT(a))$. And in the test code of Dilithium(...
guangyu liao's user avatar
3 votes
1 answer
74 views

How to reconstruct low order bits of $t$ of CRYSTALS-Dilithium from a small number of signatures?

In FIPS 204 (https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.ipd.pdf): "The vector $\textbf{t}$ is compressed in the actual public key by dropping the $d$ least significant bits from each ...
Jong Hyeok Lee's user avatar
1 vote
0 answers
28 views

How to convert Lattice based signature to R1CS statements?

How can we convert a lattice-based signature (like based on Fiat Shmair with abort e.g. Dilithium) to R1CS?
Kanchan Bisht's user avatar
0 votes
0 answers
95 views

Kyber and Dilithium usage limits?

What are the theoretical usage limits of Kyber and Dilithium? Are there any sources to back this up? Maximum number of encryptions/signatures allowed per key, etc.?
Joe's user avatar
  • 73
1 vote
1 answer
84 views

Can someone explain in simple terms how coding part and the algorithm itself, of dilithium pqc signature algorithm resemble here?

I am stuck here and can't map the coding part to the algorithm. $$\underline{\text{Power2Round}_q(r, d)}\\ r := r \bmod^+ q\\ r_0 := r mod^\pm 2^d\\ \textbf{return}\big((r-r_0) / 2^d, r_0\big) $$ What ...
Muhammad Awais's user avatar
1 vote
1 answer
72 views

How have the authors performed uniform random sampling for the secret values s1 and s2 in dilithium?

I am currently trying to understand and implement the design of post quantum algorithm signature algorithm Dilithium. I have read the document several times and they have just used uniform random ...
ijaz khalid's user avatar
2 votes
1 answer
247 views

In dilithium (post quantum signature algorithm), how have the authors precomputed the table of zetas for NTT?

I am trying to understand the design rationale of in place NTT in Dilithium. I know that how the splitting of polynomials is done but I cant seem to map this approach to the precomputed table of zetas ...
ijaz khalid's user avatar
3 votes
1 answer
88 views

Where does the 8 come from? Generic Search Problem with Bounded Probabilities

I am working with lossy ID-schemes and their security in the QROM. Following the article of Kiltz et al. , I am at a loss of the number 8 appearing in most reductions throughout the article. I know it ...
Rory's user avatar
  • 335
2 votes
0 answers
37 views

Proving the minimal entropy of Dilithium-QROM?

I am working with the securit yof CRYSTAL's Dilithium signature in the QROM. I am working with Kiltz et al.'s approach through lossy ID-schemes and looking at the proof of minimal entropy for the $DFS[...
Rory's user avatar
  • 335
5 votes
1 answer
426 views

Do we need the quantum random oracle model (QROM)?

I am currently studying the proof of the Dilithium signature in the quantum random oracle model (QROM). I am curious to hear if anyone have any thoughts on the importance of having proofs in the QROM ...
Rory's user avatar
  • 335
3 votes
1 answer
707 views

CRYSTALS-Dilithium - How do the supporting algorithms work?

I am studying the Dilithium signature from Ducas et al's CRYSTALS-Dilithium: A Lattice-Based Digital Signature Scheme. Wanting to understand how the supporting algorithms work together, I am trying ...
Rory's user avatar
  • 335
7 votes
1 answer
218 views

Are rejected Dilithium commitments secret?

On 6 March, Yi Lee sent over the NIST mailing list an announcement of their submitted paper that found a flaw in the original security proof for Dilithium. In their manuscript, they fix the proof on ...
dusk's user avatar
  • 1,175
15 votes
4 answers
7k views

Kyber and Dilithium explained to primary school students?

Kyber and Dilithium are post-quantum cryptographic designs, but the resources are hard to understand. Is it possible to explain those ciphers to children?
Flan1335's user avatar
  • 361
2 votes
1 answer
367 views

What is the effect of solving short integer solution problem in Dilithium or any other post quantum signature scheme?

I am trying to understand the post quantum based signature scheme Dilithium. I know what the hard problems are in the scheme, but I am having trouble in understanding the utilization of short integer ...
Muhammad Awais's user avatar
12 votes
1 answer
3k views

Why did NIST select Kyber and Dilithium?

NIST selected Kyber for key agreement and Dilithium for digital signature applications some days ago. But IDF's MATZOV group, in their paper, broke Kyber and Dilithium and brought the security levels ...
Daniel's user avatar
  • 121
2 votes
1 answer
238 views

Is it possible to create a Dilithium Prime or Falcon Prime?

In the NTRU Prime submission, principle author, the well-known DJB is adamant that [the] primary objective [of NTRU Prime] is to eliminate unnecessary complications in security review So much so, to ...
DannyNiu's user avatar
  • 9,207
4 votes
1 answer
298 views

Basic explanation of Falcon and Dilithium

I've been trying to search for toy examples of the round 3 digital signatures Rainbow, Falcon and Dilithium. Not a lot of actual implementation examples are out there. What I'm searching for are ...
mikrim's user avatar
  • 41
4 votes
0 answers
362 views

Which parts of CRYSTALS-Kyber and CRYSTALS-Dilithium are compatible?

The papers CRYSTALS-Kyber and CRYSTALS-Dilithium both have been written by quite different authors. It seems that at least the key generation is very different from each other. CRYSTALS mainly seems ...
Maarten Bodewes's user avatar
  • 92.6k
1 vote
1 answer
238 views

Meaning of Dilithium-1024x768 or Dilithium2

Can someone explain me the meaning of 1024 and 768 in Dilithium-1024x768 in the algorithm? And the meaning of 2 in Dilithium2 in the algorithm?
jmr's user avatar
  • 95
1 vote
0 answers
430 views

Dilithium signature scheme - Public key derivation

I was looking at post quantum signature schemes, and I came across Dilithium(https://github.com/pq-crystals/dilithium), and our system currently runs on Ed25519 which based on my question can easily ...
josephnicholas's user avatar
5 votes
0 answers
265 views

Why is it safe to generate the secret key and masking vectors using rejection sampling in CRYSTALS-Dilithium?

In CRYSTALS-Dilithium module lattice-based digital signatures, the secret key vectors $s_1, s_2$ with coefficients in $[-\eta, \eta]$ and the signature masking vector $y$ with coefficients in $(-\...
Naruto999's user avatar
  • 436
4 votes
1 answer
564 views

Dilithium signature scheme and timing attacks – Does the running time actually depend on the secret key?

The paper “CRYSTALS – Dilithium: Digital Signatures from Module Lattices” (by Léo Ducas, Tancrède Lepoint, Vadim Lyubashevsky, Peter Schwabe, Gregor Seiler, and Damien Stehlé) introduces a digital ...
Demi's user avatar
  • 4,793