New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

# Questions tagged [dilithium]

Dilithium is a digital signature algorithm based which uses the FIat-Shamir with aborts technique based on the Decisional Compact Knapsack (DCK) and Short Integer Solution (SIS) problems in module lattices. It is an example of lattice-based cryptography and is part of the Crystals family together with the KEM scheme Kyber. It was selected for standardisation as part of the NIST post-quantum cryptography process in 2022. The standard is in progress.

25 questions
Filter by
Sorted by
Tagged with
1 vote
43 views

### Showing special soundness for Dilithiums underlying $\Sigma$-protocol

I'm trying to prove the security of Dilithiums underlying $\Sigma$-protocol using the following theorem. Let $\Sigma=\left(\mathcal{P},\mathcal{V}\right)$ be a $\Sigma$-protocol on an effective ...
• 253
1 vote
77 views

### Math of Hint usage in Dilithium

For Dilithium, I understand that $$\text{HighBits}(\mathbf{Ay}) = \text{HighBits}(\mathbf{Ay} - c\mathbf{s_2}) = \text{HighBits}(A_z - c\mathbf{t})$$ The first term of the equation is performed on the ...
• 31
1 vote
44 views

### Recovering dilithium secret keys implies solving MSIS

I'm currently looking at different ways to break Dilithium and found this post: What is the effect of solving short integer solution problem in Dilithium or any other post quantum signature scheme? ...
• 253
1 vote
72 views

### USeHint and MakeHint in Dilithium

My understanding of Dilithium is below To sign, signer generates random vector y with coefficients under a given threshold. He calculates: ...
• 31
81 views

### How to reconstruct low order bits of $t$ of CRYSTALS-Dilithium from a small number of signatures?

In FIPS 204 (https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.ipd.pdf): "The vector $\textbf{t}$ is compressed in the actual public key by dropping the $d$ least significant bits from each ...
1 vote
28 views

### How to convert Lattice based signature to R1CS statements?

How can we convert a lattice-based signature (like based on Fiat Shmair with abort e.g. Dilithium) to R1CS?
101 views

### Kyber and Dilithium usage limits?

What are the theoretical usage limits of Kyber and Dilithium? Are there any sources to back this up? Maximum number of encryptions/signatures allowed per key, etc.?
• 73
1 vote
97 views

### Can someone explain in simple terms how coding part and the algorithm itself, of dilithium pqc signature algorithm resemble here?

I am stuck here and can't map the coding part to the algorithm. $$\underline{\text{Power2Round}_q(r, d)}\\ r := r \bmod^+ q\\ r_0 := r mod^\pm 2^d\\ \textbf{return}\big((r-r_0) / 2^d, r_0\big)$$ What ...
1 vote
75 views

### How have the authors performed uniform random sampling for the secret values s1 and s2 in dilithium?

I am currently trying to understand and implement the design of post quantum algorithm signature algorithm Dilithium. I have read the document several times and they have just used uniform random ...
294 views

### In dilithium (post quantum signature algorithm), how have the authors precomputed the table of zetas for NTT?

I am trying to understand the design rationale of in place NTT in Dilithium. I know that how the splitting of polynomials is done but I cant seem to map this approach to the precomputed table of zetas ...
88 views

### Where does the 8 come from? Generic Search Problem with Bounded Probabilities

I am working with lossy ID-schemes and their security in the QROM. Following the article of Kiltz et al. , I am at a loss of the number 8 appearing in most reductions throughout the article. I know it ...
• 335
39 views

• 436