Signing information in the quantum era Free

Physical signatures are marks made to identify or authenticate the creator of a message or artifact. Their precise origins are lost to history, but they are associated with some of the earliest records of pictographic scripts, dating back at least 5 millennia.¹ The information and telecommunication revolution in the second half of the 20th century would not have happened without a practical means to authenticate messages, which led to the invention of digital signature schemes.

Schemes for signing digital information are a direct, albeit stronger, analogue to physical signatures; they seek to ensure (i) authenticity of any claim regarding a message sender's identity, (ii) that the message has not been altered by any parties since the signing, and (iii) that the sender cannot refute that it was indeed them who signed the message. In Sec. II, we review the origins of digital signatures and explore some of the important bases for signatures in the modern world. From here, we review their applications and vulnerabilities associated with assumptions made in their foundations, while discussing a select few ways in which signatures have evolved for standardization and specific use cases.

Post-quantum cryptography focuses on building classical algorithms whose security is resistant to known capabilities of quantum algorithms. Post-quantum signature schemes build upon early work in digital signatures. In Sec. III, we review progress made in this field and look closely at the resources required to implement these emerging algorithms.

It has been shown that algorithms using information encodes on quantum states can be used for secure communication protocols that are not dependent upon unproven assumptions, but instead are provably secure within the laws of physics itself. Section IV discusses the application of quantum information and communications to signature schemes.

The pursuit of secure digital signature schemes was of great importance in 20th-century cryptographic research. Digital signatures are considered to be a cryptographic primitive with widespread application and use, with legal precedence in some jurisdictions. Like their physical counterparts, digital signatures are indeed used to authenticate the sending of a message, but their strength as a primitive protocol does not end here. Since their introduction in 1976 by Diffie and Hellman,² further applications have been found in the building of secure distribution schemes, digitally processed financial transactions, cryptocurrencies,³ and more. It is known that a primitive analogue to digital signatures was developed decades before Diffie and Hellman made their public contributions, with the earliest known notion of authentication by some form of digital signature being a challenge-response mechanism used by the US Air Force to identify friendly aircraft, as far back as 1952.⁴ Remarkably, even national identity and national government systems can be built with digital signatures at their core, as witnessed in Estonia's use of blockchain-style security for their Identity Card system and eResidency scheme offered to International visitors and investors.⁵ 

In Sec. II, we define digital signature schemes and their relevant security notions, as well as providing formal schematics of simple implementations of such schemes from the literature.

With research in digital signatures growing alongside research in public key cryptography,⁴ the majority of well-known and well-studied signature schemes arise from public key cryptosystems. These typically rely upon certain mathematical assumptions about the hardness of problems (signature schemes based on symmetric encryption are generally reserved for arbitrable setups). An often-seen method of building a signature scheme is as follows: find some public key cryptosystem based on one-way functions or trap-door functions, generate a signature using Alice's private key in the system, and allow any party to verify that Alice indeed sent the message using the publicly shared encryption key. Well-known cryptosystems used in such a way include RSA,⁶ ElGamal,⁷ Rabin,⁸ and Fiat–Shamir.⁹ We remark that (in a simplified manner) the main property that distinguishes a one-way function from a trap-door function is the existence of trap-door knowledge, some secret that allows the (usually) hard to invert function to become easily invertible.

A variety of trapdoor functions can be built based on performing exponentiation modulo n, depending on how we choose n. The simple act of squaring modulo n where n = pq for some prime p, q forms a trap-door function, in which the trap-door knowledge is the prime factors (p and q). We can build further trap-door functions with different exponents by carefully choosing the exponent. Again, working in modulo n such that n = pq for large primes p, q, if we choose some e such that e is coprime with $ϕ(n)=(p−1)(q−1)$ (the Euler totient function of n), we find that for any given x,

is a trapdoor function, where the trapdoor is once again the prime factors p, q. This forms the basis of the RSA cryptosystem. While the work of Diffie and Hellman in 1976 may have built the theoretical bench on which research could seek to implement digital signatures, it was a later paper by Rivest, Shamir, and Adleman that first exemplified a proof-of-concept on top of this workbench. The well-celebrated RSA paper⁶ published in 1978 marked an early showcasing of asymmetric cryptosystems, well establishing the idea of public-key cryptography in a format that is in widespread use today. Relying on exponentiation under some n = pq for large primes p and q, the RSA cryptosystem can be used to send encrypted data securely (under assumptions), and the same methodology can be used to implement a signing algorithm securely. For the basis of an RSA implemented cryptosystem, private keys and public keys must be created for use in the trap-door function, all of which is formalized as follows:

• Trap-door function: In the case of RSA, we take the trap-door function on some bit-string m to be

  $RSA{E,D}(m)=me,d (mod n).$

  Call $RSAE$ the RSA encryption function using key e and $RSAD$ the RSA decryption function using key d, defined below. We require that n = pq for some large primes p and q and choose e such that for $ϕ(n)=ϕ(pq)=(p−1)(q−1)$⁠, we have $gcd(e,ϕ(n))=1$⁠, where gcd means the greatest common divisor and $1<e<ϕ(n)$⁠.

• Public key: RSA takes as its encryption key the above chosen value, e. e is part of the public information in the cryptosystem, along with our chosen n for modular arithmetic.

• Decryption key: One calculates the decryption key d, by determining the multiplicative inverse of e mod $ϕ(n)$⁠, i.e., determining $d≡e−1(mod ϕ(n))$⁠. The decryption exponent, along with the prime factors p, q, of n, is kept secret. d can be easily calculated when p and q are known.

We denote a message as m, with C being the resulting ciphertext following encryption on m and S a signature (generated from a message m). The leading motivation for the RSA cryptosystem is its use for easy encryption of a message, as shown in Fig. 1. Anyone with knowledge of the publicly shared information (e and n) can easily encrypt a message m by performing $C=me mod n$⁠. The intended recipient of the secret message, Alice, can easily recover $m=Cd mod n$⁠, and anyone lacking knowledge of d who intercepts C will struggle to find m from just the public knowledge. Loosely, the “hardness” of recovering m without d relies upon the hardness of discovering d without knowledge of p and q. We then see that, really, the security of the RSA cryptosystem reduces down to the intractability of factoring n into its prime factors p, q. This form of problem reduction is seen throughout digital signatures and indeed all of cryptography.

While the above demonstrates RSA's use as a tool to allow any party to transmit secret messages to a recipient Alice, it is easy to use the same tools to allow Alice to sign a message that can be verified by any party (Fig. 2). Suppose Alice seeks to send a message, m, to some party Bob who wishes to verify that this message was not sent by some third party. This can be achieved by both parties carrying out the following:

1. Utilizing her secret decryption key, Alice can now compute $RSAD(m)=md mod n=Sm$⁠.

2. Alice sends the message m to Bob, along with the associated signature, S_m.

3. Bob simply calculates $RSAe(Sm)=Sme mod n=(md)e mod n=md·e mod n=m$⁠.

From this, it is clear that Bob can be convinced that only Alice (or someone with Alice's secret decryption key d) could have sent this message. As e and n are public knowledge, any other party may also be convinced of this, allowing transferability of the signature.

This (simplified) view of RSA demonstrates many fundamentals of digital signatures within a classical framework: The need for a cryptosystem whose security we have good reason to believe in, even if it is not provable (the assumption of intractability presents issues for provable security, see Sec. II F), the ability to use this cryptosystem for signing (or at least modifying the cryptosystem for signing), and the need to ensure the three pillars of security for digital signatures: authenticity, integrity, and nonrepudiation, while also hoping for the (at times less essential) property of transferability.

While much of this section, along with the literature, focuses on asymmetric signature schemes whose roots lie in public key cryptosystems, this does not mean symmetric signature schemes arising from private key cryptosystems have no value in both research and application. Given the context (Alice signing a message, Bob verifying), it is easy to see why a private-key cryptosystem utilizing the same (symmetric) key for both encryption and decryption is considered a weak arrangement for digital signatures: that both Alice and Bob use the same encryption key means either party can imitate the other. As long as Bob knows the encryption transformation used by Alice, he can always use the private key to generate a signature to deceive an unwitting third party, Charlie. The sought-after property of transferability is clearly lost. The potential applications for (secure) symmetric signatures are much smaller than those of asymmetric signatures. Both parties must trust each other to not be deceitful, which is far from practical for most settings (especially given that the parties may have no knowledge of each other prior to the signing and verification). However, such systems are in use: for financial institutions, they can be very beneficial as they are (often) less computationally taxing than their public key counterparts, and given a scenario where neither party has any reason to doubt the other's intentions [such as an automated teller machine (ATM) communicating with its parent financial institution], they can be used to a great effect.

The function $x→x2 mod n$ for some $x∈ℤ$ and n = pq, given p, q are prime, forms a trap-door function in which the trap-door information, like in RSA, is knowledge of the prime factors p, q of n. Rabin⁸ introduced a cryptosystem whose core is reliant on utilizing squaring under modular arithmetic as a trap-door function. The use of Rabin's system, along with some hashing function, can produce a signature scheme with certain advantages over RSA. It is unknown whether or not breaking RSA is actually as difficult as factoring: the security reduction that reduces RSA to factoring remains unproven as the RSA assumption. The potential that there may exist a security reduction from RSA to an easier problem than factoring is of concern. However, Rabin proved that breaking his cryptosystem is as difficult as the factoring problem. Thus, unlike RSA, cryptographers can find strength in its security as long as factoring remains intractable.

Throughout this section, we have treated the RSA cryptosystem as a tool by which to lay out the general case for, and elucidate on general points within, digital signature schemes. Principally, we have opted for this approach as the RSA cryptosystem is a well-studied example of a cryptosystem built upon the notion of a trapdoor function. As we have previously covered, this constitutes a popular method of construction, allowing us to perform both encryption and signing. Yet not all public-key cryptosystems, or all cryptosystems used to deploy signature schemes, must be reliant upon trapdoor functions. The discrete logarithm problem is one such example of a one-way function with no trapdoor information that is successfully implemented in widely used signature schemes. Working within finite fields, and letting p be a prime and g some primitive root in $ℤp*$⁠, the function

is a one-way function with no trap-door knowledge. dExp (the discrete exponential function) is easy to compute under a finite field, but its inverse, dLog, is believed to be intractable (the discrete analogue of the logarithmic function is hard to compute, i.e., it is hard to find x from $dExp(x)=gx$⁠) and there exists no “trap-door” information that makes this inverse easily computable. The assumption about the intractability of computing x is known as the discrete logarithm assumption, and can form the basis of a cryptosystem, most notably one devised by ElGamal,⁷ and has applications in signing of information.

Adaptively chosen-message attacks, as defined in Sec. II A, utilize cryptanalysis of message-signature pairs (signed by Alice) as a powerful tool in a malicious party's (Eve's) pursuit of existential forgery against a given digital signature scheme. It is known that many well-studied cryptosystems are susceptible to such an attack, including RSA. In 1988 Goldwasser, Micali, and Rivest (henceforth GMR) gave a thorough treatment of their signature scheme,¹⁰ while proving its security against adaptive chosen message attacks. Like many of the schemes preceding them, GMR's is reliant on trapdoors. However, GMR introduced the notion of claw-free permutation pairs,¹¹ and claimed that signature schemes utilizing trap-doors and claw-free permutations could produce an additional degree of security against adaptively chosen-message attacks when compared to the then-traditional method of “simple” trap-door schemes. While the scheme itself is not as simple and easily presentable as RSA, the basic notion behind the claw-free permutations is simple to see:

Typically, when performing RSA with the RSA-encryption and decryption functions $RSA{E,D}(m)=m{d,e} mod n$⁠, with message m, encryption and decryption exponents e and d, respectively, and modulus n, we take n to be some 1024-bit number. We bear in mind that, if sending a message in some text-based language, we are left with (at most) 128 ASCII characters. Assuming the language chosen is well-defined with a set of rules, we can assume most documents that need signing to be greater than this stringent limit. In order to allow the signing of messages and documents of arbitrary length, cryptographers typically turn to hash functions.

In 1996, Bellare and Rogaway introduced the notion of the probabilistic signature scheme (PSS),¹⁸ in which the signature generated is dependent upon the message and a randomly chosen input. This results in a signature scheme whose output for a given message does not remain consistent over multiple implementations. Utilizing a trap-door function (typically one well-used in nonprobabilistic schemes, such as the RSA function), a hash function and some element of randomness (typically a pseudorandom bit generator), a signature scheme that is probabilistic in nature may be implemented. Such schemes can be used to sign messages of arbitrary length and to ensure that the message m is not recoverable from just the signature of m. RSA–PSS is a common probabilistic interpretation of the RSA signing scheme that forms part of the Public-Key Cryptography Standards (PKCS) published by RSA laboratories.¹⁹ 

We have already discussed how hashing may be used before signing a message (along with padding) to ensure that all messages signed are of an appropriate size. However, the use of hashing in digital signatures extends beyond the “Hash and sign” idea used for signing protocols such as RSA. A protocol introduced by Fiat and Shamir⁹ has led to the creation of the Fiat–Shamir paradigm. The Fiat–Shamir paradigm takes an interactive proof-of-knowledge protocol²⁰ and replaces interactive steps with some random oracle, typically a publicly known collision hash function. A thorough treatment of the paradigm can be found in Delfs' and Knebl's textbook on cryptography.²¹ In addition to their use in creating signature schemes that are secure against adaptively chosen-message attacks, it has been shown by Damgard¹³ that claw-free permutations can play a role in creating collision-resistant-hash-functions (this should not seem too surprising, as it is easily recognized that their definitions are similar: Collision-resistant hashing can almost be seen as a single-function analogue of claw-free permutations).

The work of ElGamal on cryptosystems making use of the one-way nature of the discrete logarithm forms the basis of the Digital Signature Algorithm (DSA),²² a cryptographic standard popular since its proposal as a National Institute for Standards and Technology (NIST) submission for the Digital Signature Standard, DSS.

Recent years have seen increased interest in electronic voting, a concept heavily reliant on signature schemes. Electronic voting typically requires a cryptosystem that is both probabilistic and holds homomorphic properties. ElGamal is a good example of an applicable cryptosystem. Electronic voting has been used in a variety of countries, including the US (the 2000 Democratic Primary election in Arizona²³ is often cited as a landmark event in internet voting); Scottish Parliament and local elections since 2007 (although the 2007 elections can be considered good proof as to why great care must go into researching the implementation of these systems before use²⁴), Brazil²⁵ (whose 2010 presidential election results were announced just 75 min after polls closed thanks to electronic voting), and India, with the state of Gujarat being the first Indian state to enable online voting in 2011.²⁶ In Europe, Estonia also utilizes electronic voting,⁵ with the idea of the Estonian digital ID-card, which provides a digital signature, being pivotal in how government and society are run in the Baltic country.

Another subfield of cryptographic research that has garnered increased interest in recent times is Elliptic Curve Cryptography. Schemes based on the discrete logarithm problem (such as ElGamal/DSA) can be implemented similarly on the mathematical framework of elliptic curves²⁷ instead of finite fields. A key benefit of deploying a cryptosystem in such a way is the ability to perform computations at shorter binary lengths than traditionally used, without conceding security. This makes such schemes good candidates for when resources are limited, and Elliptic Curve DSA (ECDSA)²⁸ is an example of such a scheme that forms a cryptographic standard and is included in the Transport Layer Security (TLS) protocol.²⁹ 

In 1979, Ralph Merkle patented the concept of the hash tree, commonly known as the Merkle tree after him. Merkle trees can be paired with one-time signature schemes (within a symmetric cryptographic framework) to form a Merkle-Tree Based Signature scheme.³⁰ Such schemes still remain only suitable for one-time use although the work of Naor and Yung explores an extension of these types of schemes to complete multiuse signature schemes. It is believed that such signature schemes may be resistant to quantum-attacks, which are mentioned below and discussed further in Sec. II.

As we have seen, the vast majority of widely implemented cryptographic algorithms (especially those that rise from public-key cryptosystems) rely upon unproven mathematical assumptions about the hardness of certain problems in order to provide us with security. This review is by no means expansive on the workings of different signature schemes under various cryptosystems, and a reader seeking a thorough treatise of the field may turn to Simmons³¹ (for an exploration of early public key cryptosystems and signatures) and Delfs–Knebl²¹ (for a treatise of modern cryptography, with extensive sections on signatures). With the increase in research in applications of quantum theory to modern technology, these previously held assumptions are left to fall apart in front of us. Since Deutsch's introduction of the Universal Quantum Computer,³² research in utilizing the power of quantum theory for computing has yielded many strong theoretical results, with early work including the development of algorithms for a quantum computer that can perform certain tasks faster than a classical computer is believed to be able to. Included in these is Shor's algorithm,³³ which can perform prime factorization at a speed that would allow currently implemented cryptosystems to be broken. While the practical implementation of such algorithms is yet to yield results strong enough to cause immediate worry, research is still looking forward to ensure that security shall not be compromised as quantum computers grow more powerful.

As previously mentioned, advances in quantum computing have raised concerns for the field of classical cryptography. Here, we give a brief overview of why, followed by a discussion of the responses from the cryptographic community.

In an era where popular thinking was that problems based on factoring would be unbreakable, the introduction of Shor's algorithm³³ in 1994 caused uncertainty in the security of cryptosystems that were previously assumed to be secure. This review gives a brief overview of the techniques used.

Factoring a composite number N can be reduced to the problem of finding the period of a function. This is done by picking a random number $a<N$⁠, checking that $gcd(a,N)=1$ (if $gcd(a,N)≠1$⁠, then we have found a factor of N and we are done), and then looking for the period of the function,

Up to this stage, this can all be achieved classically. The quantum Fourier transform is used to find the period, resulting in Shor's algorithm being extremely efficient and appearing in the complexity class BQP (bounded-error quantum polynomial-time).³⁴ This is almost exponentially faster than the fastest known classical factoring algorithm, the general number field sieve.³⁵ 

This period solving algorithm can also be used to solve the discrete logarithm problem,³⁶ which also breaks the hardness assumption of this problem. From this, Shor's algorithm can be extended to a more general problem: the Hidden Subgroup Problem (HSP).^37–39 The HSP states that given a group G, a finite set X, and a function $f:G→X$ that hides a subgroup $H≤G$⁠, we seek to determine a generating set for H only given evaluations of f. We say that a function $f:G→X$ hides H if, for all $g1,g2∈G, f(g1)=f(g2)$ if and only if $g1H=g2H$⁠. Within this framework, Shor's algorithm can be seen as solving the HSP for finite abelian groups. Other problems can similarly be generalized to this framework. For instance, if a quantum algorithm could solve the HSP for the symmetric group, then one of the key hard problems for Lattice Cryptography (see Sec. III C)—the shortest vector problem—would be broken.⁴⁰ 

Whilst Shor's algorithm has received the most attention for the problems it causes in cryptography, it is by far not the only quantum algorithm to attack current schemes. Grover's search algorithm^41,42 can be used in certain schemes, and other factorization algorithms such as the quantum elliptic-curve factorization method⁴³ have had some success. We point the reader in the direction of Bernstein et al.⁴⁴ and Jordan and Liu⁴⁵ for more complete surveys on quantum cryptanalysis of classical cryptography.

While current estimates place the development of practical quantum computers capable of posing a security threat many years in the future (at time of writing, the record for using Shor's algorithm to factor a “large number” into two constituent primes stands at $21=3·7$⁠,⁴⁶ though much larger factorizations have been achieved in the adiabatic case⁴⁷), it is pertinent to replace our current systems well in advance of that. In light of that, the National Institute for Standards and Technology (NIST) put out a call for submissions in 2016⁴⁸ to attempt to set a new quantum-secure standard. This ongoing project aims to find new standards for both public key encryption and digital signatures.

The NIST evaluation criteria⁴⁹ for these new schemes set out both required security levels and computational cost. For the security levels, it is assumed that the attacker has access to signatures for not more than 2⁶⁴ chosen messages using a classical oracle. The security levels are grouped into broad categories defined by easy-to-analyze reference primitives—in this case, the Secure-Hash-2 (SHA2)¹⁵ and the Advanced Encryption Standard (AES).⁵⁰ The rationale behind the seemingly vague categories is that it is hard to predict advances in quantum computing and quantum algorithms, and so rather than using precise estimates of the number of “bits of security,” a comparison will suffice. See Table I for the exact security levels.

For quantum attacks, restrictions on the circuit depth are given, motivated by the difficulty of running extremely long serial quantum computations. Proposed schemes are also judged on the size of the public keys and signatures they produce as well as the computational efficiency of the key generation.

As of July 22, 2020, the NIST project to set a new quantum-secure cryptographic standard entered the third round of submissions,⁵¹ with only six proposals for digital signatures remaining. These are further split into three finalists and three alternative candidates. The finalists are the algorithms that have shown the most promise and are general purpose for the most part. Those in the alternative candidate track are considered either tailored to more specific applications or require more time to mature. Round three is predicted to take around eighteen months, though due to the ongoing global pandemic as of October 22, 2020, the schedule is much looser. Following the third round, NIST aims to continue the review process, allowing for some alternative candidates to be standardized at later date as well as giving considerations to ideas that were developed too recently to be included in the initial round in 2016.

From these, two front runners have emerged for the mathematical basis, which will replace our current systems: Multivariate and Lattice cryptography. See Table II for how these fall into the different categories.

Here, we will give a brief overview of both Multivariate- and Lattice-based cryptography, followed by a note on the other schemes.

Multivariate cryptography was developed in the late 1980s with the work of Imai and Matsumoto.⁵⁸ Originally named $C*$ cryptography after the first protocol, the name Multivariate Cryptography was adopted when the work of Patarin broke and then generalized the $C*$ protocol.⁵⁹ After Shor's now infamous algorithm was developed, it was realized that the structure of Multivariate Cryptography could be used as a direct response. For a more in-depth treatment of the subject, the reader may consult Bernstein.⁴⁴ or Wolf.⁶⁰ 

All the schemes are based on a hard problem that is relatively straightforward to understand (though several of the constructions extend the basic problem to more complex settings): the problem of solving multivariate quadratic equations over a finite field. That is, given a system of m polynomials in n variables,

and the vector $y=(y1,…,ym)∈Fm$⁠, find a solution $x∈F$ that satisfies the above equations. Formally, we say that for a finite field $F$ of size $q:=|F|$⁠, an instance of an $MQ(Fn,Fm)$-problem is a system of polynomial equations of the form,

where $1≤i≤m$ and $γijk,βij,αi∈F$⁠. These are collected in the polynomial vector $P:=(p1,…,pm)$⁠. Here, $MQ(Fn,Fm)$ denotes a family of vectorial functions $P:Fn→Fm$ of degree 2 over $F$⁠,

While theoretically the polynomials could be of any degree, there is a trade-off between security and efficiency. Higher degrees naturally have larger parameter spaces, but too low a degree would be too easy to solve and, therefore, would be deemed too insecure. Quadratics are chosen as a compromise between the two.

The final two pieces required for signatures are two affine maps, $S∈Aff−1(Fn)$ and $T∈Aff−1(Fm)$⁠. Both these can be represented in the usual way:

where $MS∈Fn×n, MT∈Fm×m$ are invertible matrices and $vS∈Fn, vT∈Fm$ are vectors.

For most multivariate signature schemes, the secret key is the triple $(S−1,P′−1,T−1)$⁠, where S and T are affine transforms and $P′$ is a polynomial vector [defined similar to Eq. (5)], known as the central equation. The choice of the shape of this equation is largely what distinguishes the different constructions in multivariate cryptography. The public key is then the following composition:

To forge the signature, one would have to solve the following problem: for a given $P∈MQ(Fn,Fm)$ and $r∈Fm$⁠, find, if any, $s∈Fn$ such that $P(r)=s$⁠. It was shown in the study by Lewis et al.⁶¹ that the decisional form of this problem is $NP$-hard, and it is believed to be intractable in the average case.⁶² 

We now formally outline the general scheme for signatures based on the Multivariate Quadratic problem:

1. Alice generates a key pair $(sk,pk)$⁠, where $sk=(S−1,P′−1,T−1)$ and $pk=P=S°P′°T$⁠, and then distributes $pk$⁠.

2. Alice then hashes the message, m, to some $c∈Fn$ using a known hash function and then computes

   $s=P−1(c)=T−1(P′−1(S−1(c))),$

   sending the pair $(m,s)$ to Bob.

3. Bob then needs to check that $P(s)=c=H(m)$ for the known hash function H.

See Fig. 3 for a diagram of how the signature schemes work. This forms the backbone of most multivariate schemes. Subsections III B 1–III B 3 examine several of the adaptations of this framework employed in various NIST submissions.

The oil and vinegar scheme was first introduced by Patarin,⁶³ but was broken by Kipnis et al.⁶⁴ and generalized to the now common Unbalanced Oil and Vinegar (UOV) protocol.

The Hidden Field Equation (HFE) protocol⁵⁹ is a generalization of one of the original multivariate systems, the Matsumoto–Imai scheme.⁵⁸ Similar to oil and vinegar, the underlying scheme was broken before the underlying trapdoor was generalized. However, unlike UOV, this scheme uses more than one field: the ground field $F$ and its nth-degree field extension $E$⁠, that is, $E:=F[t]/f(t)$⁠, where f(t) is an irreducible polynomial over $F$ of degree n.

The cryptanalysis of multivariate schemes comes in two forms:

These focus on taking advantage of the specific structural faults in the design on different protocols. Included among this are attacks on a form of Multivariate cryptography called MINRANK⁶⁶ and the hidden field equations.⁶⁷ 

Attacks directly try and break the underlying hardness assumption of solving multivariate equations. These include the use of techniques such as utilizing Gröbner bases to make the solving of the multivariate systems easier. For a good overview of the area, see the study by Billet and Ding.⁶⁸ 

Lattice cryptography was first introduced by the work of Ajtai⁶⁹ who suggested that it would be possible to base the security of cryptographic systems on the hardness of well-studied lattice problems. The familiarity of these problems made them an attractive candidate for post-quantum cryptography (PQC). This led to the development of the first lattice-based public-key encryption scheme—NTRU.⁷⁰ However, this was shown to be insecure and it would take the work of Regev to establish the first scheme whose security was proven under worst-case hardness assumptions.⁷¹ For an overview of the field of lattice cryptography, we direct the reader to Peikert.⁷² 

There is a whole suite of lattice problems on which cryptographic schemes are based. Here—following some basic definitions—we will introduce the key ideas that form the foundation of contemporary Lattice Cryptography.

We now move on to the hard lattice problems. First, we give a few of the fundamental hard problems, which form a foundation for the hard problems that contemporary lattice cryptography is built on.

Definition 20 [Shortest Vector Problem (SVP)]. Define $λ1(Λ)$ to be the length shortest nonzero vector in $Λ$⁠. The Shortest Vector Problem $(SVP)$ is that given a basis $B$ of a lattice $Λ$⁠, compute some $v∈Λ$ such that $||v||=λ1(Λ)$⁠.

Here, $λm(Λ)$ are the successive minima of the lattice, where each vector $||vi||=λi≤λj$ for $i<j$⁠, with $λ1(Λ)$ being the shortest vector in the lattice. The norm function $||·||$ is left intentionally unspecified though it is typically the Euclidean norm. This problem is regarded as hard in both classical and quantum settings, but it falters when applied to cryptographic schemes with some probabilistic element. It is more common to use the approximate analogue to the $SVP$⁠, which is as follows:

Definition 21 [Approximate Shortest Vector Problem. $SVPγ$⁠)] Given a basis $B$ of a lattice $Λ(B)$⁠, find a nonzero vector $v∈Λ$ such that $||v||≤γ(n)·λ1(Λ)$⁠.

We also make mention of bounded distance decoding (⁠$BDD$⁠) that asks the user to find the closest lattice vector to a prescribed target point $t∈Λ$⁠, which is promised to be “rather close” to the lattice.

Definition 22 [Bounded Distance Decoding (⁠$BDDγ$⁠)]. Given a basis $B$ of a full-rank lattice $Λ(B)$ and a target vector $t∈ℝn$ with a guarantee that $dist(t,Λ)<d=λ1(Λ)/(2γ(n))$⁠, find unique lattice vector $v∈Λ$ such that $||t−v||<d$⁠.

The above problems have varying degrees of provable hardness. The exact version of the shortest vector problem is known to be NP-hard (non-deterministic polynomial-time hardness) under randomized reductions;⁷⁸ however, the implementation of the hard problems such as bounded distance decoding relies on polynomial encoding, and so it is in the complexity class $NP∩co-NP$⁠.⁷⁹ Currently, there are no known quantum algorithms that solve any of the above problems in polynomial time, but there have been various attempts, see Sec. III C 5 for further details.

While the previous hard problems are fundamental to lattices, they are not easily implementable in lattice schemes. Here, we introduce the two problems that form the foundation for contemporary lattice cryptography: the short integer solution $(SIS)$⁶⁹ and learning with errors $(LWE)$⁠.⁷¹ 

Definition 23 [Short Integer Solution (⁠$SISn,qβ,m$⁠)]. Given m uniformally random vectors $ai∈ℤqn$ forming the columns of a matrix $A∈ℤqn×m$⁠, find a nonzero integer vector $z∈ℤm$ of norm $||z||≤β$ such that

$LWE$ is an average-case problem introduced by Regev, often referred to as the “encryption enabling” analogue of the SIS problem.

Definition 25 (⁠$LWE$ distribution). For a vector $z∈ℤqn$ called the secret, the $LWE$ distribution $Az,χ$ over $ℤqn×ℤq$ is sampled by choosing $a∈ℤqn$ uniformly at random, choosing $e←χ$⁠, and outputting $(a,b=⟨z,a⟩+e mod q)$⁠.

The problem comes in two distinct forms: decision and search. Decision requires distinguishing between $LWE$ samples and uniformly random ones, whereas search requires finding a secret given $LWE$ samples.

Definition 26 (Decision $LWEn,q,χ,m$⁠). Given m independent samples $(ai,bi)∈ℤqn×ℤq$ where every sample is distributed according to either,

1. $Az,χ$ for a uniformly random $z∈ℤqn$ (fixed for all samples).

2. The uniform distribution, distinguish which is the case.

Definition 27 (Search $LWEn,q,χ,m$⁠). Given m independent samples $(ai,bi)∈ℤqn×ℤq$ drawn from $Az,χ$ for a uniformly random $z∈ℤqn$⁠, find $z$⁠.

The learning with error problems has been shown to be at least as hard as quantumly solving $SVP$ on arbitrary n-dimensional lattices. The following security reduction can be shown following the proof from the study by Regev⁷¹:

Here, DGS stands for discrete Gaussian sampling. We note that the reduction between discrete Gaussian sampling and the $BDD$ problem is a quantum step.

As previously mentioned, it is possible to construct lattices from specific algebraic structures such as rings or modules,⁸⁰ when combined with the above problems, it is known as structured $LWE$ or structured $SIS$⁠. This is largely done for efficiency reasons as the parameter space needed to implement systems based on these structures is greatly reduced.⁷³ The choice of which structure is worth using has some nuances, however. For example, ring $LWE$ is generally considered to be more efficient than module $LWE$⁠; however, the efficiency comes at a cost of flexibility and security. Increasing the security of a scheme requires increasing the dimension of the lattice, which, in the ring case, is often chosen such that $N=n$⁠, where $n=2k$ for some integer k. Thus, going up a security level requires going from dimensions 512 to 1024, for instance, whereas a more optimal scheme may lie in-between these. Module $LWE$ has dimension parametrized by an integer d such that $N=dn$⁠, again for n of the form $2k$⁠. Setting d = 3 and n = 256 allows for a total dimension of 768, which may be preferable for the targeted level of security. Even further structures can be imbued, which may yet give greater flexibility: middle-product $LWE$⁸¹ and cyclic $LWE$⁠.⁸² The security of all these schemes based on the algebraic structure has been questioned however, as the reduction to standard LWE is not fully understood.^83–85 

All the lattice-based NIST submissions for signature schemes use some kind of structure: qTESLA and FALCON are based on rings (FALCON, however, uses a distinction between binary and ternary forms to capture the intermediate security levels), whereas Dilithium is based on module $LWE$⁠.

Introduced in the seminal paper of Gentry et al.,⁸⁶ the Gentry–Peikert–Vaikuntanathan (GPV) framework gives an overarching structure for taking advantage of “natural” trapdoors in lattices to obtain signatures. It is built on a signature scheme first introduced in Goldreich–Goldwasser–Halevi (GGH)⁸⁷ and NTRUsign⁸⁸ schemes:

• The public key is a full-rank matrix $A∈ℤqn×m$ generating a lattice $Λ$⁠. The private key is a matrix $B∈ℤqm×m$ generating $Λq⊥$⁠, the dual lattice of $Λ mod q$⁠.

• Given a message m, a signature is a short value $s∈ℤqm$ such that $sAT=H(m)=c$⁠, where $H:{0,1}*→ℤqn$ is a known hash function. Given $A$⁠, verifying $s$ as a valid signature is straightforward: check $s$ is short and that $sAT=c$⁠.

• Computing a signature requires more care, however:

  • Compute an arbitrary preimage $c0∈ℤqm$ such that $c0AT=c$⁠. $c0$ is not required to be short, and so it can be computed with relative ease.

  • Use $B$ to compute a vector $v∈Λq⊥$ close to $c0$⁠. Then, $s=c0−v$ is a valid signature,

    $sAT=c0AT−vAT=c−0=c.$

    (28)

    If $c0$ and $v$ are close enough, then $s$ will be short, fulfilling the second requirement of a valid signature.

The GGH and NTRUsign schemes, however, proved to be insecure as the method for computing vector $v∈Λ⊥$ leaked information about secret basis $B$ and have since been proven to be insecure by cryptanalysis.^89–91 The GPV framework (see Fig. 4 for a diagrammatic representation of this scheme) differs in that instead of the deterministic algorithm—Babai's roundoff algorithm—it uses Klein's algorithm,⁷⁵ a randomized variant of the nearest plane algorithm also developed by Babai.⁹² Whereas both deterministic algorithms would leak information about the geometry of the lattice, Klein's algorithm avoids this by sampling from a spherical Gaussian over the shifted lattice $c0+Λ$⁠.

Klein's algorithm was the first of a family of lattice algorithms known as trapdoor samplers. The GPV framework has become a generic framework into which a choice of trapdoor sampler and lattice structure can be inserted. It has also been proven to be secure under the assumptions of $SIS$ under the random oracle model.^86,93

A prudent example of an instantiation of the GPV framework is the NIST submission FALCON.⁹⁴ This uses a trapdoor sampler known as the Fast-Fourier-Sampler—developed by Prest and Ducas⁹⁵—over NTRU lattices that take advantage of the ring structure.

The Bai–Galbraith signature scheme⁹⁶ is an adaptation of an earlier work by Lyubashevesky⁹⁷ in which he develops a lattice-based signature scheme using a paradigm which he calls “Fiat–Shamir-with-aborts.” Informally, it follows the chain of reductions:

Here, CRHF stands for collision-resistant hash function. The main idea is that, from a lattice-based CRHF, one can create a one-time signature following Lyubashevsky and Micciancio;⁹⁸ however, this leaks information about the secret key. This would not be a problem for a one-time signature as the information becomes defunct after the usage. Constructing the ID scheme requires the repeated use of this, which is where the aborting technique comes in. In response to the challenge from the verifier, the prover can decide that sending the usual response would leak information and instead abort the protocol and restart it. The end result is a secure, if somewhat inefficient, ID scheme. Having to restart the protocol every time there is information leaked is done away with when adapting this to a signature scheme using Fiat–Shamir, however. The lack of interaction means that the prover can simply rerun the protocol until they find a signature, which does not leak information.

As an $LWE$ instantiation, Lyubashevesky's scheme has public key $(A,b=Az+e mod q)$⁠, where the components are picked as described above. The verifier picks small-normed vectors $y1, y2$ and computes $v=Ay1+y2$⁠. With the message m, they compute the hash $c:=H(v,m)$ and the following two vectors: $s1=y1+zc$ and $s1=y2+ec$⁠. The signature is then $s=(s1,s2,c)$⁠. Here, to ensure that neither $s1$ nor $s2$ leak information about the protocol, rejection sampling is employed. Developed in Refs. 99–101, this technique allows the vectors to be picked from a distribution independent of the secret. Verification requires checking that $||s1||$ and $||s2||$ are small enough and that $H(As1+s2−bc mod q,m)=c$⁠. This can be thought of as proof of knowledge of $(z,e)$⁠.

Bai and Galbraith adapted this such that it instead becomes proof of knowledge of only $z$ using a variation of the verification equation and compression techniques. Once the public key has been created, only one vector is required, $y$⁠, from which $v=Ay mod q$⁠. The least significant bits of $v$ are then thrown away, and the remainder is hashed with the message m to get a hash value c. From this value, the vector $c$ is created and the signature is $(s=y+zc,c)$⁠, with rejection sampling again being used to check that the distribution of $z$ is independent of the secret. Computing $w=As−bc≡Ay−ec mod q$ allows for verification by checking that the hash value of the most significant bits of $w$ with m is equal to c. See Fig. 5 for a schematic for the Bai–Galbraith signature scheme.

The NIST submission CRYSTALS-Dilithium is based on Bai–Galbraith signatures over module-$LWE$⁠.

Similar to the multivariate case, there is a breadth of literature on specific attacks, both quantum and classical, and suffice to say we will not be going into them in too much depth. Here, we give a brief summary of some of the avenues that have been attempted and references for readers to investigate. Similar to attacks on Multivariate Cryptographic schemes, these can largely be broken down into three categories: attacks on the underlying hard problems, attacks on specific schemes, and side-channel attacks (see Sec. III E for details of side-channel attacks).

The security of lattice cryptography can be largely reduced down to the shortest vector problem, and so the general motivation for these attacks is to solve the said problem. Schemes of this kind tend to come in two forms: algorithmic or sampling. Largely, the question to be answered is the following: given a random basis for a lattice, can one find the shortest vector? Or at least a small enough vector, satisfying the approximate $SVP$? On the algorithmic side, there are lattice reduction algorithms such as Schnorr¹⁰² or Lyu et al.,¹⁰³ which attempt to find almost-orthogonal bases from highly nonorthogonal bases. In a similar vein, quantum speed ups of vector enumeration have been proposed by Aono et al.¹⁰⁴ There are also search approaches such as the sieving algorithms¹⁰⁵ and their quantum counterparts.¹⁰⁶ Newer approaches, devised using adiabatic quantum computing, posing $SVP$ as an energy minimization problem as in the study by Joseph et al.^107,108 have also been developed. Similar to the use of sampling to generate small signatures, if a truly efficient discrete Gaussian sampler was developed, it could pose a major problem.^109,110 Simply setting the center of the distribution as the zero vector would allow the shortest vector to be picked with a high probability. There have also been suggestions that certain quantum algorithms could be used to pick vectors more efficiently from these distributions.

As mentioned previously, the $SVP$ can be shown to be equivalent to solving the Hidden Subgroup Problem for symmetric groups, which has also been the focus of much quantum cryptanalytic research.¹¹¹ 

For details on how individual schemes are taking known attacks into account, we refer the reader to the design documents: Dilithium¹¹² and FALCON.¹¹³ 

Here, we give a brief overview of the remaining two NIST submissions, Picnic and SPHINCS⁺, both of which are based on symmetric primitives.

Unlike the previously mentioned schemes, Picnic only requires the hardness provided by symmetric primitives such as hash functions and block ciphers.¹¹⁴ It is a general scheme for the adaptation of a three-move proof-of-knowledge scheme (known as $Σ$-protocols) to signature using a transformation from the study by Unruh.¹¹⁵ It is claimed by Unruh¹¹⁶ that the Fiat–Shamir paradigm for transforming proof-of-knowledge schemes into signatures is impractical to prove secure in the quantum random oracle model, and so Unruh provides an alternative. The Picnic protocol provides two signature schemes: one via Unruh and another using Fiat–Shamir.

Picnic is built upon a $Σ$-protocol called ZKB++,¹¹⁴ which itself is built on an earlier scheme called ZKBOO.¹¹⁷ For the sake of brevity, the details of Picnic and the underlying schemes are omitted, and instead, we will explain the underpinning framework by first explicitly defining $Σ$-protocols followed by Unruh's transformation.

SPHINCS⁺¹¹⁹ is based on an earlier protocol called SPHINCS.¹²⁰ This protocol is a hash-based, stateless signature scheme that had the goal of having the practical elements of other hash-based schemes and adding extra security by removing the stateful nature. A stateful algorithm depends in some way on a quantity called the state, which is initialized in some way. This is often a counter, though not necessarily, and stateful schemes can lead to many insecurities as they need to keep track of all produced signatures.

SPHINCS expands the idea of using a Merkle tree³⁰ to extend a one-time signature into a many-time signature scheme by creating a hypertree. In this tree of trees, leaves of the initial Merkle tree become the root one-time signatures for further trees, which themselves cascade into further trees. The size of the overall tree becomes a compromise between security and efficiency in the original scheme: which leaves are picked to become the next tree are chosen randomly, and so a smaller tree has a chance to repeat the leaf choice. In order to abate this, a few-times signature is used at the bottom of the tree. This randomness is what makes SPHINCS stateless. Whereas Merkle's original design iterates over the signing keys, SPHINCS builds on the theoretical work of Goldreich,¹²¹ in which the keys are picked randomly. The size of the hypertree allows the assumption that the new key has not been used before.

Improving on the previous design, SPHINCS⁺ uses a more secure few-time signature at the bottom of the tree, known as Forest of Random Subsets (FORS), an improvement on a previous signature called HORST.¹²⁰ A better selection algorithm for choosing the leaves of the tree is also included. It also introduces the idea of tweakable hash functions.

Here, we include references for cryptanalysis efforts of the above schemes. For Picnic, the recent attacks include a multiattack on the scheme and its underlying zero-knowledge protocols,¹²² and an attack on the block cipher used in implementation, LowMC.¹²³ Both these—as well as some side-channel attack analysis—are addressed in the design document.¹²⁴ 

Currently, the main attack against the SPHINCS framework is that of Castelnovi et al.^125,126 This is a type of side-channel attack known as a differential fault attack. In the design document,¹²⁷ general protection against this kind of attack—as well as other known general attacks—is addressed.

It would be remiss of this paper to give an overview of the state of contemporary cryptographic signatures—especially with regard to new standards—without a note on side-channel attacks. Side-channel attacks are cryptanalytic attacks that focus on finding flaws in the implementation of protocols rather than the design. Examples of this include timing attacks—where an adversary can gleam information about a secret from a protocol by taking advantage of a subroutine running in nonconstant time- and energy attacks—a similar process but instead requires examining the energy use of the protocols. This has led to some of the bigger breaks of security systems that have been employed (Ref. 128, p. 116). Unfortunately, in the case of Post-Quantum Cryptography, it is often a form of attack that has not been considered in as much depth as is potentially necessary and many of the submissions are missing a large-scale analysis of how they could be affected. Similar to the attacks previously mentioned, however, it is beyond the scope of this paper to go into a great amount of detail, and so instead, we provide a list of references for invested readers.

For a good overview of side-channel attacks in general, we refer the readers to the study by Fan et al.¹²⁹ or Lo'ai et al.¹³⁰ Beyond this, we direct the readers toward specific analysis of side channel attacks for certain NIST submissions.

There has been some work on general fault attacks on multivariate public key cryptosystems.¹³¹ Side-channel attacks on rainbow can be seen in the general attacks on unbalanced oil and vinegar schemes.^132–134 

Dilithium was attacked using a side-channel assisted existential forgery attack.¹³⁵ This was responded to with countermeasures suggested in the implementation that mask the protocol.¹³⁶ FALCON has recently been attacked using a protocol known as BEARZ.¹³⁷ The attacking party also suggested countermeasures to prevent this fault attack and timing attacks on FALCON.

For each submission, we also direct the readers to the respective design documents.^{52,112,113,124,127,138} Unfortunately, the level of details on each is not to an equal standard, with some severely lacking side-channel attack analysis.

When considering the performance of these different protocols, there are various angles to analyze them. At a top level view, one could compare a range of properties such as the key size, length of signatures, verification times, and signature creation times. NIST makes the point that these algorithms will be employed in a multitude of applications, each with different requirements. For example, if the applications can cache public keys or refrain from transmitting them frequently, then the size of the public key is not as important. Similarly, in terms of the computational efficiency, a server with high traffic spending a significant portion of its resources verifying client signatures will be more sensitive to slower key operations. The call for proposals⁴⁹ even suggests that it may be necessary to standardize more than one algorithm to meet the differing needs.

While the computational efficiency relies on the specific architecture used, the key and signature sizes can be compared theoretically. A comparison of the NIST schemes for these architectures can be found in Table III. Many of the submissions include data on several variants of their respective schemes, but we have only included a cut down list here. The variants—as well as the original data—can be found in the submissions themselves.^52–57 

The timings, however, do have a certain dependence on implementation and as such NIST has set out their requirements with respect to the NIST PQC reference platform:⁴⁹ an Intel ×64 running Windows or Linux and supporting the GCC compiler. A comparison of the performance of the timings of the schemes can be found in Table IV. Unless noted otherwise, the submissions used the reference architecture.

While progress in the field of quantum computing does pose a threat to our current digital security models and implementations of digital signature schemes, throughout this section, we have given a brief overview of the work being done to combat this direct threat. Working toward NIST's criteria for both security and efficiency ensures that sought-after solutions are implementable with current technology, well ahead of implementations of Shor's algorithm being practical. Where theoretical protocols have struggled to reach a compromise between security and efficiency, research has already yielded results to adapt, as shown by modifications of the UOV schemes and SPHINCS.

Indeed, this is the case in reality also, with Google implementing a lattice-based protocol in their Chrome web-browser (although this has since been removed in an effort to ‘not influence the standardization procedure’).¹³⁹ However, we remain wary of further threats presented. For example, that a solution to the HSP problem could cause issues for lattice cryptography showcases the need for research to continue remaining ahead of the curve.

The National Institute for Standards and Technology's goal of implementing a new standard is predicted to still be at least a year off completion, and so it is far from finalized. It is certainly likely that the recommendation will be several new standards depending on the application. While there is a notion of simplicity leading to security, some of the above schemes eschew this in favor of ruthless efficiency (albeit with the necessity for careful implementation), with some even claiming to be faster than current protocols. Ultimately, the advances in cryptography in response to quantum computing appear to be leading to altogether more complicated systems, but for the sake of security, this is certainly the right move.

The security of classical digital signatures lies in creating problems that are infeasible to solve. The security of techniques based on quantum physics instead relies upon proven scientific principles.¹⁴⁰ The uncertainty inherent in quantum physics has in recent years found great many uses in the field of security, ranging from random number generators to optical identity tags.¹⁴¹ This well-known phenomenon is what protects a system against attack, as in many cases, it is physically impossible for the attacker to breach the system without detection.

As with many classical digital signatures, quantum digital signatures rely upon a one-way function for their encryption. In this case, however, rather than using a mathematical one-way function, classical data are encoded as quantum information.¹⁴² In order to implement this, each quantum digital signature protocol follows three steps similar to those in classical cryptography:¹⁴³ 

1. GEN: Alice uses her private key to generate a signature s consisting of quantum information.

2. SIGN: Alice sends her message m to the recipients (denoted as Bob and Charlie) with the corresponding signature, denoted as (m, pk).

3. VER: Bob and Charlie verify that the message is authentic and repudiation has not occurred. In the general case, this involves a comparison of (m, s) to the classical description of s.

In order to delve further into what each step entails, we will discuss a generic QDS (quantum digital signature) model, although schemes will vary in their specific implementation of these steps that most follow this general framework.^142,143

The generation step begins with a purely classical operation, the random generation of a private key for each possible single bit message (1 or 0). This key, denoted as $pki=(pk1i,pk2i,…,pkLi)$⁠, is purely classical information, where i = 0, 1 to denote the message. Its length L is determined by the level of security required and the QDS scheme used. It is using this string that Alice will identify herself at a later stage, and so it is imperative that it is never shared.

The next stage of the generation step is done by first defining a set of nonorthogonal quantum states.¹⁴³ An example of quantum states that can be used is the BB84 states.¹⁴⁴ Alice then generates four separate strings of quantum information (known as quantum digital signatures) by encoding her pk strings using the defined quantum states. These four signatures consist of a copy of the encoded private key for both possible messages for both Bob and Charlie. These are denoted as $qsBi,qsCi$ with the subscripts denoting who the signature pairs will be sent to. Alice then sends $qsBi,qsCi$ to the correct recipient via a secure quantum channel. Bob and Charlie measure their quantum signature pairs to generate a classical signature from them, $sBi,sCi$⁠.

Before proceeding to the next step, in most cases, Bob and Charlie randomly select approximately half of the elements in their measured signature (though this can occur before the measurement) and forward to the other. They do not have to exchange the same elements. As such to all extents and purposes from Alice's perspective, both $sBi$ and $sCi$ are exactly the same. This prevents her from committing repudiation. The exact method of this “symmetrization” is dependent on the QDS scheme.

To sign a message in most protocols, Alice sends her message of a bit of 1 or 0 with the corresponding private key to Bob,¹⁴⁵ denoted as $(mi,pki)$⁠. As the protocols focus only on the signing of a message, it is assumed that the message is sent along a secure channel whether this is quantum or classical in nature.¹⁴³ To send a multibit message, the process of generation and signing is iterated for each bit.¹⁴⁶ 

Finally, there is the verification stage. This varies greatly between each protocol (see the relevant protocol section for specific details). The general case is that Bob compares his measured signature $sBi$ with the private key pkⁱ received from Alice. If the number of mismatches between the two is below the required threshold (see Sec. IV A 1), Bob deems the message as authentic. If Bob wishes to forward the message to Charlie, he sends $(mi,pki)$ he received from Alice. Charlie then performs the same process with a different required threshold.

The security of quantum digital signatures is shown most prominently in the validation step. Each of the signing protocols relies on the same principles to provide security.¹⁴³ It is key to this that the states chosen are nonorthogonal. Therefore, any measurement performed in one state will not commute with a measurement on the other.¹⁴⁰ Thus, any measurement performed will probabilistically disturb the other state, effectively destroying the information it held.¹⁴⁷ As such without knowing the initial private key, no one can discern the original classical input. Getting the correct result is entirely dependent on chance; even then, one would have no way to tell if it is the correct result.¹⁴² 

This is reinforced by the Holevo bound placed on the information that can be obtained, and only single bits worth of information may be extracted from a qubit.¹⁴⁸ This prevents further information to help the attacker's deductions from being obtained.¹⁴² If anyone attempted to forge a signature, they would have to guess the private key correctly based on the information they can gather. For short private keys, this is indeed improbable but still possible. As a signature gets longer, however, the chance of successfully guessing falls off exponentially to a negligible value for a long enough private key.^142,143 As such, a simple comparison will reveal their ruse.¹⁴⁹ Therefore, unlike classical digital signatures, QDS is not dependent on the difficulty of mathematical techniques and as such demonstrates information theoretical security.¹⁴⁰ 

There are three possible levels to the degree of verification that Bob and Charlie can deem the message/signature combination has fulfilled:¹⁴² 

• 1-ACC (accept): Message is valid and can be transferred.

• 0-ACC: Message is valid and might not be transferable.

• REJ (reject): Message is invalid.

1-ACC and 0-ACC provide similar levels of security in the standards they uphold, and both require that the message is valid. As such, if Bob performs the validation test on the signature and finds it to be true, then the first condition of these security levels is fulfilled. The difference arises in the transferability of the signature. If Bob has any reason to believe that Charlie would not come to the same conclusion as him, then the message and signature would be deemed 0-ACC (i.e., repudiation has occurred). Only a message with the validation level of 1-ACC is deemed fully secure. Finally, if the signature that Bob receives is invalid, then the message is given the validation level REJ and is rejected.

These criteria are mathematically defined by a series of thresholds proposed by Gottesman and Chuang.¹⁴² We first define the probability of failure of an attacker p_f, and this is the probability that their measurement will fail to get the correct classical description given a minimum error measurement. There is also the probability that an honest measurement will fail due to environmental factors such as noise, denoted as p_e. Both these thresholds are calculated based on outside factors such as the number of copies of the signature circulated, the method with which measurements are taken, the apparatus used to distribute/measure the signatures, etc. Using these as the boundaries for acceptable error levels, with p_f as the upper and p_e as the lower, the allowed error thresholds can be set.¹⁴² For a signature to be authenticated, it must have a fractional error lower than s_v, wherein p_f > s_v. Based on this, the upper bounds of the probability that the forger can effectively mimic a valid signature are given by $e−c(pf−sv)2L$⁠,¹⁴³ where c is a constant. This shows that the security against forging is dependent not only on the environmental factors (as p_e and p_f define the range in which s_v can fall) but also on the length of the signature itself.¹⁴³ 

One threshold is not enough to protect against repudiation as stated by Gottesman and Chuang.¹⁴² If Alice was dishonest and sent different signatures to Bob and Charlie (with the aim to have Bob accept and Charlie reject it), she could successfully repudiate with only one threshold. With only one threshold (s_v) for verifying the signature, Alice could tailor each signature to have $svL$ errors. The number of errors is defined by a normal distribution with a mean of $svL$⁠. As such, the probability of Bob accepting the message (errors below $svL$⁠) and Charlie rejecting it (errors above $svL$⁠) is 0.25.¹⁴³ By introducing a second threshold s_a, where s_v > s_a, Charlie must pass instead of s_v, which reduces the probability of successful repudiation to negligible with a long enough signature. This is due to the fact that Alice would have to generate a signature that would give a result both below s_v and above s_a. In a similar manner to forgery, the upper bound on the probability for successful repudiation is now defined by $e−c′(sa−sv)2L$⁠, where $c′$ is a constant.

This defines the necessary criteria for setting out mathematically how to achieve the verification conditions. To summarize the relative size of each of the thresholds, 0 $<pe<sa<sv<pf$⁠. In order to achieve a 1-ACC level of verification, a signature's error fraction must be below s_v for Bob and s_a for Charlie. Falling below only s_v would result in a 0-ACC rating, and falling below neither results in a REJ.

The first QDS protocol was proposed by Gottesman and Chuang in 2001¹⁴² and, hence, referred to as GC-QDS. As the precursor to all other QDS protocols as expected GC-QDS was only a theoretical proposal, however, it is important to analyze. It sets the standard for the “ideal” quantum digital signature protocol, one in which the signature remains as quantum information throughout the process. This ensures information theoretical security throughout.

As detailed in Sec. IV A, to begin with, Alice generates her random private keys, pkⁱ, for each possible message value. The initial proposal for this scheme suggested each private key element, $pkni$⁠, as a two bit string and $qsni$ the corresponding BB84 state.¹⁴² Using this, Alice generates copies of each quantum digital signature for each possible message value by encoding pkⁱ as quantum information. As many copies of the public key as there are, recipients are generated and one is distributed to each. The recipients, in this case Bob and Charlie, then do not measure the received signature and instead store it in stable quantum memory, a key difference to other protocols. This is the “generation” phase for this protocol.¹⁴² 

For the signing phase, Alice only sends out classical information. She sends to Bob $(mi,pki)$⁠. As with most QDS protocols, this is assumed to be performed over a secure classical channel, an assumption that can be inexpensively implemented and so is not outlandish to assume.

Finally, there is the verification phase. Using pk and the known function for encoding classical information as quantum information, Bob generates his own set of quantum states. He then compares the states that he has generated to those he has stored from Alice using a SWAP test.¹⁴² If the number of mismatches between the two falls below the acceptance threshold s_a, Bob accepts the message as authentic. For further verification, he can forward $(mi,pki)$ to Charlie who will repeat the process with his threshold s_v.

The unforgeability in this scheme stems from the strict policy of not measuring the quantum digital signature until authentication is required,¹⁴³ as demonstrated in Fig. 6. For an attacker to forge a signature, they would, as in classical digital signatures, have to bypass the one-way nature of the classical to quantum encoding. Aside from obtaining the private key from Alice, the only way to achieve this is to intercept the quantum digital signature and correctly guess the measurement basis for each qubit. Thus, as previously discussed, for a long enough signature, there is a negligible probability that Bob and Charlie will not notice that the signature has been tampered with.¹⁴⁹ Owing to the collapse of a quantum wavefunction upon measurement, the very act of attempting to intercept and forge a message will reveal that an attack has occurred as the signature remains only as quantum information. The only attack that can be achieved by interception is to cause the qs distribution phase to abort.¹⁴² 

The protection against repudiation lies with the comparative SWAP tests and relevant thresholds that Bob and Charlie apply to their stored public keys.¹⁴² As SWAP tests do not measure a quantum state and instead compare two to determine similarity, it makes them the perfect operation to enforce nonrepudiation. Coupling the nondestructive nature of the SWAP test with the thresholds detailed in Sec. IV A renders the probability of repudiation to negligible with a long enough signature.¹⁴² 

This scheme is not without faults; however, its most prominent fault is its reliance on the immature technology of quantum memory. If the technology were perfected, it would allow for the indefinite storage of qs. As of time of writing, however, quantum memory cannot store quantum information for long time periods.^150,151 In theory, this protocol can have long-term quantum digital signatures, but in practice, this is simply not possible. Although there have been recent advancements in the storage times of quantum memories, this protocol is currently infeasible.^145,152

The SWAP tests themselves are an issue within the same vein as quantum memory, and the technology to perform them is not available. Each recipient would require a quantum computer in order to perform such a test. As with the quantum memory requirement, this ensures that Gottesman and Chuang's theoretical proposal remains theory.

The attractive concept of quantum digital signatures coupled with the initial proposal's reliance on quantum memory and computing leads to a great deal of interest in QDS from both a theoretical and experimental standpoint.¹⁴⁰ The reliance on currently immature quantum technologies has led to new proposals that find methods of getting around this constraint. One of the earliest proposals was that of the multiport.¹⁵³ This apparatus consists of a square array of four separate 50:50 beam splitters as shown in Sec. IV C.¹⁴⁹ The apparatus and its potential in cryptography were first proposed in 2006¹⁴⁷ but only as a theoretical method of public key distribution. Later, in 2012, it was adapted for use in quantum digital signatures and experimentally demonstrated.

For use in quantum digital signatures, the multiport is effectively split into two; the top two beam splitters belong to Bob and the bottom two to Charlie. The multiport in of itself primarily affects the generation stage of the quantum digital signature process.

The generation stage begins the same as other QDS schemes. Alice generates a randomized classical private key which she encodes with her chosen quantum basis. She then sends these to Bob and Charlie. She sends the copies of each quantum digital signature at the same time (i.e., $qsB1$ and $qsC1$ are sent out at the same time and then the other set of copies is sent).

The first set of beam splitters (moving from left to right in Fig. 7) is used by Bob and Charlie to split their copies of the signature into two equal amplitude components. One half of these is kept by Bob/Charlie, and the other half is sent to the other recipient. This ensures that Alice is unaware as to who has which bit in each of the copies that she initially sent.^149,151 In the second set of beam splitters, the half that was originally kept by the receiver is mixed with the half from the other recipient in a comparison test. The process of this is detailed in Fig. 8.

In the initial implementation of this protocol, Bob and Charlie would store the received states in quantum memory ready for the verification stage. In 2014, Dunjko showed that it was indeed possible to remove the quantum memory from this protocol.¹⁴⁹ Progressing instead to verification via comparison of classical data, the latter will be the focus of this section.

Rather than storing the quantum digital signature, the incoming signature is measured and the outputs of this measurement are stored. This classical string of results then forms an individual's measured signature. Most commonly, the measurements performed are quantum state elimination measurements (covered in further detail in Sec. IV D); however, unambiguous state discrimination was initially proposed.¹⁵¹ The key principle of either method is that it does not give a completely accurate description of Alice's initial private key. Thus, it does not enable a recipient to then forge a signature. The measurement and storage of this now classical signature complete the generation stage of the protocol.

To sign a message, Alice simply sends her single bit message alongside the relevant private key to Bob.¹⁵¹ Bob then compares the private key with the signature he measured, applying the s_a threshold detailed in Sec. IV A 1 to determine the degree to which he trusts it. He then forwards the key and message to Charlie to validate that Alice indeed sent them both the same signature, and similarly, Charlie compares the two to see if the errors between them fall below s_v. From these results, they determine the level of validity in the message and signature.

The security of this protocol lies with the square array of beam splitters.¹⁵³ It is the secondary beam splitters that Bob and Charlie use to check the validity of the signature. One output of the beam splitters will be a mixed state of $|α⟩$ and $|β⟩$⁠. If Alice was honest, then $|α⟩=|β⟩$⁠, and as both are identical and coherent, the initial input from Alice is obtained. If, however, Alice sent Bob and Charlie different signatures, the multiport will symmetrize these and prevent repudiation.¹⁵³ The null ports then act as a safeguard against active forging.¹⁵¹ In this scenario, Bob is the dishonest party and attempts to forward a forged signature and message to Charlie. In this case, Charlie would measure a nonzero (assuming no background count) reading on his null port, informing him to the presence of a forged signature.

One of the key issues with this scheme is the loss present in this system, measured at 7.5 dB. The signature length L required for a security level of 0.01 $%$ was $5.0×1013$ for a half bit.¹⁵¹ The count rate with USE was found to be $2.0×105$ counts per second. Given that this would yield a time required of 7.9 years to sign and send, this is clearly an impractical signature length. This is particularly troublesome when one considers this was not taken at a separation distance, 5m, great enough for use in a practical setting.¹⁵¹ Methods of improving upon this technique were proposed such as increasing the clock rate of the VCSEL used to generate the pulses. Due to the loss rates and impractical distance requirements, however, using multiports in quantum digital signatures serves only as a proof of concept for not requiring advanced quantum technologies.

The development of quantum digital signature schemes shows common themes, the reliance on quantum mechanics to achieve information theoretical security, and moving away from the reliance on immature quantum technologies. Multiports, while flawed, demonstrated that quantum memory and quantum computing is not necessary for QDS. The next clear step, as stated in the paper implementing multiports, is to develop a system that does not use them for security.¹⁵¹ The simplest way to achieve this is random forwarding.

As with all previous schemes, Alice begins by generating a string of classical bits that she keeps as her private key. She then encodes this in quantum states using nonorthogonal bases.¹⁵⁴ Once again, two copies of each quantum digital signature are created and the copies of the same signature are sent to Bob and Charlie at the same time (arrows 1 and 2 in Fig. 9).

Unique to this protocol is that upon receiving the quantum digital signature, Bob and Charlie randomly choose elements of the signature qsⁱ to forward to the other, usually by a “coin toss” protocol,^145,154 arrow 3 in Fig. 9. They then record the location in the string of those that were passed on and which elements were retained. If either receive less than $L(12−r)$ or more than $L(12+r)$⁠, where r is a threshold the two of them set, they abort.¹⁵⁴ Thus, Bob and Charlie's final quantum digital signature will be a randomized mix, whose contents are defined only by the coin toss performed to dictate whether to keep an element. From the view point of Alice, therefore, once she has sent the messages, the reduced density matrices for Bob's and Charlie's quantum digital signature elements are identical, regardless of whether or not she tried to commit repudiation.¹⁵⁴ 

Bob and Charlie then measure their quantum signature copies to get their measured classical signature sⁱ. This is known as the pre-measurement approach.¹⁵⁴ Alternatively, Bob and Charlie can measure the quantum digital signature elements before forwarding in a postmeasurement approach. In this case, there is no need for a quantum communication channel between them, reducing the system to only having the quantum channels between them and Alice. In either scheme, the technique of USE (Unambiguous State Elimination) is commonly used to measure qs.¹⁴⁵ Whichever approach is applied, the random forwarding scheme is secure against forgery committed both by Bob and Charlie. In order to convince the other that a forged signature is valid, they would need to correctly guess the measurement results of the half of the others signature that they did not receive. For a long enough signature, the probability of this occurring is negligible.

To sign a message, Alice simply sends her private key concatenated with the message to Bob (arrow 4 in Fig. 9). Bob verifies the authenticity of the signature by comparing how many signature elements he correctly eliminated. If the error in this falls below s_a, then the message is deemed authentic and he passes it along with the key to Charlie, thus protecting against the possibility of an outside attacker forging a signature. Charlie performs the same comparison with his stored classical signature and his error threshold s_v. If it passes this, then the message is deemed valid. Repudiation has not occurred due to the symmetrized signatures and Bob has not committed a forgery as Charlie's signature has successfully been compared with Alice's.

The benefits of random forwarding are apparent in the reduced dependence on quantum technologies. Stripping back QDS protocols so, one is only using Quantum Key Distribution (QKD) to handle quantum information, which is far more practical than quantum memory or a multiport.^145,155 The technology is more mature and has undergone a rigorous amount of field testing, thus allowing for easier integration of QDS into existing networks. In addition, using QKD-based quantum communication adds, in exactly the same manner for QKD, protection against message interception. Although this scheme would result in the sacrifice of some bits for Alice and Bob to compare, it would remove the risk of outside interception,¹⁵⁶ giving the random forwarding protocol a wide range of applications and versatility. As such, many other schemes build on the primitive of random forwarding, either by developing more advanced hardware and measurement techniques¹⁵⁷ or using it as the primitive for symmetrization in schemes such as QKD-based schemes proposed by Collins et al.,¹⁵⁵ detailed in Sec. IV E.

Quantum cryptography as a field did not begin with the development of QDS, but instead with a far more developed technique, it is known as Quantum Key Distribution. This is a process by which, through the exchange of quantum information, Alice and Bob can generate a secret key for use in encrypted communication. By observing the error rates that occur in the measurement of the quantum information, it is possible to detect if an eavesdropper is present.¹⁴⁰ Through this it can be confirmed if the exchanged key is indeed completely secret. If so, by using a one-time pad protocol, Alice and Bob can achieve completely secure encryption. This in itself could be used to generate a digital signature.^154,156 As Alice and Bob would know that the signature could only be known by one of them, it would act as an identifier.

This principle in itself, however, is not of particular use. First, it does not allow for more than one recipient, a major drawback for a signing scheme. Second, it was shown that schemes based on partial QKD protocols could be expanded to multiple recipients and were more efficient in signing than secret key exchange via QKD.¹⁵⁶ 

The Quantum Key Distribution Key Generation Protocol (QKD KGP) differs from other quantum digital signature schemes in how the quantum information is distributed. It does, however, still follow the usual three-step process of generation, signing, and verification.

In the generation step, rather than Alice sending quantum information to Bob and Charlie, they send it to Alice.¹⁵⁵ This is done to simplify security analysis as it means that Alice cannot send out entangled states. As with Alice, in other schemes, Bob and Charlie first generate their own individual random classical private key for both possible message values (⁠$pkB0, pkB1$ and $pkC0, pkC1$⁠), recording the basis that each element was encoded in. They encode this as quantum information using the chosen method (both BB84 states and phase encoding have been used^155,156,158) thus forming two sets of separate quantum digital signatures $qsB0, qsB1$ and $qsC0, qsC1$⁠.

Bob (Charlie) then performs a partial QKD protocol with Alice.¹⁵⁶ He sends his quantum digital signatures to her, and Alice chooses a random basis, based on the encoding method used, to measure each element, resulting in Alice having two strings of classical elements from Bob (Charlie), $sB0$ and $sB1$ (⁠$sC0$ and $sC1$⁠). Bob (Charlie) then announces which basis each element was encoded in for each qs over a classical channel to Alice, who then “sifts” her signatures by discarding any that were not measured in the same basis. Bob (Charlie) discards the corresponding elements of his private key. Two further sections of the measured signatures and corresponding private keys are then sacrificed.^156,158 At first, Alice and Bob (Charlie) determine the hamming distance between corresponding sections of their signature and private key. If they are sufficiently correlated (they need not be exactly the same), the process proceeds and those sections are discarded. Second, Alice and Bob (Charlie) compare corresponding sections in order to observe if the error that an eavesdropper who induces in the measurements is present. If not, these sections are discarded and the process continues. Each test is performed over a classical channel, and if either of these steps is not successful, the process repeats.

Alice will now have four sets of signatures, $sB0, sB1, sC0$⁠, and $sC1$⁠. As the error correction usually present in QKD protocols has not been performed, these measured signatures will not exactly match their private key counterparts. Bob and Charlie then randomly select half of their private keys and forward them on to the other over a secret classical channel. To all extents and purposes from the perspective of Alice, each of these keys is identical, as she does not know what has been forwarded.¹⁵⁵ 

To send a message, Alice then sends to Bob $(mi,sBi,sCi)$⁠. To verify the authenticity of this, Bob compares $sBi$ with his corresponding private key $pkBi$ and $sCi$ with the half that he received from Charlie. If the fraction of mismatches in both is less than s_a, then he deems them authentic. For further verification, he can forward $(mi,sBi,sCi)$ to Charlie who will repeat the process with s_v as his threshold.

The security of this scheme relies on the already proven security of QKD while adapting that pre-existing technology for use as a quantum digital signature.¹⁵⁶ The key difference to other QDS schemes, that of two different quantum signatures for each message, improves the efficiency of the scheme over other QDS schemes and secret key sharing via QKD. Neither Bob nor Charlie can be dishonest and attempt to forge as they do not know the half of the other's private key that was not sent. This is opposed to other QDS schemes wherein a forger has access to the whole of the QDS. The different private keys remove the risk of colluding forgers who, in other schemes, would have had a copy of the QDS each to try and determine the correct measurement values from it. The only option for a forger is to eavesdrop, which can be determined from the sacrificed bits. as Also, with this, Alice cannot commit repudiation as she does not know who has which private key elements. Finally, this scheme's lack of the need for error correction and privacy amplification as in a full QKD protocol means that it is more tolerant to noise. As such, it can be implemented in QKD-based systems and used in a wider variety of scenarios.

The protocols detailed in this report have all focused on signing a single bit of data. The message is encoded into the quantum digital signature by having a signature for both possible message values. As of now, there is not a great calling to analyze multibit messages as the focus is on producing a practical single bit protocol. It is proposed that single bit signing protocols are expanded in a simple manner to sign a message of many bits.¹⁵⁹ For each bit in the message as a whole, the signing process is iterated. Multiple different signature pairs would be sent to Bob and Charlie. When Alice sends her multibit message, she would send each bit with a valid private key string. Nonetheless, some papers have, however, raised concerns over this, citing that insufficient research has been performed in this area.¹⁴⁶ As such, simply iterating the process may weaken the security of the protocol and not even be the most efficient way to sign the message.

The potential issues surrounding iterating a protocol were first raised by Wang et al.¹⁴⁶ in which a multibit signing scheme was proposed that “tagged” the ends of a message. This was later returned to and improved upon.¹⁶⁰ This work gained attention from other research groups who also saw an issue in single bit iteration. Techniques such as ghost imaging,¹⁵⁹ quantum but commitment,¹⁶¹ and adaptations of Wang's initial technique¹⁶² have been proposed.

The argument for defining how a protocol handles messages longer than a single bit in length arises as the whole multibit message itself is not encoded anywhere in the signature. Only the value of a single bit is encoded. In a classical signature, this is the case and allows for the checking of message integrity. A demonstration of the issues of simply iterating a QDS protocol is that of selective attacks. Defining a message as a series of iterated single bits with corresponding private key strings such that the pair received by Bob (⁠$M,PKM$⁠) can be broken down as:¹⁴⁶ 

where m and pk represent the individual bit components of the multibit message and their corresponding private key strings, respectively. The corresponding set of quantum signature strings is, therefore, denoted by