2024-07-18 | Jung Hee Cheon, Hyeongmin Choe, Julien Devevey, Tim Güneysu, Dongyeon Hong, Markus Krausz, Georg Land, Marc Möller, Damien Stehle, MinJune Yi
HAETAE (Hyperball bimodAI modulE rejection signAture schemE) is a new lattice-based digital signature scheme designed to balance security and practicality, particularly for space-limited applications such as IoT devices. The scheme is based on the Fiat-Shamir with Aborts paradigm, similar to the NIST-selected Dilithium signature scheme, but with a focus on reducing signature and verification key sizes. HAETAE achieves up to 39% and 25% smaller signature and key sizes, respectively, compared to Dilithium, while maintaining high security levels. The design includes a bimodal distribution for rejection sampling and uniform distributions over hyperballs, which allows for efficient implementation and protection against side-channel attacks. The scheme is optimized for constant-time execution and includes portable, constant-time reference implementations, as well as optimized versions using AVX2 instructions and reduced stack size for the Cortex-M4 microcontroller. The paper also discusses the use of fixed-point arithmetic to simplify the key generation and signing algorithms, and provides a detailed specification and analysis of the scheme's security and performance.HAETAE (Hyperball bimodAI modulE rejection signAture schemE) is a new lattice-based digital signature scheme designed to balance security and practicality, particularly for space-limited applications such as IoT devices. The scheme is based on the Fiat-Shamir with Aborts paradigm, similar to the NIST-selected Dilithium signature scheme, but with a focus on reducing signature and verification key sizes. HAETAE achieves up to 39% and 25% smaller signature and key sizes, respectively, compared to Dilithium, while maintaining high security levels. The design includes a bimodal distribution for rejection sampling and uniform distributions over hyperballs, which allows for efficient implementation and protection against side-channel attacks. The scheme is optimized for constant-time execution and includes portable, constant-time reference implementations, as well as optimized versions using AVX2 instructions and reduced stack size for the Cortex-M4 microcontroller. The paper also discusses the use of fixed-point arithmetic to simplify the key generation and signing algorithms, and provides a detailed specification and analysis of the scheme's security and performance.