MIRANDA: short signatures from a leakage-free full-domain-hash scheme

2025-10-08

AI Summary

Addressing the challenges of trapdoor information leakage and implementation complexity in code-based full-domain hash (FDH) signatures, this paper proposes MIRANDA—the first matrix-code-based FDH signature scheme conforming to the GPV paradigm. MIRANDA constructs decodable subcodes from Gabidulin codes and employs uniform bit sampling together with uniquely decodable parameter settings to realize a leakage-free signing mechanism that avoids rejection sampling. It adopts a compact, generic trapdoor structure enabling short signatures without revealing the underlying trapdoor. Under the assumption of 128-bit classical security, signatures are only 90 bytes, and public keys are approximately 2.6 MB. The scheme achieves strong security—proven in the random oracle model under the hardness of the Rank Syndrome Decoding problem—while offering exceptional compactness and practical efficiency. MIRANDA thus bridges theoretical rigor and real-world deployability for post-quantum digital signatures.

Technology Category

• Machine Learning: Quantum Machine Learning
• Game Theory and Economic Paradigms: Mechanism Design
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust

Application Category

• Security and Privacy: Applications of cryptography
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs

Abstract

We present $mathsf{Miranda}$, the first family of full-domain-hash signatures based on matrix codes. This signature scheme fulfils the paradigm of Gentry, Peikert and Vaikuntanathan ($mathsf{GPV}$), which gives strong security guarantees. Our trapdoor is very simple and generic: if we propose it with matrix codes, it can actually be instantiated in many other ways since it only involves a subcode of a decodable code (or lattice) in a unique decoding regime of parameters. Though $mathsf{Miranda}$ signing algorithm relies on a decoding task where there is exactly one solution, there are many possible signatures given a message to sign and we ensure that signatures are not leaking information on their underlying trapdoor by means of a very simple procedure involving the drawing of a small number of uniform bits. In particular $mathsf{Miranda}$ does not use a rejection sampling procedure which makes its implementation a very simple task contrary to other $mathsf{GPV}$-like signatures schemes such as $mathsf{Falcon}$ or even $mathsf{Wave}$. We instantiate $mathsf{Miranda}$ with the famous family of Gabidulin codes represented as spaces of matrices and we study thoroughly its security (in the EUF-CMA security model). For~$128$ bits of classical security, the signature sizes are as low as~$90$ bytes and the public key sizes are in the order of~$2.6$ megabytes.

Problem

• Designing short signatures using matrix codes without leakage
• Developing a simple trapdoor mechanism for GPV signature paradigm
• Ensuring signature security without complex rejection sampling procedures

Innovation

• Uses matrix codes for full-domain-hash signatures
• Employs simple trapdoor from decodable subcodes
• Avoids rejection sampling with uniform bit drawing