\addauthor

[orcid = 0000-0002-8959-636X, inst = 1, email = ramses.fernandez@fairgate.io, surname = Fernandez, ]Ramses Fernandez \addaffiliation[country = ]Fairgate Labs

Withdrawability in Fiat–Shamir with aborts constructions

Abstract

This article presents an extension of the work performed by Liu, Baek and Susilo [liu2023] on withdrawable signatures to the Fiat–Shamir with aborts paradigm. We introduce an abstract construction, and provide security proofs for this proposal. As an instantiation, we provide a concrete withdrawable signature scheme based on a no-hint, full- $\mathbf{t}$ Dilithium-style Fiat–Shamir-with-aborts construction [ducas2017]; adapting to production ML-DSA (with hints) introduces a small $\varepsilon_{\mathrm{zk}}$ term.

keywords:

[Withdrawability, Digital signatures, Module Learning with Errors]Withdrawability, Digital signatures, Module Learning with Errors @@@

1 Introduction

Digital signatures serve as a fundamental cryptographic mechanism that enables entities to bind their identities to pieces of information. The essential purpose of a digital signature is to allow a signer, who has established a public key $pk$ , to sign messages using their private key $sk$ in a way that enables anyone knowing $pk$ to verify both the message’s origin and its integrity during transit.

An important paradigm for the creation of digital signatures is the Fiat–Shamir transform, which converts interactive identification protocols into non-interactive digital signature schemes. Starting with a three-move identification protocol, where a prover demonstrates knowledge to a verifier through commitment, challenge, and response steps, the transform replaces the verifier’s random challenge with a hash function applied to both the commitment and the message. This creates a digital signature scheme where the signing algorithm computes a commitment, generates a challenge by hashing the commitment with the message, and produces a response using the secret key.

The Schnorr signature scheme is perhaps the most well-known application of the Fiat–Shamir transform, which has gained particular attention due to its security characteristics and its valuable properties, such as signature aggregation. These advantages make Schnorr signatures especially attractive for blockchain applications where transaction size reduction and privacy enhancement are crucial considerations.

The impact of digital signatures is particularly important in blockchain technology, where this primitive extends beyond basic transaction authentication, enabling sophisticated smart contract interactions, multi-signature schemes for enhanced security, and threshold signature systems for distributed key management. Furthermore, innovations in signature aggregation and batch verification techniques have contributed significantly to blockchain scalability solutions.

Current public-key cryptographic algorithms serve as the foundation for protecting sensitive electronic information from unauthorized access. These algorithms have successfully withstood attacks from conventional computing systems for decades, due to the hardness of their underlying mathematical problems, prime factorization and the computation of discrete logarithms. However, the emergence of quantum computing presents a significant challenge to this security paradigm, as Shor’s algorithm demonstrates the potential to solve both the prime factorization and the computation of discrete logarithms efficiently. This means that quantum computers possess computational capabilities that could potentially compromise current cryptographic methods, exposing vulnerable data and information.

To address this impending challenge, new cryptographic approaches are being designed to withstand attacks from both traditional computers and future quantum systems. These methods rely on problems, such as lattices, error-correcting codes or isogenies of elliptic curves, which have enhanced mathematical structure, leading to computational problems assumed to be hard both for classical and quantum computers. This framework is known as post-quantum cryptography, which represents a critical advancement in information security, ensuring that digital assets remain protected against evolving technological threats.

The Fiat–Shamir transform can be extended to lattices, leading to the Fiat–Shamir with aborts paradigm due to Lyubashevsky [lyubashevsky2009]. Fiat–Shamir with aborts provides a framework for constructing digital signature schemes with provable security. This methodology addresses the challenge of generating signatures from lattice-based one-way functions by introducing a controlled rejection sampling technique, aborting. When a potential signature might reveal information about the secret key, the signing algorithm simply aborts and restarts the process. This paradigm converts an interactive identification protocol with a non-negligible probability of aborting into a signature scheme through iterative execution until a successful completion occurs, the aborting procedure. This transformation eliminates the need for interaction by substituting the verifier’s challenge with a hash function evaluation, which security analyses treat as a random oracle.

Amongst the main constructions based on the Fiat–Shamir with aborts mechanism, we find Dilithium [ducas2017] and HAETAE [cheon2024]. Dilithium derives its security from the difficulty of solving certain lattice problems, specifically the Module Learning with Errors and Module Short Integer Solution problems. The importance of the scheme comes from the effective balance between security, signature size, and computational efficiency, making it practical for real-world implementations. HAETAE has been specifically designed to produce more compact and efficiently maskable signatures. While built upon the Fiat–Shamir with aborts paradigm underpinning Dilithium, HAETAE introduces design choices that optimize the complexity-to-compactness ratio, which is particularly important in space-constrained implementation scenarios.

Digital signatures are designed to provide authenticity, integrity, and non-repudiation for signed messages. Once a signature is created, it remains valid indefinitely, and the signer cannot rescind it. This permanence, while typically considered a feature, raises an important question: is it possible for signers to efficiently revoke their signatures without compromising their private keys or affecting the validity of their other signatures? Liu, Baek, and Susilo address this challenge by introducing the concept of withdrawable signatures [liu2023], offering a practical and secure mechanism for signature revocation in situations where this capability is desirable.

The practical applications of withdrawable signatures span multiple domains where signature revocation capability is essential without compromising the signer’s private key. In blockchain-based smart contracts, these signatures enable participants to commit to contract conditions while maintaining the ability to revoke their commitment, particularly valuable when contract fulfillment depends on multiple parties or external conditions. Within decentralized e-voting systems, withdrawable signatures provide voters the security to cast their votes while retaining the flexibility to modify their choices before final vote tabulation, allowing voters to respond to new information or developments during the voting period. Additionally, in decentralized escrow services, these signatures facilitate multi-party transactions by allowing participants to revoke their signatures if circumstances change or disputes arise, without compromising the security of other parties’ signatures.

1.1 Contributions

This paper builds upon the research conducted by Liu, Baek, and Susilo on withdrawable signatures [liu2023] to present a general methodology for constructing post-quantum withdrawable signatures based on Lyubashevsky’s Fiat–Shamir with aborts paradigm [lyubashevsky2009].

The work first introduces a comprehensive abstract construction that takes a mechanism based on the Fiat–Shamir with aborts paradigm as its starting point and extends it to incorporate withdrawability features. To demonstrate the practical applications of this abstract framework, the paper presents a concrete withdrawable construction from a no-hint, full- $\mathbf{t}$ Dilithium-style variant [ducas2017]; the no-hint variant keeps the naHVZK proof exact (perfect, $\varepsilon_{\mathrm{zk}}=0$ ), whereas production ML-DSA requires handling hints and incurs a small $\varepsilon_{\mathrm{zk}}$ .

The integration of withdrawability features with post-quantum cryptography addresses two crucial challenges in modern cryptographic systems. First, it provides the flexibility to revoke signatures when needed, a capability increasingly important in dynamic digital environments. Second, it ensures this functionality remains secure against quantum computing threats.

1.2 Related work

The research in this paper revolves around three gravity centres, namely: the work done by Lyubashevsky, the construction of Liu, Baek and Susilo, and the digital scheme Dilithium.

The Fiat–Shamir heuristic [fiat2000] provides a method for transforming public-coin interactive proof systems into digital signatures. This transformation works by substituting the verifier’s public coin tosses with hash function evaluations. In the random oracle model (ROM), these hash functions are treated as uniform functions that adversaries can access through classical computing methods.

Schnorr’s signature scheme stands as a prominent implementation of the Fiat–Shamir heuristic, with its security fundamentally based on the discrete logarithm problem. However, the emergence of quantum computing necessitates two critical adaptations to this framework. First, the discrete logarithm hardness assumption must be replaced with quantum-resistant alternatives. Second, the security model must account for quantum access to the random oracle (QROM), as quantum adversaries can query the hash function in superposition.

Lyubashevsky’s work [lyubashevsky2009] introduced an innovative lattice-based signature scheme that builds upon Schnorr’s design while incorporating abortion as a crucial modification. The abort mechanism ensures that the signature distribution remains independent of the signing key, preventing potential attacks against the signature scheme. The protocol manages these aborts through a loop structure, continuing iterations until a successful execution occurs without an abort.

This modified approach, known as Fiat–Shamir with aborts, maintains the fundamental concept of replacing non-final verifier steps with hash function evaluations while adapting to the requirements of lattice-based cryptography. The integration of the abort mechanism represents a significant advancement in developing quantum-resistant signature schemes, providing a robust framework for cryptographic security in the post-quantum era.

On the other hand, Liu, Baek and Susilo propose a designated-verifier signature scheme that introduces withdrawability to digital signatures. Their construction generates a withdrawable signature $\sigma$ for a message $\mu$ , distinct from conventional signature schemes.

The scheme’s construction centers on a transformation mechanism. When a signer generates a withdrawable signature, it remains verifiable only by the designated verifier. The signature can then follow two paths: it either remains in its withdrawable state through signer inaction, effectively withdrawing the signature, or undergoes transformation through a “Confirm” algorithm. This algorithm converts the withdrawable signature $\sigma$ into a confirmed signature $\tilde{\sigma}$ , which becomes verifiable through both parties’ public keys while maintaining a deterministic relationship to $\sigma$ .

The formal construction involves two entities, signer and verifier, with their public keys comprising a set $\pi=\{pk_{s},pk_{v}\}$ , respectively. The scheme utilizes the underlying signature structure to construct a withdrawable signature $\sigma$ specifically designated for the verifier. Subsequently, using the secret key $sk_{s}$ and $\sigma$ , the signer can generate a verifiable signature for $\mu$ through the public key set $\pi$ . This confirmed signature $\tilde{\sigma}$ maintains a cryptographic link to the original withdrawable signature $\sigma$ via the public key set $\pi$ , ensuring the signature transformation’s verifiability and traceability.

Finally, we find Dilithium [ducas2017], which builds upon the Fiat–Shamir with aborts paradigm. The scheme operates over module lattices, specifically using the module learning with errors (MLWE) and the module short integer solution (MSIS) problems as its primary security foundations. Its construction employs a ring $R_{q}=\mathbb{Z}_{q}[x]/(x^{n}+1)$ with carefully chosen parameters $n$ and $q$ . The signature scheme utilizes matrices and vectors over this ring, with dimensions selected to balance security and efficiency.

The key generation in Dilithium produces a public key containing a matrix $\mathbf{A}\in R_{q}^{k\times l}$ and a vector $\mathbf{t}=\mathbf{A}\mathbf{s}_{1}+\mathbf{s}_{2}$ , where $\mathbf{s}_{1}$ and $\mathbf{s}_{2}$ are secret vectors with small coefficients. The signing process involves generating a masking vector $\mathbf{y}$ , computing $\mathbf{w}=\mathbf{A}\mathbf{y}$ , and using a challenge value $c$ derived from the message and $\mathbf{w}$ to produce the signature. The scheme incorporates rejection sampling to ensure signature security, leading to probabilistic signature generation.

2 Preliminaries

2.1 Notation

We write $R$ and $R_{q}$ to denote the rings $\mathbb{Z}[x]/(x^{n}+1)$ and $\mathbb{Z}_{q}[x]/(x^{n}+1)$ respectively, where $q$ is an integer. We will denote vectors by bold letters, and regular font letters denote elements in $R$ or $R_{q}$ . Unless otherwise specified, all vectors are assumed to be column vectors. Bold upper-case letters denote matrices.

If $S$ is a set, then $a\xleftarrow{\mathdollar}S$ means that $a$ is chosen uniformly at random from $S$ . All logarithms are assumed to be base $2$ , and the hash function $H(\cdot,\cdot)$ will operate on the concatenation of its arguments.

For any even positive integer $\alpha$ , we define $r^{\prime}=r\mathbin{\mathrm{mod}^{\pm}}\alpha$ to be the unique element $r^{\prime}$ in the range $-\tfrac{\alpha}{2}<r^{\prime}\leq\tfrac{\alpha}{2}$ such that $r^{\prime}\equiv r\bmod\alpha$ . For any odd positive integer $\alpha$ , we define $r^{\prime}=r\mathbin{\mathrm{mod}^{\pm}}\alpha$ to be the unique element $r^{\prime}$ in the range $-\tfrac{\alpha-1}{2}\leq r^{\prime}\leq\tfrac{\alpha-1}{2}$ such that $r^{\prime}\equiv r\bmod\alpha$ . We refer to these operations as centered reductions modulo $\alpha$ .

For any positive integer $\alpha$ , we define $r^{\prime}=r\bmod^{+}\alpha$ to be the unique element $r^{\prime}$ in the range $0\leq r^{\prime}<\alpha$ such that $r^{\prime}\equiv r\bmod\alpha$ . When the specific representation is not significant, we simply write $r\bmod\alpha$ .

For an element $w\in\mathbb{Z}_{q}$ , we denote $\lVert w\rVert_{\infty}$ to mean $|w\mathbin{\mathrm{mod}^{\pm}}q|$ . For $w=\sum_{i=0}^{n-1}w_{i}x^{i}\in R$ , we define $\lVert w\rVert_{\infty}=\max_{i}\lVert w_{i}\rVert_{\infty}$ and $\lVert w\rVert=\sqrt{\lVert w_{0}\rVert_{\infty}^{2}+\dots+\lVert w_{n-1}\rVert_{\infty}^{2}}$ . For $\mathbf{w}=(w_{1},\dots,w_{k})\in R^{k}$ : $\lVert\mathbf{w}\rVert_{\infty}=\max_{i}\lVert w_{i}\rVert_{\infty}$ and $\lVert\mathbf{w}\rVert=\sqrt{\lVert w_{1}\rVert^{2}+\dots+\lVert w_{k}\rVert^{2}}$ . We denote by $S_{\alpha}$ the set of all elements $w\in R$ such that $\lVert w\rVert_{\infty}\leq\alpha$ for $\alpha\in R$ . There will be an abuse of notation: we write $S$ , with no subindex, to indicate that bounds in this case are given by the underlying scheme.

From [ducas2017] we set $\beta$ as the maximum possible coefficient of $c\mathbf{s}_{i}$ , $\gamma_{1}$ is large enough so the signature does not reveal the secret key and small enough so that the signature is not forged, $\gamma_{2}$ is the low-order rounding bound with $2\gamma_{2}\mid q-1$ (concretely $\gamma_{2}=(q-1)/88$ for level 2 and $(q-1)/32$ for levels 3 and 5, so $\gamma_{2}\neq\gamma_{1}/2$ in general), and $\eta$ is a small integer. We write $\mathcal{C}=B_{\tau}$ for the challenge set of weight $\tau$ (Definition LABEL:def:stmsis); the concrete weights are $\tau\in\{39,49,60\}$ for the three parameter sets, and $M=|\mathcal{C}|=2^{\tau}\binom{n}{\tau}$ . Fix an efficiently invertible bijection $\iota:\mathbb{Z}_{M}\to\mathcal{C}$ (for instance the indexing underlying SampleInBall), with inverse $\iota^{-1}:\mathcal{C}\to\mathbb{Z}_{M}$ . We use a challenge hash $H_{M}:\{0,1\}^{*}\to\mathbb{Z}_{M}$ . Let $\mathsf{HB}(\cdot)$ denote the recoverable (high-order) part of a commitment, i.e. for every accepted transcript $\mathsf{HB}(\mathbf{A}\mathbf{z}-c\mathbf{t})=\mathsf{HB}(\mathbf{A}\mathbf{y})$ ; in Dilithium $\mathsf{HB}(\cdot)=\mathsf{HighBits}(\cdot,2\gamma_{2})$ .

Let $\mathsf{PKE}=(\mathsf{KGen}_{e},\mathsf{Enc},\mathsf{Dec})$ be a public-key encryption scheme satisfying ciphertext pseudorandomness: for honestly generated $ek$ and any message $K$ , $\mathsf{Enc}(ek,K)$ is computationally indistinguishable from a uniform element of the ciphertext space given $ek$ (but not $dk$ ); we write its advantage $\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}$ . Ciphertext pseudorandomness implies both IND- CPA and key-privacy (anonymity), but neither of those implies it. We use $\mathsf{PKE}$ to encrypt a chosen symmetric key $K$ . The CPA-secure module-LWE encryption underlying ML-KEM (Kyber) is a candidate instantiation: its ciphertext components are pseudorandom under decisional MLWE, and pseudorandomness is understood with respect to the actual (compressed) ciphertext encoding space, up to the standard compression/statistical terms. Let $G:\{0,1\}^{\kappa}\to\{0,1\}^{*}$ be a pseudorandom generator (XOF). Each party holds, in addition to its lattice keys, an encryption key pair $(ek,dk)\leftarrow\mathsf{KGen}_{e}(1^{\kappa})$ ; for a key set $\pi=\{pk_{s},pk_{v}\}$ we write $ek_{s},ek_{v}$ (resp. $dk_{s},dk_{v}$ ) for the signer’s and verifier’s encryption keys.

Public parameters $pp\leftarrow\mathsf{Setup}(1^{\kappa})$ fix the common matrix $\mathbf{A}\in R_{q}^{k\times l}$ (with the $\mathsf{PKE}$ and PRG descriptions); every key pair is generated as $(pk,sk)\leftarrow\mathsf{KeyGen}(pp)$ relative to the same $\mathbf{A}$ , so the two OR-proof branches share a module matrix.

2.2 Basic definitions

A withdrawable signature scheme involves two participating parties: signers and verifiers. The scheme operates in two primary stages: first, the generation of a withdrawable signature, and second, its transformation into a confirmed signature. Both stages are executed by the signer. Concerning the security of a withdrawable signature scheme $WS$ , it is established through three properties, namely: correctness, unforgeability under insider corruption, and withdrawability.

1.

Correctness establishes a strong relation between the verification algorithms: if a withdrawable signature $\sigma$ is successfully verified through the $\mathsf{WSVerify}$ algorithm, then its corresponding confirmed signature $\tilde{\sigma}$ must also be verifiable through the $\mathsf{CVerify}$ algorithm.
2.

Unforgeability under insider corruption ensures that only the original signer possesses the capability to transform a verifiable withdrawable signature $\sigma$ (generated using $sk_{s}$ for verifier $pk_{v}$ ) into its corresponding confirmed signature $\tilde{\sigma}$ . This requirement holds even when an adversary has obtained the verifier’s secret key $sk_{v}$ , maintaining the exclusive control of the signer over the confirmation process.
3.

Finally, withdrawability establishes the indistinguishability of signature origin. Specifically, given a verifiable withdrawable signature $\sigma$ , no PPT adversary $\mathcal{A}$ should be able to determine whether the signature was generated by the signer or the verifier, provided that the $\mathsf{Confirm}$ algorithm has not been executed on $\sigma$ . This property effectively ensures that both the signer and the designated verifier possess equivalent capabilities in generating withdrawable signatures.

Threat model.

All results are in the (quantum) random-oracle model, stated for the classical ROM with the QROM variant noted in Remark LABEL:rem:qrom. Keys are honestly generated unless stated otherwise: withdrawability is proved for honest keys (Theorem LABEL:thm:withdraw), and Remark LABEL:rem:wd treats an adversarially chosen verifier key at the cost of a decisional-MLWE term. Unforgeability (Theorem LABEL:thm:unforge) is under insider corruption, i.e. the adversary may hold the designated verifier’s secret key. For withdrawability we distinguish third-party adversaries (holding no secret key), defeated by the encryption layer of Section LABEL:sec:sdvs, from the designated verifier (holding $dk_{v}$ ), defeated by the origin ambiguity of the public core.

Definition 2.1 ([liu2023], Section LABEL:subsec:instantiation).

wbsphack @@writeaux\newlabeldef:wswcurrentlabel1wesphack A withdrawable signature scheme is composed of five polynomial-time algorithms $\mathsf{KeyGen},\mathsf{WSign},\mathsf{WSVerify},\mathsf{Confirm},\mathsf{CVerify}$ , defined as follows:

•

$pp\leftarrow\mathsf{Setup}(1^{\kappa})$ , $(pk,sk)\leftarrow\mathsf{KeyGen}(pp)$ : $\mathsf{Setup}$ fixes public parameters $pp$ , in particular the common matrix $\mathbf{A}$ shared by all users, and $\mathsf{KeyGen}(pp)$ outputs one key pair. The signer and verifier keys $(pk_{s},sk_{s})$ , $(pk_{v},sk_{v})$ are two independent invocations of $\mathsf{KeyGen}(pp)$ and thus share $\mathbf{A}$ ; by convention each secret key embeds its own public key, i.e. $sk=(pk,\mathbf{s}_{1},\mathbf{s}_{2},dk)$ , so that a party can reconstruct $\pi$ from its own $sk$ .
•

$\sigma\leftarrow\mathsf{WSign}(\mu,sk_{s},\pi)$ : given a message $\mu$ , a signer’s secret key $sk_{s}$ , and a tuple $\pi=\{pk_{s},pk_{v}\}$ containing both the signer’s public key $pk_{s}$ and a designated verifier’s public key $pk_{v}$ from the set of all public keys $PK$ (those output by $\mathsf{KeyGen}$ ), the withdrawable signing algorithm generates a withdrawable signature $\sigma$ . This signature is specifically bound to message $\mu$ under the signer’s identity and can only be verified by the designated verifier $pk_{v}$ .
•

$1/0\leftarrow\mathsf{WSVerify}(\mu,sk_{v},pk_{s},\sigma)$ : the withdrawable signature verification algorithm uses the designated verifier’s secret key $sk_{v}$ (which includes $dk_{v}$ ) to return $1$ iff $\sigma$ is a valid withdrawable signature on $\mu$ under $\pi=\{pk_{s},pk_{v}\}$ , and $0$ otherwise. Among third parties only the designated verifier can run it; the signer may also recover the public core (via $dk_{s}$ ) for confirmation. The signature is not publicly verifiable.
•

$\tilde{\sigma}\leftarrow\mathsf{Confirm}(\mu,sk_{s},\pi,\sigma)$ : the confirmation algorithm transforms a withdrawable signature $\sigma$ into a confirmed signature $\tilde{\sigma}$ . It takes as input the original message $\mu$ , the signer’s secret key $sk_{s}$ , the public key set $\pi$ , and the withdrawable signature $\sigma$ . The resulting confirmed signature $\tilde{\sigma}$ serves as a publicly verifiable signature with respect to the key set $\pi$ .
•

$1/0\leftarrow\mathsf{CVerify}(\mu,\pi,\sigma,\tilde{\sigma})$ : the confirmed signature verification algorithm validates the authenticity of a confirmed signature $\tilde{\sigma}$ on message $\mu$ with respect to the public key set $\pi$ . It takes as additional input the original withdrawable signature $\sigma$ from which the confirmed signature was derived. The algorithm outputs $1$ if the confirmed signature is valid and $0$ otherwise.

Definition 2.2.

wbsphack @@writeaux\newlabeldef:correctwcurrentlabel1wesphack A withdrawable signature scheme $WS$ is correct if, for any security parameter $\kappa$ , any public key set $\pi$ , and any message $\mu\in\{0,1\}^{*}$ , when executing the sequence $\mathsf{KeyGen},\mathsf{WSign}$ , and $\mathsf{Confirm}$ , then the corresponding verification algorithms satisfy:

\mathsf{WSVerify}(\mu,sk_{v},pk_{s},\sigma)=1\quad\text{and}\quad\mathsf{CVerify}(\mu,\pi,\sigma,\tilde{\sigma})=1

with overwhelming probability (in the security parameter $\kappa$ ).

Definition 2.3.

wbsphack @@writeaux\newlabeldef:eufwcurrentlabel1wesphack For a PPT adversary $\mathcal{A}$ and security parameter $\kappa$ , we define the unforgeability under insider corruption experiment $\mathsf{Exp}^{\text{EUF-CMA}}_{WS,\mathcal{A}}(1^{\kappa})$ using the three oracles in Algorithms LABEL:alg:corrupt–LABEL:alg:confirm-oracle.

Algorithm 1 Corruption oracle

\mathcal{O}^{\mathsf{Corrupt}}_{i}(\cdot)

wbsphack @@writeaux\newlabelalg:corruptwcurrentlabel1wesphack

1:if

i\neq s

then

CO\leftarrow CO\cup\{i\}

2: return

sk_{i}

3:else return

\bot

4:end if

Algorithm 2 Withdrawable signing oracle

\mathcal{O}^{\mathsf{WSign}}_{sk_{s},\pi}(\mu)

wbsphack @@writeaux\newlabelalg:wsign-oraclewcurrentlabel1wesphack

1:if

(pk_{s}\in\pi)\wedge(s\notin CO)

then

\sigma\leftarrow\mathsf{WSign}(\mu,sk_{s},\pi)

W\leftarrow W\cup\{\sigma\}

4: return

\sigma

5:else return

\bot

6:end if

Algorithm 3 Confirmation oracle

\mathcal{O}^{\mathsf{Confirm}}_{sk_{s},\pi}(\mu,\sigma)

wbsphack @@writeaux\newlabelalg:confirm-oraclewcurrentlabel1wesphack

1:if

\sigma\in W

then

M\leftarrow M\cup\{\mu\}

\tilde{\sigma}\leftarrow\mathsf{Confirm}(\mu,sk_{s},\pi,\sigma)

4: return

\tilde{\sigma}

5:else return

\bot

6:end if

Using these three oracles, we define the unforgeability experiment $\mathsf{Exp}^{\text{EUF-CMA}}_{WS,\mathcal{A}}(1^{\kappa})$ as follows:

Algorithm 4 Unforgeability experiment

\mathsf{Exp}^{\text{EUF-CMA}}_{WS,\mathcal{A}}(1^{\kappa})

wbsphack @@writeaux\newlabelalg:euf-expwcurrentlabel1wesphack

pp\leftarrow\mathsf{Setup}(1^{\kappa})

2:for

i=1

m

(pk_{i},sk_{i})\leftarrow\mathsf{KeyGen}(pp)

3:end for

4:Select

s,v\in\{1,\dots,m\}

where

v\neq s

5:Initialize empty sets

CO\leftarrow\emptyset,\ W\leftarrow\emptyset,\ M\leftarrow\emptyset

(\mu^{*},\sigma^{*},\tilde{\sigma}^{*})\leftarrow\mathcal{A}^{\mathcal{O}^{\mathsf{Corrupt}}_{i}(\cdot),\,\mathcal{O}^{\mathsf{WSign}}_{sk_{s},\pi}(\cdot),\,\mathcal{O}^{\mathsf{Confirm}}_{sk_{s},\pi}(\cdot,\cdot)}(1^{\kappa},\pi^{*})

7:if

(\pi^{*}=\{pk_{s},pk_{v}\})\wedge(v\in CO)\wedge(\mu^{*}\notin M)

then

8: if

(\mathsf{WSVerify}(\mu^{*},sk_{v},pk_{s},\sigma^{*})=1)\wedge(\mathsf{CVerify}(\mu^{*},\pi^{*},\sigma^{*},\tilde{\sigma}^{*})=1)

then return

1

9: end if

10:end if

11:return

0

A withdrawable signature scheme $WS$ is considered unforgeable under insider corruption with EUF-CMA security if, for all PPT adversaries $\mathcal{A}$ , there exists a negligible function $\mathsf{negl}$ such that:

\Pr[\mathsf{Exp}^{\text{EUF-CMA}}_{WS,\mathcal{A}}(1^{\kappa})=1]\leq\mathsf{negl}(1^{\kappa}).

Definition 2.4.

wbsphack @@writeaux\newlabeldef:withdrawwcurrentlabel1wesphack Let $(pk_{0},sk_{0}),(pk_{1},sk_{1})\leftarrow\mathsf{KeyGen}(pp)$ be two generated public/secret key pairs, and let $\pi=\{pk_{0},pk_{1}\}$ . For a randomly selected bit $b\xleftarrow{\mathdollar}\{0,1\}$ , a security parameter $\kappa$ , and a PPT adversary $\mathcal{A}$ , we build the withdrawability experiment $\mathsf{Exp}^{\text{Withdraw}}_{WS,\mathcal{A}}(1^{\kappa})$ with the oracle of Algorithm LABEL:alg:withdraw-oracle.

Algorithm 5 Signing oracle

\mathcal{O}^{\mathsf{WSign}}_{sk_{b},\pi}(\cdot)

for the withdrawability experimentwbsphack @@writeaux\newlabelalg:withdraw-oraclewcurrentlabel1wesphack

1:if

\pi=\{pk_{0},pk_{1}\}

then

\sigma_{b}\leftarrow\mathsf{WSign}(\mu,sk_{b},\pi)

M\leftarrow M\cup\{\mu\}

4: return

\sigma_{b}

5:else return

\bot

6:end if

With this signing oracle, we have the following experiment:

Algorithm 6 Withdrawability experiment

\mathsf{Exp}^{\text{Withdraw}}_{WS,\mathcal{A}}(1^{\kappa})

wbsphack @@writeaux\newlabelalg:withdraw-expwcurrentlabel1wesphack

pp\leftarrow\mathsf{Setup}(1^{\kappa})

; for

i=0,1

(pk_{i},sk_{i})\leftarrow\mathsf{KeyGen}(pp)

\pi\leftarrow\{pk_{0},pk_{1}\};\ b\xleftarrow{\mathdollar}\{0,1\};\ M\leftarrow\emptyset

(\mu^{*},\mathit{st})\leftarrow\mathcal{A}^{\mathcal{O}^{\mathsf{WSign}}_{sk_{b},\pi}}(pp,\pi)

\triangleright

stage 1: choose challenge message

\sigma_{b}\leftarrow\mathsf{WSign}(\mu^{*},sk_{b},\pi)

b^{\prime}\leftarrow\mathcal{A}^{\mathcal{O}^{\mathsf{WSign}}_{sk_{b},\pi}}(\mathit{st},\sigma_{b})

\triangleright

stage 2: guess

6:if

(b=b^{\prime})\wedge(\mu^{*}\notin M)

then return

1

7:end if

8:return

0

A withdrawable signature scheme $WS$ is withdrawable if, for any PPT adversary $\mathcal{A}$ , and in the absence of the execution of the $\mathsf{Confirm}$ algorithm, there exists a negligible function $\mathsf{negl}$ such that:

\Pr[\mathsf{Exp}^{\text{Withdraw}}_{WS,\mathcal{A}}(1^{\kappa})=1]\leq\tfrac{1}{2}+\mathsf{negl}(1^{\kappa}).

2.3 Security definitions and computational assumptions

Definition 2.5.

wbsphack @@writeaux\newlabeldef:ds-eufwcurrentlabel1wesphack For a signature scheme $DS=(\mathsf{KeyGen},\mathsf{Sign},\mathsf{Verify})$ and a PPT adversary $\mathcal{A}$ , consider the following experiment $\mathsf{Exp}^{\text{EUF-CMA}}_{\mathcal{A}}$ :

1.

The challenger $\mathcal{B}$ generates a key pair $(pk_{s},sk_{s})\leftarrow\mathsf{KeyGen}(pp)$ using the system parameters $SP$ . It provides $pk_{s}$ to $\mathcal{A}$ while retaining $sk_{s}$ to handle signature queries.
2.

$\mathcal{A}$ receives access to the signing oracle $\mathcal{O}^{\mathsf{Sign}}_{sk_{s}}(\cdot)$ that computes $\sigma\leftarrow\mathsf{Sign}(\mu,sk_{s})$ upon request.
3.

Eventually, $\mathcal{A}$ outputs a forgery attempt $(\mu^{*},\sigma^{*})$ .
4.

$\mathcal{A}$ succeeds if $\mathsf{Verify}(\mu^{*},pk_{s},\sigma^{*})=1$ and $\mu^{*}$ was not previously queried to $\mathcal{O}^{\mathsf{Sign}}_{sk_{s}}(\cdot)$ .

We say that $DS$ is $(t,q_{s},\varepsilon)$ -secure under EUF-CMA if no adversary running in time $t$ and making at most $q_{s}$ signing queries can succeed with probability greater than $\varepsilon$ .

Definition 2.6.

wbsphack @@writeaux\newlabeldef:dvswcurrentlabel1wesphack A designated-verifier signature scheme $DVS$ consists of four probabilistic polynomial-time algorithms operating on key pairs $(pk_{s},sk_{s})$ for signers and $(pk_{d},sk_{d})$ for designated verifiers:

DVS=\left\{\begin{aligned} &(pk,sk)\leftarrow\mathsf{KeyGen}(pp)\\ &\sigma\leftarrow\mathsf{Sign}(\mu,pk_{d},sk_{s})\\ &\sigma\leftarrow\mathsf{Simul}(\mu,pk_{s},sk_{d})\\ &0/1\leftarrow\mathsf{Verify}(\mu,pk_{s},sk_{d},\sigma)\end{aligned}\right\}

The key security property of $DVS$ schemes is non-transferability, which states that for any message-signature pair $(\mu,\sigma)$ that validates under $\mathsf{Verify}$ , it should be computationally infeasible to determine whether $\sigma$ was produced by the signer using $\mathsf{Sign}$ or simulated by the designated verifier using $\mathsf{Simul}$ , without access to the signer’s secret key $sk_{s}$ . The formal definition of this property follows:

Definition 2.7 (Non-transferability).

wbsphack @@writeaux\newlabeldef:nontranswcurrentlabel1wesphack For a designated-verifier signature scheme and a PPT adversary $\mathcal{A}$ , consider the non-transferability experiment $\mathsf{Exp}^{\mathsf{Sign}}_{\text{NonTrans},DV,\mathcal{A}}$ :

Algorithm 7 Non-transferability experiment

\mathsf{Exp}^{\mathsf{Sign}}_{\text{NonTrans},DV,\mathcal{A}}(1^{\kappa})

wbsphack @@writeaux\newlabelalg:nontranswcurrentlabel1wesphack

(pk_{s},sk_{s}),(pk_{d},sk_{d})\leftarrow\mathsf{KeyGen}(pp)

2:Provide

\mathcal{A}

access to oracles:

\mathcal{O}^{\mathsf{Sign}}_{sk_{s},pk_{d}}(\cdot):\ \sigma_{0}\leftarrow\mathsf{Sign}(\mu,sk_{s},pk_{d})

\mathcal{O}^{\mathsf{Simul}}_{sk_{d},pk_{s}}(\cdot):\ \sigma_{1}\leftarrow\mathsf{Simul}(\mu,pk_{s},sk_{d})

\mathcal{A}

outputs message

\mu^{*}

\sigma^{*}_{0}\leftarrow\mathsf{Sign}(\mu^{*},pk_{d},sk_{s});\quad\sigma^{*}_{1}\leftarrow\mathsf{Simul}(\mu^{*},pk_{s},sk_{d})

b\xleftarrow{\mathdollar}\{0,1\}

8:Provide

\mathcal{A}

with signature

\sigma^{*}_{b}

\mathcal{A}

outputs bit

b^{\prime}

10:if

b^{\prime}=b

then return

1

11:else return

0

12:end if

A $DVS$ achieves non-transferability if for any PPT adversary $\mathcal{A}$ , there exists a negligible function $\mathsf{negl}$ such that:

\Pr[\mathsf{Exp}^{\mathsf{Sign}}_{\text{NonTrans},DV,\mathcal{A}}(1^{\kappa})=1]\leq\tfrac{1}{2}+\mathsf{negl}(1^{\kappa}).

The security of our scheme rests upon three fundamental lattice-based hardness assumptions. The Module Learning With Errors (MLWE) assumption provides protection against key-recovery attacks, ensuring the confidentiality of secret keys. The SelfTargetMSIS assumption establishes the security foundation against new message forgery attempts, preventing adversaries from generating valid signatures for previously unsigned messages. Finally, the MSIS assumption is essential for achieving strong unforgeability, which prevents even slight modifications of existing signatures.

Definition 2.8 (Module Learning With Errors (MLWE)).

wbsphack @@writeaux\newlabeldef:mlwewcurrentlabel1wesphack For integers $m,k$ and a probability distribution $D:R_{q}\to[0,1]$ , the advantage of an algorithm $\mathcal{A}$ in solving the decisional $\text{MLWE}_{m,k,D}$ problem over the ring $R_{q}$ is defined as:

	$\displaystyle\mathsf{Adv}^{\text{MLWE}}_{m,k,D}:=\big\|$	$\displaystyle\Pr[b=1\mid\mathbf{A}\leftarrow R_{q}^{m\times k};\ \mathbf{t}\leftarrow R_{q}^{m};\ b\leftarrow\mathcal{A}(\mathbf{A},\mathbf{t})]$
	$\displaystyle-$	$\displaystyle\Pr[b=1\mid\mathbf{A}\leftarrow R_{q}^{m\times k};\ \mathbf{s}_{1}\leftarrow D^{k};\ \mathbf{s}_{2}\leftarrow D^{m};\ b\leftarrow\mathcal{A}(\mathbf{A},\mathbf{A}\mathbf{s}_{1}+\mathbf{s}_{2})]\big\|.$

Definition 2.9 (Module Short Integer Solution (MSIS)).

wbsphack @@writeaux\newlabeldef:msiswcurrentlabel1wesphack For an algorithm $\mathcal{A}$ , we define its advantage function $\mathsf{Adv}^{\text{MSIS}}_{m,k,\gamma}$ in solving the (Hermite Normal Form) $\text{MSIS}_{m,k,\gamma}$ problem over the ring $R_{q}$ as:

\mathsf{Adv}^{\text{MSIS}}_{m,k,\gamma}(\mathcal{A}):=\Pr\!\left[0<\lVert\mathbf{y}\rVert_{\infty}\leq\gamma\ \wedge\ [\,\mathbf{I}\mid\mathbf{A}\,]\cdot\mathbf{y}=0\ \middle|\ \mathbf{A}\leftarrow R_{q}^{m\times k};\ \mathbf{y}\leftarrow\mathcal{A}(\mathbf{A})\right].

Let $B_{h}$ denote the subset of elements in $R$ that have exactly $h$ coefficients equal to either $-1$ or $1$ , with all remaining coefficients being $0$ . The cardinality of this set is given by $|B_{h}|=2^{h}\cdot\binom{n}{h}$ .

Definition 2.10 (SelfTargetMSIS).

wbsphack @@writeaux\newlabeldef:stmsiswcurrentlabel1wesphack Let $H:\{0,1\}^{*}\to B_{h}$ be a cryptographic hash function. For an algorithm $\mathcal{A}$ , we define its advantage function as:

\mathsf{Adv}^{\text{SelfTargetMSIS}}_{H,m,k,\gamma_{1}}(\mathcal{A}):=\Pr\!\left[\begin{aligned} &0\leq\lVert\mathbf{y}\rVert_{\infty}\leq\gamma_{1}\ \wedge\ H\big([\,\mathbf{I}\mid\mathbf{A}\,]\cdot\mathbf{y}\,\big\|\,M\big)=c\\ &\ \big|\ \mathbf{A}\leftarrow R_{q}^{m\times k};\ (\mathbf{y}:=(\mathbf{r},c),M)\leftarrow\mathcal{A}^{\langle H(\cdot)\rangle}(\mathbf{A})\end{aligned}\right].

The above problems are hard if, for any PPT adversary $\mathcal{A}$ , the respective advantages are negligible.

The intuition is that the MLWE assumption protects against key-recovery attacks, the SelfTargetMSIS is the assumption upon which new message forgery is based, and the MSIS assumption is needed for strong unforgeability. The decisional MLWE will be used to prove withdrawability.

3 Withdrawable signature schemes

3.1 The abstract construction

wbsphack @@writeaux\newlabelsec:abstractwcurrentlabel1wesphack In this section we provide a global construction for withdrawable signatures based on the Fiat–Shamir with aborts paradigm and prove the unforgeability and withdrawability as described in Definition LABEL:def:ws. This construction follows the paradigm described in [lyubashevsky2009] combined with ideas in [liu2023]. Let $\mathcal{C}=B_{h}$ be the (bounded) challenge set and $H:\{0,1\}^{*}\to\mathcal{C}$ a random oracle. Sampling uniformly from $R$ is not well defined, and the challenge must be small enough that $\mathbf{z}=\mathbf{y}+c\mathbf{s}_{1}\in S^{l}$ .

Algorithm 8 Fiat–Shamir with aborts signaturewbsphack @@writeaux\newlabelalg:fswawcurrentlabel1wesphack

1:procedure KeyGen(

1^{\kappa}

)

\mathbf{A}\leftarrow R_{q}^{k\times l},\ \mathbf{s}_{1}\leftarrow S^{l},\ \mathbf{s}_{2}\leftarrow S^{k}

\mathbf{t}=\mathbf{A}\mathbf{s}_{1}+\mathbf{s}_{2}

4: return

pk=(\mathbf{A},\mathbf{t}),\ sk=(\mathbf{s}_{1},\mathbf{s}_{2})

5:end procedure

6:procedure Sign(

\mu,sk,\mathbf{t}

)

7: repeat

\mathbf{y}\leftarrow S^{l},\ \mathbf{w}=\mathsf{HB}(\mathbf{A}\mathbf{y}),\ c=H(\mu,\mathbf{w}),\ \mathbf{z}=\mathbf{y}+c\mathbf{s}_{1}

8: until

\mathbf{z}\in S^{l}

and the recoverability bound holds

9: return

\sigma=(\mathbf{z},c)

10:end procedure

11:procedure Verify(

\mu,\sigma,pk

)

12:

\mathbf{w}^{\prime}=\mathsf{HB}(\mathbf{A}\mathbf{z}-c\mathbf{t})

13: if

(\mathbf{z}\in S^{l})\wedge(c=H(\mu,\mathbf{w}^{\prime}))

then return

1

14: end if

15:end procedure

Theorem 3.1 ([lyubashevsky2009], Theorem 2).

wbsphack @@writeaux\newlabelthm:lyuwcurrentlabel1wesphack Let $n$ be an integer which is a power of $2$ . If the above signature scheme is not strongly unforgeable, then there is a polynomial-time algorithm that can solve $\operatorname{SVP}_{\varepsilon}(\Lambda)$ , for $\varepsilon=\tilde{O}(n^{2})$ and for every lattice $\Lambda$ corresponding to an ideal in the ring $\mathbb{Z}[x]/(x^{n}+1)$ .

Taking the above scheme as starting point, we define a withdrawable lattice-based scheme as follows:

Algorithm 9

\mathsf{KeyGen}(pp)

wbsphack @@writeaux\newlabelalg:abs-keygenwcurrentlabel1wesphack

1:parse

\mathbf{A}

from

pp

\mathbf{s}_{1}\leftarrow S^{l},\ \mathbf{s}_{2}\leftarrow S^{k}

\mathbf{t}=\mathbf{A}\mathbf{s}_{1}+\mathbf{s}_{2}

(ek,dk)\leftarrow\mathsf{KGen}_{e}(1^{\kappa})

5:return

pk=(\mathbf{A},\mathbf{t},ek),\ sk=(pk,\mathbf{s}_{1},\mathbf{s}_{2},dk)

Algorithm 10

\mathsf{WSign}^{\mathsf{pub}}(\mu,sk_{s},\pi)

wbsphack @@writeaux\newlabelalg:abs-wsignwcurrentlabel1wesphack

\pi=\{pk_{s},pk_{v}\}

2:repeat

\triangleright

simulate verifier branch from the accepted distribution

c_{v}\xleftarrow{\mathdollar}\mathcal{C};\ \mathbf{z}_{v}\xleftarrow{\mathdollar}S^{l};\ w_{v}=\mathsf{HB}(\mathbf{A}\mathbf{z}_{v}-c_{v}\mathbf{t}_{v})

4:until the low-order recoverability test on

\mathbf{A}\mathbf{z}_{v}-c_{v}\mathbf{t}_{v}

holds

5:repeat

\mathbf{y}\xleftarrow{\mathdollar}S^{l};\ w_{s}=\mathsf{HB}(\mathbf{A}\mathbf{y})

g=H_{M}(\mu,w_{s},w_{v},\pi);\ c_{s}=\iota\big((g-\iota^{-1}(c_{v}))\bmod M\big)

\mathbf{z}_{s}=\mathbf{y}+c_{s}\mathbf{s}_{1}

\triangleright

sk_{s}=(pk_{s},\mathbf{s}_{1},\mathbf{s}_{2},dk_{s})

9:until

\mathbf{z}_{s}\in S^{l}

and the recoverability bound holds

10:return

\sigma=(c_{s},c_{v},\mathbf{z}_{s},\mathbf{z}_{v})

Algorithm 11

\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\sigma)

wbsphack @@writeaux\newlabelalg:abs-wsverifywcurrentlabel1wesphack

\sigma=(c_{s},c_{v},\mathbf{z}_{s},\mathbf{z}_{v})

w_{s}^{\prime}=\mathsf{HB}(\mathbf{A}\mathbf{z}_{s}-c_{s}\mathbf{t}_{s});\ w_{v}^{\prime}=\mathsf{HB}(\mathbf{A}\mathbf{z}_{v}-c_{v}\mathbf{t}_{v})

g=H_{M}(\mu,w_{s}^{\prime},w_{v}^{\prime},\pi)

4:if

(\iota^{-1}(c_{s})+\iota^{-1}(c_{v})\equiv g\!\!\pmod{M})\wedge(\mathbf{z}_{s},\mathbf{z}_{v}\in S^{l})

then return

1

5:end if

Algorithm 12

\mathsf{Confirm}^{\mathsf{pub}}(\mu,sk_{s},\pi,\sigma)

wbsphack @@writeaux\newlabelalg:abs-confirmwcurrentlabel1wesphack

1:return

\tilde{\sigma}\leftarrow\mathsf{Sign}_{sk_{s}}(\mu\,\|\,\pi\,\|\,\sigma)

Algorithm 13

\mathsf{CVerify}^{\mathsf{pub}}(\mu,\pi,\sigma,\tilde{\sigma})

wbsphack @@writeaux\newlabelalg:abs-cverifywcurrentlabel1wesphack

1:if

\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\sigma)=1\ \wedge\ \mathsf{Verify}_{pk_{s}}(\mu\,\|\,\pi\,\|\,\sigma,\ \tilde{\sigma})=1

then return

1

2:end if

The proofs for Theorem LABEL:thm:unforge and Theorem LABEL:thm:withdraw below closely follow the structure of their analogous Theorems 12 and 13 in [liu2023]. The fundamental arguments remain valid when adapting the security assumptions to our context, with the primary distinction being the underlying signature scheme.

Assumption 1 (Commitment min-entropy).

wbsphack @@writeaux\newlabelass:entropywcurrentlabel1wesphack The commitment pair $(w_{s},w_{v})$ produced by an accepted run of $\mathsf{WSign}$ has min-entropy at least $\alpha$ ; for the concrete Dilithium parameter sets $\alpha\geq 1024$ (and $\alpha\geq 1397$ at level 2), so $2^{-\alpha}\leq 2^{-1024}$ .

Remark 3.2 (Heuristic support for Assumption LABEL:ass:entropy).

Let $w_{s}[1]=\mathbf{a}_{1}\!\cdot\!\mathbf{y}$ be one output coordinate ( $\mathbf{a}_{1}\in R_{q}^{\,l}$ the first row of $\mathbf{A}$ ). The input min-entropy $H_{\infty}(\mathbf{y})=l\,n\log_{2}(2\gamma_{1})$ exceeds $\log_{2}|R_{q}|=n\log_{2}q$ by $\geq 12544$ (level 2), $19712$ (level 3), $29952$ (level 5) bits, so under the module regularity of the SIS map $(\mathbf{a}_{1},\mathbf{a}_{1}\!\cdot\!\mathbf{y})$ is statistically close to $(\mathbf{a}_{1},\mathcal{U}(R_{q}))$ , and $\mathsf{HighBits}(w_{s}[1],2\gamma_{2})$ has min-entropy $\approx n\log_{2}((q-1)/2\gamma_{2})\geq 1024$ . Conditioning on the constant-probability rejection event lowers this by $O(1)$ bits. A fully rigorous bound needs a regularity lemma over $R_{q}$ with exact conditions for a completely split $q$ and the rejection-conditioned law of $\mathbf{y}$ ; we therefore record the value as Assumption LABEL:ass:entropy.

Lemma 3.3 (Witness-free simulatability / naHVZK).

wbsphack @@writeaux\newlabellem:zkwcurrentlabel1wesphack There is a PPT algorithm $\mathsf{Sim}(\mu,\pi)$ , taking no secret key and fixing $H_{M}$ at a single point, such that for all honestly generated $\pi=\{pk_{s},pk_{v}\}$ and all $\mu$ , the output of $\mathsf{Sim}(\mu,\pi)$ together with its induced $H_{M}$ -entry is within statistical distance $\varepsilon_{\mathrm{zk}}$ of a genuine pair $(\mathsf{WSign}(\mu,sk_{s},\pi),H_{M}\text{-entry})$ , conditioned on the programmed point being fresh. Concretely $\mathsf{Sim}$ repeatedly samples $c_{s},c_{v}\xleftarrow{\mathdollar}\mathcal{C}$ and $\mathbf{z}_{s},\mathbf{z}_{v}\xleftarrow{\mathdollar}S_{\gamma_{1}-\beta-1}^{l}$ until both $\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{z}_{s}-c_{s}\mathbf{t}_{s},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta$ and $\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{z}_{v}-c_{v}\mathbf{t}_{v},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta$ (the same low-order test as $\mathsf{WSign}$ ); it then sets $w_{s}=\mathsf{HighBits}(\mathbf{A}\mathbf{z}_{s}-c_{s}\mathbf{t}_{s},2\gamma_{2})$ , $w_{v}=\mathsf{HighBits}(\mathbf{A}\mathbf{z}_{v}-c_{v}\mathbf{t}_{v},2\gamma_{2})$ , programs $H_{M}(\mu,w_{s},w_{v},\pi):=(\iota^{-1}(c_{s})+\iota^{-1}(c_{v}))\bmod M$ , and returns $(c_{s},c_{v},\mathbf{z}_{s},\mathbf{z}_{v})$ .

Proof 3.4.

The verifier branch is produced by exactly this simulation already in $\mathsf{WSign}$ , so it is identical in both distributions. The signer branch is one FS-with-aborts transcript; by the non-abort honest-verifier zero-knowledge of the base scheme its accepted output $(c_{s},\mathbf{z}_{s})$ is within statistical distance $\varepsilon_{\mathrm{zk}}$ of $(c_{s}\xleftarrow{\mathdollar}\mathcal{C},\ \mathbf{z}_{s}\ \text{short},\ w_{s}=\mathsf{HighBits}(\mathbf{A}\mathbf{z}_{s}-c_{s}\mathbf{t}_{s},2\gamma_{2}))$ . Finally the law of $(c_{s},c_{v},g)$ agrees: in the real scheme $c_{v}$ and $g=H_{M}(\cdots)$ are uniform and independent and $c_{s}=\iota((g-\iota^{-1}(c_{v}))\bmod M)$ ; in $\mathsf{Sim}$ both $c_{s},c_{v}$ are uniform and $g$ is set to $\iota^{-1}(c_{s})+\iota^{-1}(c_{v})$ . Both yield $(c_{s},c_{v})\sim\mathcal{U}(\mathcal{C})^{2}$ with $g$ determined by the constraint.

Theorem 3.5.

wbsphack @@writeaux\newlabelthm:unforgewcurrentlabel1wesphack If the underlying signature scheme $\mathsf{Sign}$ is EUF-CMA secure, then the publicly-verifiable core of Algorithms LABEL:alg:abs-keygen–LABEL:alg:abs-cverify is unforgeable under insider corruption in the (Q)ROM (the full designated scheme of Section LABEL:sec:sdvs inherits this via Proposition LABEL:prop:sdvs). For any adversary $\mathcal{A}$ making $q_{W}$ signing, $q_{C}$ confirmation and $q_{H_{M}}$ random-oracle queries, there is an adversary $\mathcal{B}$ such that, in the random-oracle model,

\mathsf{Adv}^{\mathrm{EUF\text{-}CMA\text{-}ic}}_{WS}(\mathcal{A})\ \leq\ \mathsf{Adv}^{\mathrm{EUF\text{-}CMA}}_{\mathsf{Sign}}(\mathcal{B})\ +\ q_{W}\,\varepsilon_{\mathrm{zk}}\ +\ \frac{q_{W}(q_{H_{M}}+q_{W})}{2^{\alpha}},

where $\varepsilon_{\mathrm{zk}}$ is the per-proof simulation error of Lemma LABEL:lem:zk and $\alpha$ the commitment min-entropy (Assumption LABEL:ass:entropy). The last term is the random-oracle programming loss; in the quantum random-oracle model it is replaced by the adaptive-reprogramming term of Remark LABEL:rem:qrom. The reduction incurs no multiplicative $q_{H}$ factor.

Remark 3.6.

Algorithms LABEL:alg:abs-keygen–LABEL:alg:abs-cverify form the publicly-verifiable core: Theorem LABEL:thm:withdraw establishes its origin ambiguity and Theorem LABEL:thm:unforge the unforgeability of its confirmation. The designated withdrawable signature of Definition LABEL:def:ws is the strong designated-verifier scheme of Section LABEL:sec:sdvs, which wraps this core and inherits both properties (Proposition LABEL:prop:sdvs).

Proof 3.7.

We use a short sequence of games; $\Pr[\mathsf{G}_{i}]$ is the probability that game $\mathsf{G}_{i}$ outputs $1$ . Throughout, $H_{M}$ (the OR-proof challenge oracle) is domain-separated from the random oracle of the underlying scheme $DS$ of Definition LABEL:def:ds-euf; recall $\mathsf{Confirm}(\mu,sk_{s},\pi,\sigma)=\mathsf{Sign}_{sk_{s}}(\mu\|\pi\|\sigma)$ and $\mathsf{CVerify}(\mu,\pi,\sigma,\tilde{\sigma})=1$ iff $\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\sigma)=1$ and $\mathsf{Verify}_{pk_{s}}(\mu\|\pi\|\sigma,\tilde{\sigma})=1$ , with $\langle\cdot\rangle$ an injective encoding.

Game $\mathsf{G}_{0}$ . The experiment $\mathsf{Exp}^{\mathrm{EUF\text{-}CMA\text{-}ic}}_{WS,\mathcal{A}}(1^{\kappa})$ of Definition LABEL:def:euf (Algorithm LABEL:alg:euf-exp). Thus $\Pr[\mathsf{G}_{0}]=\mathsf{Adv}^{\mathrm{EUF\text{-}CMA\text{-}ic}}_{WS}(\mathcal{A})$ .

Game $\mathsf{G}_{1}$ . As $\mathsf{G}_{0}$ , but $\mathcal{O}^{\mathsf{WSign}}$ is answered by $\mathsf{Sim}(\mu,\pi)$ of Lemma LABEL:lem:zk, programming the one induced $H_{M}$ -entry; if that entry is already defined the game raises $\mathsf{bad}$ and aborts. By a hybrid over the $q_{W}$ signing queries, each replacement changes $\mathcal{A}$ ’s view by at most $\varepsilon_{\mathrm{zk}}$ (Lemma LABEL:lem:zk) unless the programmed point $(\mu,w_{s},w_{v},\pi)$ already occurs in the $H_{M}$ -table; at that moment the table has at most $q_{H_{M}}+q_{W}$ entries and, by Definition LABEL:ass:entropy, $(w_{s},w_{v})$ is unpredictable with min-entropy $\geq\alpha$ , so a collision occurs with probability at most $(q_{H_{M}}+q_{W})/2^{\alpha}$ . Hence

\big|\Pr[\mathsf{G}_{0}]-\Pr[\mathsf{G}_{1}]\big|\leq q_{W}\,\varepsilon_{\mathrm{zk}}+\frac{q_{W}(q_{H_{M}}+q_{W})}{2^{\alpha}}.

In $\mathsf{G}_{1}$ the signer key $sk_{s}$ is used only inside $\mathcal{O}^{\mathsf{Confirm}}$ , via $\mathsf{Sign}_{sk_{s}}(\langle\mu,\pi,\sigma\rangle)$ : $\mathcal{O}^{\mathsf{Corrupt}}$ never returns $sk_{s}$ ; $\mathcal{O}^{\mathsf{WSign}}$ now runs $\mathsf{Sim}$ (no secret key); the oracles $H,H_{M}$ are key-independent; and the keys of parties $i\neq s$ are independent of $sk_{s}$ .

We build $\mathcal{B}$ against the $\mathrm{EUF\text{-}CMA}$ -security of $DS$ (Definition LABEL:def:ds-euf). $\mathcal{B}$ gets a challenge key $pk^{\ast}$ , a signing oracle $\mathsf{Sign}_{sk^{\ast}}(\cdot)$ and access to $DS$ ’s random oracle $H$ . It generates a fresh encryption key pair $(ek_{s},dk_{s})\leftarrow\mathsf{KGen}_{e}(1^{\kappa})$ itself and sets $pk_{s}:=(pk^{\ast},ek_{s})$ , so that $\mathsf{Verify}_{pk_{s}}$ parses and uses only the signing component $pk^{\ast}$ while $ek_{s}$ enters $\pi$ exactly as in an honest key; it never uses $dk_{s}$ . It runs $(pk_{i},sk_{i})\leftarrow\mathsf{KeyGen}(pp)$ for all $i\neq s$ (so it holds $sk_{v}$ ), sets $\pi:=\{pk_{s},pk_{v}\}$ , and runs $\mathcal{A}$ , answering: $\mathcal{O}^{\mathsf{Corrupt}}(i)$ by $\bot$ if $i=s$ and by $sk_{i}$ otherwise (in particular it can deliver $sk_{v}$ ); $H_{M}$ by lazy sampling consistent with programming; $H$ by relaying to its own oracle (it never programs $H$ ); $\mathcal{O}^{\mathsf{WSign}}(\mu)$ by $\mathsf{Sim}(\mu,\pi)$ (aborting on $\mathsf{bad}$ ); and $\mathcal{O}^{\mathsf{Confirm}}(\mu,\sigma)$ , for $(\mu,\sigma)\in W$ , by setting $M\leftarrow M\cup\{\mu\}$ and returning $\tilde{\sigma}\leftarrow\mathsf{Sign}_{sk^{\ast}}(\langle\mu,\pi,\sigma\rangle)$ . This is a perfect emulation of $\mathsf{G}_{1}$ . When $\mathcal{A}$ outputs $(\mu^{\ast},\sigma^{\ast},\tilde{\sigma}^{\ast})$ , $\mathcal{B}$ outputs $(\langle\mu^{\ast},\pi,\sigma^{\ast}\rangle,\tilde{\sigma}^{\ast})$ .

If $\mathcal{A}$ wins $\mathsf{G}_{1}$ then $\mathsf{CVerify}(\mu^{\ast},\pi,\sigma^{\ast},\tilde{\sigma}^{\ast})=1$ , hence $\mathsf{Verify}_{pk^{\ast}}(\langle\mu^{\ast},\pi,\sigma^{\ast}\rangle,\tilde{\sigma}^{\ast})=1$ . The only messages $\mathcal{B}$ sent to its signing oracle are $\langle\mu_{j},\pi,\sigma_{j}\rangle$ for the confirmation queries $j$ , each of which placed $\mu_{j}$ into $M$ . Since $\mu^{\ast}\notin M$ , we have $\mu^{\ast}\neq\mu_{j}$ for all $j$ , so by injectivity of $\langle\cdot\rangle$ the forgery message $\langle\mu^{\ast},\pi,\sigma^{\ast}\rangle$ is new. Thus $\mathcal{B}$ wins, giving $\Pr[\mathsf{G}_{1}]\leq\mathsf{Adv}^{\mathrm{EUF\text{-}CMA}}_{DS}(\mathcal{B})$ ; $\mathcal{B}$ makes at most $q_{C}$ signing queries. Combining,

\mathsf{Adv}^{\mathrm{EUF\text{-}CMA\text{-}ic}}_{WS}(\mathcal{A})\leq\mathsf{Adv}^{\mathrm{EUF\text{-}CMA}}_{DS}(\mathcal{B})+q_{W}\,\varepsilon_{\mathrm{zk}}+\frac{q_{W}(q_{H_{M}}+q_{W})}{2^{\alpha}}.

The reduction never rewinds $\mathcal{A}$ and never extracts from the OR-proof (only its simulatability is used), so there is no multiplicative $q_{H}$ loss. Insider corruption is captured: $\mathcal{B}$ holds $sk_{v}$ and may hand it to $\mathcal{A}$ , yet confirmation still needs $sk_{s}=sk^{\ast}$ , which $\mathcal{B}$ never knows.

Remark 3.8 (QROM).

wbsphack @@writeaux\newlabelrem:qromwcurrentlabel1wesphack In the QROM the only changes are: (i) the simulation of $\mathcal{O}^{\mathsf{WSign}}$ programs $H_{M}$ at an adaptively chosen, high-min-entropy point under superposition queries, which is handled by the adaptive reprogramming lemma of Grilo–Hövelmanns–Hülsing–Majenz [grilo2021], turning the term $q_{W}(q_{H_{M}}+q_{W})/2^{\alpha}$ into $\tfrac{3}{2}q_{W}\sqrt{(q_{H_{M}}+q_{W}+1)/2^{\alpha}}$ ; and (ii) Definition LABEL:def:ds-euf is taken in the QROM, which for Dilithium follows from $\mathrm{SelfTargetMSIS}$ and $\mathrm{MSIS}$ [ducas2017, kiltz2018]. The reduction $\mathcal{B}$ is unchanged, as it relays $H$ to the (quantum) $DS$ challenger and never programs it.

Theorem 3.9.

wbsphack @@writeaux\newlabelthm:withdrawwcurrentlabel1wesphack The scheme of Algorithms LABEL:alg:abs-keygen–LABEL:alg:abs-cverify is withdrawable. For any computationally unbounded adversary $\mathcal{A}$ making at most $q_{W}$ signing and $q_{H_{M}}$ random-oracle queries,

\mathsf{Adv}^{\mathrm{Withdraw}}_{WS}(\mathcal{A}):=\Pr\!\big[\mathsf{Exp}^{\mathrm{Withdraw}}_{WS,\mathcal{A}}(1^{\kappa})=1\big]\ \leq\ \tfrac{1}{2}+(q_{W}{+}1)\,\varepsilon_{\mathrm{zk}}+\frac{(q_{W}{+}1)(q_{H_{M}}{+}q_{W}{+}1)}{2^{\alpha}},

where $q_{W}$ is the number of signing-oracle queries, $q_{H_{M}}$ the number of queries to $H_{M}$ , and $\varepsilon_{\mathrm{zk}},\alpha$ are as in Lemma LABEL:lem:zk and Definition LABEL:ass:entropy. The bound is statistical, so it holds against computationally unbounded adversaries making at most $q_{H_{M}}$ random-oracle queries (assuming both key pairs are generated honestly by the experiment, as in Definition LABEL:def:withdraw). If instead $pk_{v}$ may be chosen by $\mathcal{A}$ , the bound gains an additive $\mathsf{Adv}^{\mathrm{MLWE}}$ term (Definition LABEL:def:mlwe), see Remark LABEL:rem:wd.

Proof 3.10.

We bound $\Pr[\mathsf{Exp}^{\mathrm{Withdraw}}_{WS,\mathcal{A}}(1^{\kappa})=1]$ of Definition LABEL:def:withdraw (Algorithm LABEL:alg:withdraw-exp). The experiment generates both key pairs honestly, sets $\pi=\{pk_{0},pk_{1}\}$ , draws $b\xleftarrow{\mathdollar}\{0,1\}$ , and gives $\mathcal{A}$ the challenge $\sigma_{b}=\mathsf{WSign}(\mu^{*},sk_{b},\pi)$ together with the signing oracle $\mathcal{O}^{\mathsf{WSign}}_{sk_{b},\pi}$ of Algorithm LABEL:alg:withdraw-oracle; finally $\mathcal{A}$ outputs a guess $b^{\prime}$ and wins iff $b^{\prime}=b$ . Let $\mathsf{Sim}(\mu,\pi)$ be the witness-free simulator of Lemma LABEL:lem:zk; crucially $\mathsf{Sim}$ depends only on the set $\pi$ (it simulates both branches), not on which party is the prover.

The whole view of $\mathcal{A}$ consists of $N:=q_{W}+1$ withdrawable signatures, all produced under the witness $sk_{b}$ (the challenge and the $q_{W}$ oracle replies), plus $\mathcal{A}$ ’s $q_{H_{M}}$ queries to $H_{M}$ .

Game $\mathsf{S}$ (witness-free). Modify the experiment so that each of these $N$ signatures is produced by $\mathsf{Sim}(\cdot,\pi)$ , programming the single induced $H_{M}$ -entry (and aborting on a clash). Since $\mathsf{Sim}$ uses neither $sk_{0}$ nor $sk_{1}$ , the entire experiment $\mathsf{S}$ – and hence the joint distribution of $\mathcal{A}$ ’s view and output $b^{\prime}$ – is independent of $b$ . Writing $p_{\mathsf{S}}:=\Pr[b^{\prime}=1\mid\mathsf{S}]$ , independence gives $\Pr[b^{\prime}=b\mid\mathsf{S}]=\tfrac{1}{2}\big((1-p_{\mathsf{S}})+p_{\mathsf{S}}\big)=\tfrac{1}{2}$ .

For $b\in\{0,1\}$ let $G_{b}$ be the real experiment conditioned on that bit, and $p_{b}:=\Pr[b^{\prime}=1\mid G_{b}]$ . We pass from $G_{b}$ to $\mathsf{S}$ by replacing the $N$ signatures one at a time. Each step turns one $\mathsf{WSign}(\cdot,sk_{b},\pi)$ into one $\mathsf{Sim}(\cdot,\pi)$ ; by Lemma LABEL:lem:zk, applied with party $b$ as the real prover (valid because $pk_{b}$ is honest, so $sk_{b}$ is a genuine witness), the two are within statistical distance $\varepsilon_{\mathrm{zk}}$ , provided the programmed point $(\mu,w_{s},w_{v},\pi)$ is fresh. By Definition LABEL:ass:entropy the commitment pair has min-entropy $\geq\alpha$ , so at any step the freshness fails with probability at most $(q_{H_{M}}+N)/2^{\alpha}$ (the $H_{M}$ -table holds at most $q_{H_{M}}+N$ points). Summing over the $N$ hybrids,

\big|p_{b}-p_{\mathsf{S}}\big|\ \leq\ \delta:=N\varepsilon_{\mathrm{zk}}+\frac{N(q_{H_{M}}+N)}{2^{\alpha}},\qquad b\in\{0,1\}.

Using $\Pr[b^{\prime}=0\mid G_{0}]=1-p_{0}$ ,

\Pr[\mathsf{Exp}^{\mathrm{Withdraw}}_{WS,\mathcal{A}}=1]=\tfrac{1}{2}\big(\Pr[b^{\prime}=0\mid G_{0}]+\Pr[b^{\prime}=1\mid G_{1}]\big)=\tfrac{1}{2}+\tfrac{1}{2}\,(p_{1}-p_{0}).

By the triangle inequality $|p_{1}-p_{0}|\leq|p_{1}-p_{\mathsf{S}}|+|p_{\mathsf{S}}-p_{0}|\leq 2\delta$ , hence

\Pr[\mathsf{Exp}^{\mathrm{Withdraw}}_{WS,\mathcal{A}}=1]\ \leq\ \tfrac{1}{2}+\delta=\tfrac{1}{2}+(q_{W}+1)\varepsilon_{\mathrm{zk}}+\frac{(q_{W}+1)(q_{H_{M}}+q_{W}+1)}{2^{\alpha}}.

Every step is information-theoretic, so the bound holds against computationally unbounded adversaries that make at most $q_{H_{M}}$ random-oracle queries.

Remark 3.11 (Theorem LABEL:thm:withdraw in the QROM).

wbsphack @@writeaux\newlabelrem:qrom-wdwcurrentlabel1wesphack Theorem LABEL:thm:withdraw is stated in the classical ROM. Its only use of the random oracle is the witness-free simulation of $\mathsf{WSign}$ , which programs $H_{M}$ at the adaptively chosen, high- min-entropy point $(\mu,w_{s},w_{v},\pi)$ (Assumption LABEL:ass:entropy). In the QROM the adaptive-reprogramming lemma of Grilo–Hövelmanns–Hülsing–Majenz [grilo2021] applies exactly as in Remark LABEL:rem:qrom, replacing the classical freshness term $\tfrac{(q_{W}{+}1)(q_{H_{M}}{+}q_{W}{+}1)}{2^{\alpha}}$ by $\tfrac{3}{2}(q_{W}{+}1)\sqrt{(q_{H_{M}}{+}q_{W}{+}1)/2^{\alpha}}$ ; the statistical, information-theoretic core of the argument is unchanged. For the no-hint instantiation the two real signing distributions are identical (Lemma LABEL:lem:perfectzk), so the $dk_{v}$ / $sk_{v}$ bound of Proposition LABEL:prop:sdvs is exact in both models and incurs no reprogramming term.

Remark 3.12 (Adversarial $pk_{v}$ ; strong-DV variant).

wbsphack @@writeaux\newlabelrem:wdwcurrentlabel1wesphack Definition LABEL:def:withdraw generates both keys honestly, so the proof is statistical. In the stronger model where $\mathcal{A}$ chooses $pk_{v}$ , $\mathsf{Sim}$ still simulates for any $pk_{v}$ , but the two real provers require both statements to admit short witnesses; bridging an honestly generated $pk_{v}$ to an adversarial one costs one decisional-MLWE step (Definition LABEL:def:mlwe), adding $\mathsf{Adv}^{\mathrm{MLWE}}$ to the bound. For the strong designated-verifier scheme of Section LABEL:sec:sdvs, the same hybrid first replaces every signature by a simulated one and then replaces the two ciphertexts and the one-time pad by uniform strings; this yields $\Pr[\mathsf{Exp}^{\mathrm{Withdraw}}=1]\leq\tfrac{1}{2}+(q_{W}{+}1)\varepsilon_{\mathrm{zk}}+q_{W}\big(2\,\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}+\mathsf{Adv}^{\mathrm{prg}}_{G}\big)+\tfrac{(q_{W}{+}1)(q_{H_{M}}{+}q_{W}{+}1)}{2^{\alpha}}$ , i.e. withdrawability against third parties as in Proposition LABEL:prop:sdvs, now made quantitative; non-transferability against the designated verifier is exactly the statistical statement proved above.

3.2 An instantiation

wbsphack @@writeaux\newlabelsubsec:instantiationwcurrentlabel1wesphack The general construction of Section LABEL:sec:abstract for a withdrawable digital signature scheme whose underlying scheme is built using the Fiat–Shamir with aborts paradigm was proven to be unforgeable under insider corruption and withdrawable. As a direct application of this proposal, in this section we present a withdrawable signature scheme based on a no-hint, full- $\mathbf{t}$ Dilithium-style Fiat–Shamir-with-aborts signature [ducas2017]; adapting to production ML-DSA (with hints, and a nonzero $\varepsilon_{\mathrm{zk}}$ ) is discussed after Corollary LABEL:cor:concrete. The verification algorithm below is public; it serves as a building block ( $\mathsf{WSVerify}^{\mathsf{pub}}$ ) that Section LABEL:sec:sdvs encrypts to the designated verifier to obtain the strong designated-verifier withdrawable signature of Definition LABEL:def:ws.

Algorithm 14 Dilithium signature [ducas2017]wbsphack @@writeaux\newlabelalg:dilithiumwcurrentlabel1wesphack

1:procedure KeyGen(

1^{\kappa}

)

\mathbf{A}\xleftarrow{\mathdollar}R_{q}^{k\times l},\ (\mathbf{s}_{1},\mathbf{s}_{2})\xleftarrow{\mathdollar}S_{\eta}^{l}\times S_{\eta}^{k}

\mathbf{t}=\mathbf{A}\mathbf{s}_{1}+\mathbf{s}_{2}

4: return

(pk=(\mathbf{A},\mathbf{t}),\ sk=(\mathbf{A},\mathbf{t},\mathbf{s}_{1},\mathbf{s}_{2}))

5:end procedure

6:procedure Sign(

\mu,sk

)

7: repeat

\mathbf{y}\xleftarrow{\mathdollar}S_{\gamma_{1}-1}^{l}

\mathbf{w}=\mathsf{HighBits}(\mathbf{A}\mathbf{y},2\gamma_{2})

10:

c\in\mathcal{C}=H(\mu,\mathbf{w})

11:

\mathbf{z}=\mathbf{y}+c\mathbf{s}_{1}

12: until

(\lVert\mathbf{z}\rVert_{\infty}<\gamma_{1}-\beta)\wedge(\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{y}-c\mathbf{s}_{2},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta)

13: return

\sigma=(\mathbf{z},c)

14:end procedure

15:procedure Verify(

\mu,pk,\sigma

)

16:

\mathbf{w}^{\prime}=\mathsf{HighBits}(\mathbf{A}\mathbf{z}-c\mathbf{t},2\gamma_{2})

17: if

\lVert\mathbf{z}\rVert_{\infty}<\gamma_{1}-\beta

and

c=H(\mu,\mathbf{w}^{\prime})

then return

1

18: end if

19:end procedure

Taking the above algorithm as starting point and following the general construction in Section LABEL:sec:abstract, it is straightforward to set a withdrawable digital signature based on Dilithium.

Since Dilithium relies on the hardness of MSIS, Theorem LABEL:thm:unforge applies to prove that the proposal below is unforgeable under insider corruption. Theorem LABEL:thm:withdraw then proves withdrawability of the honest-key public core statistically, under Assumption LABEL:ass:entropy and perfect naHVZK; the hardness of the decisional MLWE problem is used only for adversarially chosen verifier keys (Remark LABEL:rem:wd) and for the privacy of the encryption layer in Section LABEL:sec:sdvs.

Below follows the withdrawable signature based on Dilithium:

Algorithm 15

\mathsf{KeyGen}(pp)

wbsphack @@writeaux\newlabelalg:dil-keygenwcurrentlabel1wesphack

1:parse

\mathbf{A}

from

pp

(\mathbf{s}_{1},\mathbf{s}_{2})\xleftarrow{\mathdollar}S_{\eta}^{l}\times S_{\eta}^{k}

\mathbf{t}=\mathbf{A}\mathbf{s}_{1}+\mathbf{s}_{2}

(ek,dk)\leftarrow\mathsf{KGen}_{e}(1^{\kappa})

5:return

pk=(\mathbf{A},\mathbf{t},ek),\ sk=(pk,\mathbf{s}_{1},\mathbf{s}_{2},dk)

Algorithm 16

\mathsf{WSign}^{\mathsf{pub}}(\mu,sk_{s},\pi)

wbsphack @@writeaux\newlabelalg:dil-wsignwcurrentlabel1wesphack

\pi=(pk_{s},pk_{v})

2:repeat

\triangleright

simulate verifier branch from the accepted distribution

c_{v}\xleftarrow{\mathdollar}\mathcal{C};\ \mathbf{z}_{v}\xleftarrow{\mathdollar}S_{\gamma_{1}-\beta-1}^{l};\ w_{v}=\mathsf{HighBits}(\mathbf{A}\mathbf{z}_{v}-c_{v}\mathbf{t}_{v},2\gamma_{2})

4:until

\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{z}_{v}-c_{v}\mathbf{t}_{v},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta

5:repeat

\mathbf{y}\xleftarrow{\mathdollar}S_{\gamma_{1}-1}^{l};\ w_{s}=\mathsf{HighBits}(\mathbf{A}\mathbf{y},2\gamma_{2})

g=H_{M}(\mu,w_{s},w_{v},\pi);\ c_{s}=\iota\big((g-\iota^{-1}(c_{v}))\bmod M\big)

\mathbf{z}_{s}=\mathbf{y}+c_{s}\mathbf{s}_{1}^{\prime}

9:until

(\lVert\mathbf{z}_{s}\rVert_{\infty}<\gamma_{1}-\beta)\wedge(\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{y}-c_{s}\mathbf{s}_{2}^{\prime},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta)

10:return

\sigma=(c_{s},c_{v},\mathbf{z}_{s},\mathbf{z}_{v})

Throughout, the signer instance of a key pair is written $sk_{s}=(pk_{s},\mathbf{s}_{1}^{\prime},\mathbf{s}_{2}^{\prime},dk_{s})$ with $pk_{s}=(\mathbf{A},\mathbf{t}_{s},ek_{s})$ , and the verifier instance $sk_{v}=(pk_{v},\mathbf{s}_{1}^{\prime\prime},\mathbf{s}_{2}^{\prime\prime},dk_{v})$ ; the primes are the per-party renaming of the generic $(\mathbf{s}_{1},\mathbf{s}_{2})$ output by $\mathsf{KeyGen}(pp)$ .

Remark 3.13.

wbsphack @@writeaux\newlabelrem:symwcurrentlabel1wesphack $\mathsf{WSign}^{\mathsf{pub}}$ is invoked by either party: the caller runs its own branch for real (with the rejection loop) and simulates the other from the accepted distribution above. A verifier signs by swapping the roles of $s$ and $v$ . Because both branches are now drawn from the accepted low-order distribution, the two invocations produce identically distributed $\sigma$ (Lemma LABEL:lem:perfectzk, $\varepsilon_{\mathrm{zk}}=0$ ), and the public predicates $\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{z}_{s}-c_{s}\mathbf{t}_{s},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta$ and $\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{z}_{v}-c_{v}\mathbf{t}_{v},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta$ hold simultaneously, revealing nothing about the origin.

Algorithm 17

\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\sigma)

wbsphack @@writeaux\newlabelalg:dil-wsverifywcurrentlabel1wesphack

\sigma=(c_{s},c_{v},\mathbf{z}_{s},\mathbf{z}_{v})

w_{s}^{\prime}=\mathsf{HighBits}(\mathbf{A}\mathbf{z}_{s}-c_{s}\mathbf{t}_{s},2\gamma_{2});\ w_{v}^{\prime}=\mathsf{HighBits}(\mathbf{A}\mathbf{z}_{v}-c_{v}\mathbf{t}_{v},2\gamma_{2})

g=H_{M}(\mu,w_{s}^{\prime},w_{v}^{\prime},\pi)

4:if

(\iota^{-1}(c_{s})+\iota^{-1}(c_{v})\equiv g\!\!\pmod{M})\wedge(\lVert\mathbf{z}_{s}\rVert_{\infty}<\gamma_{1}-\beta)\wedge(\lVert\mathbf{z}_{v}\rVert_{\infty}<\gamma_{1}-\beta)

then return

1

5:end if

Algorithm 18

\mathsf{Confirm}^{\mathsf{pub}}(\mu,sk_{s},\pi,\sigma)

wbsphack @@writeaux\newlabelalg:dil-confirmwcurrentlabel1wesphack

1:return

\tilde{\sigma}\leftarrow\mathsf{Sign}_{sk_{s}}(\mu\,\|\,\pi\,\|\,\sigma)

\triangleright

ordinary Dilithium signature, Alg. LABEL:alg:dilithium

Algorithm 19

\mathsf{CVerify}^{\mathsf{pub}}(\mu,\pi,\sigma,\tilde{\sigma})

wbsphack @@writeaux\newlabelalg:dil-cverifywcurrentlabel1wesphack

\sigma=(c_{s},c_{v},\mathbf{z}_{s},\mathbf{z}_{v})

2:if

\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\sigma)=1\ \wedge\ \mathsf{Verify}_{pk_{s}}(\mu\,\|\,\pi\,\|\,\sigma,\ \tilde{\sigma})=1

then return

1

3:end if

Remark 3.14 (Correctness).

wbsphack @@writeaux\newlabelrem:rrwcurrentlabel1wesphack For the real branch, the rejection condition $\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{y}-c_{s}\mathbf{s}_{2}^{\prime},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta$ yields $\mathsf{HighBits}(\mathbf{A}\mathbf{z}_{s}-c_{s}\mathbf{t}_{s},2\gamma_{2})=\mathsf{HighBits}(\mathbf{A}\mathbf{y},2\gamma_{2})=w_{s}$ ; the simulated branch matches by construction; and $\iota^{-1}(c_{s})+\iota^{-1}(c_{v})\equiv g$ by definition of $c_{s}$ . Hence $\mathsf{WSVerify}$ accepts honest signatures, and $\mathsf{CVerify}$ accepts by correctness of $\mathsf{Sign}$ . The quantity $r$ of the original construction is no longer used, so the former $r=r^{\prime}$ identity is unnecessary.

Instantiation of $\varepsilon_{\mathrm{zk}}$ and $\alpha$ .

Our scheme uses the no-hint identification scheme: verification recomputes $w^{\prime}=\mathsf{HighBits}(\mathbf{A}\mathbf{z}-c\mathbf{t},2\gamma_{2})$ from the full $\mathbf{t}$ (no $\mathbf{t}_{0}/\mathbf{t}_{1}$ split, no hint). For this scheme the simulator of Lemma LABEL:lem:zk is perfect.

Lemma 3.15 (Perfect naHVZK).

wbsphack @@writeaux\newlabellem:perfectzkwcurrentlabel1wesphack Conditioned on the programmed $H_{M}$ -point being fresh, the simulator $\mathsf{Sim}(\mu,\pi)$ of Lemma LABEL:lem:zk produces a transcript identically distributed to a genuine $\mathsf{WSign}(\mu,sk_{s},\pi)$ ; that is, $\varepsilon_{\mathrm{zk}}=0$ .

Proof 3.16.

Fix the challenge $c$ (uniform in the real game as $H_{M}$ is a random oracle, and uniform in the simulation by programming a fresh point). In $\mathsf{WSign}$ , $\mathbf{y}$ is uniform over $S_{\gamma_{1}-1}^{l}$ and $\mathbf{z}=\mathbf{y}+c\mathbf{s}_{1}^{\prime}$ ; conditioned on $\lVert\mathbf{z}\rVert_{\infty}<\gamma_{1}-\beta$ , $\mathbf{z}$ is uniform over $S_{\gamma_{1}-\beta-1}^{l}$ , because each target $\mathbf{z}$ in that box has a unique in-range preimage $\mathbf{y}=\mathbf{z}-c\mathbf{s}_{1}^{\prime}$ (as $\lVert c\mathbf{s}_{1}^{\prime}\rVert_{\infty}\leq\beta$ ). The further test $\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{y}-c\mathbf{s}_{2}^{\prime},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta$ equals $\lVert\mathsf{LowBits}(\mathbf{A}\mathbf{z}-c\mathbf{t}_{s},2\gamma_{2})\rVert_{\infty}<\gamma_{2}-\beta$ (since $\mathbf{A}\mathbf{z}-c\mathbf{t}_{s}=\mathbf{A}\mathbf{y}-c\mathbf{s}_{2}^{\prime}$ ), a function of $(c,\mathbf{z})$ and the public $\mathbf{t}_{s}$ only; and the recomputed commitment is $\mathsf{HighBits}(\mathbf{A}\mathbf{z}-c\mathbf{t}_{s},2\gamma_{2})=w_{s}$ . The corrected simulator (Lemma LABEL:lem:zk) draws $\mathbf{z}$ uniformly over $S_{\gamma_{1}-\beta-1}^{l}$ with the identical low-order test and sets $w_{s}=\mathsf{HighBits}(\mathbf{A}\mathbf{z}-c\mathbf{t}_{s},2\gamma_{2})$ . Hence the conditional law of $(c,\mathbf{z},w_{s})$ is identical in both, and the verifier branch is produced by the same simulation on both sides. The transcripts therefore coincide.

	$(k,l)$	$\eta,\tau,\beta$	$\gamma_{1},\gamma_{2}$	$\tfrac{q-1}{2\gamma_{2}}$	$\alpha\ (\geq)$
Dilithium2 / ML-DSA-44	$(4,4)$	$2,39,78$	$2^{17},\,95232$	$44$	$1397$
Dilithium3 / ML-DSA-65	$(6,5)$	$4,49,196$	$2^{19},\,261888$	$16$	$1024$
Dilithium5 / ML-DSA-87	$(8,7)$	$2,60,120$	$2^{19},\,261888$	$16$	$1024$

Table 1: Parameters (

n=256

q=8380417

) and the resulting commitment min-entropy lower bound

\alpha

(bits). Challenge entropies

\log_{2}|B_{\tau}|=192.8,225.3,257.0

Corollary 3.17 (Concrete security).

wbsphack @@writeaux\newlabelcor:concretewcurrentlabel1wesphack Instantiated with no-hint Dilithium, the scheme has $\varepsilon_{\mathrm{zk}}=0$ (Lemma LABEL:lem:perfectzk) and $\alpha\geq 1024$ (Assumption LABEL:ass:entropy). Hence, for any adversary making $q_{W}$ signing and $q_{H_{M}}$ random-oracle queries, Theorems LABEL:thm:unforge and LABEL:thm:withdraw give

	$\displaystyle\mathsf{Adv}^{\mathrm{EUF\text{-}CMA\text{-}ic}}_{WS}(\mathcal{A})$	$\displaystyle\leq\mathsf{Adv}^{\mathrm{EUF\text{-}CMA}}_{DS}(\mathcal{B})+q_{W}(q_{H_{M}}+q_{W})\,2^{-1024},$
	$\displaystyle\mathsf{Adv}^{\mathrm{Withdraw}}_{WS}(\mathcal{A})$	$\displaystyle\leq\tfrac{1}{2}+(q_{W}{+}1)(q_{H_{M}}{+}q_{W}{+}1)\,2^{-1024}.$

Unforgeability reduces to the EUF-CMA security of the underlying no-hint Dilithium-style signature (up to the $2^{-1024}$ programming term), whereas withdrawability follows statistically from perfect naHVZK ( $\varepsilon_{\mathrm{zk}}=0$ ) and Assumption LABEL:ass:entropy, up to the same $2^{-1024}$ programming term; it does not reduce to EUF-CMA.

Remark 3.18 (Hint-optimised Dilithium).

Production Dilithium publishes $\mathbf{t}_{1}$ (not $\mathbf{t}$ ) plus a hint $\mathbf{h}$ , which trades the exact recovery $\mathsf{HighBits}(\mathbf{A}\mathbf{z}-c\mathbf{t})=w_{s}$ for $\mathsf{UseHint}$ . That variant has a small, standard naHVZK defect in place of $\varepsilon_{\mathrm{zk}}=0$ and slightly smaller signatures; our no-hint choice keeps the proofs clean (perfect naHVZK) at a modest size cost. Either way the asymptotic and concrete security are governed by the same $\mathsf{Adv}^{\mathrm{EUF\text{-}CMA}}_{DS}$ and $2^{-\alpha}$ terms.

3.3 Strong designated-verifier variant

wbsphack @@writeaux\newlabelsec:sdvswcurrentlabel1wesphack

The scheme of Sections LABEL:sec:abstract and 3.2 is publicly verifiable. To match the Liu–Baek–Susilo model [liu2023], where a withdrawable signature is verifiable only by the designated verifier, we upgrade it to a strong designated-verifier (SDVS) scheme: we hybrid-encrypt the publicly-verifiable signature to the verifier (and to the signer, so that $\mathsf{Confirm}$ stays stateless). Write $(\mathsf{WSign}^{\mathsf{pub}},\mathsf{WSVerify}^{\mathsf{pub}},\mathsf{Confirm}^{\mathsf{pub}},\mathsf{CVerify}^{\mathsf{pub}})$ for the scheme of Section LABEL:subsec:instantiation (Algorithms LABEL:alg:dil-wsign–LABEL:alg:dil-cverify), where $\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\rho)$ is public; $\mathsf{KeyGen}$ is as amended (each party holds $(ek,dk)$ ). Let $\rho$ denote a public ring signature and $\|\rho\|$ its bit length.

Algorithm 20

\mathsf{WSign}(\mu,sk_{s},\pi)

(strong DVS)wbsphack @@writeaux\newlabelalg:sdvs-wsignwcurrentlabel1wesphack

\rho\leftarrow\mathsf{WSign}^{\mathsf{pub}}(\mu,sk_{s},\pi)

\triangleright

public OR-proof ring signature

K\xleftarrow{\mathdollar}\{0,1\}^{\kappa}

ct_{s}\leftarrow\mathsf{Enc}(ek_{s},K);\quad ct_{v}\leftarrow\mathsf{Enc}(ek_{v},K)

C\leftarrow\rho\oplus G(K)

\triangleright

G(K)

truncated to

\|\rho\|

bits

5:return

\sigma=(ct_{s},ct_{v},C)

Algorithm 21

\mathsf{WSVerify}(\mu,sk_{v},pk_{s},\sigma)

(strong DVS; designated)wbsphack @@writeaux\newlabelalg:sdvs-wsverifywcurrentlabel1wesphack

1:parse

pk_{v}

from

sk_{v}

;

\pi=\{pk_{s},pk_{v}\}

; parse

\sigma=(ct_{s},ct_{v},C)

K\leftarrow\mathsf{Dec}(dk_{v},ct_{v});\quad\rho\leftarrow C\oplus G(K)

3:return

\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\rho)

Algorithm 22

\mathsf{Confirm}(\mu,sk_{s},\pi,\sigma)

(strong DVS)wbsphack @@writeaux\newlabelalg:sdvs-confirmwcurrentlabel1wesphack

1:parse

\sigma=(ct_{s},ct_{v},C)

K\leftarrow\mathsf{Dec}(dk_{s},ct_{s});\quad\rho\leftarrow C\oplus G(K)

\triangleright

signer recovers

\rho

via its own

dk_{s}

\bar{\sigma}\leftarrow\mathsf{Sign}_{sk_{s}}(\mu\,\|\,\pi\,\|\,\sigma)

4:return

\tilde{\sigma}=(\bar{\sigma},\rho,K)

Algorithm 23

\mathsf{CVerify}(\mu,\pi,\sigma,\tilde{\sigma})

(strong DVS; public)wbsphack @@writeaux\newlabelalg:sdvs-cverifywcurrentlabel1wesphack

1:parse

\sigma=(ct_{s},ct_{v},C),\ \tilde{\sigma}=(\bar{\sigma},\rho,K)

2:if

\big(C=\rho\oplus G(K)\big)\wedge\big(\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\rho)=1\big)\wedge\big(\mathsf{Verify}_{pk_{s}}(\mu\,\|\,\pi\,\|\,\sigma,\bar{\sigma})=1\big)

then return

1

3:end if

Remark 3.19 (Scope of confirmed verification).

wbsphack @@writeaux\newlabelrem:cverify-scopewcurrentlabel1wesphack $\mathsf{CVerify}$ certifies that the signer authenticated the outer object $\sigma$ (via $\bar{\sigma}=\mathsf{Sign}_{sk_{s}}(\mu\|\pi\|\sigma)$ ) and that the revealed pad opens $C$ to a public core $\rho$ that passes $\mathsf{WSVerify}^{\mathsf{pub}}$ . It does not publicly certify ciphertext consistency, i.e. that $ct_{s}$ and $ct_{v}$ encrypt the same $K$ : for randomised $\mathsf{PKE}$ this cannot be checked without opening the encryption randomness. Confirmation is therefore a signer-authenticated opening of $\sigma$ to a valid ambiguous core, which is all correctness (Definition LABEL:def:correct) and unforgeability (Theorem LABEL:thm:unforge) require; it does not retroactively attest that the designated verifier could decrypt $\sigma$ prior to confirmation. For honestly generated $\sigma$ the two ciphertexts do share $K$ , so $\mathsf{WSVerify}=1\Rightarrow\mathsf{CVerify}=1$ as stated.

Proposition 3.20 (SDVS variant).

wbsphack @@writeaux\newlabelprop:sdvswcurrentlabel1wesphack Assume $\mathsf{PKE}$ has ciphertext pseudorandomness (advantage $\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}$ ) and $G$ is a secure PRG. Then Algorithms LABEL:alg:sdvs-wsign–LABEL:alg:sdvs-cverify form a correct withdrawable signature (Definitions LABEL:def:ws–LABEL:def:withdraw) with designated verification, and:

•

(Designated verification / privacy.) Without $dk_{s}$ or $dk_{v}$ , $\sigma$ is pseudorandom; in particular third parties cannot publicly verify $\sigma$ ; recovering $\rho$ (and hence verifying) requires a decryption key, so both the designated verifier (via $dk_{v}$ ) and the signer (via $dk_{s}$ ) can verify.
•

(Withdrawability.) For any PPT third-party adversary making $q_{W}$ signing and $q_{H_{M}}$ random-oracle queries, $\mathsf{Adv}^{\mathrm{Withdraw}}:=\Pr[\mathsf{Exp}^{\mathrm{Withdraw}}_{WS,\mathcal{A}}=1]\leq\tfrac{1}{2}+(q_{W}{+}1)\big(2\,\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}+\mathsf{Adv}^{\mathrm{prg}}_{G}\big)$ , where $\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}$ is the ciphertext-pseudorandomness advantage of $\mathsf{PKE}$ . Against an adversary holding the full verifier secret key $sk_{v}=(pk_{v},\mathbf{s}_{1}^{\prime\prime},\mathbf{s}_{2}^{\prime\prime},dk_{v})$ the bound is $\tfrac{1}{2}+(q_{W}{+}1)\,\varepsilon_{\mathrm{zk}}$ : by the perfect naHVZK of Lemma LABEL:lem:perfectzk the verifier branch is identically distributed whether produced for real or simulated, so the witness confers no distinguishing power. This equals exactly $\tfrac{1}{2}$ for the no-hint Dilithium instantiation.
•

(Unforgeability under insider corruption.) Reduces to the EUF-CMA security of $\mathsf{Sign}$ exactly as in Theorem LABEL:thm:unforge; the reduction chooses $K$ and the ciphertexts itself, hence needs no secret key.

Proof 3.21.

The strong-DV algorithms (Algorithms LABEL:alg:sdvs-wsign–LABEL:alg:sdvs-cverify) are built on the public core

(\mathsf{WSign}^{\mathsf{pub}},\mathsf{WSVerify}^{\mathsf{pub}},\mathsf{Confirm}^{\mathsf{pub}},\mathsf{CVerify}^{\mathsf{pub}})

of Section LABEL:subsec:instantiation, a public-key encryption scheme $\mathsf{PKE}=(\mathsf{KGen}_{e},\mathsf{Enc},\mathsf{Dec})$ with decryption-failure probability $\delta_{\mathsf{PKE}}$ and ciphertext-pseudorandomness advantage $\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}$ (i.e. for any message $m$ , $\mathsf{Enc}(ek,m)$ is indistinguishable from a uniform ciphertext given $ek$ but not $dk$ ; this implies IND-CPA and key-privacy), and a PRG $G$ with advantage $\mathsf{Adv}^{\mathrm{prg}}_{G}$ . Recall $\sigma=(ct_{s},ct_{v},C)$ , $ct_{s}=\mathsf{Enc}(ek_{s},K)$ , $ct_{v}=\mathsf{Enc}(ek_{v},K)$ , $C=\rho\oplus G(K)$ , $\rho=\mathsf{WSign}^{\mathsf{pub}}(\mu,sk_{s},\pi)$ , $K\xleftarrow{\mathdollar}\{0,1\}^{\kappa}$ .

The verifier recovers $K=\mathsf{Dec}(dk_{v},ct_{v})$ and $\rho=C\oplus G(K)$ , so

\mathsf{WSVerify}=\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\rho)=1

by correctness of the core. $\mathsf{Confirm}$ recovers the same $(\rho,K)$ via $dk_{s}$ and outputs $\tilde{\sigma}=(\bar{\sigma},\rho,K)$ , $\bar{\sigma}=\mathsf{Sign}_{sk_{s}}(\mu\|\pi\|\sigma)$ ; then $\mathsf{CVerify}$ makes the following verifications: $C=\rho\oplus G(K)$ (true), $\mathsf{WSVerify}^{\mathsf{pub}}(\mu,\pi,\rho)=1$ , and $\mathsf{Verify}_{pk_{s}}(\mu\|\pi\|\sigma,\bar{\sigma})=1$ , all of which hold. The error is at most $2\delta_{\mathsf{PKE}}$ plus the negligible correctness errors of the core and of $\mathsf{Sign}$ .

We show $\sigma$ is pseudorandom to any party lacking both $dk_{s},dk_{v}$ . Hybrids: $\mathsf{H}_{0}=$ real $\sigma$ ; $\mathsf{H}_{1}$ replaces $ct_{s}$ by a uniform string; $\mathsf{H}_{2}$ also replaces $ct_{v}$ by a uniform string; $\mathsf{H}_{3}$ also replaces $G(K)$ by a uniform string $R$ . Each PKE step costs $\leq\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}$ (the reduction picks $K$ , embeds the challenge as $ct_{s}$ resp. $ct_{v}$ , and computes the rest from the known $K$ ; no decryption key is used); the PRG step costs $\leq\mathsf{Adv}^{\mathrm{prg}}_{G}$ (in $\mathsf{H}_{2}$ , $K$ feeds only $G$ ). In $\mathsf{H}_{3}$ , $C=\rho\oplus R$ is uniform and independent of $\rho$ , so $\sigma$ is uniform. Hence $\Delta(\sigma,\mathcal{U})\leq 2\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}+\mathsf{Adv}^{\mathrm{prg}}_{G}$ . Consequently no public procedure can decide validity of $\sigma$ (it would distinguish $\mathsf{H}_{0}$ from $\mathsf{H}_{3}$ ); verification requires a decryption key, so the designated verifier (via $dk_{v}$ ) and the signer (via $dk_{s}$ ) can verify, while third parties cannot.

In Definition LABEL:def:withdraw the adversary $\mathcal{A}$ holds no secret keys and sees $N:=q_{W}+1$ signatures (challenge and oracle replies) under the bit $b$ . Applying the previous hybrid to each, every signature is within $2\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}+\mathsf{Adv}^{\mathrm{prg}}_{G}$ of uniform independently of $b$ (a uniform $\sigma$ reveals neither $\rho$ nor which keys were used). Thus each of the two conditional views is within $N(2\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}+\mathsf{Adv}^{\mathrm{prg}}_{G})$ of the same $b$ -independent all-uniform view, whence

\Pr[\mathsf{Exp}^{\mathrm{Withdraw}}_{WS,\mathcal{A}}=1]\leq\tfrac{1}{2}+(q_{W}{+}1)\big(2\mathsf{Adv}^{\mathrm{pr}}_{\mathsf{PKE}}+\mathsf{Adv}^{\mathrm{prg}}_{G}\big).

If $\mathcal{A}$ holds the full verifier secret key $sk_{v}=(pk_{v},\mathbf{s}_{1}^{\prime\prime},\mathbf{s}_{2}^{\prime\prime},dk_{v})$ (in particular its $dk_{v}$ ), it decrypts and recovers $\rho=\mathsf{WSign}^{\mathsf{pub}}(\mu,sk_{b},\pi)$ ; the ciphertexts and $C$ are then determined by $(\rho,K)$ and carry no further information about $b$ . Here we do not route through the simulator/programming hybrid of Theorem LABEL:thm:withdraw; instead we compare the two real public-core distributions $\mathsf{WSign}^{\mathsf{pub}}(\cdot,sk_{0},\pi)$ and $\mathsf{WSign}^{\mathsf{pub}}(\cdot,sk_{1},\pi)$ directly. In each, one branch is produced for real and the other is drawn from the accepted low-order distribution, and in both cases the challenge $g=H_{M}(\mu,w_{s},w_{v},\pi)$ is read from the honest random oracle. By the per-branch naHVZK of Lemma LABEL:lem:zk, a real accepted branch and a simulated accepted branch are within statistical distance $\varepsilon_{\mathrm{zk}}$ as distributions, with no oracle reprogramming; hence the two real signing distributions are within $2\varepsilon_{\mathrm{zk}}$ per signature, and no $2^{-\alpha}$ freshness term is incurred. Summing over the $N=q_{W}{+}1$ signatures, $\Pr[\mathsf{Exp}^{\mathrm{Withdraw}}=1]\leq\tfrac{1}{2}+(q_{W}{+}1)\varepsilon_{\mathrm{zk}}$ . For the no-hint Dilithium instantiation $\varepsilon_{\mathrm{zk}}=0$ (Lemma LABEL:lem:perfectzk), so the two real distributions are identical and the excess advantage $\Pr[\mathsf{Exp}^{\mathrm{Withdraw}}=1]-\tfrac{1}{2}$ is exactly $0$ : even the designated verifier cannot tell whether it or the signer produced $\sigma$ .

The reduction is that of Theorem LABEL:thm:unforge, with the reduction performing the encryption itself. $\mathcal{B}$ receives the $\mathsf{Sign}$ -challenge key $pk^{\ast}$ , sets $pk_{s}:=pk^{\ast}$ , $\mathcal{B}$ receives the $\mathsf{Sign}$ -challenge key $pk^{\ast}$ (the signing component only). It generates a fresh encryption key pair $(ek_{s},dk_{s})\leftarrow\mathsf{KGen}_{e}(1^{\kappa})$ itself and sets $pk_{s}:=(pk^{\ast},ek_{s})$ , keeping $dk_{s}$ private; it never uses $dk_{s}$ (confirmation replies are served from stored $(\rho,K)$ , and signing queries encrypt under the public $ek_{s}$ ). It generates all other keys honestly (so it holds $sk_{v}$ and may give it to $\mathcal{A}$ ). It answers: $\mathcal{O}^{\mathsf{WSign}}(\mu)$ by simulating $\rho$ with the witness-free simulator of Lemma LABEL:lem:zk (programming $H_{M}$ ), drawing $K$ , setting $ct_{s}=\mathsf{Enc}(ek_{s},K)$ , $ct_{v}=\mathsf{Enc}(ek_{v},K)$ , $C=\rho\oplus G(K)$ , storing $(\sigma,\rho,K)$ in $W$ , and returning $\sigma$ ; and $\mathcal{O}^{\mathsf{Confirm}}(\mu,\sigma)$ , for $\sigma\in W$ , by retrieving the stored $(\rho,K)$ and returning $(\mathsf{Sign}_{sk^{\ast}}(\mu\|\pi\|\sigma),\rho,K)$ through the signing oracle. Thus $\mathcal{B}$ uses neither $sk_{s}$ nor any decryption key. A confirmed forgery $(\mu^{\ast},\sigma^{\ast},\tilde{\sigma}^{\ast}=(\bar{\sigma}^{\ast},\rho^{\ast},K^{\ast}))$ with $\mu^{\ast}$ never confirmed satisfies $\mathsf{Verify}_{pk^{\ast}}(\mu^{\ast}\|\pi\|\sigma^{\ast},\bar{\sigma}^{\ast})=1$ on the fresh message $\mu^{\ast}\|\pi\|\sigma^{\ast}$ , which $\mathcal{B}$ outputs. As in Theorem LABEL:thm:unforge,

\mathsf{Adv}^{\mathrm{EUF\text{-}CMA\text{-}ic}}_{WS}(\mathcal{A})\leq\mathsf{Adv}^{\mathrm{EUF\text{-}CMA}}_{DS}(\mathcal{B})+q_{W}\,\varepsilon_{\mathrm{zk}}+q_{W}(q_{H_{M}}+q_{W})/2^{\alpha},

with no contribution from $\mathsf{PKE}$ or $G$ (which $\mathcal{B}$ evaluates honestly).

3.4 Comparison with Liu–Baek–Susilo

wbsphack @@writeaux\newlabelsec:comparisonwcurrentlabel1wesphack

Our construction realises the same primitive and the same security model as Liu, Baek and Susilo [liu2023]: the syntax of Definition LABEL:def:ws and the security notions of Definitions LABEL:def:correct, LABEL:def:euf and LABEL:def:withdraw are theirs, and we follow their two-stage “withdraw, then confirm” template. The differences are confined to the construction, and each of them follows from a single structural fact about lattices.

Root cause: the group shared secret has no cheap lattice analogue.

The designation mechanism of [liu2023] is, at its core, a Diffie–Hellman (or pairing) shared secret embedded in the signature. In their Schnorr-based scheme the withdrawable signature contains $\sigma_{2}=pk_{v}^{\,z-rt}$ , which the designated verifier checks by raising to its secret key $sk_{v}$ via $(g^{a})^{b}=(g^{b})^{a}$ ; the BLS-based scheme uses $e(\cdot,g^{sk_{v}})$ in the same way. A single algebraic object thereby delivers both properties required of a withdrawable signature at once: signer/verifier ambiguity — either party can compute $\sigma$ from its own secret — and designation — verification requires $sk_{v}$ — using nothing but the parties’ ordinary public keys, in effect a non-interactive key agreement (NIKE). This shared secret is essentially free in a group but has no cheap lattice counterpart: the noisy analogue of $(g^{a})^{b}\approx(g^{b})^{a}$ agrees only approximately, so a literal transcription that blinds the signature by a uniform matrix $\mathbf{B}\in R_{q}^{k\times k}$ leaves a residue $\mathbf{B}\mathbf{s}_{2}^{\prime\prime}$ that the verifier cannot cancel (it is given $\mathbf{B}\mathbf{A}$ , never $\mathbf{B}$ ). Lattice NIKE is in fact possible: after a long line of negative evidence, including information-theoretic efficiency barriers for polynomial-modulus reconciliation [guo2022], the recent SWOOSH scheme [gajland2024] gives the first practical M-LWE NIKE — but at a cost (public keys of hundreds of kilobytes, a super-polynomial modulus-to-noise ratio, and a NIZK for active security) well above what designation needs. Crucially, designation does not require a shared secret at all: it only needs to deliver a key to the designated verifier, which is public-key encryption — a weaker and far cheaper primitive. We therefore keep ambiguity and designation as separate mechanisms, an OR-proof for the former and encryption for the latter; this is the origin of every row of Table LABEL:tab:comparison.

Aspect	Liu–Baek–Susilo [liu2023]	This work	Reason
Designation of $\sigma$	$sk_{v}$ enters the verification exponent (Diffie–Hellman / pairing)	encrypt $\sigma$ to $pk_{v}$ via a PKE	no free shared secret
Signer/verifier ambiguity	algebraic symmetry of $\sigma$	two-party FS-with-aborts OR-proof (witness-indist.)	no DH symmetry
Confirmation	re-derive shared randomness $r$ ; rebuild a linked $\tilde{\sigma}$	ordinary signature $\mathsf{Sign}_{sk_{s}}(\mu\,\\|\,\pi\,\\|\,\sigma)$	FS randomness not reusable
Key material	one key pair (signing $=$ designation)	signing key pair $+$ encryption key pair $(ek,dk)$	signing key cannot designate
Withdrawability from	DDH (Schnorr) / DBDH (BLS)	decisional MLWE (PKE) $+$ statistical WI	lattice counterpart
Unforgeability from	CDH / DL	MSIS / SelfTargetMSIS	lattice counterpart
Overall structure	monolithic designated-verifier object	public ambiguous core $+$ encryption layer	composition forced

Table 2: Comparison of the Liu–Baek–Susilo withdrawable signature with the lattice construction of this work. Every difference follows from the absence of a free Diffie–Hellman-style shared secret in the lattice setting (Section LABEL:sec:comparison).wbsphack @@writeaux\newlabeltab:comparisonwcurrentlabel1wesphack

Ambiguity and confirmation.

For ambiguity we use a two-clause Fiat–Shamir-with-aborts OR-proof (Algorithm LABEL:alg:dil-wsign): a proof of knowledge of a short witness for $\mathbf{t}_{s}$ or for $\mathbf{t}_{v}$ , which either party can produce by executing its own branch and simulating the other. This is the natural lattice substitute for the group symmetry, and it agrees with the authors’ own description of withdrawable signatures as two-party ring signatures augmented with a transformation stage [liu2023]. For confirmation, where [liu2023] reconstructs the shared randomness $r$ and rebuilds an algebraically linked $\tilde{\sigma}$ , we let $\mathsf{Confirm}$ emit an ordinary signature $\mathsf{Sign}_{sk_{s}}(\mu\,\|\,\pi\,\|\,\sigma)$ on the entire withdrawable object: the masking randomness of Fiat–Shamir with aborts is not reusable in the way a discrete-logarithm nonce is, and binding by a signature is both simpler and reducible to the unforgeability of the underlying scheme (Theorem LABEL:thm:unforge).

Designation by encryption: a PKE, not a KEM.

Lacking the free shared secret, we transport the designation explicitly: the scheme of Section LABEL:sec:sdvs encrypts the publicly verifiable, ambiguous signature $\rho$ to the verifier, so that only a holder of $dk_{v}$ can recover and check it. This encryption must place the same chosen key $K$ under two public keys: $ek_{v}$ , so that the verifier can decrypt and verify, and $ek_{s}$ , so that the signer can decrypt and run $\mathsf{Confirm}$ statelessly (it is given only $\sigma$ ). A key-encapsulation mechanism returns a fresh random key for each encapsulation and recipient, so $\mathsf{Encaps}(ek_{v})$ and $\mathsf{Encaps}(ek_{s})$ would produce two independent keys and the parties could never reconstruct the same $\rho=C\oplus G(K)$ ; delivering one shared chosen $K$ to both recipients is exactly encryption of a chosen message, i.e. a public-key encryption scheme. We therefore instantiate $\mathsf{PKE}$ with the CPA-secure module-LWE encryption underlying ML-KEM (Kyber), and not with the KEM itself. This encryption is precisely what the group construction obtains for nothing: there the shared key is the Diffie–Hellman value that both parties derive from their public keys, so [liu2023] require no encryption at all, whereas we must transport it — and to both parties — which is why a public-key encryption scheme appears in our construction where theirs has none.

Consequences.

The two schemes rest on parallel hardness assumptions: decisional MLWE replaces DDH/DBDH for withdrawability, and MSIS/SelfTargetMSIS replace CDH/DL for unforgeability. The lattice route is less compact — an extra encryption key pair per party, and a withdrawable signature carrying two ciphertexts and a one-time pad rather than three group elements — but it gains two properties: the withdrawable signature is pseudorandom, concealing from outsiders even the existence of a signature, and non-transferability against the designated verifier is perfect ( $\varepsilon_{\mathrm{zk}}=0$ for the no-hint instantiation) rather than computational. We regard these as necessary adaptations of the Liu–Baek–Susilo notion to the post-quantum setting rather than departures from it.

4 Conclusion and future research

This work uses the ideas in [liu2023] to extend the Fiat–Shamir with aborts paradigm [lyubashevsky2009] with withdrawability and defines a general construction for withdrawable lattice-based digital signature schemes.

We demonstrated our approach by creating a withdrawable version of Dilithium, though the same principles could be applied to other signature schemes like HAETAE [cheon2024]. Our construction maintains the security properties of the underlying signature scheme while adding the ability to withdraw signatures when needed by the signer.

Several directions remain for future research, including optimizing our construction’s efficiency and exploring additional features such as blindness, multiparty capabilities, or enhancing this construction with extended withdrawability, where rather than limiting verification to a specific entity, we can ensure the universal verifiability of the withdrawable signature by employing any signature scheme that can maintain signer ambiguity (this is work done in [liu2024]).

Another potential line of research is given by practical applications, particularly how these constructions could enhance quantum resistance in blockchain systems. The ability to withdraw signatures could prove valuable in blockchain environments where transaction revocation is desirable but traditionally difficult to implement.

References

uxtagasecondoftwo

Withdrawability in Fiat–Shamir with aborts constructions

Abstract

keywords:

1 Introduction

1.1 Contributions

1.2 Related work

2 Preliminaries

2.1 Notation

2.2 Basic definitions

Threat model.

Definition 2.1 ([liu2023], Section LABEL:subsec:instantiation).

Definition 2.2.

Definition 2.3.

Definition 2.4.

2.3 Security definitions and computational assumptions

Definition 2.5.

Definition 2.6.

Definition 2.7 (Non-transferability).

Definition 2.8 (Module Learning With Errors (MLWE)).

Definition 2.9 (Module Short Integer Solution (MSIS)).

Definition 2.10 (SelfTargetMSIS).

3 Withdrawable signature schemes

3.1 The abstract construction

Theorem 3.1 ([lyubashevsky2009], Theorem 2).

Assumption 1 (Commitment min-entropy).

Remark 3.2 (Heuristic support for Assumption LABEL:ass:entropy).

Lemma 3.3 (Witness-free simulatability / naHVZK).

Proof 3.4.

Theorem 3.5.

Remark 3.6.

Proof 3.7.

Remark 3.8 (QROM).

Theorem 3.9.

Proof 3.10.

Remark 3.11 (Theorem LABEL:thm:withdraw in the QROM).

Remark 3.12 (Adversarial p​kvpk_{v}; strong-DV variant).

3.2 An instantiation

Remark 3.13.

Remark 3.14 (Correctness).

Instantiation of εzk\varepsilon_{\mathrm{zk}} and α\alpha.

Lemma 3.15 (Perfect naHVZK).

Proof 3.16.

Corollary 3.17 (Concrete security).

Remark 3.18 (Hint-optimised Dilithium).

3.3 Strong designated-verifier variant

Remark 3.19 (Scope of confirmed verification).

Proposition 3.20 (SDVS variant).

Proof 3.21.

3.4 Comparison with Liu–Baek–Susilo

Root cause: the group shared secret has no cheap lattice analogue.

Ambiguity and confirmation.

Designation by encryption: a PKE, not a KEM.

Consequences.

4 Conclusion and future research

References

Remark 3.12 (Adversarial $pk_{v}$ ; strong-DV variant).

Instantiation of $\varepsilon_{\mathrm{zk}}$ and $\alpha$ .