LINEture Cryptosystem

• LINEture is a post-quantum digital signature scheme based on binary matrix algebra and secret-shared factorable permutations for compact key and signature generation.
• It utilizes a layered construction with message hashing, randomized session keys, and zero-knowledge protocols to ensure secure and efficient identity verification.
• The scheme achieves practical efficiency with significantly smaller keys and signatures compared to conventional NIST candidates, although its non-standard design calls for further cryptanalysis.

The LINEture cryptosystem is a digital signature scheme characterized by compact keys and signatures, utilizing matrix algebra over the field $\mathbb{F}_2$ and novel security mechanisms based on brute-force intractability. Unlike conventional cryptography predicated on computationally hard problems, LINEture achieves post-quantum security through algebraic indeterminacy, secret-shared factorable permutations, randomized session keys, and zero-knowledge authentication protocols (Khalimov et al., 11 Jan 2026, Kotukh et al., 6 Jan 2026).

1. Algebraic Foundation and Core Construction

LINEture operates on vectors and matrices over the binary field $\mathbb{F}_2$, with the principal objects being $m$-bit words and permutation matrices of size $2^m \times m$. Message signatures are constructed by associating each $m$-bit word $x \in \mathbb{F}_2^m$ to an element of an elementary abelian $2$-group. A public factorable permutation $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$ is given as:

$$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$

where $G_j$ are blocks encoding basis-vectors. The internal factorization of $\mathbb{F}_2$0 is concealed via a sequence of six secret homomorphic matrix transformations: basis permutation, block shuffle, add-vector, polynomial multiplication, non-singular matrix multiplication, and matrix addition. The resulting $\mathbb{F}_2$1 matrix’s factorization remains infeasible to recover except by brute-force, creating the cryptosystem’s fundamental hardness (Khalimov et al., 11 Jan 2026).

The shared secret for signature generation and verification is encoded as a stack of $\mathbb{F}_2$2 permutation matrices $\mathbb{F}_2$3, synthesized homomorphically by combining a public key matrix $\mathbb{F}_2$4 with a session-key matrix $\mathbb{F}_2$5:

$\mathbb{F}_2$6

(Eq. 1).

The indeterminacy of recovering $\mathbb{F}_2$7 from $\mathbb{F}_2$8 (except for known secret parameters) reduces adversarial attacks to brute-force search over secret matrix blocks.

2. Key Generation Process

Key generation proceeds as follows:

1. Master Key Construction:
   • Select a random non-singular matrix $\mathbb{F}_2$9 and form the private block matrix $m$0:

   $m$1

2. Public Substitution Blocks:

   • For each $m$2, generate matrices $m$3, $m$4, $m$5, and $m$6 of prescribed dimensions.
   • Assemble block matrices $m$7 to form $m$8.
3. Key Publishing:
   • The public key is $m$9, while master key components $2^m \times m$0, $2^m \times m$1, $2^m \times m$2, $2^m \times m$3 are retained privately (Khalimov et al., 11 Jan 2026).

3. Signature Generation Algorithm

Signature generation leverages message-dependent randomization and session keys as follows:

1. Message Hashing:
   • Hash the message to obtain $2^m \times m$4, viewed as $2^m \times m$5 words of $2^m \times m$6 bits.
2. Session Key Construction and Nonces:
   • Generate $2^m \times m$7 random nonces $2^m \times m$8 and an identity-proof nonce $2^m \times m$9, then compute $m$0 and $m$1.
   • Derive each $m$2 from $m$3 as per prespecified rules with scalar transformations $m$4.
3. Shared-Secret Computation:
   • Calculate $m$5 for two choices of $m$6 to enable a zero-knowledge proof of secret knowledge.
   • Verify $m$7 for identity proof.
4. Inverse Substitution:
   • Compute $m$8, achieved by block-diagonal inversion into $m$9 independent $x \in \mathbb{F}_2^m$0 inverses.
5. Signature Formation:
   • Output $x \in \mathbb{F}_2^m$1 (Khalimov et al., 11 Jan 2026).

4. Signature Verification Algorithm

Verification uses only public data and the received signature:

1. Hash Re-Evaluation:
   • Recompute $x \in \mathbb{F}_2^m$2 from nonces and message.
2. Session Key Reconstruction:
   • Derive $x \in \mathbb{F}_2^m$3 for $x \in \mathbb{F}_2^m$4 exactly as performed by the signer.
3. Identity Proof Validation:
   • For any $x \in \mathbb{F}_2^m$5, confirm $x \in \mathbb{F}_2^m$6; this demonstrates knowledge of the private decomposition.
4. Message Hash Reconstruction:
   • Compute $x \in \mathbb{F}_2^m$7 for the reconstructed shared-secret $x \in \mathbb{F}_2^m$8.
5. Acceptance Condition:
   • Accept the signature if and only if $x \in \mathbb{F}_2^m$9 (Khalimov et al., 11 Jan 2026).

5. Security Properties and Parameter Influence

Security relies on algebraic indeterminacy created by the incomplete definition of the matrix inversion underlying session keys. The adversarial effort to recover the secret matrix $2$0 is bounded by brute-force complexity $2$1, with $2$2 denoting word size and $2$3 the number of matrix subblocks. Collision resistance in substitution and hash-forgery is bounded by $2$4 and $2$5 respectively. The effective security is the minimum of these quantities; parameter recommendations for 128/192/256-bit classical security levels are prescribed explicitly:

• 128-bit security: $2$6, $2$7, $2$8, $2$9
• 192-bit security: $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$0, $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$1, $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$2, $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$3
• 256-bit security: $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$4, $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$5, $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$6 (Khalimov et al., 11 Jan 2026)

A deeper parameter analysis reveals a dualistic role for the vector dimension $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$7. While originally considered to affect only signature length, $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$8 also establishes a "verification barrier" of $g: \mathbb{F}_2^m \to \mathbb{F}_2^m$9 bits in the context of zero-knowledge identity proof. For $$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$0, the security contribution from this barrier dominates, enforcing a parameter selection rule $$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$1 for maximal cryptographic efficiency (Kotukh et al., 6 Jan 2026).

6. Performance, Practicality, and Comparative Evaluation

Key and signature sizes are notably compact. For typical NIST Level 1 parameters ($$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$2, $$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$3, $$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$4):

• Public key: $$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$51536 bytes
• Signature (with $$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$6): $$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$7144 bytes
• All signature and verification operations reduce to binary-matrix multiplication and inversion ($$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$8 bit operations), compatible with a few thousand machine cycles for practical $$g(x) = x_1 G_1 \oplus x_2 G_2 \oplus \cdots \oplus x_m G_m,$$9 values (Khalimov et al., 11 Jan 2026).

A comparative summary versus other NIST-PQC candidates is shown below:

Scheme	Security (bits)	PubKey size	Sig size
LINEture (8,16,3)	128	~50 B	~100 B
CRYSTALS-Dilithium-II	128	~1300 B	~2420 B
Falcon-512	128	~897 B	~666 B
SPHINCS+	128	~32 B	~8000 B

This suggests LINEture offers key and signature sizes substantially smaller than lattice-based or hash-based alternatives, but its algebraic structure is distinct from NIST standards and lacks a tight reduction proof. The trade-off is between unconventional algebraic design and practical compactness (Kotukh et al., 6 Jan 2026).

7. Context, Implications, and Limitations

LINEture advances a non-standard approach to post-quantum digital signatures, with security based on secret-shared permutations and brute-force resistance rather than assumed computational hardness. The scheme's security and efficiency directly reflect choice of $G_j$0, with parameter tuning ensuring classical security thresholds. The absence of a tight reduction and limited public cryptanalysis to date mark open directions for further investigation and scrutiny. A plausible implication is that ongoing community cryptanalysis and standardized benchmark comparisons will be essential for establishing long-term confidence in the scheme's resilience and practicality (Khalimov et al., 11 Jan 2026, Kotukh et al., 6 Jan 2026).