---
title: SelfTargetMSIS in Lattice Cryptography
url: https://www.emergentmind.com/topics/selftargetmsis
type: topic
---

# SelfTargetMSIS in Lattice Cryptography

SelfTargetMSIS is a computational problem within module lattice-based cryptography, introduced as a central security assumption in the analysis of CRYSTALS-Dilithium digital signatures. It extends the traditional Module Short Integer Solution (MSIS) problem to a “self-targeting” variant, forming the basis for the first quantum reduction from Module Learning With Errors (MLWE) to Dilithium’s signature security in the Quantum Random Oracle Model (QROM). This problem and its reduction underpin the provable post-quantum security of Dilithium instantiated in rings with moduli q ≡ 1 mod 2n, enabling practical use of the fastest Number Theoretic Transform (NTT) algorithms in implementation [2312.16619].

## 1. Definition and Formalization

Let $q$ be an odd prime, $n$ a power of 2, and $R_q = \mathbb{Z}_q[X]/(X^n+1)$. Consider integer parameters $m, k, \gamma, \tau$ and a hash function $H\colon \{0,1\}^* \to B_\tau$, where $B_\tau \subset R_q$ is the set of ring elements with exactly $\tau$ nonzero coefficients, each in $\{\pm1\}$. A quantum adversary $\mathcal{A}$ is given quantum query access to $H$ and a random $A \gets R_q^{m \times k}$.

Success in SelfTargetMSIS$_{H, \tau, m, k, \gamma}$ is defined as the adversary producing a pair $(y, M)$ such that
$$
H((I_m \parallel A)\cdot y \ \| \ M) = y_{m+k}, \quad \|y\|_\infty \leq \gamma,
$$
where $\cdot$ is the canonical matrix–vector product over $R_q$, $I_m$ is the $m\times m$ identity, and $y_{m+k}$ selects the last coordinate of $y$. Formally,
$$
\mathrm{Adv}^{\mathrm{SelfTargetMSIS}}_{H,\tau,m,k,\gamma}(\mathcal{A}) := \Pr_{A, H}\left[\begin{array}{l}
(y, M) \leftarrow \mathcal{A}^{|H\rangle}(A):\\
H((I_m\|A)\cdot y \ \| \ M) = y_{m+k} \wedge \|y\|_\infty \leq \gamma
\end{array}\right].
$$
This formulation captures the challenge of finding a "self-targeted" preimage $y$ whose last component matches the hash output, even when $H$ is accessible only as a quantum random oracle [2312.16619].

## 2. Relationship to Classical MSIS and MLWE

SelfTargetMSIS is a structural extension of the MSIS problem. In MSIS$_{m,k,\gamma}$, the adversary, given $A \gets R_q^{m\times k}$, finds nonzero $y \in R_q^{m+k}$ such that $(I_m\|A)y = 0$ and $\|y\|_\infty \leq \gamma$.

Connections:
- **MSIS ≤ROM SelfTargetMSIS:** Classically, given two distinct SelfTargetMSIS solutions for the same $A$ but different $y_{m+k}$, their difference is a short MSIS solution.
- **MLWE to SelfTargetMSIS (quantum):** The sEUF security reduction chain for Dilithium in the QROM decomposes a forger into three parts: one attacking MLWE, one for SelfTargetMSIS, and one for MSIS. Therefore, demonstrating the quantum hardness of SelfTargetMSIS underpins the security of Dilithium in the QROM [2312.16619].

## 3. Quantum Reduction: MLWE to SelfTargetMSIS

The key technical contribution is a quantum reduction from MLWE$_{m+k, m, \eta}$ to SelfTargetMSIS$_{H, \tau, m, k, \gamma}$. The reduction follows four main steps:
- **Plain→SelfTargetMSIS:** Ensures the input matrix $A$ is in row-echelon form (specifically $(I_m\|A')$), so a solver for the "Plain" problem yields a SelfTargetMSIS solver, modulo negligible loss.
- **Plain→CCB (Chosen-Coordinate Binding):** Applies the Liu–Zhandry "measure-and-reprogram" lemma, converting any $Q$-query SelfTargetMSIS adversary into a query-free solver for a CCB experiment—with a quadratic degradation to $(2Q+1)^2$ in advantage.
- **CCB→Collapse (Collapsing Test):** Utilizes quantum rewinding techniques (Unruh), showing that a successful CCB adversary gives a solution to the collapsing test experiment, with success probability squared (minus statistical offset).
- **Collapse→MLWE:** Uses identity-vs-measurement distinguishing (following Liu–Montgomery–Zhandry) to show any successful Collapse adversary can be turned into an MLWE distinguisher, given appropriate parameter constraints ($2\gamma\eta n(m+k)<q/32$ and $q\equiv1\ \mathrm{mod}\ 2n$).

The result is that, under these conditions, any quantum adversary with non-negligible advantage $\varepsilon$ against SelfTargetMSIS can be converted into an MLWE adversary with comparable runtime and advantage $\Omega(\varepsilon^2/Q^4)$ [2312.16619].

## 4. Collapsing Hash Functions and Security in the QROM

The analysis requires that the MSIS-derived hash function $H((I_m\|A)y\ \|\ M)$ is *collapsing* in the sense of Unruh. This property ensures that, in the QROM, hash outputs appear classical to any quantum adversary, enabling the Fiat–Shamir with aborts paradigm for signature security to go through with negligible loss.

The collapsing property is established through a sequence of projection-based arguments connecting the ability to win the Chosen-Coordinate Binding game to violating the collapsing condition. Specifically, if an adversary can produce two distinct valid preimages with different last coordinates, then the hash cannot be collapsing. This property is critical for extending the sEUF–CMA (strong Existential Unforgeability under Chosen Message Attack) proof for Dilithium from the classical ROM to the QROM [2312.16619].

## 5. Integration in Dilithium Security Proofs

With these reductions and hash function properties, security proofs for CRYSTALS-Dilithium under the native condition $q\equiv1\ \mathrm{mod}\ 2n$ in the QROM are achieved under standard Module LWE and MSIS assumptions. Specifically, for any forger making $Q$ queries, the existential unforgeability advantage is bounded by:
$$
\mathrm{Adv}^{\mathrm{sEUF}}_{\mathrm{Dilithium}}(\mathcal{A}) \leq \mathrm{Adv}^{\mathrm{MLWE}}(B) + \mathrm{Adv}^{\mathrm{SelfTargetMSIS}}(C) + \mathrm{Adv}^{\mathrm{MSIS}}(D) + \text{negligible}.
$$
Given the reduction $\mathrm{Adv}^{\mathrm{SelfTargetMSIS}} \leq O(\mathrm{Adv}^{\mathrm{MLWE}}/Q^4)$, every Dilithium forger yields a nonnegligible MLWE or MSIS solver [2312.16619].

## 6. Parameter Choices and Practical Implications

The quantum reduction introduces a $Q^4$-factor loss, requiring larger parameters for concrete instantiations. For NIST Level 3 security (target 128-bit quantum SVP cost), Jackson et al. propose:
- $q_0 \approx 2^{43.5}$, $n=512$, $k=10$, $l=10$, $\tau=40$, $\gamma_1 \approx 3.7 \times 10^5$, $\gamma_2 \approx 7.4 \times 10^5$, $\eta=2$, $d=15$
- Public key size: $\approx 18\,592$ bytes
- Signature size: $\approx 13\,490$ bytes

Compared to standard Dilithium ($\approx1952$ B public key, $3448$ B signature), these settings are $\approx1.3\times$ larger in signature and $\approx9.5\times$ larger in public key size at Level 3. However, they are the first settings for which sEUF in QROM is provably reduced to MLWE/MSIS, exploiting native NTT (“fast ring”) structures. Additionally, the ring arithmetic is $1.9$–$3.6\times$ faster than hybrid-NTT instantiations previously needed to avoid the $q\equiv 1\ \mathrm{mod}\ 2n$ case [2312.16619].

| Security Level | MLWE (bits) | SelfTargetMSIS (bits) | Public Key Size (B) | Signature Size (B) |
|----------------|:----------:|:---------------------:|:------------------:|:------------------:|
| Level 3 (128Q) |   $\sim$400 |     $\sim$100         |      18,592        |      13,490        |

## 7. Significance and Ongoing Research

SelfTargetMSIS enables the first *quantum-sound* security proof for CRYSTALS-Dilithium in its natural parameter regime, without requiring restrictive modulus choices or inefficient hybrid structures. The quantum reduction and collapsing hash analysis close prior gaps in the QROM, providing a solid foundation for Dilithium as a post-quantum standard with native NTT performance. A plausible implication is ongoing optimization of parameter sizes and better bounds for SelfTargetMSIS hardness, as this directly impacts key and signature efficiency in practice [2312.16619].

Source: https://www.emergentmind.com/topics/selftargetmsis