Signature-Based Encoding Scheme

• Signature-based encoding schemes are digital signature constructions that embed message-dependent data into a structured format verified through public cryptographic relations.
• They typically employ a three-stage process: normalizing the message, applying secret inversion or sampling, and public verification using a forward mapping.
• Implementations span code-based, lattice, and multivariate designs, balancing performance, security parameters, and post-quantum resilience.

A signature-based encoding scheme is a class of digital signature constructions in which signing is implemented by encoding message-dependent data—typically a hash, syndrome, challenge transcript, authenticated subtree, or structured witness—into an object whose validity is checked by a public verification relation. In the schemes surveyed here, the signature may be the encoded representation of a message hash and randomness, a low-weight vector satisfying a syndrome equation, a Merkle authentication path tied to a signed root, or a transcript certifying knowledge of a code- or lattice-based witness; verification recovers or checks the encoded structure rather than merely testing an opaque tag (Kumar et al., 28 Jul 2025, Al-Jabbari et al., 2024, Arpin et al., 30 Jun 2026, Boyar et al., 2022).

1. Core construction pattern

A recurring pattern is a three-stage map from message to signature. First, the message is normalized into a target object such as a syndrome, a challenge vector, or a structured hash. Second, the signer uses secret information to invert or sample from a hidden relation. Third, verification applies a public forward map and checks equality with the target object. In the neural-network construction, the central map is

$Y = f(W_x X + W_\theta \theta),$

while signing uses the inverse

$X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$

so the signature is literally a preimage of a public map (Kumar et al., 28 Jul 2025).

The same pattern appears in module-lattice signatures. A message hash $\mu = \mathrm{CRH}(M)$ is encoded by $\mathrm{NHSEncode}(\mu)$ into a ring element, inserted into signature components, and later recovered through

$\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$

The signature is therefore an encoding of the message hash inside a module-LWE/module-SIS relation, not just an externally attached authenticator (Al-Jabbari et al., 2024).

Sigma-protocol-based signatures instantiate the pattern through transcript encoding. In code-based schemes such as CROSS and LESS, commitments, challenges, and responses are first defined as identification transcripts and then transformed into signatures by Fiat–Shamir. The signature encodes the prover’s ability to satisfy a restricted syndrome-decoding relation or a code-equivalence relation under the challenge pattern determined by the message hash (Arpin et al., 30 Jun 2026).

2. Code-based realizations

Code-based signature-based encoding schemes are organized around parity-check equations and low-weight or structured solutions. In the CFS-style paradigm and its Reed–Muller variant, the signer hashes a message into a syndrome and decodes it to an error vector. For the punctured Reed–Muller construction, signing iterates over counters $i$, computes

$s = h(h(M)\,\|\,i),$

decodes $s' = S^{-1}s$ with respect to a modified parity-check matrix $H_m$, and outputs a signature $(e,i)$ such that verification recomputes $X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$0 and compares it with $X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$1. The construction explicitly uses complete decoding, allows an error-weight parameter $X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$2, and derives EUF-CMA security under complete decoding and indistinguishability assumptions for the modified Reed–Muller code (Lee et al., 2017).

A second family uses sigma protocols for code relations. CROSS is built from restricted syndrome decoding: the secret key is an element $X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$3 such that

$X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$4

and signatures are Fiat–Shamir transcripts proving knowledge of such an $X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$5. LESS is built from computational code equivalence: the secret key is a monomial matrix $X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$6 such that

$X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$7

and signatures encode the ability to answer code-equivalence challenges consistently. In both cases, the signature is a structured encoding of a witness to a code-based relation (Arpin et al., 30 Jun 2026).

Identification-based constructions yield a similar encoding view. The improved q-ary Stern protocol defines a weight-preserving transformation

$X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$8

commitments

$X = f\big(W_x^{-1}(Y - f(W_\theta \theta))\big),$9

and a masked response

$\mu = \mathrm{CRH}(M)$0

After Fiat–Shamir, the signature becomes a non-interactive encoding of knowledge of a low-weight solution to the q-ary Syndrome Decoding problem, with quasi-cyclic structure used to reduce public-key size (Cayrel et al., 2010).

LDGM-based designs make the encoding layer especially explicit. In LEDAsig, the signer computes a sparse syndrome $\mu = \mathrm{CRH}(M)$1, forms an error vector $\mu = \mathrm{CRH}(M)$2, adds a random sparse codeword $\mu = \mathrm{CRH}(M)$3, and outputs

$\mu = \mathrm{CRH}(M)$4

while verification checks

$\mu = \mathrm{CRH}(M)$5

SPANSE keeps the same code-based architecture but changes the published representation: it computes

$\mu = \mathrm{CRH}(M)$6

and requires $\mu = \mathrm{CRH}(M)$7 for all $\mu = \mathrm{CRH}(M)$8, so signatures are abnormally dense rather than sparse (Leary et al., 2018, Baldi et al., 2022).

3. Lattice, module, and multivariate encodings

Lattice-based schemes often encode signatures as short responses satisfying linear-algebraic verification equations. In the lattice ring signature derived from Lyubashevsky’s trapdoor-free signatures, each user has a short secret matrix $\mu = \mathrm{CRH}(M)$9 satisfying

$\mathrm{NHSEncode}(\mu)$0

A ring signature has the form

$\mathrm{NHSEncode}(\mu)$1

and verification checks norm bounds together with

$\mathrm{NHSEncode}(\mu)$2

The signature therefore encodes anonymous ring membership and knowledge of a short preimage, with rejection sampling ensuring that the signer’s component is statistically indistinguishable from the others (Wang et al., 2014).

Module-lattice signatures use an explicit encode–decode layer between bit strings and ring elements. In the Module-LWE/Module-SIS scheme,

$\mathrm{NHSEncode}(\mu)$3

and the message digest $\mathrm{NHSEncode}(\mu)$4 is mapped by $\mathrm{NHSEncode}(\mu)$5 into a polynomial in $\mathrm{NHSEncode}(\mu)$6. The signer embeds this polynomial into $\mathrm{NHSEncode}(\mu)$7, while verification recovers the digest with $\mathrm{NHSEncode}(\mu)$8 and checks a second hash relation involving $\mathrm{NHSEncode}(\mu)$9. The signature is thus a ring/module encoding of the message digest with a built-in reconciliation step (Al-Jabbari et al., 2024).

Multivariate and neural constructions realize signing as inversion of a hidden nonlinear map. The neural-network scheme defines a recurrent binary-weight network with attention-like random vectors $\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$0, collapses the recurrence into matrices $\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$1 and $\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$2, and obtains the central map

$\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$3

Messages are hashed as $\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$4, mixed with random vectors $\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$5, and encoded into target vectors

$\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$6

Signing computes preimages $\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$7 of these targets under a masked version of $\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$8, while verification re-applies the public map and compares the recovered coordinates with the hash components (Kumar et al., 28 Jul 2025).

4. Structured, extractable, and anonymous signatures

Some signature-based encoding schemes are designed so that the signature carries additional structure beyond mere authenticity. Quotable signatures encode an entire message into a Merkle tree, sign the root once, and allow any party to derive valid signatures for allowable subsequences. Leaves are hashed as

$\mathrm{NHSDecode}(z_2+z_3-Pz_1)=\mathrm{CRH}(M).$9

internal nodes as

$i$0

and quoting consists of extracting the minimal authentication path for the quoted tokens together with the root signature. The derived signature still verifies under the original public key and exposes where the quoted tokens occur in the original sequence (Boyar et al., 2022).

Ring-signature systems encode anonymity sets and membership relations. In the certificateless VANET construction, an identity string $i$1 is mapped to a public key

$i$2

and a ring signature encodes the assertion that the signer belongs to a self-chosen anonymous group $i$3. Additional group elements

$i$4

bind a hardware secret and a time interval into the pseudonym certificate, yielding anonymity, multi-level privacy, auditability, and Sybil-detection structure in the same signed object (Jiang et al., 2014).

Signcryption integrates encryption and signature into a single encoded ciphertext. In the Schnorr-based signcryption scheme, the sender derives a shared key $i$5, splits it into $i$6, computes

$i$7

and sends

$i$8

The signcrypted text is therefore a signature-based encoding of both message confidentiality and authenticity; unsigncryption reconstructs $i$9, decrypts $s = h(h(M)\,\|\,i),$0, and verifies $s = h(h(M)\,\|\,i),$1 (Savu, 2012).

Quantum digital signatures extend the idea to non-local encodings. In the EPR-based scheme, Alice maps an $s = h(h(M)\,\|\,i),$2-bit message to

$s = h(h(M)\,\|\,i),$3

teleports it through a multiparty controlled EPR channel, and induces two non-locally correlated classical signatures: a public global signature $s = h(h(M)\,\|\,i),$4 and Bob’s signature $s = h(h(M)\,\|\,i),$5. Verification functions $s = h(h(M)\,\|\,i),$6 exploit Charlie’s private Bell-measurement data to test transferability, no forgery, and no repudiation without long-term quantum memory (Nadeem et al., 2015).

5. Security notions and reductions

The dominant security notion is existential unforgeability under adaptive chosen-message attacks. The neural-network multivariate construction states that, assuming a collision-resistant hash modeled as a random oracle and hardness of the Discrete Logarithm with Matrix Decomposition Problem, the proposed scheme is EUF-CMA secure (Kumar et al., 28 Jul 2025). The module-lattice scheme bounds UF-CMA advantage by the sum of Module-LWE and H-MSIS advantages, with the public key $s = h(h(M)\,\|\,i),$7 treated as a Module-LWE sample and forgeries reduced to short-solution finding under a random oracle (Al-Jabbari et al., 2024).

Lattice ring signatures and code-based Fiat–Shamir systems use standard-model or random-oracle reductions to canonical hard problems. The lattice ring signature is proved strongly unforgeable against adaptive chosen-message attacks in the random oracle model, with security reduced to SIS through rejection sampling (Wang et al., 2014). CROSS and LESS derive code-based digital signatures by applying Fiat–Shamir to sigma protocols for restricted syndrome decoding and code equivalence, and the resulting schemes are presented as EUF-CMA secure in the random oracle model (Arpin et al., 30 Jun 2026).

Dual-assumption constructions emphasize reductionist security. The factoring/discrete-logarithm signature scheme proposes a design based on cube-root extraction modulo a composite modulus and the discrete logarithm problem, and states that if an adversary can break the scheme with an algorithm $s = h(h(M)\,\|\,i),$8, then $s = h(h(M)\,\|\,i),$9 can be used to solve both the DLP and the IFP (Ciss et al., 2012). More structured notions also appear. Quotable signatures strengthen classical EUF-CMA by declaring a forgery successful only when the adversary outputs a valid signature on a message that is not a quote of any previously signed message (Boyar et al., 2022).

6. Pitfalls, trade-offs, and current directions

A central lesson of the literature is that the encoding layer itself can create exploitable leakage. The cryptanalysis of Persichetti’s one-time code-based signature shows that a single sparse signature can reveal enough information for key recovery through statistical analysis followed by information set decoding, because sparsity leaks support information about the secret key (Santini et al., 2018). SPANSE is explicitly motivated by this failure mode and replaces sparse signatures with dense ones to “eliminate the possibility of deducing information from the sparsity of signatures,” while remaining in the one-time setting (Baldi et al., 2022).

Parameter selection is equally delicate. The analysis of the Liu–Yang–Han–Wang McEliece-based signature notes that choosing $s' = S^{-1}s$0 or $s' = S^{-1}s$1 improves performance but introduces weak keys exploitable by enumerating Goppa codes and applying the Support Splitting Algorithm, so the construction becomes insecure for the suggested parameters (D'Alconzo, 2022). The punctured Reed–Muller scheme addresses analogous structural attacks by puncturing and random insertion, while the improved q-ary Stern family uses quasi-cyclic constructions to reduce public keys from about $s' = S^{-1}s$2 Kbits to about $s' = S^{-1}s$3 Kbits, and even to $s' = S^{-1}s$4 bits with quasi-cyclic structure, without changing the underlying q-ary syndrome-decoding basis (Lee et al., 2017).

The same trade-off recurs across post-quantum families. The Module-LWE/Module-SIS signature reports, for $s' = S^{-1}s$5, $s' = S^{-1}s$6, and $s' = S^{-1}s$7, a public key of about $s' = S^{-1}s$8 bytes, a secret key of about $s' = S^{-1}s$9 bytes, and a signature of about $H_m$0 bytes, while improving the decoding failure bound from about $H_m$1 in the earlier Sharafi–Daghigh design to at most $H_m$2 through NewHope-style encoding (Al-Jabbari et al., 2024). SPANSE instead targets very fast signing and verification but retains public keys of about $H_m$3 kB in its preliminary $H_m$4-bit instance and remains one-time (Baldi et al., 2022). Quotable signatures, by contrast, are efficient when the structure of the signed object is favorable: for contiguous quotes the verification-path overhead is bounded by $H_m$5 hash values, whereas arbitrary subsequences require the larger bound

$H_m$6

in addition to one classical signature (Boyar et al., 2022).

Current directions therefore cluster around three themes. One is hiding structure without sacrificing trapdoor efficiency, as in dense-signature code-based designs and punctured or randomized code families. A second is extracting richer semantics from signatures—quotes, anonymous membership, signcrypted confidentiality, or auditable pseudonyms—by making the signed object itself a structured encoding. A third is obtaining post-quantum security with practical key sizes, low decoding-failure probability, and proofs against adaptive chosen-message attacks across lattices, codes, and multivariate maps (Kumar et al., 28 Jul 2025, Arpin et al., 30 Jun 2026, Wang et al., 2014).