SPANSE: One-Time Code-Based Signature

• SPANSE is a one-time digital signature protocol leveraging dense QC-LDGM codes and the NP-hard syndrome decoding problem for post-quantum security.
• It achieves efficient signing and verification by using linear algebra routines along with quasi-cyclic structures and dense random masking to prevent key leakage.
• Key features include moderate public key sizes, fast operations, and strong resistance against both statistical and structural cryptanalytic attacks.

The SPANSE scheme is a one-time code-based digital signature protocol designed to achieve efficient signing and verification with moderate public key size and enhanced resistance against key-leakage attacks. SPANSE distinguishes itself from earlier code-based signatures by employing dense, zero-free signatures and leveraging the NP-hard syndrome decoding problem for large-weight vectors, aligning its security with recent trends in post-quantum cryptography. The scheme exploits the structure of quasi-cyclic low-density generator matrix (QC-LDGM) codes and introduces dense random masking to eliminate structural leakage, targeting both practical efficiency and robust cryptanalytic resistance (Baldi et al., 2022).

1. Design Objectives and Security Foundations

SPANSE was designed with several principal goals: enabling fast one-time signature generation and verification using linear algebra routines; optimizing public key size to a few megabytes through QC representations; and eliminating earlier vulnerabilities posed by signature sparsity, specifically information leakage exploitable by support-decomposition or key-recovery attacks.

Security is founded on the hardness of the syndrome decoding problem (SDP) over $\mathbb F_q$ for vectors with weight close to the codeword length, a problem known to be NP-complete for any target weight. A crucial aspect is that all signatures are densely populated—no zero entries—preventing statistical attacks that exploit sparse output. Additional safeguards are achieved by ensuring that no helpful algebraic structure is accessible in the public key $H'$, with the underlying secret QC-LDGM code and a dense masking transformation $S$ obfuscating the system. One-time usage per key-pair is mandatory, as repeated signature publication can lead to statistical distinguishability without further countermeasures (Baldi et al., 2022).

2. Scheme Definition: Structure and Algorithms

The SPANSE construction relies on:

• Field: A prime field of size $q$, typically $q\approx 2^7$ (e.g., $q=127$).
• QC-LDGM code: Length $n=p\,n_0$, dimension $k=p\,k_0$, redundancy $r=n-k$, structured via circulant $p\times p$ blocks.
• Secret matrices: Sparse generator matrix $H'$0, systematic parity-check $H'$1, random permutation $H'$2, and a dense QC matrix $H'$3 with specifically chosen row/column distribution.
• Hash and syndrome map: Cryptographic hash $H'$4 and randomness-dependent mapping $H'$5 to binary vectors of prescribed weight.

The workflow consists of three main stages:

2.1 Key Generation

Input parameters are code structure ($H'$6, $H'$7, $H'$8, $H'$9), LDGM row weight $S$0, and base field $S$1. The key steps are:

1. Generate a random QC-LDGM generator $S$2 with prescribed sparse row weight.
2. Compute a systematic parity-check matrix $S$3.
3. Sample a random QC permutation $S$4.
4. Sample a dense QC matrix $S$5 with defined distribution.
5. Derive the public key $S$6.

The secret key comprises $S$7; the public key is $S$8.

2.2 Signature Generation

Given a message $S$9 and the secret key:

1. Compute $q$0.
2. Use $q$1 to obtain $q$2, a binary vector of prescribed weight $q$3.
3. Map $q$4 with the secret permutation ($q$5).
4. Form an error vector $q$6 so $q$7.
5. Repeat: sample random weight-$q$8 codeword $q$9, compute $q\approx 2^7$0. Repeat until all entries of $q\approx 2^7$1 are nonzero.
6. Output $q\approx 2^7$2.

2.3 Signature Verification

Given $q\approx 2^7$3, message $q\approx 2^7$4, and signature $q\approx 2^7$5:

1. Reject if any entry of $q\approx 2^7$6 is zero.
2. Compute $q\approx 2^7$7 and $q\approx 2^7$8; reject if $q\approx 2^7$9.
3. Compute syndrome $q=127$0; accept if $q=127$1, else reject.

3. Hardness Assumptions and Security Reductions

The core hard problem is the large-weight Syndrome Decoding Problem (SDP$q=127$2), in which $q=127$3 and a target weight $q=127$4 (here, typically $q=127$5 or $q=127$6) are given, and the task is to find an $q=127$7 of at least this weight such that $q=127$8. This version remains NP-complete.

The best known generic attack is the PGE+Subset-Sum solver (generalization of Debris-Alazard et al.), with time complexity $q=127$9, for $n=p\,n_0$0 in typical settings ($n=p\,n_0$1, $n=p\,n_0$2, $n=p\,n_0$3). "Decoding One Out of Many" (DOOM) techniques yield a further speed-up factor of $n=p\,n_0$4, impacting the effective exponent. Other attacks such as Information Set Decoding (ISD) are countered by the masked code design; their complexity is approximately $n=p\,n_0$5 operations on the intended parameters (Baldi et al., 2022).

Asymptotically, the problem’s resistance scales linearly in $n=p\,n_0$6 for fixed code rate and field size.

4. Concrete Parameters and Performance Metrics

A parameterization for 128-bit classical security includes:

• $n=p\,n_0$7
• Circulant size $n=p\,n_0$8
• $n=p\,n_0$9, $k=p\,k_0$0 ($k=p\,k_0$1), $k=p\,k_0$2
• LDGM generator row weight $k=p\,k_0$3
• Syndrome weight $k=p\,k_0$4
• Codeword sampling: sum $k=p\,k_0$5 rows of $k=p\,k_0$6 for target codeword weight $k=p\,k_0$7
• Masking distribution for $k=p\,k_0$8: e.g., uniform binary $k=p\,k_0$9 leads to negligible rejection rate ($r=n-k$0)

Performance characteristics:

Parameter	Value/Estimate	Notes
Public key size	≈ 2,437 kB	120 × 120 circulant polynomials, $r=n-k$1
Signature length	21 kB	$r=n-k$2 bits
KeyGen cost	$r=n-k$3 ops	Performed offline
Signing/verif.	$r=n-k$4 ops	< 1 ms on modern hardware

This balance of efficiency and compactness is made possible by the dense signature regime and quasi-cyclic structures (Baldi et al., 2022).

5. Security Analysis and Cryptanalytic Position

The scheme’s main line of defense is the standard large-weight SDP for random-looking codes as obfuscated by dense $r=n-k$5 and $r=n-k$6. No support-leakage or structural attacks are facilitated, given that every signature reveals no sparsity pattern. The primary cryptanalytic avenues are:

• ISD and generic decoding: estimated workfactor $r=n-k$7.
• PGE+SS for large-weight decoding: $r=n-k$8 after accounting for DOOM speedup.
• Structural recovery: the design of $r=n-k$9 and $p\times p$0 precludes attacks leveraging the sparseness or algebraic redundancy of the underlying LDGM code.
• Key reuse: signatures produced per key are one-time and rejection-sampled for uniformity, but keys must not be reused across multiple messages, as this could enable statistical distinguishers.

A plausible implication is that with the correct rejection-sampling and strict one-time usage policy, the system’s resistance to state-of-the-art algebraic and statistical attacks is commensurate with its targeted classical security margin.

6. Comparative Context and Relation to Previous Schemes

Earlier code-based signature schemes relying on QC-LDGM structures and sparse signatures (e.g., Baldi–Chiaraluce–Santini, 2013) were vulnerable to decomposition and key-recovery due to observable sparsity. Goppa code-based hash-and-sign approaches such as CFS/KKS face significant limitations in key size (>10 MB) and slow signature generation (many syndrome decoding attempts). WAVE, a large-weight scheme using special $p\times p$1 codes over $p\times p$2, achieves similar key size but slower cubic signing cost.

SPANSE delivers multiple improvements:

• Public key sizes approach 2.5 MB with a compact QC structure over a large prime field.
• Both signature generation and verification scale quadratically, without the need for decoding loops.
• Dense signature outputs avoid any sparsity-exploitable leakage.
• The security basis is the standard large-weight SDP, benefiting from straightforward security reductions for random codes.

This positions SPANSE as a competitively efficient and secure one-time signature primitive within the landscape of post-quantum code-based cryptography (Baldi et al., 2022).