---
title: 'SPANSE: One-Time Code-Based Signature'
url: https://www.emergentmind.com/topics/spanse-scheme
type: topic
---

# SPANSE: One-Time Code-Based Signature

The SPANSE scheme is a one-time code-based digital signature protocol designed to achieve efficient signing and verification with moderate public key size and enhanced resistance against key-leakage attacks. SPANSE distinguishes itself from earlier code-based signatures by employing dense, zero-free signatures and leveraging the NP-hard syndrome decoding problem for large-weight vectors, aligning its security with recent trends in post-quantum cryptography. The scheme exploits the structure of quasi-cyclic low-density generator matrix (QC-LDGM) codes and introduces dense random masking to eliminate structural leakage, targeting both practical efficiency and robust cryptanalytic resistance [2205.12887].

## 1. Design Objectives and Security Foundations

SPANSE was designed with several principal goals: enabling fast one-time signature generation and verification using linear algebra routines; optimizing public key size to a few megabytes through QC representations; and eliminating earlier vulnerabilities posed by signature sparsity, specifically information leakage exploitable by support-decomposition or key-recovery attacks. 

Security is founded on the hardness of the syndrome decoding problem (SDP) over \(\mathbb F_q\) for vectors with weight close to the codeword length, a problem known to be NP-complete for any target weight. A crucial aspect is that all signatures are densely populated—no zero entries—preventing statistical attacks that exploit sparse output. Additional safeguards are achieved by ensuring that no helpful algebraic structure is accessible in the public key \(H'\), with the underlying secret QC-LDGM code and a dense masking transformation \(S\) obfuscating the system. One-time usage per key-pair is mandatory, as repeated signature publication can lead to statistical distinguishability without further countermeasures [2205.12887].

## 2. Scheme Definition: Structure and Algorithms

The SPANSE construction relies on:

- Field: A prime field of size \(q\), typically \(q\approx 2^7\) (e.g., \(q=127\)).
- QC-LDGM code: Length \(n=p\,n_0\), dimension \(k=p\,k_0\), redundancy \(r=n-k\), structured via circulant \(p\times p\) blocks.
- Secret matrices: Sparse generator matrix \(G\in\{0,1\}^{k\times n}\), systematic parity-check \(H\), random permutation \(P\in\{0,1\}^{r\times r}\), and a dense QC matrix \(S\in\mathbb F_q^{n\times n}\) with specifically chosen row/column distribution.
- Hash and syndrome map: Cryptographic hash \(\mathcal H\) and randomness-dependent mapping \(\mathcal F_\Theta\) to binary vectors of prescribed weight.

The workflow consists of three main stages:

### 2.1 Key Generation

Input parameters are code structure (\(n\), \(k\), \(r\), \(p\)), LDGM row weight \(w_g\), and base field \(q\). The key steps are:
1. Generate a random QC-LDGM generator \(G\) with prescribed sparse row weight.
2. Compute a systematic parity-check matrix \(H = [I_r | P_H]\).
3. Sample a random QC permutation \(P\).
4. Sample a dense QC matrix \(S\) with defined distribution.
5. Derive the public key \(H' = P^{-1} H S^{-1}\).

The secret key comprises \((G, H, P, S)\); the public key is \(H'\).

### 2.2 Signature Generation

Given a message \(m\) and the secret key:
1. Compute \(h = \mathcal H(m)\).
2. Use \(\Theta\) to obtain \(s = \mathcal F_\Theta(h)\), a binary vector of prescribed weight \(w\).
3. Map \(s\) with the secret permutation (\(s' = P s\)).
4. Form an error vector \(e = [0_{1\times k} | (s')^T]\) so \(H e^T = s'\).
5. Repeat: sample random weight-\(w_c\) codeword \(c \in \mathcal C\), compute \(\sigma = (e+c) S^T\). Repeat until all entries of \(\sigma\) are nonzero.
6. Output \((\sigma, \Theta)\).

### 2.3 Signature Verification

Given \(H'\), message \(m\), and signature \((\sigma, \Theta)\):
1. Reject if any entry of \(\sigma\) is zero.
2. Compute \(h = \mathcal H(m)\) and \(s^* = \mathcal F_\Theta(h)\); reject if \(\mathrm{wt}(s^*) \ne w\).
3. Compute syndrome \(s = H' \sigma^T\); accept if \(s = s^*\), else reject.

## 3. Hardness Assumptions and Security Reductions

The core hard problem is the large-weight Syndrome Decoding Problem (SDP\(_{\ge\tau}\)), in which \((H', s)\) and a target weight \(\tau\) (here, typically \(\tau = n\) or \(\tau \approx \frac{q-1}{q} n\)) are given, and the task is to find an \(e\) of at least this weight such that \(H' e^T = s\). This version remains NP-complete.

The best known generic attack is the PGE+Subset-Sum solver (generalization of Debris-Alazard et al.), with time complexity \(T_{\rm SDP} = 2^{\alpha n}\), for \(\alpha \approx 0.00548\) in typical settings (\(n=24000\), \(q=127\), \(R=0.5\)). "Decoding One Out of Many" (DOOM) techniques yield a further speed-up factor of \(\sqrt{p}\), impacting the effective exponent. Other attacks such as Information Set Decoding (ISD) are countered by the masked code design; their complexity is approximately \(2^{132}\) operations on the intended parameters [2205.12887].

Asymptotically, the problem’s resistance scales linearly in \(n\) for fixed code rate and field size.

## 4. Concrete Parameters and Performance Metrics

A parameterization for 128-bit classical security includes:

- \(q=127\)
- Circulant size \(p=101\)
- \(n=24000\), \(k=12000\) (\(R=0.5\)), \(r=12000\)
- LDGM generator row weight \(w_g=11\)
- Syndrome weight \(w=26\)
- Codeword sampling: sum \(m_g=12\) rows of \(G\) for target codeword weight \(w_c=132\)
- Masking distribution for \(S\): e.g., uniform binary \(d(x) = 0.5 + 0.5x\) leads to negligible rejection rate (\(\approx1.4\times 10^{-6}\))

Performance characteristics:

| Parameter        | Value/Estimate            | Notes                                 |
|------------------|--------------------------|---------------------------------------|
| Public key size  | ≈ 2,437 kB               | 120 × 120 circulant polynomials, \(p=101\) |
| Signature length | 21 kB                     | \(n\log_2 q = 24000\times7 = 168000\) bits|
| KeyGen cost      | \(O(n^3) \sim 10^{9}\) ops      | Performed offline                     |
| Signing/verif.   | \(O(n^2) \sim 6\times10^8\) ops | < 1 ms on modern hardware             |

This balance of efficiency and compactness is made possible by the dense signature regime and quasi-cyclic structures [2205.12887].

## 5. Security Analysis and Cryptanalytic Position

The scheme’s main line of defense is the standard large-weight SDP for random-looking codes as obfuscated by dense \(S\) and \(P\). No support-leakage or structural attacks are facilitated, given that every signature reveals no sparsity pattern. The primary cryptanalytic avenues are:

- ISD and generic decoding: estimated workfactor \(\approx 2^{132}\).
- PGE+SS for large-weight decoding: \(\approx 2^{131.6}\) after accounting for DOOM speedup.
- Structural recovery: the design of \(S\) and \(P\) precludes attacks leveraging the sparseness or algebraic redundancy of the underlying LDGM code.
- Key reuse: signatures produced per key are one-time and rejection-sampled for uniformity, but keys must not be reused across multiple messages, as this could enable statistical distinguishers.

A plausible implication is that with the correct rejection-sampling and strict one-time usage policy, the system’s resistance to state-of-the-art algebraic and statistical attacks is commensurate with its targeted classical security margin.

## 6. Comparative Context and Relation to Previous Schemes

Earlier code-based signature schemes relying on QC-LDGM structures and sparse signatures (e.g., Baldi–Chiaraluce–Santini, 2013) were vulnerable to decomposition and key-recovery due to observable sparsity. Goppa code-based hash-and-sign approaches such as CFS/KKS face significant limitations in key size (>10 MB) and slow signature generation (many syndrome decoding attempts). WAVE, a large-weight scheme using special \((U, U+V)\) codes over \(\mathbb F_3\), achieves similar key size but slower cubic signing cost.

SPANSE delivers multiple improvements:

- Public key sizes approach 2.5 MB with a compact QC structure over a large prime field.
- Both signature generation and verification scale quadratically, without the need for decoding loops.
- Dense signature outputs avoid any sparsity-exploitable leakage.
- The security basis is the standard large-weight SDP, benefiting from straightforward security reductions for random codes.

This positions SPANSE as a competitively efficient and secure one-time signature primitive within the landscape of post-quantum code-based cryptography [2205.12887].

Source: https://www.emergentmind.com/topics/spanse-scheme