authors [at] raccoonfamily [dot] org<\/code>.<\/p>\nThe Raccoon signature scheme is based on the Fiat-Shamir transform from a Schnorr lattice-based signature with a fine-tuned analysis to prevent the use of the rejection-sampling method and Gaussian sampling, enabling the use of masking techniques \u2014a countermeasure against side-channel attacks\u2014 on the secret keys during the signature algorithm.<\/p>\n
Furthermore, the security of Raccoon relies on standard assumptions on module lattices, which are the same one used in the (selected) standard Dilithium. These assumptions are well studied since a decade and have shown to be robust while offering fair parameter size.<\/p>\n
Highlights<\/h2>\n
The Raccoon<\/strong> signature scheme has been designed to ensure the ease of implementation as well as<\/p>\n\n- Masking.<\/strong> The main design of Raccoon makes it possible to enable the use of efficient masking techniques. Raccoon can be masked with a quasi-linear overhead with respect to the masking order. This allows masking at high orders with a small impact on efficiency.<\/li>\n
- Standard lattice assumptions.<\/strong> The security of Raccoon relies on (variants) of lattice assumptions that are well-understood. Namely, these assumptions are Module-LWE and Module-SIS similarly to the primary standard Dilithium.<\/li>\n
- Simple and portable implementations.<\/strong> The design of Raccoon relies on two points to ease the implementation on a wide range of platforms. First, the error distribution is a sum of uniforms, thus avoiding the implementation of Gaussian sampling. Then, the selected 49-bit modulus splits into a 24 and 25-bit moduli, which facilitates implementations on 32-bit architecture.<\/li>\n<\/ul>\n
\nKey sizes for the different parameter levels with a number of shares\u202fd<\/em> = 1 (no masking) and d<\/em> = 32.<\/caption>\n\n\n\n\n\n <\/colgroup>\n\n\n\n| 1<\/td>\n | 1<\/td>\n | 2.256<\/td>\n | 14.800<\/td>\n | 11.524<\/td>\n<\/tr>\n |
\n| 1<\/td>\n | 32<\/td>\n | 2.256<\/td>\n | 15.296<\/td>\n | 11.524<\/td>\n<\/tr>\n |
\n| 3<\/td>\n | 1<\/td>\n | 3.160<\/td>\n | 18.840<\/td>\n | 14.544<\/td>\n<\/tr>\n |
\n| 3<\/td>\n | 32<\/td>\n | 3.160<\/td>\n | 19.584<\/td>\n | 14.544<\/td>\n<\/tr>\n |
\n| 5<\/td>\n | 1<\/td>\n | 4.064<\/td>\n | 26.016<\/td>\n | 20.330<\/td>\n<\/tr>\n |
\n| 5<\/td>\n | 32<\/td>\n | 4.064<\/td>\n | 27.008<\/td>\n | 20.330<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n |