BUFFing FALCON Without Increasing the Signature Size
摘要
This work shows how \(\textsf{FALCON}\) can achieve the Beyond UnForgeability Features (BUFF) introduced by Cremers et al. (S&P’21) more efficiently than by applying the generic BUFF transform. Specifically, we show that applying a transform of Pornin and Stern (ACNS’05), dubbed \(\textsf{PS}\text {-}3\) transform, already suffices for \(\textsf{FALCON}\) to achieve BUFF security. For \(\textsf{FALCON}\) , this merely means to include the public key in the hashing step in signature generation and verification, instead of hashing only the nonce and the message; the other signature computation steps and the signature output remain untouched. In comparison to the BUFF transform, which appends a hash value to the final signature, the \(\textsf{PS}\text {-}3\) transform therefore achieves shorter signature sizes, without incurring additional computations.