Performances

The SDitH scheme has two trade-offs: the trade-off for short signatures and the trade-off for fast timings. The proposed instances target 3 security levels defined by NIST: L1 (security of AES-128), L3 (security of AES-192), L5 (security of AES-256). Finally, the main instances rely on a hash-based grinding, while the alternative ones rely on a cipher-based grinding (-cipherpow suffix).

Security Level L1

Instance Public Key (bytes) Secret Key (bytes) Signature (bytes) Key Generation (cycles) Sign (cycles) Verify (cycles)
SDitH3-L1-gf2-short 70 147 3721 0.066M 10.14M 9.04M
SDitH3-L1-gf2-short-cipherpow 70 147 3721 0.067M 9.21M 9.01M
SDitH3-L1-gf2-fast 70 147 4914 0.066M 2.11M 1.86M
SDitH3-L1-gf2-fast-cipherpow 70 147 4643 0.066M 2.08M 1.78M

Security Level L3

Instance Public Key (bytes) Secret Key (bytes) Signature (bytes) Key Generation (cycles) Sign (cycles) Verify (cycles)
SDitH3-L3-gf2-short 98 208 8484 0.096M 36.93M 36.11M
SDitH3-L3-gf2-short-cipherpow 98 208 8484 0.096M 37.05M 36.67M
SDitH3-L3-gf2-fast 98 208 10852 0.096M 8.04M 7.39M
SDitH3-L3-gf2-fast-cipherpow 98 208 10452 0.097M 8.49M 7.27M

Security Level L5

Instance Public Key (bytes) Secret Key (bytes) Signature (bytes) Key Generation (cycles) Sign (cycles) Verify (cycles)
SDitH3-L5-gf2-short 132 275 15147 0.148M 55.94M 55.21M
SDitH3-L5-gf2-short-cipherpow 132 275 15147 0.148M 57.05M 56.27M
SDitH3-L5-gf2-fast 132 275 19144 0.148M 12.21M 11.33M
SDitH3-L5-gf2-fast-cipherpow 132 275 19144 0.148M 12.43M 11.61M

Main features

Conservative security

Our signature scheme is based on the presumably hardest problem in code-based cryptography: the Syndrome Decoding (SD) problem for random linear codes.

Adaptive and tunable parameters

Using MPCitH enables us to tailor parameters, in particular the number of parties, meaning that we can provide a variety of parameter sets tailored to different use cases.

Small code-based signatures

SD-in-the-Head is particularly performant in terms of the common “signature size + public-key size” metric (one of the best code-based schemes for this metric).

Small key sizes

Both the secret key and public key sizes are small. The public key, which is often transported with the signature, is between 70-132 bytes across all security levels.