Generalized Centered Binomial Distribution for Bimodal Lattice Signatures

In CRYPTO 2013, Ducas et al. introduced a bimodal discrete Gaussian distribution into the Fiat-Shamir with abort paradigm, proposing a signature scheme called BLISS, which significantly improved rejection sampling efficiency and reduced the number of required abort steps compared to all previously proposed (uni-modal) lattice-based signature schemes. Although the theoretical structure of the bimodal distribution is elegant, the BLISS implementation suffers from several side-channel vulnerabilities. The primary issue arises from the fact that the probability mass function of the bimodal discrete Gaussian distribution is a transcendental function, which makes it difficult to implement solely with integers in constant-time. To address this issue, we introduce a new distribution called ‘Generalized Centered Binomial Distribution (GCBD)’ that can replace the (bimodal) discrete Gaussian distribution. As a generalized form of the centered binomial distribution (CBD), GCBD is simple and efficient in sampling integers from distributions with large standard deviations. GCBD sampling consists of sampling uniformly random bit-strings and integer addition/subtraction operations, allowing for efficient constant-time implementation. Furthermore, bimodal rejection sampling using GCBD can be implemented only with integer operations in constant-time, with the help of the Newton-Raphson method. By incorporating the bimodal GCBD rejection sampling into BLISS, we present a new variant of BLISS that can be implemented in constant-time, thereby eliminating the side-channel vulnerabilities associated with timing attacks. Finally, we compare the performance of our variant to GALACTICS, a previous constant-time implementation of BLISS. While the signing algorithm of our variant is about 3.3 times slower than that of GALACTICS, GCBD can serve as an alternative to the discrete Gaussian distribution for designing bimodal lattice signatures.