Method for optimizing an execution of a generation of a crystals-dilithium post-quantum signature

A method for optimizing the execution of the generation of a Crystals-Dilithium post-quantum digital signature σ=({tilde over (c)}, z, h) of a message M with a secret key sk=(ρ, K, tr, s1, s2, t0) where ρ, K, tr are 256 bits binary values, s1 and s2 are vectors of length l, respectively k, of elements of the ring Rq whose coefficients are lower than a first predetermined value η, and t0 is a polynomial vector of length k with k, l, n and q integers,

• said Crystals-Dilithium post-quantum digital signature generation comprising
• a) generating a masking vector y, of length l, of polynomials with coefficients less than a second predetermined value γ1,
• b) computing a first vector of polynomials, of length k, w=Ay, where A is a k×l matrix each of whose entries is a polynomial in the ring Rq=Zq[X]/(Xn+1),
• c) determining a second vector of polynomials w1 and a third vector of polynomials w0, both of length k, where every polynomial coefficient wi in Ay, with i in 0, . . . , k−1, is written as wi=w1i·2γ2+w0i where |w0|γ2 with γ2 a third predetermined value, d) generating a challenge c based on the message and the second vector of polynomials w1,
• e) performing rejection tests comprising testing if test vectors generated from said vectors, said challenge and said secret key fulfill predetermined conditions, and when said conditions are not fulfilled, restarting the signature generation from step a), else generating said signature,
• the steps a), b), c), d), and e) being repeated until the conditions are satisfied, said method being performed by a cryptographic device comprising a processor and a memory
• wherein performing rejection tests comprises:
• following said determination of said third vector of polynomials w0, generating a first test vector r0 as w0−cs2, and checking whether said first test vector r0 fulfills a first condition,
• when said first condition is met, generating a second test vector z=y+cs1, and checking whether said second test vector z fulfills a second condition, and wherein, when said second condition is met, said signature is generated from said second test vector.