Paper 2026/895 Original: eprint.iacr.org/2026/895 ↗
On the Properties of HighBits and LowBits Functions and their Applications
Abstract
ML-DSA is a lattice-based signature scheme that has recently been standardized by NIST as FIPS 204. Among the many subroutines used by ML-DSA are the high bits (Hb) and low bits (Lb) functions, which, as their name suggest, return only the higher bits or the lower bits of some integer. Recently, Seck and Roux-Langlois (IACR CiC 2025) conjectured that the high bits of a sum of two integers t and r can be expressed as the sum of the high bits of each integer, plus an error term that can take at most seven different values. In this paper, we study the properties of the functions Hb and Lb and we prove that the conjecture of Seck and Roux-Langlois holds. In addition, we provide a complete characterization of the error term. As an application, we explain how these properties can be used to design lattice-based signature schemes with advanced features.
Metadata
- Available format(s)
PDF- Category
- Public-key cryptography
- Publication info
- Preprint.
- History
- 2026-05-07: last updated
- 2026-05-07: published
- Short URL
- https://ia.cr/2026/895
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2026/895,
author = {Alice Pellet-Mary and Michel Seck},
title = {On the Properties of HighBits and LowBits Functions and their Applications},
howpublished = {Cryptology {ePrint} Archive, Paper 2026/895},
year = {2026},
url = {https://eprint.iacr.org/2026/895}
}