Algorithm 3 Master Keygen

Input:  Security parameter N, prime q, $\sigma$ Output:  KGC’s public key $mpk$ and secret key $msk$. 1:$\mathbf{Start}$ Sample $f,g\in D_{Z^N,\sigma }$. 2:if $\Vert f\Vert >\sigma \sqrt{N}$ or $\Vert g\Vert >\sigma \sqrt{N}$ or fmodq $\notin R_q^{*}$ or gmodq$\notin R_q^{*}$ then 3:    $\mathbf{Restart}$ 4: end if 5:if max($\Vert (g,-f)\Vert ,\Vert (\frac{g\overline{f}}{f\overline{f}+g\overline{g}},\frac{g\overline{g}}{f\overline{f}+g\overline{g}})\Vert )>1.17\sqrt{g}$ then 6:    $\mathbf{Restart}$ 7: end if 8:$R_f=\mathrm{resultant}(f,X^N+1)$ and $R_g=\mathrm{resultant}(g,X^N+1)$, respectively. The resultant of f can be straightforwardly calculated as ${\displaystyle \prod _{i=1}^{N-1}}f\left(X^i\right)$ (mod $\Phi \left(N\right))$ where $\Phi \left(N\right)$ is the cyclotomic polynomial $\Phi \left(N\right)=1+X+X^2+\cdots +X^{N-1}$. The details of the $resultant$ operation can refer to [36] 9:Compute ${\rho }_f,{\rho }_f$ satisfy ${\rho }_{f}f+k_f(X^N+1)=R_f$, ${\rho }_{g}f+k_g(X^N+1)=R_g$ by the Extended Euclidean Algorithm where $k_f$ and $k_g$ are integers. 10:if  $(R_f,R_g)\ne 1$  then 11:    $\mathbf{Restart}$ 12: end if 13:Use the Extended Euclidean Algorithm to find $\alpha$ and $\beta$ satisfy $\alpha R_f+\beta R_g=1$, that is, we have $\left(\alpha {\rho }_f\right)f+\left(\beta {\rho }_g\right)g=1+k(x^N+1).$ 14:Let $F=q\beta {\rho }_g$, $G=-q\alpha {\rho }_f$, then $f\ast G-g\ast F=q$ (mod $X^N+1$) 15:return The KGC’s master public key $mpk=h=f^{-1}g$, KGC’s master secret key $msk=B=\left(\begin{array}{cc}{\mathcal{A}}_g& -{\mathcal{A}}_f\\ {\mathcal{A}}_G& -{\mathcal{A}}_F\end{array}\right)$, where ${\mathcal{A}}_g$, $-{\mathcal{A}}_f$, ${\mathcal{A}}_G$ and $-{\mathcal{A}}_F$ are anti-circulant matrices, and their ith row consists of the coefficients of the polynomial $g{x}^{i}mod(X^N+1)$, $f{x}^{i}mod(X^N+1)$, $G{x}^{i}mod(X^N+1)$ and $F{x}^{i}mod(X^N+1)$, respectively.