1

Efficient Ring Signatures Without Random Oracles

Hovav Shacham and Brent Waters

2

Alice’s Dilemma

United Chemical Corporation

3

Option 1: Come Forward

United Chemical Corporation

4

Option 1: Come Forward

United Chemical Corporation

Alice gets fired!

5

Option 2: Anonymous Letter

United Chemical Corporation

Lack of Credibility

6

Ring Signatures [RST’01]

Alice chooses a set of S public keys (that includes her own)

Signs a message M, on behalf of the “ring” of users

Integrity: Signed by some user in the set

Anonymity: Can’t tell which user signed

7

Ring Signature Solution

United Chemical Corporation

8

Prior Work

Random Oracle Constructions•RST (Introduced)•DKNS (Constant Size

Generic [BKM’05]•Formalized definitions

Open – Efficient Construction w/o Random Oracles

9

This work

Waters’ Signatures

GOS ’06 Style

NIZK Techniques

Efficient Group Signatures w/o

ROs

10

Our Approach

1) GOS encrypt one of a set of public keys

2) Sign and GOS encrypt message

3) Prove encrypted signature under encrypted key

11

Bilinear groups of order N=pq [BGN’05]

G: group of order N=pq. (p,q) – secret.

bilinear map: e: G G GT

12

BGN encryption, GOS NIZK [GOS’06]

Subgroup assumption: G p Gp

E(m) : r ZN , C gm (gp)r G

GOS NIZK: Statement: C G

Claim: “ C = E(0) or C = E(1) ’’

Proof: G

idea: IF: C = g (gp)r or C = (gp)r

THEN: e(C , Cg-1) = e(gp,gp)r (GT)

q

13

Upshot of GOS proofs

Prove well-formed in one subgroup

“Hidden” by the other subgroup

14

Waters’ Signature Scheme (Modified)

Global Setup: g, u’,u1,…,ulg(n), 2 G, A=ga 2 G

Key-gen: Choose gb = PK, gab = PrivKey

Sign (M): (s1,s2) = gab(u’ ki=1 uMi)r, g-r

Verify: e(s1,g) e( s2, u’ ki=1 uMi ) = e(A,gb)

15

Our Approach

gb1 gb2 gb3

gb3

Alice encrypts her Waters PK

Alice encrypt signature

Prove signature verifies for encrypted key

gab(u’ ki=1 uMi)r, g-r

16

A note on setup assumptions

Common reference string from N=pq for GOS proofs

Common Random String •Linear Assumption -- GOS Crypto ’06•Upcoming work by Boyen ‘07

Open: Efficient Ring Signatures w/o setup assumptions

17

Conclusion

First efficient Ring Signatures w/o random oracles

Combined Waters’ signatures and GOS NIZKs•Encrypted one of several PK’s

Open: Removing setup assumptions

18

THE END