Efficient Ring Signatures Without Random Oracles

1

Efficient Ring Signatures Without Random Oracles

Hovav Shacham and Brent Waters

2

Alice’s Dilemma United Chemical

Corporation

3

Option 1: Come Forward United Chemical

Corporation

4

Option 1: Come Forward United Chemical

Corporation

Alice gets fired!

5

Option 2: Anonymous LetterUnited Chemical

Corporation

Lack of Credibility

6

Ring Signatures [RST’01] Alice chooses a set of S public keys (that includes

her own)

Signs a message M, on behalf of the “ring” of users

Integrity: Signed by some user in the set

Anonymity: Can’t tell which user signed

7

Ring Signature Solution United Chemical

Corporation

8

Prior Work Random Oracle Constructions

•RST (Introduced)•DKNS (Constant Size

Generic [BKM’05]•Formalized definitions

Open – Efficient Construction w/o Random Oracles

9

This work

Waters’ Signatures

GOS ’06 StyleNIZK

TechniquesEfficient Group Signatures w/o

ROs

10

Our Approach1) GOS encrypt one of a set of public keys2) Sign and GOS encrypt message

3) Prove encrypted signature under encrypted key

11

Bilinear groups of order N=pq [BGN’05]

G: group of order N=pq. (p,q) – secret.bilinear map: e: G G GT

12

BGN encryption, GOS NIZK [GOS’06]

Subgroup assumption: G p Gp

E(m) : r ZN , C gm (gp)r G

GOS NIZK: Statement: C GClaim: “ C = E(0) or C = E(1) ’’Proof: G

idea: IF: C = g (gp)r or C = (gp)r

THEN: e(C , Cg-1) = e(gp,gp)r (GT)q

13

Upshot of GOS proofs Prove well-formed in one subgroup

“Hidden” by the other subgroup

14

Waters’ Signature Scheme (Modified)

Global Setup: g, u’,u1,…,ulg(n), 2 G, A=ga 2 G

Key-gen: Choose gb = PK, gab = PrivKey

Sign (M): (s1,s2) = gab(u’ ki=1 uMi)r, g-r

Verify: e(s1,g) e( s2, u’ ki=1 uMi ) = e(A,gb)

15

Our Approach

gb1 gb2 gb3

gb3

Alice encrypts her Waters PKAlice encrypt signatureProve signature verifies for encrypted key

gab(u’ ki=1 uMi)r, g-r

16

A note on setup assumptions Common reference string from N=pq for GOS

proofs

Common Random String •Linear Assumption -- GOS Crypto ’06•Upcoming work by Boyen ‘07

Open: Efficient Ring Signatures w/o setup assumptions

17

Conclusion First efficient Ring Signatures w/o random

oracles

Combined Waters’ signatures and GOS NIZKs•Encrypted one of several PK’s

Open: Removing setup assumptions

18

THE END