1 Efficient Ring Signatures Without Random Oracles Hovav Shacham and Brent Waters
Jan 15, 2016
1
Efficient Ring Signatures Without Random Oracles
Hovav Shacham and Brent Waters
2
Alice’s Dilemma
United Chemical Corporation
3
Option 1: Come Forward
United Chemical Corporation
4
Option 1: Come Forward
United Chemical Corporation
Alice gets fired!
5
Option 2: Anonymous Letter
United Chemical Corporation
Lack of Credibility
6
Ring Signatures [RST’01]
Alice chooses a set of S public keys (that includes her own)
Signs a message M, on behalf of the “ring” of users
Integrity: Signed by some user in the set
Anonymity: Can’t tell which user signed
7
Ring Signature Solution
United Chemical Corporation
8
Prior Work
Random Oracle Constructions•RST (Introduced)•DKNS (Constant Size
Generic [BKM’05]•Formalized definitions
Open – Efficient Construction w/o Random Oracles
9
This work
Waters’ Signatures
GOS ’06 Style
NIZK Techniques
Efficient Group Signatures w/o
ROs
10
Our Approach
1) GOS encrypt one of a set of public keys
2) Sign and GOS encrypt message
3) Prove encrypted signature under encrypted key
11
Bilinear groups of order N=pq [BGN’05]
G: group of order N=pq. (p,q) – secret.
bilinear map: e: G G GT
12
BGN encryption, GOS NIZK [GOS’06]
Subgroup assumption: G p Gp
E(m) : r ZN , C gm (gp)r G
GOS NIZK: Statement: C G
Claim: “ C = E(0) or C = E(1) ’’
Proof: G
idea: IF: C = g (gp)r or C = (gp)r
THEN: e(C , Cg-1) = e(gp,gp)r (GT)
q
13
Upshot of GOS proofs
Prove well-formed in one subgroup
“Hidden” by the other subgroup
14
Waters’ Signature Scheme (Modified)
Global Setup: g, u’,u1,…,ulg(n), 2 G, A=ga 2 G
Key-gen: Choose gb = PK, gab = PrivKey
Sign (M): (s1,s2) = gab(u’ ki=1 uMi)r, g-r
Verify: e(s1,g) e( s2, u’ ki=1 uMi ) = e(A,gb)
15
Our Approach
gb1 gb2 gb3
gb3
Alice encrypts her Waters PK
Alice encrypt signature
Prove signature verifies for encrypted key
gab(u’ ki=1 uMi)r, g-r
16
A note on setup assumptions
Common reference string from N=pq for GOS proofs
Common Random String •Linear Assumption -- GOS Crypto ’06•Upcoming work by Boyen ‘07
Open: Efficient Ring Signatures w/o setup assumptions
17
Conclusion
First efficient Ring Signatures w/o random oracles
Combined Waters’ signatures and GOS NIZKs•Encrypted one of several PK’s
Open: Removing setup assumptions
18
THE END