1 Efficient Ring Signatures Without Random Oracles Hovav Shacham and Brent Waters

2 Alice’s Dilemma United Chemical Corporation

3 Option 1: Come Forward United Chemical Corporation

4 Option 1: Come Forward United Chemical Corporation Alice gets fired!

5 Option 2: Anonymous Letter United Chemical Corporation Lack of Credibility

6 Ring Signatures [RST’01]  Alice chooses a set of S public keys (that includes her own)  Signs a message M, on behalf of the “ring” of users  Integrity: Signed by some user in the set  Anonymity: Can’t tell which user signed

7 Ring Signature Solution United Chemical Corporation

8 Prior Work  Random Oracle Constructions RST (Introduced) DKNS (Constant Size  Generic [BKM’05] Formalized definitions  Open – Efficient Construction w/o Random Oracles

9 This work Waters’ Signatures GOS ’06 Style NIZK Techniques Efficient Group Signatures w/o ROs

10 Our Approach 1)GOS encrypt one of a set of public keys 2) Sign and GOS encrypt message 3) Prove encrypted signature under encrypted key

11 Bilinear groups of order N=pq [BGN’05]  G : group of order N=pq. (p,q) – secret. bilinear map: e: G  G  G T

12 BGN encryption, GOS NIZK [GOS’06]  Subgroup assumption: G  p G p  E(m) : r  Z N, C  g m (g p ) r  G  GOS NIZK: Statement: C  G Claim: “ C = E(0) or C = E(1) ’’ Proof:   G idea: IF: C = g  (g p ) r or C = (g p ) r THEN : e(C, Cg -1 ) = e(g p,g p ) r  (G T ) q

13 Upshot of GOS proofs  Prove well-formed in one subgroup  “Hidden” by the other subgroup

14 Waters’ Signature Scheme (Modified)  Global Setup: g, u’,u 1,…,u lg(n), 2 G, A=g a 2 G  Key-gen: Choose g b = PK, g ab = PrivKey  Sign (M): (s 1,s 2 ) = g ab (u’  k i =1 u M i ) r, g -r  Verify: e(s 1,g) e( s 2, u’  k i =1 u M i ) = e(A,g b )

15 Our Approach gb1gb1 gb2gb2 gb3gb3 gb3gb3  Alice encrypts her Waters PK  Alice encrypt signature  Prove signature verifies for encrypted key g ab (u’  ki=1 u Mi )r, g -r

16 A note on setup assumptions  Common reference string from N=pq for GOS proofs  Common Random String Linear Assumption -- GOS Crypto ’06 Upcoming work by Boyen ‘07  Open: Efficient Ring Signatures w/o setup assumptions

17 Conclusion  First efficient Ring Signatures w/o random oracles  Combined Waters’ signatures and GOS NIZKs Encrypted one of several PK’s  Open: Removing setup assumptions

18 THE END