Download presentation
Presentation is loading. Please wait.
Published byDwain Arnold Modified over 9 years ago
1
1 Efficient Ring Signatures Without Random Oracles Hovav Shacham and Brent Waters
2
2 Alice’s Dilemma United Chemical Corporation
3
3 Option 1: Come Forward United Chemical Corporation
4
4 Option 1: Come Forward United Chemical Corporation Alice gets fired!
5
5 Option 2: Anonymous Letter United Chemical Corporation Lack of Credibility
6
6 Ring Signatures [RST’01] Alice chooses a set of S public keys (that includes her own) Signs a message M, on behalf of the “ring” of users Integrity: Signed by some user in the set Anonymity: Can’t tell which user signed
7
7 Ring Signature Solution United Chemical Corporation
8
8 Prior Work Random Oracle Constructions RST (Introduced) DKNS (Constant Size Generic [BKM’05] Formalized definitions Open – Efficient Construction w/o Random Oracles
9
9 This work Waters’ Signatures GOS ’06 Style NIZK Techniques Efficient Group Signatures w/o ROs
10
10 Our Approach 1)GOS encrypt one of a set of public keys 2) Sign and GOS encrypt message 3) Prove encrypted signature under encrypted key
11
11 Bilinear groups of order N=pq [BGN’05] G : group of order N=pq. (p,q) – secret. bilinear map: e: G G G T
12
12 BGN encryption, GOS NIZK [GOS’06] Subgroup assumption: G p G p E(m) : r Z N, C g m (g p ) r G GOS NIZK: Statement: C G Claim: “ C = E(0) or C = E(1) ’’ Proof: G idea: IF: C = g (g p ) r or C = (g p ) r THEN : e(C, Cg -1 ) = e(g p,g p ) r (G T ) q
13
13 Upshot of GOS proofs Prove well-formed in one subgroup “Hidden” by the other subgroup
14
14 Waters’ Signature Scheme (Modified) Global Setup: g, u’,u 1,…,u lg(n), 2 G, A=g a 2 G Key-gen: Choose g b = PK, g ab = PrivKey Sign (M): (s 1,s 2 ) = g ab (u’ k i =1 u M i ) r, g -r Verify: e(s 1,g) e( s 2, u’ k i =1 u M i ) = e(A,g b )
15
15 Our Approach gb1gb1 gb2gb2 gb3gb3 gb3gb3 Alice encrypts her Waters PK Alice encrypt signature Prove signature verifies for encrypted key g ab (u’ ki=1 u Mi )r, g -r
16
16 A note on setup assumptions Common reference string from N=pq for GOS proofs Common Random String Linear Assumption -- GOS Crypto ’06 Upcoming work by Boyen ‘07 Open: Efficient Ring Signatures w/o setup assumptions
17
17 Conclusion First efficient Ring Signatures w/o random oracles Combined Waters’ signatures and GOS NIZKs Encrypted one of several PK’s Open: Removing setup assumptions
18
18 THE END
Similar presentations
© 2025 SlidePlayer.com. Inc.
All rights reserved.