Efficient Ring Signatures Without Random Oracles

1. Efficient Ring Signatures Without Random Oracles Hovav Shacham and Brent Waters

2. Alice’s Dilemma United Chemical Corporation

3. Option 1: Come Forward United Chemical Corporation

4. Option 1: Come Forward United Chemical Corporation Alice gets fired!

5. Option 2: Anonymous Letter United Chemical Corporation Lack of Credibility

6. Ring Signatures [RST’01] • Alice chooses a set of S public keys (that includes her own) • Signs a message M, on behalf of the “ring” of users • Integrity: Signed by some user in the set • Anonymity: Can’t tell which user signed

7. Ring Signature Solution United Chemical Corporation

8. Prior Work • Random Oracle Constructions • RST (Introduced) • DKNS (Constant Size • Generic [BKM’05] • Formalized definitions • Open – Efficient Construction w/o Random Oracles

9. This work Waters’ Signatures GOS ’06 Style NIZK Techniques + Efficient Group Signatures w/o ROs =

10. Our Approach • GOS encrypt one of a set of public keys 2) Sign and GOS encrypt message 3) Prove encrypted signature under encrypted key

11. Bilinear groups of order N=pq [BGN’05] • G: group of order N=pq. (p,q) – secret. bilinear map: e: G  G  GT

12. BGN encryption, GOS NIZK [GOS’06] • Subgroup assumption: G p Gp • E(m) : r  ZN , C  gm (gp)r  G • GOS NIZK: Statement: C  G Claim: “ C = E(0) or C = E(1) ’’ Proof:   G idea: IF: C = g  (gp)r or C = (gp)r THEN: e(C , Cg-1) = e(gp,gp)r  (GT)q

13. Upshot of GOS proofs • Prove well-formed in one subgroup • “Hidden” by the other subgroup

14. Waters’ Signature Scheme (Modified) • Global Setup: g, u’,u1,…,ulg(n), 2 G, A=ga2 G • Key-gen: Choose gb = PK, gab = PrivKey • Sign (M): (s1,s2) = gab(u’ ki=1 uMi)r, g-r • Verify: e(s1,g) e( s2, u’ ki=1 uMi) = e(A,gb)

15. gb3 gab(u’ ki=1 uMi)r, g-r Our Approach • Alice encrypts her Waters PK • Alice encrypt signature • Prove signature verifies for encrypted key gb1 gb2 gb3

16. A note on setup assumptions • Common reference string from N=pq for GOS proofs • Common Random String • Linear Assumption -- GOS Crypto ’06 • Upcoming work by Boyen ‘07 • Open: Efficient Ring Signatures w/o setup assumptions

17. Conclusion • First efficient Ring Signatures w/o random oracles • Combined Waters’ signatures and GOS NIZKs • Encrypted one of several PK’s • Open: Removing setup assumptions

18. THE END