Efficient Ring Signatures Without Random Oracles

1
Efficient Ring Signatures Without Random Oracles
Hovav Shacham and Brent Waters
2
Alices Dilemma
United Chemical Corporation
3
Option 1 Come Forward
United Chemical Corporation
4
Option 1 Come Forward
United Chemical Corporation
Alice gets fired!
5
Option 2 Anonymous Letter
United Chemical Corporation
Lack of Credibility
6
Ring Signatures RST01

• Alice chooses a set of S public keys (that
  includes her own)
• Signs a message M, on behalf of the ring of
  users
• Integrity Signed by some user in the set
• Anonymity Cant tell which user signed

7
Ring Signature Solution
United Chemical Corporation
8
Prior Work

• Random Oracle Constructions
• RST (Introduced)
• DKNS (Constant Size
• Generic BKM05
• Formalized definitions
• Open Efficient Construction w/o Random Oracles

9
This work
Waters Signatures
GOS 06 Style NIZK Techniques

Efficient Group Signatures w/o ROs

10
Our Approach

• GOS encrypt one of a set of public keys

2) Sign and GOS encrypt message
3) Prove encrypted signature under encrypted key
11
Bilinear groups of order Npq BGN05

• G group of order Npq. (p,q)
  secret.
• bilinear map e G ? G ? GT

12
BGN encryption, GOS NIZK GOS06

• Subgroup assumption G ?p Gp
• E(m) r ? ZN , C ? gm (gp)r ? G
• GOS NIZK Statement C ? G
• Claim C E(0) or C E(1)
• Proof ? ? G
• idea IF C g ? (gp)r or C
  (gp)r
• THEN e(C , Cg-1) e(gp,gp)r ?
  (GT)q

13
Upshot of GOS proofs

• Prove well-formed in one subgroup
• Hidden by the other subgroup

14
Waters Signature Scheme (Modified)

• Global Setup g, u,u1,,ulg(n), 2 G, Aga 2 G
• Key-gen Choose gb PK, gab PrivKey
• Sign (M) (s1,s2) gab(u ?ki1 uMi)r, g-r
• Verify e(s1,g) e( s2, u ?ki1 uMi ) e(A,gb)

15
Our Approach

• Alice encrypts her Waters PK
• Alice encrypt signature
• Prove signature verifies for encrypted key

gb1
gb2
gb3
16
A note on setup assumptions

• Common reference string from Npq for GOS proofs
• Common Random String
• Linear Assumption -- GOS Crypto 06
• Upcoming work by Boyen 07
• Open Efficient Ring Signatures w/o setup
  assumptions

17
Conclusion

• First efficient Ring Signatures w/o random
  oracles
• Combined Waters signatures and GOS NIZKs
• Encrypted one of several PKs
• Open Removing setup assumptions

18
THE END