Efficient ring signatures without random oracles
This presentation is the property of its rightful owner.
Sponsored Links
1 / 18

Efficient Ring Signatures Without Random Oracles PowerPoint PPT Presentation


  • 61 Views
  • Uploaded on
  • Presentation posted in: General

Efficient Ring Signatures Without Random Oracles. Hovav Shacham and Brent Waters. Alice’s Dilemma. United Chemical Corporation. Option 1: Come Forward. United Chemical Corporation. Option 1: Come Forward. United Chemical Corporation. Alice gets fired!. Option 2: Anonymous Letter.

Download Presentation

Efficient Ring Signatures Without Random Oracles

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


Efficient ring signatures without random oracles

Efficient Ring Signatures Without Random Oracles

Hovav Shacham and Brent Waters


Alice s dilemma

Alice’s Dilemma

United Chemical Corporation


Option 1 come forward

Option 1: Come Forward

United Chemical Corporation


Option 1 come forward1

Option 1: Come Forward

United Chemical Corporation

Alice gets fired!


Option 2 anonymous letter

Option 2: Anonymous Letter

United Chemical Corporation

Lack of Credibility


Ring signatures rst 01

Ring Signatures [RST’01]

  • Alice chooses a set of S public keys (that includes her own)

  • Signs a message M, on behalf of the “ring” of users

  • Integrity: Signed by some user in the set

  • Anonymity: Can’t tell which user signed


Ring signature solution

Ring Signature Solution

United Chemical Corporation


Prior work

Prior Work

  • Random Oracle Constructions

    • RST (Introduced)

    • DKNS (Constant Size

  • Generic [BKM’05]

    • Formalized definitions

  • Open – Efficient Construction w/o Random Oracles


This work

This work

Waters’ Signatures

GOS ’06 Style

NIZK Techniques

+

Efficient Group Signatures w/o ROs

=


Our approach

Our Approach

  • GOS encrypt one of a set of public keys

2) Sign and GOS encrypt message

3) Prove encrypted signature under encrypted key


Bilinear groups of order n pq bgn 05

Bilinear groups of order N=pq [BGN’05]

  • G: group of order N=pq. (p,q) – secret.

    bilinear map: e: G  G  GT


Bgn encryption gos nizk gos 06

BGN encryption, GOS NIZK [GOS’06]

  • Subgroup assumption: G p Gp

  • E(m) : r  ZN , C  gm (gp)r  G

  • GOS NIZK: Statement: C  G

    Claim: “ C = E(0) or C = E(1) ’’

    Proof:   G

    idea: IF: C = g  (gp)r or C = (gp)r

    THEN: e(C , Cg-1) = e(gp,gp)r  (GT)q


Upshot of gos proofs

Upshot of GOS proofs

  • Prove well-formed in one subgroup

  • “Hidden” by the other subgroup


Waters signature scheme modified

Waters’ Signature Scheme (Modified)

  • Global Setup: g, u’,u1,…,ulg(n), 2 G, A=ga2 G

  • Key-gen: Choose gb = PK, gab = PrivKey

  • Sign (M): (s1,s2) = gab(u’ ki=1 uMi)r, g-r

  • Verify: e(s1,g) e( s2, u’ ki=1 uMi) = e(A,gb)


Our approach1

gb3

gab(u’ ki=1 uMi)r, g-r

Our Approach

  • Alice encrypts her Waters PK

  • Alice encrypt signature

  • Prove signature verifies for encrypted key

gb1

gb2

gb3


A note on setup assumptions

A note on setup assumptions

  • Common reference string from N=pq for GOS proofs

  • Common Random String

    • Linear Assumption -- GOS Crypto ’06

    • Upcoming work by Boyen ‘07

  • Open: Efficient Ring Signatures w/o setup assumptions


Conclusion

Conclusion

  • First efficient Ring Signatures w/o random oracles

  • Combined Waters’ signatures and GOS NIZKs

    • Encrypted one of several PK’s

  • Open: Removing setup assumptions


The end

THE END


  • Login