Loading in 5 sec....

Efficient Ring Signatures Without Random OraclesPowerPoint Presentation

Efficient Ring Signatures Without Random Oracles

- 78 Views
- Uploaded on
- Presentation posted in: General

Efficient Ring Signatures Without Random Oracles

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Efficient Ring Signatures Without Random Oracles

Hovav Shacham and Brent Waters

United Chemical Corporation

United Chemical Corporation

United Chemical Corporation

Alice gets fired!

United Chemical Corporation

Lack of Credibility

- Alice chooses a set of S public keys (that includes her own)
- Signs a message M, on behalf of the “ring” of users
- Integrity: Signed by some user in the set
- Anonymity: Can’t tell which user signed

United Chemical Corporation

- Random Oracle Constructions
- RST (Introduced)
- DKNS (Constant Size

- Generic [BKM’05]
- Formalized definitions

- Open – Efficient Construction w/o Random Oracles

Waters’ Signatures

GOS ’06 Style

NIZK Techniques

+

Efficient Group Signatures w/o ROs

=

- GOS encrypt one of a set of public keys

2) Sign and GOS encrypt message

3) Prove encrypted signature under encrypted key

- G: group of order N=pq. (p,q) – secret.
bilinear map: e: G G GT

- Subgroup assumption: G p Gp
- E(m) : r ZN , C gm (gp)r G
- GOS NIZK: Statement: C G
Claim: “ C = E(0) or C = E(1) ’’

Proof: G

idea: IF: C = g (gp)r or C = (gp)r

THEN: e(C , Cg-1) = e(gp,gp)r (GT)q

- Prove well-formed in one subgroup
- “Hidden” by the other subgroup

- Global Setup: g, u’,u1,…,ulg(n), 2 G, A=ga2 G
- Key-gen: Choose gb = PK, gab = PrivKey
- Sign (M): (s1,s2) = gab(u’ ki=1 uMi)r, g-r
- Verify: e(s1,g) e( s2, u’ ki=1 uMi) = e(A,gb)

gb3

gab(u’ ki=1 uMi)r, g-r

- Alice encrypts her Waters PK
- Alice encrypt signature
- Prove signature verifies for encrypted key

gb1

gb2

gb3

- Common reference string from N=pq for GOS proofs
- Common Random String
- Linear Assumption -- GOS Crypto ’06
- Upcoming work by Boyen ‘07

- Open: Efficient Ring Signatures w/o setup assumptions

- First efficient Ring Signatures w/o random oracles
- Combined Waters’ signatures and GOS NIZKs
- Encrypted one of several PK’s

- Open: Removing setup assumptions

THE END