efficient ring signatures without random oracles
Download
Skip this Video
Download Presentation
Efficient Ring Signatures Without Random Oracles

Loading in 2 Seconds...

play fullscreen
1 / 18

Efficient Ring Signatures Without Random Oracles - PowerPoint PPT Presentation


  • 87 Views
  • Uploaded on

Efficient Ring Signatures Without Random Oracles. Hovav Shacham and Brent Waters. Alice’s Dilemma. United Chemical Corporation. Option 1: Come Forward. United Chemical Corporation. Option 1: Come Forward. United Chemical Corporation. Alice gets fired!. Option 2: Anonymous Letter.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Efficient Ring Signatures Without Random Oracles' - devlin


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
alice s dilemma
Alice’s Dilemma

United Chemical Corporation

option 1 come forward
Option 1: Come Forward

United Chemical Corporation

option 1 come forward1
Option 1: Come Forward

United Chemical Corporation

Alice gets fired!

option 2 anonymous letter
Option 2: Anonymous Letter

United Chemical Corporation

Lack of Credibility

ring signatures rst 01
Ring Signatures [RST’01]
  • Alice chooses a set of S public keys (that includes her own)
  • Signs a message M, on behalf of the “ring” of users
  • Integrity: Signed by some user in the set
  • Anonymity: Can’t tell which user signed
ring signature solution
Ring Signature Solution

United Chemical Corporation

prior work
Prior Work
  • Random Oracle Constructions
    • RST (Introduced)
    • DKNS (Constant Size
  • Generic [BKM’05]
    • Formalized definitions
  • Open – Efficient Construction w/o Random Oracles
this work
This work

Waters’ Signatures

GOS ’06 Style

NIZK Techniques

+

Efficient Group Signatures w/o ROs

=

our approach
Our Approach
  • GOS encrypt one of a set of public keys

2) Sign and GOS encrypt message

3) Prove encrypted signature under encrypted key

bilinear groups of order n pq bgn 05
Bilinear groups of order N=pq [BGN’05]
  • G: group of order N=pq. (p,q) – secret.

bilinear map: e: G  G  GT

bgn encryption gos nizk gos 06
BGN encryption, GOS NIZK [GOS’06]
  • Subgroup assumption: G p Gp
  • E(m) : r  ZN , C  gm (gp)r  G
  • GOS NIZK: Statement: C  G

Claim: “ C = E(0) or C = E(1) ’’

Proof:   G

idea: IF: C = g  (gp)r or C = (gp)r

THEN: e(C , Cg-1) = e(gp,gp)r  (GT)q

upshot of gos proofs
Upshot of GOS proofs
  • Prove well-formed in one subgroup
  • “Hidden” by the other subgroup
waters signature scheme modified
Waters’ Signature Scheme (Modified)
  • Global Setup: g, u’,u1,…,ulg(n), 2 G, A=ga2 G
  • Key-gen: Choose gb = PK, gab = PrivKey
  • Sign (M): (s1,s2) = gab(u’ ki=1 uMi)r, g-r
  • Verify: e(s1,g) e( s2, u’ ki=1 uMi) = e(A,gb)
our approach1

gb3

gab(u’ ki=1 uMi)r, g-r

Our Approach
  • Alice encrypts her Waters PK
  • Alice encrypt signature
  • Prove signature verifies for encrypted key

gb1

gb2

gb3

a note on setup assumptions
A note on setup assumptions
  • Common reference string from N=pq for GOS proofs
  • Common Random String
    • Linear Assumption -- GOS Crypto ’06
    • Upcoming work by Boyen ‘07
  • Open: Efficient Ring Signatures w/o setup assumptions
conclusion
Conclusion
  • First efficient Ring Signatures w/o random oracles
  • Combined Waters’ signatures and GOS NIZKs
    • Encrypted one of several PK’s
  • Open: Removing setup assumptions
ad