Efficient ring signatures without random oracles
Download
1 / 18

Efficient Ring Signatures Without Random Oracles - PowerPoint PPT Presentation


  • 87 Views
  • Uploaded on

Efficient Ring Signatures Without Random Oracles. Hovav Shacham and Brent Waters. Alice’s Dilemma. United Chemical Corporation. Option 1: Come Forward. United Chemical Corporation. Option 1: Come Forward. United Chemical Corporation. Alice gets fired!. Option 2: Anonymous Letter.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'Efficient Ring Signatures Without Random Oracles' - devlin


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
Efficient ring signatures without random oracles

Efficient Ring Signatures Without Random Oracles

Hovav Shacham and Brent Waters


Alice s dilemma
Alice’s Dilemma

United Chemical Corporation


Option 1 come forward
Option 1: Come Forward

United Chemical Corporation


Option 1 come forward1
Option 1: Come Forward

United Chemical Corporation

Alice gets fired!


Option 2 anonymous letter
Option 2: Anonymous Letter

United Chemical Corporation

Lack of Credibility


Ring signatures rst 01
Ring Signatures [RST’01]

  • Alice chooses a set of S public keys (that includes her own)

  • Signs a message M, on behalf of the “ring” of users

  • Integrity: Signed by some user in the set

  • Anonymity: Can’t tell which user signed


Ring signature solution
Ring Signature Solution

United Chemical Corporation


Prior work
Prior Work

  • Random Oracle Constructions

    • RST (Introduced)

    • DKNS (Constant Size

  • Generic [BKM’05]

    • Formalized definitions

  • Open – Efficient Construction w/o Random Oracles


This work
This work

Waters’ Signatures

GOS ’06 Style

NIZK Techniques

+

Efficient Group Signatures w/o ROs

=


Our approach
Our Approach

  • GOS encrypt one of a set of public keys

2) Sign and GOS encrypt message

3) Prove encrypted signature under encrypted key


Bilinear groups of order n pq bgn 05
Bilinear groups of order N=pq [BGN’05]

  • G: group of order N=pq. (p,q) – secret.

    bilinear map: e: G  G  GT


Bgn encryption gos nizk gos 06
BGN encryption, GOS NIZK [GOS’06]

  • Subgroup assumption: G p Gp

  • E(m) : r  ZN , C  gm (gp)r  G

  • GOS NIZK: Statement: C  G

    Claim: “ C = E(0) or C = E(1) ’’

    Proof:   G

    idea: IF: C = g  (gp)r or C = (gp)r

    THEN: e(C , Cg-1) = e(gp,gp)r  (GT)q


Upshot of gos proofs
Upshot of GOS proofs

  • Prove well-formed in one subgroup

  • “Hidden” by the other subgroup


Waters signature scheme modified
Waters’ Signature Scheme (Modified)

  • Global Setup: g, u’,u1,…,ulg(n), 2 G, A=ga2 G

  • Key-gen: Choose gb = PK, gab = PrivKey

  • Sign (M): (s1,s2) = gab(u’ ki=1 uMi)r, g-r

  • Verify: e(s1,g) e( s2, u’ ki=1 uMi) = e(A,gb)


Our approach1

gb3

gab(u’ ki=1 uMi)r, g-r

Our Approach

  • Alice encrypts her Waters PK

  • Alice encrypt signature

  • Prove signature verifies for encrypted key

gb1

gb2

gb3


A note on setup assumptions
A note on setup assumptions

  • Common reference string from N=pq for GOS proofs

  • Common Random String

    • Linear Assumption -- GOS Crypto ’06

    • Upcoming work by Boyen ‘07

  • Open: Efficient Ring Signatures w/o setup assumptions


Conclusion
Conclusion

  • First efficient Ring Signatures w/o random oracles

  • Combined Waters’ signatures and GOS NIZKs

    • Encrypted one of several PK’s

  • Open: Removing setup assumptions