Efficient Ring Signatures Without Random Oracles
description
Transcript of Efficient Ring Signatures Without Random Oracles
![Page 1: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/1.jpg)
1
Efficient Ring Signatures Without Random Oracles
Hovav Shacham and Brent Waters
![Page 2: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/2.jpg)
2
Alice’s Dilemma
United Chemical Corporation
![Page 3: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/3.jpg)
3
Option 1: Come Forward
United Chemical Corporation
![Page 4: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/4.jpg)
4
Option 1: Come Forward
United Chemical Corporation
Alice gets fired!
![Page 5: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/5.jpg)
5
Option 2: Anonymous Letter
United Chemical Corporation
Lack of Credibility
![Page 6: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/6.jpg)
6
Ring Signatures [RST’01]
Alice chooses a set of S public keys (that includes her own)
Signs a message M, on behalf of the “ring” of users
Integrity: Signed by some user in the set
Anonymity: Can’t tell which user signed
![Page 7: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/7.jpg)
7
Ring Signature Solution
United Chemical Corporation
![Page 8: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/8.jpg)
8
Prior Work
Random Oracle Constructions•RST (Introduced)•DKNS (Constant Size
Generic [BKM’05]•Formalized definitions
Open – Efficient Construction w/o Random Oracles
![Page 9: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/9.jpg)
9
This work
Waters’ Signatures
GOS ’06 Style
NIZK Techniques
Efficient Group Signatures w/o
ROs
![Page 10: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/10.jpg)
10
Our Approach
1) GOS encrypt one of a set of public keys
2) Sign and GOS encrypt message
3) Prove encrypted signature under encrypted key
![Page 11: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/11.jpg)
11
Bilinear groups of order N=pq [BGN’05]
G: group of order N=pq. (p,q) – secret.
bilinear map: e: G G GT
![Page 12: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/12.jpg)
12
BGN encryption, GOS NIZK [GOS’06]
Subgroup assumption: G p Gp
E(m) : r ZN , C gm (gp)r G
GOS NIZK: Statement: C G
Claim: “ C = E(0) or C = E(1) ’’
Proof: G
idea: IF: C = g (gp)r or C = (gp)r
THEN: e(C , Cg-1) = e(gp,gp)r (GT)
q
![Page 13: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/13.jpg)
13
Upshot of GOS proofs
Prove well-formed in one subgroup
“Hidden” by the other subgroup
![Page 14: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/14.jpg)
14
Waters’ Signature Scheme (Modified)
Global Setup: g, u’,u1,…,ulg(n), 2 G, A=ga 2 G
Key-gen: Choose gb = PK, gab = PrivKey
Sign (M): (s1,s2) = gab(u’ ki=1 uMi)r, g-r
Verify: e(s1,g) e( s2, u’ ki=1 uMi ) = e(A,gb)
![Page 15: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/15.jpg)
15
Our Approach
gb1 gb2 gb3
gb3
Alice encrypts her Waters PK
Alice encrypt signature
Prove signature verifies for encrypted key
gab(u’ ki=1 uMi)r, g-r
![Page 16: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/16.jpg)
16
A note on setup assumptions
Common reference string from N=pq for GOS proofs
Common Random String •Linear Assumption -- GOS Crypto ’06•Upcoming work by Boyen ‘07
Open: Efficient Ring Signatures w/o setup assumptions
![Page 17: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/17.jpg)
17
Conclusion
First efficient Ring Signatures w/o random oracles
Combined Waters’ signatures and GOS NIZKs•Encrypted one of several PK’s
Open: Removing setup assumptions
![Page 18: Efficient Ring Signatures Without Random Oracles](https://reader035.fdocuments.net/reader035/viewer/2022062423/56814903550346895db639ca/html5/thumbnails/18.jpg)
18
THE END