No abstract

Abstract. Basing signature schemes on strong lattice problems has been a long standing open issue. Today, two families of lattice-based signature schemes are known: the ones based on the hash-andsign construction of Gentry et al.; and Lyubashevsky's schemes, which are based on the Fiat-Shamir framework. In this paper we show for the first time how to adapt the schemes of Lyubashevsky to the ring signature setting. In particular we transform the scheme of ASIACRYPT 2009 into a ring signature scheme that provides strong properties of security under the random oracle model. Anonymity is ensured in the sense that signatures of different users are within negligible statistical distance even under full key exposure. In fact, the scheme satisfies a notion which is stronger than the classical full key exposure setting as even if the keypair of the signing user is adversarially chosen, the statistical distance between signatures of different users remains negligible. Considering unforgeability, the best lattice-based ring signature schemes provide either unforgeability against arbitrary chosen subring attacks or insider corruption in log-sized rings. In this paper we present two variants of our scheme. In the basic one, unforgeability is ensured in those two settings. Increasing signature and key sizes by a factor k (typically 80 − 100), we provide a variant in which unforgeability is ensured against insider corruption attacks for arbitrary rings. The technique used is pretty general and can be adapted to other existing schemes.

No abstract

International audience—Ring signatures were introduced by Rivest, Shamir and Tauman in 2001 [32]. These sig-natures allow a signer to anonymously authenticate a message on behalf of a group of his choice. This concept was then extended by Bresson, Stern and Szydlo into -out-of-(threshold) ring signatures in 2002 [9]. We propose in this article a generalization of Stern's code based identification (and signature) scheme [36] to design a practical -out-of-threshold ring signature scheme. The size of the resulting signatures is in () and does not depend on , contrary to most of the existing protocols. Our scheme is existentially unforge-able under a chosen message attack in the random oracle model assuming the hardness of the minimum distance problem, is unconditionally source hiding, has a very short public key and has an overall complexity in (). This protocol is the first efficient code-based ring signature scheme and the first code-based thresh-old ring signature scheme. Moreover it has a better complexity than number-theory based schemes which have a complexity in (). This paper is an extended version of [2] with complete proofs and definitions