Calamari and Falafl: Logarithmic (Linkable) Ring Signatures from Isogenies and Lattices

Abstract

We construct efficient ring signatures (RS) from isogeny and lattice assumptions. Our ring signatures are based on a logarithmic OR proof for group actions. We instantiate this group action by either the CSIDH group action or an MLWE-based group action to obtain our isogeny-based or lattice-based RS scheme, respectively. Even though the OR proof has a binary challenge space and therefore requires a number of repetitions which is linear in the security parameter, the sizes of our ring signatures are small and scale better with the ring size N than previously known post-quantum ring signatures. We also construct linkable ring signatures (LRS) that are almost as efficient as the non-linkable variants. The isogeny-based scheme produces signatures whose size is an order of magnitude smaller than all previously known logarithmic post-quantum ring signatures, but it is relatively slow (e.g. 5.5 KB signatures and 79 s signing time for rings with 8 members). In comparison, the latticebased construction is much faster, but has larger signatures (e.g. 30 KB signatures and 90 ms signing time for the same ring size). For small ring sizes our lattice-based ring signatures are slightly larger than state-ofthe-art schemes, but they are smaller for ring sizes larger than N ≈ 1024.

Identity-Based Linkable Ring Signature on NTRU Lattice

“…It is indicated that this scheme has a smaller size of key and signature, and the computational efficiency of signature generation and verification has also been further increased through the comparison with other similar schemes. Finally, we implemented our scheme and other schemes [15,28,29], and it is shown that the time for signature generation and verification of this scheme decreases roughly by 44.951% and 33.503%, respectively, compared with other three existing latest LRS schemes [15,28,29]. Compared with latest lattice-based LRS schemes [28,29], the proposed scheme has the smallest public and private key size and also has the smallest signature size when N ≤ 8.…”

“…Finally, we implemented our scheme and other schemes [15,28,29], and it is shown that the time for signature generation and verification of this scheme decreases roughly by 44.951% and 33.503%, respectively, compared with other three existing latest LRS schemes [15,28,29]. Compared with latest lattice-based LRS schemes [28,29], the proposed scheme has the smallest public and private key size and also has the smallest signature size when N ≤ 8.…”

“…In Section 6, we discuss how initial parameters are selected and point at the next research directions. In Section 7, we make a detailed performance comparison with other three existing schemes [15,28,29]. Finally, we present the experimental results of this scheme and related schemes in Section 8.…”

“…at same year, Baum et al [27] produced a more efficient LRS scheme based upon the collision-resistance hash function on lattice, whose security is based on the problem of Module-LWE and Module-SIS. In 2020, Beullens et al [28] gave the logarithmic LRS from isogeny and lattice assumptions; the length of the signature has a logarithmic relationship with the number of ring members. But they generally have the disadvantages of high communication costs and lower computation performance.…”

An Anonymous Trust-Marking Scheme on Blockchain Systems

“…However, anonymity of claim issuers is not a primary subject of the standards; thus, it cannot be directly employed for our usage. One naive solution is to employ anonymous signatures such as ring signatures [40], especially linkable ring signatures [5], [13], [30], [32], [44], [45], [47], which have been widely used to add anonymity in cryptocurrencies such as Monero [35]. This solution assumes that there are token admitters who are trusted; i.e., they are recognized as entities that can issue tokens but are not allowed further responsibilities.…”