Group signatures and more from isogenies and lattices: generic, simple, and efficient

Abstract

We construct an efficient dynamic group signature (or more generally an accountable ring signature) from isogeny and lattice assumptions. Our group signature is based on a simple generic construction that can be instantiated by cryptographically hard group actions such as the CSIDH group action or an MLWE-based group action. The signature is of size $$O(\log N)$$ O ( log N ) , where N is the number of users in the group. Our idea builds on the recent efficient OR-proof by Beullens, Katsumata, and Pintore (Asiacrypt’20), where we efficiently add a proof of valid ciphertext to their OR-proof and further show that the resulting non-interactive zero-knowledge proof system is online extractable. Our group signatures satisfy more ideal security properties compared to previously known constructions, while simultaneously having an attractive signature size. The signature size of our isogeny-based construction is an order of magnitude smaller than all previously known post-quantum group signatures (e.g., 6.6 KB for 64 members). In comparison, our lattice-based construction has a larger signature size (e.g., either 126 KB or 89 KB for 64 members depending on the satisfied security property). However, since the $$O(\cdot )$$ O ( · ) -notation hides a very small constant factor, it remains small even for very large group sizes, say $$2^{20}$$ 2 20 .

Malleable Commitments from Group Actions and Zero-Knowledge Proofs for Circuits Based on Isogenies

“…Obtaining a stronger parameter set from isogenies is an active research area [7,13]. In this model, there exists various constructions, such as logarithmic (linkable) ring signatures [6], threshold signatures [14], logarithmic (and tightly secure) group signatures [5], and compact blind signatures [21].…”

“…As such, our results remain predominantly theoretical. However, it is essential to highlight that the KO-EGA model implies the existence of numerous cryptographic primitives with significant relevance in real-world applications [6,14,5,21]. The challenge of instantiating a stronger KO-EGA remains an open problem and an active area of research, which is orthogonal to the focus of our paper.…”

“…Furthermore, we construct a proof system for a matrix branching relation. Using the technique given in [5], each of these constructions leads to an online-extractable zero-knowledge proof of knowledge for NP statements without trusted setup under the random oracle model. We use the known-order effective group action (KO-EGA) model to develop our schemes, where we know the group order and have an efficient algorithm for computing the action of ng for any g within the (additive) group and n ∈ N. Currently, the only two known post-quantum instantiations of KO-EGA are from isogeny-based group actions, specifically CSI-FiSh and SCALLOP [7,13], and the quantum security levels of these two instantiations are somewhat lower than the NIST-1 requirement [24].…”

“…Our construction of malleable commitment is based on an adaptation of the public key encryption scheme of [5] (Sec. 4).…”

“…In this paper, we introduce a relaxed notion of homomorphic commitments, called malleable commitments, which requires less structure to be instantiated. We provide a malleable commitment construction from the ElGamal-type isogeny-based group action from Eurocrypt'22 [5]. We show how malleable commitments with a group structure in the malleability can be used to build zero-knowledge proofs for NP statements, improving on the naive construction from one-way functions.…”