Report and Trace Ring Signatures

Fraser, Ashley; Quaglia, Elizabeth A.

doi:10.1007/978-3-030-92548-2_10

Cited by 3 publications

(24 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Specifically, Xu and Yung introduced accountable ring signatures [31], which introduce a designated tracer that can revoke the anonymity of signers. More recently, Fraser and Quaglia presented report and trace ring (RTR) signatures [13]. This new ring signature variant builds upon the functionality of accountable ring signatures, requiring that the designated tracer can revoke anonymity only if a ring member first sends a report of malicious behaviour to the designated tracer 4 .…”

Section: Introductionmentioning

confidence: 99%

“…Upon receiving a report, a designated tracer can trace the signer's identity. Fraser and Quaglia defined report and trace ring signatures in [13], and provided a complete security model for the primitive. Accompanying this formalisation, the authors present a provably secure generic construction and concrete instantiation of an RTR signature.…”

Section: Introductionmentioning

confidence: 99%

“…As such, the complexity of the proof is linear in the security parameter. The efficiency analysis of the instantiation presented in [13] omits the security parameter. That is, signing is claimed to be linear in the size of the ring |R| but is, in fact, linear in λ • |R|.…”

Section: Introductionmentioning

confidence: 99%

“…This work addresses the limitations of the existing RTR signature instantiation. Namely, we introduce a new instantiation of the generic construction in [13] (Section 4) that is more efficient than the instantiation in [13] with respect to signing. Then, we introduce a new RTR signature scheme construction (Section 5) that can be instantiated with any group for which the Decisional Diffie-Hellman assumption holds.…”

Section: Introductionmentioning

confidence: 99%

“…In the generic construction of [13], during signing, the signer generates a reporter token that is encrypted to each ring member. The signer also generates a proof of correct encryption of the reporter token.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Improving the Efficiency of Report and Trace Ring Signatures

Bultel

Fraser

Quaglia

2022

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Ring signatures allow signers to produce verifiable signatures and remain anonymous within a set of signers (i.e., the ring) while doing so. They are well-suited to protocols that target anonymity as a primary goal, for example, anonymous cryptocurrencies. However, standard ring signatures do not ensure that signers are held accountable if they act maliciously. Fraser and Quaglia (CANS'21) introduced a ring signature variant that they called report and trace ring signatures which balances the anonymity guarantee of standard ring signatures with the need to hold signers accountable. In particular, report and trace ring signatures introduce a reporting system whereby ring members can report malicious message/signature pairs. A designated tracer can then revoke the signer's anonymity if, and only if, a ring member submits a report to the tracer. Fraser and Quaglia present a generic construction of a report and trace ring signature scheme and outline an instantiation for which it is claimed that the complexity of signing is linear in the size of the ring |R|. In this paper, we introduce a new instantiation of Fraser and Quaglia's generic report and trace ring signature construction. Our instantiation uses a pairing-based variant of ElGamal that we define. We demonstrate that our instantiation is more efficient. In fact, we highlight that the efficiency of Fraser and Quaglia's instantiation omits a scaling factor of λ where λ is a security parameter. As such, the complexity of signing for their instantiation grows linearly in λ • |R|. Our instantiation, on the other hand, achieves signing complexity linear in |R|. We also introduce a new pairing-free report and trace ring signature construction reaching a similar signing complexity. Whilst this construction requires some additional group exponentiations, it can be instantiated over any prime order group for which the Decisional Diffie-Hellman assumption holds.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations