Ring Signatures: Stronger Definitions, and Constructions without Random Oracles

Abstract

Ring signatures, first introduced by Rivest, Shamir, and Tauman, enable a user to sign a message so that a ring of possible signers (of which the user is a member) is identified, without revealing exactly which member of that ring actually generated the signature. In contrast to group signatures, ring signatures are completely "ad-hoc" and do not require any central authority or coordination among the various users (indeed, users do not even need to be aware of each other); furthermore, ring signature schemes grant users fine-grained control over the level of anonymity associated with any particular signature. This paper has two main areas of focus. First, we examine previous definitions of security for ring signature schemes and suggest that most of these prior definitions are too weak, in the sense that they do not take into account certain realistic attacks. We propose new definitions of anonymity and unforgeability which address these threats, and then give separation results proving that our new notions are strictly stronger than previous ones. Next, we show two constructions of ring signature schemes in the standard model: one based on generic assumptions which satisfies our strongest definitions of security, and a second, more efficient scheme achieving weaker security guarantees and more limited functionality. These are the first constructions of ring signature schemes that do not rely on random oracles or ideal ciphers.

Foundations of Fully Dynamic Group Signatures

“…The definition below implies anonymity against full key exposure attacks [BKM09] as in the game the adversary is allowed to choose the secret signing keys of the users.…”

Two-Party (Blind) Ring Signatures and Their Applications

“…Our definition of unforgeability is slightly stronger than the strongest notion, existential unforgeability with respect to insider corruption [2], in which we allow the adversary to issue signature query on behalf of arbitrary ring without supplying the corresponding secret key.…”

“…It means that given a message m and a signature (σ, R), it is infeasible to determine who created the signature, even if all the secret keys are known. The formal definition is adapted from [2] for general ring signatures against full key exposure. Note that we allow the common reference string to be maliciously generated in this model.…”

“…We first describe our construction of a two-party ring signature, which is essentially the scheme from [2] with a proof-of-correctness added to the public key.…”

“…The general version of Bender et al [2] uses generic ZAPs for NP as a building block and is inefficient. They also proposed an efficient twoparty ring signature scheme under standard assumptions in a weaker security model.…”