Shorter Ring Signatures from Standard Assumptions

Abstract

Ring signatures, introduced by Rivest, Shamir and Tauman (ASIACRYPT 2001), allow to sign a message on behalf of a set of users while guaranteeing authenticity and anonymity. Groth and Kohlweiss (EUROCRYPT 2015) and Libert et al. (EUROCRYPT 2016) constructed schemes with signatures of size logarithmic in the number of users. An even shorter ring signature, of size independent from the number of users, was recently proposed by Malavolta and Schröder (ASIACRYPT 2017). However, all these short signatures are obtained relying on strong and controversial assumptions. Namely, the former schemes are both proven secure in the random oracle model while the later requires non-falsifiable assumptions. The most efficient construction under mild assumptions remains the construction of Chandran et al. (ICALP 2007) with a signature of size Θ(√ n), where n is the number of users, and security is based on the Diffie-Hellman assumption in bilinear groups (the SXDH assumption in asymmetric bilinear groups). In this work we construct an asymptotically shorter ring signature from the hardness of the Diffie-Hellman assumption in bilinear groups. Each signature comprises Θ(3 √ n) group elements, signing a message requires computing Θ(3 √ n) exponentiations, and verifying a signature requires Θ(n 2/3) pairing operations. To the best of our knowledge, this is the first ring signature based on bilinear groups with o(√ n) signatures and sublinear verification complexity.

One-Shot Fiat-Shamir-Based NIZK Arguments of Composite Residuosity and Logarithmic-Size Ring Signatures in the Standard Model

“…However, it is not clear how to adapt their approach without using generic NIZK. Assuming a common reference string, constructions with sub-linear-size signatures in the standard model were given in [22,44,28]. Malavolta and Schröder [60] used SNARKs (and thus non-falsifiable assumptions) to obtain constant-size signatures.…”

Ring Signature With Unconditional Anonymity in the Plain Model

“…Then, Chandran, Groth, and Sahai [CGS07] proposed the first sublinear-size ring signature scheme based on the composite order groups with bilinear maps. Moreover, Gonzalez [Gon19] recently improved the signature size of their construction.…”

“…So far, a lot of ring signature schemes with unconditional anonymity has been proposed in the common reference string (CRS) model and in the random oracle model (e.g., [DKNS04], [DRS18], [CGS07], [Gon19], [GK15], [LPQ18], [MS17], [RST01]). On the other hand, in the plain model, we have only one scheme proposed by Malavolta and Schröder [MS17].…”

QA-NIZK Arguments of Same Opening for Bilateral Commitments

“…Indeed, suppose that we want to prove that a commitment opens to a bit, that is, that the opening of some commitments satisfies the quadratic equation X(X − 1) = 0. This often appears as part of a larger proof, for example in ring signatures [8,14,15], e-voting [7] or range proofs [6]. To prove that a commitment opens to a bit, Groth-Sahai proofs proceed as follows:…”