Signatures with Flexible Public Key: Introducing Equivalence Classes - - PowerPoint PPT Presentation

Signatures with Flexible Public Key: Introducing Equivalence Classes for Public Keys

Michael Backes, Lucjan Hanzlik, Kamil Kluzcniak, Jonas Schneider

▪ New primitive! Signatures with Flexible Public Key ▪ Applications to

• sub-linear size Ring Signatures from falsifiable assumptions without

trusted setup

• efficient standard model Group Signatures in combination with SPS-EQ

This Talk

Ring Signatures [Rivest-Shamir-Tauman, 2001]

ℛ

vk1 vk2 vkn

…

Ring

Ring Signatures [Rivest-Shamir-Tauman, 2001]

ski vki

ℛ

vk1 vk2 vkn

…

Ring

Ring Signatures [Rivest-Shamir-Tauman, 2001]

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ)

ski vki

ℛ

vk1 vk2 vkn

…

Ring

Ring Signatures [Rivest-Shamir-Tauman, 2001]

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ) 𝚋𝚍𝚍𝚏𝚚𝚞/𝚜𝚏𝚔𝚏𝚍𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓(σ, m, ℛ)

ski vki

Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006]

𝒝

Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

Signing Oracle Corruption Oracle

Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ)

σ

i, m, ℛ

Signing Oracle Corruption Oracle

Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ)

σ

i, m, ℛ

Signing Oracle Corruption Oracle

i

ski

Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ)

σ

i, m, ℛ

Signing Oracle Corruption Oracle

m*, σ*, ℛ*

i

ski

Ring Signatures: Unforgeability [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ)

σ

i, m, ℛ

Signing Oracle Corruption Oracle

m*, σ*, ℛ*

i

ski

𝚋𝚍𝚍𝚏𝚚𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓(σ*, m*, ℛ*)

(m*, ℛ*) never queried

• nly honest keys in ℛ*

𝒝 wins if

Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ)

σ

i, m, ℛ

Signing Oracle

Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

Challenge Oracle

i0, i1, m, ℛ σ*, ω1, …, ωl

σ* ← 𝖳𝗃𝗁𝗈(skib, m, ℛ)

b ← {0,1}

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ)

σ

i, m, ℛ

Signing Oracle

Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

̂ b

Challenge Oracle

i0, i1, m, ℛ σ*, ω1, …, ωl

σ* ← 𝖳𝗃𝗁𝗈(skib, m, ℛ)

b ← {0,1}

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ)

σ

i, m, ℛ

Signing Oracle

Ring Signatures: Anonymity [Bender-Katz-Morselli, 2006]

𝒝

vk1 vk2 vkl

…

̂ b

Challenge Oracle

i0, i1, m, ℛ σ*, ω1, …, ωl

σ* ← 𝖳𝗃𝗁𝗈(skib, m, ℛ)

b ← {0,1}

σ ← 𝖳𝗃𝗁𝗈(ski, m, ℛ)

σ

i, m, ℛ

Signing Oracle

b = ̂ b

𝒝 wins if

▪ Standard Model security, falsifiable assumptions, no ROM ▪ Small signatures for efficiency ▪ No form of trusted setup!

Ring Signatures: Desiderata

Ring Signatures: Generic Approach

Sign the Message Prove Ring Membership

Ring Signatures: Generic Approach

Sign the Message Prove Ring Membership

Ring Signatures: [Malavolta-Schröder, 2017]

Ring Signatures: [Malavolta-Schröder, 2017]

Σ: Signature Scheme with Rerandomizable Keys σm ← Σ . 𝖳𝗃𝗁𝗈(sk′, m||ℛ) sk′ ← Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖳𝖫(sk, r)

[Fleischhacker-Krupp-Malavolta-Simkin-S-Schröder, 2016]

Ring Signatures: [Malavolta-Schröder, 2017]

σ = (vk′, σm, π)

Π: tailored NIZK-PoK with shared setup π ← Π . 𝖰𝗌𝗉𝗐𝖿

vk in ℛ

vk′ = Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖶𝖫(vk, r)

( )

Σ: Signature Scheme with Rerandomizable Keys σm ← Σ . 𝖳𝗃𝗁𝗈(sk′, m||ℛ) sk′ ← Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖳𝖫(sk, r)

[Fleischhacker-Krupp-Malavolta-Simkin-S-Schröder, 2016]

Ring Signatures: [Malavolta-Schröder, 2017]

σ = (vk′, σm, π)

Π: tailored NIZK-PoK with shared setup π ← Π . 𝖰𝗌𝗉𝗐𝖿

vk in ℛ

vk′ = Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖶𝖫(vk, r)

( )

Σ: Signature Scheme with Rerandomizable Keys σm ← Σ . 𝖳𝗃𝗁𝗈(sk′, m||ℛ) sk′ ← Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖳𝖫(sk, r)

[Fleischhacker-Krupp-Malavolta-Simkin-S-Schröder, 2016]

• No Setup
• Security under q-Strong DH assumption + Linear-KEA (GGM)
• O(n) signature size

Signatures with Flexible Public Key (SFPK)

Signatures with Flexible Public Key (SFPK)

(sk, vk) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ)

σ ← 𝖳𝗃𝗁𝗈(sk, m) ← 𝖶𝖿𝗌𝗃𝗀𝗓(vk, σ, m)

𝚋𝚍𝚍𝚏𝚚𝚞 𝚜𝚏𝚔𝚏𝚍𝚞

Signatures with Flexible Public Key (SFPK)

(sk, vk) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ)

σ ← 𝖳𝗃𝗁𝗈(sk, m) ← 𝖶𝖿𝗌𝗃𝗀𝗓(vk, σ, m)

𝚋𝚍𝚍𝚏𝚚𝚞 𝚜𝚏𝚔𝚏𝚍𝚞

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r) vk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖶𝖫(vk, r)

vk′ ∼ vk

Signatures with Flexible Public Key (SFPK)

(sk, vk) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ)

σ ← 𝖳𝗃𝗁𝗈(sk, m) ← 𝖶𝖿𝗌𝗃𝗀𝗓(vk, σ, m)

𝚋𝚍𝚍𝚏𝚚𝚞 𝚜𝚏𝚔𝚏𝚍𝚞

(τ, sk, vk) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈(1λ)

← 𝖣𝗂𝖿𝖽𝗅𝖲𝖿𝗊(τ, vk, vk′)

𝚣𝚏𝚝 𝚘𝚙

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r) vk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖶𝖫(vk, r)

vk′ ∼ vk

Signatures with Flexible Public Key (SFPK)

(sk, vk) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ)

σ ← 𝖳𝗃𝗁𝗈(sk, m) ← 𝖶𝖿𝗌𝗃𝗀𝗓(vk, σ, m)

𝚋𝚍𝚍𝚏𝚚𝚞 𝚜𝚏𝚔𝚏𝚍𝚞

(τ, sk, vk) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈(1λ)

← 𝖣𝗂𝖿𝖽𝗅𝖲𝖿𝗊(τ, vk, vk′)

𝚣𝚏𝚝 𝚘𝚙

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r) vk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖶𝖫(vk, r)

vk′ ∼ vk

Example

vk, vk′ ∈ 𝔿ℓ

vk ∼ vk′ if there is r ∈ ℤ*

p

(vkr

1, …vkr ℓ) = (vk′ 1, …vk′ ℓ)

SFPK: Unforgeability

𝒝

SFPK: Unforgeability

𝒝

(τ, sk, vk) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈(1λ) (τ, vk)

SFPK: Unforgeability

𝒝

(τ, sk, vk) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈(1λ) (τ, vk)

σ

m, r

σ ← 𝖳𝗃𝗁𝗈(sk′, m)

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r)

SFPK: Unforgeability

𝒝

(τ, sk, vk) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈(1λ) (τ, vk) (vk*, m*, σ*)

σ

m, r

σ ← 𝖳𝗃𝗁𝗈(sk′, m)

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r)

SFPK: Unforgeability

𝒝

(τ, sk, vk) ← 𝖴𝖫𝖿𝗓𝖧𝖿𝗈(1λ) (τ, vk) (vk*, m*, σ*)

σ

m, r

σ ← 𝖳𝗃𝗁𝗈(sk′, m)

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r)

𝚋𝚍𝚍𝚏𝚚𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓(vk*, σ*, m*)

m* never queried

𝚣𝚏𝚝 ← 𝖣𝗂𝖿𝖽𝗅𝖲𝖿𝗊(τ, 𝗐𝗅, 𝗐𝗅*)

𝒝 wins if

SFPK: Class-Hiding

𝒝

SFPK: Class-Hiding

𝒝

(sk0, vk0) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω0) (sk1, vk1) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω1)

SFPK: Class-Hiding

𝒝

(sk0, vk0) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω0) (sk1, vk1) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω1)

b ← {0,1}

SFPK: Class-Hiding

𝒝

(sk0, vk0) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω0) (sk1, vk1) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω1)

b ← {0,1}

r ← R

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(skb, r) vk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖰𝖫(vkb, r)

SFPK: Class-Hiding

𝒝

(sk0, vk0) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω0) (sk1, vk1) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω1)

b ← {0,1}

r ← R

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(skb, r) vk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖰𝖫(vkb, r)

(vk′, ω0, ω1)

SFPK: Class-Hiding

𝒝

(sk0, vk0) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω0) (sk1, vk1) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω1)

b ← {0,1}

r ← R

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(skb, r) vk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖰𝖫(vkb, r)

(vk′, ω0, ω1)

σ

m

σ ← 𝖳𝗃𝗁𝗈(sk′, m)

SFPK: Class-Hiding

𝒝

̂ b

(sk0, vk0) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω0) (sk1, vk1) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω1)

b ← {0,1}

r ← R

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(skb, r) vk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖰𝖫(vkb, r)

(vk′, ω0, ω1)

σ

m

σ ← 𝖳𝗃𝗁𝗈(sk′, m)

SFPK: Class-Hiding

𝒝

̂ b

(sk0, vk0) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω0) (sk1, vk1) ← 𝖫𝖿𝗓𝖧𝖿𝗈(1λ; ω1)

b ← {0,1}

r ← R

sk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(skb, r) vk′ ← 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖰𝖫(vkb, r)

(vk′, ω0, ω1)

σ

m

σ ← 𝖳𝗃𝗁𝗈(sk′, m)

b = ̂ b

𝒝 wins if

𝖶𝖿𝗌𝗃𝗀𝗓

e(σ1, g2) =? e(t, g2) ⋅ e(HKPHF(m), σ3)

e(σ2, g2) =? e(g1, σ3)

𝖳𝗃𝗁𝗈

σ1 := Xy ⋅ HKPHF(m)r

r ← ℤ*

p

σ2 := gr

1

σ3 := gr

2 Instantiation

sk = (y, X) ∈ ℤp × 𝔿1

vk = (A, B, C, D, t := e(Xy, g2), KPHF)

∈

∈

ℤp × 𝔿1

𝔿4

1 × 𝔿T × 𝔿λ+1 1

𝖶𝖿𝗌𝗃𝗀𝗓

e(σ1, g2) =? e(t, g2) ⋅ e(HKPHF(m), σ3)

e(σ2, g2) =? e(g1, σ3)

𝖳𝗃𝗁𝗈

σ1 := Xy ⋅ HKPHF(m)r

r ← ℤ*

p

σ2 := gr

1

σ3 := gr

2 Instantiation

sk = (y, X) ∈ ℤp × 𝔿1

vk = (A, B, C, D, t := e(Xy, g2), KPHF)

∈

∈

ℤp × 𝔿1

𝔿4

1 × 𝔿T × 𝔿λ+1 1

• Unforgeable under DLIN assumption and security of PHF

(e.g. CDH)

• Class Hiding under DDH assumption in 𝔿1

Ring Signatures: [Malavolta-Schröder, 2017]

σ = (vk′, σm, π)

Π: tailored NIZK-PoK with shared setup π ← Π . 𝖰𝗌𝗉𝗐𝖿

vk in ℛ

vk′ = Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖶𝖫(vk, r)

( )

Σ: Signature Scheme with Rerandomizable Keys σm ← Σ . 𝖳𝗃𝗁𝗈(sk′, m||ℛ) sk′ ← Σ . 𝖲𝖿𝗌𝖻𝗈𝖾𝖳𝖫(sk, r)

[Fleischhacker-Krupp-Malavolta-Simkin-S-Schröder, 2016]

• No Setup
• Security under q-Strong DH assumption + Linear-KEA (GGM)
• O(n) signature size

Ring Signatures: Our Construction

Ring Signatures: Our Construction

Σ: Signature Scheme with Flexible Public Keys σm ← Σ . 𝖳𝗃𝗁𝗈(sk′, m||ℛ) sk′ ← Σ . 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r)

Ring Signatures: Our Construction

Σ: Signature Scheme with Flexible Public Keys σm ← Σ . 𝖳𝗃𝗁𝗈(sk′, m||ℛ) sk′ ← Σ . 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r)

σ = (vk′, σm, π)

Π: perfectly sound NIWI [Groth-Ostrovsky-Sahai, 2006] π ← Π . 𝖰𝗌𝗉𝗐𝖿

vk in ℛ

vk′ = Σ . 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖶𝖫(vk, r)

( )

Ring Signatures: Our Construction

Σ: Signature Scheme with Flexible Public Keys σm ← Σ . 𝖳𝗃𝗁𝗈(sk′, m||ℛ) sk′ ← Σ . 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r)

σ = (vk′, σm, π)

Π: perfectly sound NIWI [Groth-Ostrovsky-Sahai, 2006] π ← Π . 𝖰𝗌𝗉𝗐𝖿

vk in ℛ

vk′ = Σ . 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖶𝖫(vk, r)

( )

• No need to extract randomizer from SFPK in unforgeability proof!
• Perfectly sound NIWI without Setup + square root technique

[Chandran-Groth-Sahai, 2007] ➡ O(√n) size Ring Signatures without Setup from Standard assumptions!

Group Signatures [Bellare-Micciancio-Warinschi, 2003]

σ ← 𝖳𝗃𝗁𝗈(gpk, ski, m) 𝚋𝚍𝚍𝚏𝚚𝚞/𝚜𝚏𝚔𝚏𝚍𝚞 ← 𝖶𝖿𝗌𝗃𝗀𝗓(gpk, σ, m)

𝒣

sk1 sk2 skn

…

Group

i ← 𝖯𝗊𝖿𝗈(osk, σ, m)

Anonymity

• Signature hides

signer identity Traceability

• Opening cannot be

evaded or subverted

gpk

msk

• sk

Group Signatures: Our construction

Σflex: SFPK

[Fuchsbauer-Gay, 2018]

ΣEQ: SPS-EQ

vk, vk′ ∈ 𝔿ℓ

vk ∼ vk′ if there is r ∈ ℤ*

p

(vkr

1, …vkr ℓ) = (vk′ 1, …vk′ ℓ)

}

𝖳𝖿𝗎𝗏𝗊 : 𝖳𝗃𝗁𝗈 :

Group Signatures: Our construction

Σflex: SFPK

[Fuchsbauer-Gay, 2018]

ΣEQ: SPS-EQ

vk, vk′ ∈ 𝔿ℓ

vk ∼ vk′ if there is r ∈ ℤ*

p

(vkr

1, …vkr ℓ) = (vk′ 1, …vk′ ℓ)

}

For i ∈ [n] : (osk[i], ski, vki) ← Σflex . 𝖴𝖫𝖿𝗓𝖧𝖿𝗈(1λ) (msk, gpk[0]) ← ΣSPS . 𝖫𝖿𝗓𝖧𝖿𝗈(1λ)

(gpk[1], …, gpk[n]) ← (ΣSPS . 𝖳𝗃𝗁𝗈(msk, vk1), …, ΣSPS . 𝖳𝗃𝗁𝗈(msk, vkn))

𝖳𝖿𝗎𝗏𝗊 : 𝖳𝗃𝗁𝗈 :

Group Signatures: Our construction

σm ← Σflex . 𝖳𝗃𝗁𝗈(sk′, m) sk′ ← Σflex . 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r) σ′

vk ← Σ𝖥𝖱 . 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊(gpk[0], vk′, σvk)

σ = (vk′, σm, σvk′)

Σflex: SFPK

[Fuchsbauer-Gay, 2018]

ΣEQ: SPS-EQ

vk, vk′ ∈ 𝔿ℓ

vk ∼ vk′ if there is r ∈ ℤ*

p

(vkr

1, …vkr ℓ) = (vk′ 1, …vk′ ℓ)

}

For i ∈ [n] : (osk[i], ski, vki) ← Σflex . 𝖴𝖫𝖿𝗓𝖧𝖿𝗈(1λ) (msk, gpk[0]) ← ΣSPS . 𝖫𝖿𝗓𝖧𝖿𝗈(1λ)

(gpk[1], …, gpk[n]) ← (ΣSPS . 𝖳𝗃𝗁𝗈(msk, vk1), …, ΣSPS . 𝖳𝗃𝗁𝗈(msk, vkn))

𝖳𝖿𝗎𝗏𝗊 : 𝖳𝗃𝗁𝗈 :

Group Signatures: Our construction

σm ← Σflex . 𝖳𝗃𝗁𝗈(sk′, m) sk′ ← Σflex . 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊𝖳𝖫(sk, r) σ′

vk ← Σ𝖥𝖱 . 𝖣𝗂𝖻𝗈𝗁𝖿𝖲𝖿𝗊(gpk[0], vk′, σvk)

σ = (vk′, σm, σvk′)

Σflex: SFPK

[Fuchsbauer-Gay, 2018]

ΣEQ: SPS-EQ

vk, vk′ ∈ 𝔿ℓ

vk ∼ vk′ if there is r ∈ ℤ*

p

(vkr

1, …vkr ℓ) = (vk′ 1, …vk′ ℓ)

}

For i ∈ [n] : (osk[i], ski, vki) ← Σflex . 𝖴𝖫𝖿𝗓𝖧𝖿𝗈(1λ) (msk, gpk[0]) ← ΣSPS . 𝖫𝖿𝗓𝖧𝖿𝗈(1λ)

(gpk[1], …, gpk[n]) ← (ΣSPS . 𝖳𝗃𝗁𝗈(msk, vk1), …, ΣSPS . 𝖳𝗃𝗁𝗈(msk, vkn))

𝖳𝖿𝗎𝗏𝗊 : 𝖳𝗃𝗁𝗈 :

• DDH + co-Flex-DH ⇒ 20𝔿1 + 5𝔿2
• GGM + co-Flex-DH ⇒ 9𝔿1 + 2𝔿2

[Fuchsbauer-Hanser-Slamanig, 2014]

Summary

Signatures with flexible public keys: ➡ short ring signatures from weak assumptions without setup ➡ short group signatures because of compatibility with SPS-EQ ➡ generic privacy preserving building block

Thanks!

jonas.schneider@cispa-helmholtz.de ia.cr/2018/191