CSCI361

Ring Signatures: How to Leak a Secret

1
Problem
• How to generate an anonymous signature from a high-ranking White
House official
We want to hide who signed the message Secretary of
Secretary
Defense
• Proposed by Rivest, Shamir and Tauman of State

President
Vice
President
Who signed? Attorney
General

2
Ring Signature
• A type of digital signature that can be produced by any member of a
group of users who have private keys
• A message signed with a ring signature can be verified by anyone
• Important features
It is impossible (computationally infeasible) to determine which of the group
members’ keys was used to produce the signature
There is no way to revoke the anonymity of a given ring signature
Any members in the ring can produce a ring signature without setup

3
Realisation of Ring Signature for Two Users
• Setup: User-1 with public key
P1=(e1,N1) and private key (d1,N1);
User-2 with public key P2=(e2,N2) and
private key (d2,N2) User-1
• They are using RSA for underlying
singing algorithm
• H: A cryptographic hash function like
SHA User-2

• E: Symmetric encryption. E-1:

Symmetric decryption = D  E is
called a Pseudo Random Function
(PRF).
4
Realisation of Ring Signature for Two Users
• Assume that User-2 is the signer
User-2 gets his message m and calculate the key k = H(m).
Pick a random glue value v.
Pick a random x1 for User-1 and calculate y1=x1e mod N1.
1

Solve an equation for Ek(y2 ⨁Ek(y1 ⨁ v ))=v, where E is symmetric

encryption, to get y2: y2 = E-1k(v) ⨁Ek(y1 ⨁ v )
Calculate x2 = y2d mod N2.
2

The ring signature is now (P1,P2, v, x1, x2).

5
Realisation of Ring Signature for Two Users
• Signature Verification
Calculate y1 = x1e mod N1 and y2 = x2e mod N2.
1 2

Calculate k = H(m).
Check whether Ek(y2 ⨁Ek(y1 ⨁ v ))=v. If yes, the ring signature on
m is valid, otherwise, it is invalid.

6
Example: Realisation of Ring Signature for
Two Users
• Setup: User-1 with public key
P1=(3,55) and private key (27,55);
User-2 with public key P2=(5,65) User-1
and private key (29,65)
• They are using RSA for underlying
singing algorithm
User-2
• H: SSHA (4 bit output)
• E: Symmetric encryption. E-1:
Symmetric decryption = D

7
Example: Realisation of Ring Signature for
Two Users
• Assume that User-2 is the signer
User-2 gets his message m=5 and calculate the key k= 1101 = H(5).
Pick a random glue value v=1010001.
Pick a random x1 =3(=0000011) for User-1 and calculate y1=x1e mod 1

N1=33mod55 =27=0011011.
Solve an equation for Ek(y2 ⨁Ek(y1 ⨁ v ))=v  E1101(y2 ⨁E1101(0011011
⨁ 1010001))=1010001 to get y2:
y2 = E-11101(1010001) ⨁E1101(0011011 ⨁ 1010001) = E-11101(1010001)
⨁E1101(1001010) = 1010111 ⨁0100101 = 1110010 mod 65= 114 mod 65
=49=0110001 (Assume that E-11101(1010001) = 1010111) and E1101(1001010) =
0100101)
After y2 is calculated, we know that E1101(0110001 ⨁ 0100101) =
E1101(0010100)=1010001
8
Example: Realisation of Ring Signature for
Two Users
(continued)
Calculate x2 = y2d mod N2 = 4929 mod 65= 4=0000100.
2

The ring signature is now (P1,P2, v, x1, x2) =

((3,55)(5,65),1010001,0000011,0000100).

9
Realisation of Ring Signature for Two Users
• Signature Verification
Calculate y1 = x1e mod N1 =00000113 mod 55=33 mod 55= 27
1

(=0011011) and y2 = x2e mod N2=00111015 mod 65=45 mod 65 =

2

49 (=0110001).
Calculate k = H(m)=H(5)=1101.
Check whether Ek(y2 ⨁Ek(y1 ⨁ v ))=v.  E1101(0110001
⨁E1101(0011011⨁ 1010001 ))  E1101(0110001 ⨁E1101(1001010))
 E1101(0110001 ⨁0100101)  E1101(0010100)=1010001 (See
page 8)

10
Realisation of Ring Signature for n Users
• Before we desribe n user
scheme, assume (without loss
of generality) that among n User-1
users, “User-n” is always a User-2

name for the group member

who generates a ring User-n
User-3
siganture.
Of course anyone in the group can be .....
“User-n”

11
Realisation of Ring Signature for n Users
• User-1 with public key P1=(e1,N1) and private key (d1,N1);
User-2 with public key P2=(e2,N2) and private key (d2,N2);…,
User-(n-1) with public key Pn-1=(en-1,Nn-1) and private key (dn-
1,Nn-1)
User-n gets her message m and calculate the key k = H(m).
Pick a random glue value v.
Pick a random x1 for User-1, x2 for User-2, …, xn-1 for User-(n-1)
and calculate y1=x1e mod N1, y2=x2e mod N1, …, yn-1=xn-1e mod Nn-1.
1 2 n-1

12
Realisation of Ring Signature for n Users
Solve an equation for Ek(yn ⨁Ek(yn-1⨁Ek(•••E(k(y1 ⨁ v ) •••)))=v,
where E is symmetric encryption.
Calculate xn = ynd mod Nn.
n

The ring signature is now (P1,P2, …, Pn,v, x1, x2, …, xn).

13