In this paper we formalize the notion of a ring signature, which makes it possible to specify a set of possible signers without revealing which member actually produced the signature.Unlike group signatures, ring signatures have no group managers, no setup procedures, no revocation procedures, and no coordination:any user can choose any set of possible signers that includes himself,and sign any message by using his secret key and the others’ public keys,without getting their approval or assistance. Ring signatures provide an elegant way to leak authoritativ secrets in an anonymous way, to sign casual email in a way which can only be verified by its intended recipient, and to solve other problems in multiparty computations. The main contribution of this paper is a new construction of such signatures which is unconditionally signer-ambiguous, provably secure in the random oracle model,and exceptionally efficient:adding each ring member increases the cost of signing or verifying by a single modular multiplication and a single symmetric encryption.
- signature scheme
- ring signature scheme
- signer-ambiguous signature scheme
- group signature scheme
- designated verifier signature scheme
Jan Camenisch. Efficient and generalized group signatures. In Walter Fumy, editor, Advances in Cryptology — Eurocrypt’ 97,pages 465–479,Berlin,1997.Springer. Lecture Notes in Computer Science 1233.
David Chaum and Eugène Van Heyst. Group signatures.In D.W. Davies,editor, Advances in Cryptology — Eurocrypt’ 91, pages 257–265,Berlin,1991.Springer-Verlag.Lecture Notes in Computer Science No.547.
Ronald Cramer, Ivan Damgård,and Berry Schoenmakers. Proofs of partial knowledge and simplified design of witness hiding protocols. In Yvo Desmedt,editor, Advances in Cryptology — CRYPTO’ 94,pages 174–187,Berlin,1994.Springer-Verlag.Lecture Notes in Computer Science Volume 839.
W. Diffie and M.E. Hellman.New directions in cryptography. IEEE Trans.Inform.Theory,IT-22:644–654,November1976.
G.H. Hardy and E.M. Wright.An Introduction to the Theory of Numbers.Oxford, fifth edition,1979.
M. Jakobsson, K. Sako,and R. Impagliazzo.Designated verifier proofs and their applications.In Ueli Maurer,editor, Advances in Cryptology — EuroCrypt’ 96, pages 143–154,Berlin,1996.Springer-Verlag.Lecture Notes in Computer Science Volume 1070.
M. Luby and C. Rackoff How to construct pseudorandom permutations from pseudorandom functions. SIAM J.Computing,17(2):373–386,April 1988.
M. Rabin.Digitalized signatures as intractable as factorization.Technical ReportMIT/LCS/TR-212,MIT Laboratory for Computer Science,January 1979.
Ronald L. Rivest, Adi Shamir,and Leonard M. Adleman. A method for obtaining digital signatures and public-key cryptosystems.Communications of the ACM,21(2):120–126,1978.
Alfredo De Santis, Giovanni Di Crescenzo, Giusepp Persiano,and Moti Yung. On monotone formula closure of SZK.In Proc. 35th FOCS,pages 454–465. IEEE, 1994.
Editors and Affiliations
© 2001 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Rivest, R.L., Shamir, A., Tauman, Y. (2001). How to Leak a Secret. In: Boyd, C. (eds) Advances in Cryptology — ASIACRYPT 2001. ASIACRYPT 2001. Lecture Notes in Computer Science, vol 2248. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-45682-1_32
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-42987-6
Online ISBN: 978-3-540-45682-7
eBook Packages: Springer Book Archive