Abstract DualRing is a novel generic construction introduced by Yuen et al. (CRYPTO’21), which can transform a special kind of (Type-T*) canonical identification scheme to a ring signature scheme. Compared with the classical approaches, this method can get a shorter signature. In this paper, we construct a new middle-product learning with errors (MPLWE)-based ring signature scheme by using this framework. Specifically, we propose a new MPLWE-based identification scheme, which is compatible with the DualRing, then we obtain a ring signature scheme by using DualRing framework. We also show how to achieve linkability from this ring signature by using a collision resistant hash function. In the end, we provide available parameter options for our (linkable) ring signature scheme. Under these parameters, the signature size of our linkable ring signature is $2-40 \times $ shorter (depending on the ring size) than the previous MPLWE-based scheme by Das et al. (Africacrypt’19).
Abstract DualRing is a novel generic construction introduced by Yuen et al. (CRYPTO’21), which can transform a special kind of (Type-T*) canonical identification scheme to a ring signature scheme. Compared with the classical approaches, this method can get a shorter signature. In this paper, we construct a new middle-product learning with errors (MPLWE)-based ring signature scheme by using this framework. Specifically, we propose a new MPLWE-based identification scheme, which is compatible with the DualRing, then we obtain a ring signature scheme by using DualRing framework. We also show how to achieve linkability from this ring signature by using a collision resistant hash function. In the end, we provide available parameter options for our (linkable) ring signature scheme. Under these parameters, the signature size of our linkable ring signature is 2−40× shorter (depending on the ring size) than the previous MPLWE-based scheme by Das et al. (Africacrypt’19).
In order to solve the problem of large key size and low efficiency in the linkable ring signature scheme on lattice, this paper reconstructs the linkable ring signature scheme from lattice based on the ring learning with errors (RLWE) problem, according to the technical route of “homomorphic commitment→∑-protocol→Fiat-Shamir transformation”. This paper first constructs a homomorphic commitment scheme over a polynomial ring based on the RLWE problem, and then designs a ∑-protocol based on the commitment scheme, and transforms the ∑-protocol into a linkable ring signature scheme using the Fiat-Shamir transformation methods. Finally, this paper proposes a simple digital currency model based on the linkable ring signature scheme. Security analysis shows since the proposed scheme is constructed based on the problem of RLWE, its security can reduce to the lattice-based difficult problem and resist the quantum computer attack. Efficiency analysis shows compared with the previous linkable ring signature schemes on lattice, since the ring elements in the scheme are taken from small polynomials, the proposed scheme has shorter key size and higher computational efficiency, and the description of the scheme is simpler.
Abstract Middle-product learning with errors (MP-LWE) was proposed in 2017 by Rosa et al., it is considered to be a method that combines the high efficiency of the R-LWE with the security guarantee of the ordinary LWE. Following the idea of this problem, in the TCC 2019, Alex Lombardi et al. further studied the method of constructing identity-based encryption (IBE) scheme on the premise of the MP-LWE. They introduced several major technologies, these include the introduction of a new leftover hash lemma and the instan-tiation of a brand-new variant of lattice trapdoor corresponding to MP-LWE. The idea of instantiation of trapdoor is very novel, but the equation can not be solved correctly by using the trapdoor. In the current work, we have improved the research results of the Lombardi et al., that is, we re-instantiate the trapdoor matching MP-LWE and use it to construct a new IBE scheme. Further, we also use the classical transformation of Abdalla et al. to transform the constructed IBE scheme into a MP-LWE-based public key search encryption scheme (PEKS). Compared to IBE and PEKS schemes from LWE, our scheme is more effective, and their ciphertexts and keys size are only O˜(n) in size (for identities of size n bits). Compared to IBE and PEKS schemes from ring-LWE, our schemes have similar efficiency
This work proposes a Fiat-Shamir linkable ring lattice-based signature scheme, building on Yuen et al. ‘s generic ring signature. It converts the MLWE-based Σ-protocol into a linkable ring signature through the Fiat-Shamir transformation, employing rejection sampling to avoid private key leakage. Linkability is achieved by attaching a public key structure label, avoiding complex zero-knowledge proofs and pseudorandom function calculations. Compared to other lattice-based schemes, our approach improves signature length. Security analysis under the random oracle model confirms correctness, anonymity, unforgeability, linkability, and non-slanderability.
Although most existing linkable ring signature schemes on lattice can effectively resist quantum attacks, they still have the disadvantages of excessive time and storage overhead. This paper constructs an identity-based linkable ring signature (LRS) scheme over NTRU lattice by employing the technologies of trapdoor generation and rejection sampling. The security of this scheme relies on the small integer solution (SIS) problem on NTRU lattice. We prove that this scheme has unconditional anonymity, unforgeability, and linkability under the random oracle model (ROM). Through the performance analysis, this scheme has a shorter size of public/private keys, and when the number of ring members is small (such as N ≤ 8 ), this scheme has a shorter signature size compared with other existing latest lattice-based LRS schemes. The computational efficiency of signature has also been further improved since it only involves multiplication in the polynomial ring and modular operations of small integers. Finally, we implemented our scheme and other similar schemes, and it is shown that the time for the signature generation and verification of this scheme decreases roughly by 44.951% and 33.503%, respectively.
So far, most ring signature schemes rely on hard number theory problems, such as discrete logarithm, bilinear pairings and so on. Unfortunately, the above underlying number theory problems will be solvable in the post quantum era. Lattice-based cryptography is a hotspot of research recently, due to its implementation simplicity and provable security reductions. When the hash-and-sign signature scheme was constructed based on the hardness of worst-case lattice problems, provably secure lattice-based ring signature schemes were finally constructed. However, the hash-and-sign ring signatures were rather inefficient (with megabytes long signatures). In this paper, we propose an alternative method for constructing lattice-based and identity-based ring signature scheme which does not use the hash-and-sign methodology. In the random oracle model, the proposed signature scheme based on the problem in general lattices is unforgeable and holds anonymity. Compared with the previous instantiations of the hash-and-sign ring signature schemes, the lengths of secret key, public key and signatures in the proposed scheme are much shorter. The signing algorithm is quite simple, with matrix-vector multiplications and rejection samplings.
So far, most ring signature schemes rely on hard number theory problems, such as discrete logarithm, bilinear pairings and so on. Unfortunately, the above underlying number theory problems will be solvable in the post quantum era. Lattice-based cryptography is a hotspot of research recently, due to its implementation simplicity and provable security reductions. When the hash-and-sign signature scheme was constructed based on the hardness of worst-case lattice problems, provably secure lattice-based ring signature schemes were finally constructed. However, the hash-and-sign ring signatures were rather inefficient (with megabytes long signatures). In this paper, we propose an alternative method for constructing lattice-based and identity-based ring signature scheme which does not use the hash-and-sign methodology. In the random oracle model, the proposed signature scheme based on the problem in general lattices is unforgeable and holds anonymity. Compared with the previous instantiations of the hash-and-sign ring signature schemes, the lengths of secret key, public key and signatures in the proposed scheme are much shorter. The signing algorithm is quite simple, with matrix-vector multiplications and rejection samplings.