Tightly secure ring signatures in the standard model

Abstract

Ring signatures allow a user to sign messages as a member of a set of users, which is called the ring. This primitive ensures that nobody can detect which member in the ring signs the message. Libert, Peters, and Qian (2018) [24] proposed the first tightly secure ring signature scheme with O(log⁡n) signature size in the random oracle model, where n is the size of a ring. To our knowledge, a tightly secure ring signature scheme has never been reported without depending on the random oracle methodology. In this paper, we propose two generic constructions of tightly secure ring signatures in the standard model. Our first (resp., second) construction is secure in the common reference string model (resp., the plain model). Both of our constructions are secure under the decisional linear assumption over the pairing groups. Our first generic construction has a more efficient instantiation than our second one. While our second generic construction does not have an efficient instantiation, its signature size achieves O(log⁡n) asymptotically, which is the same as one of the Libert et al.'s scheme.