It Wasn't Me! - Repudiability and Claimability of Ring Signatures
It Wasn't Me! - Repudiability and Claimability of Ring Signatures
复制标题
这不是我！
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Adam Sealfon
中科院分区：
文献类型：
--
作者：
Sunoo Park;Adam Sealfon
由[RST01]引入的环签名是数字签名的一种变体，它证明一组特定各方中的一个已经认可了一条消息，同时隐藏了该组中哪一方是签名者。环签名的设计允许任何人将其他人的名字附加到签名上，只要签名者自己的名字也附加上即可。但是，如果声称的签名者希望谴责已签名的消息，或者如果签名者希望稍后站出来声明签名的所有权，那么环签名可以提供什么保证呢？先前的环签名安全定义并没有给出这个问题的决定性答案：在大多数现有定义下，保证可以是任意一种。也就是说，与一些标准定义一致的是，非签名者可能能够否认他没有产生的签名，或者这可能是不可能的。类似地，签名者稍后可以令人信服地声称他生成的签名确实是他自己的，或者不是。这些保证中的任何一个都可能是可取的。例如，举报人可能有理由想要稍后索要匿名发布的签名，或者被错误地牵涉到与环签名相关的犯罪的人可能希望谴责陷害他们并损害他们声誉的签名。在其他情况下，即使在胁迫下，环中的成员也无法提供他签署或未签署特定签名的证据，这可能是可取的。无论如何，以某种方式提供保证似乎是非常可取的。
Ring signatures, introduced by [RST01], are a variant of digital signatures which certify that one among a particular set of parties has endorsed a message while hiding which party in the set was the signer. Ring signatures are designed to allow anyone to attach anyone else’s name to a signature, as long as the signer’s own name is also attached. But what guarantee do ring signatures provide if a purported signatory wishes to denounce a signed message—or alternatively, if a signatory wishes to later come forward and claim ownership of a signature? Prior security definitions for ring signatures do not give a conclusive answer to this question: under most existing definitions, the guarantees could go either way. That is, it is consistent with some standard definitions that a non-signer might be able to repudiate a signature that he did not produce, or that this might be impossible. Similarly, a signer might be able to later convincingly claim that a signature he produced is indeed his own, or not. Any of these guarantees might be desirable. For instance, a whistleblower might have reason to want to later claim an anonymously released signature, or a person falsely implicated in a crime associated with a ring signature might wish to denounce the signature that is framing them and damaging their reputation. In other circumstances, it might be desirable that even under duress, a member of a ring cannot produce proof that he did or did not sign a particular signature. In any case, a guarantee one way or the other seems highly desirable.