Two extensions of the ring signature scheme of Rivest–Shamir–Taumann

Abstract

Two extensions of RST (Rivest, Shamir and Taumann) ring signature are proposed which keep the form of RST ring signature unchanged. One extension is to implement the verifiability property with which the real signer is able to prove that she actually signed the ring signature if she publishes her secret value. In contrast to the available verifiable ring signatures, this scheme is very simple, secure and efficient. In this scheme only the glue value of RST ring signature is replaced by the output of a hash function which takes as input a secret value and some signature parameters and the real signer is able to prove himself any times. The other extension is to construct an anonymous subliminal channel in RST ring signature so that the subliminal sender (the real signer) is able to keep herself subliminal anonymous to the subliminal receiver. The subliminal anonymity is implemented for the first time in this paper. In addition, if the sender wants to revoke the subliminal anonymity, she is able to use the first extension.

Introduction

In 2001, Rivest, Shamir and Taumann first formalized the concept of the ring signature based on a trapdoor one-way function and presented a provably secure ring signature scheme in the random oracle model [14] which we called RST ring signature. Ring signature can be used to leak a secret anonymously because it has no group manager, no setup procedures, and no cooperation among ring members. For example, Alice, an employee of a company, wants to disclose a secret of her boss to a journalist without revealing her identity. She can use a ring signature to sign the message and hide her identity by choosing other employees as the ring members. Since then many provably secure ring signatures were presented in the random oracle model or in the standard model, e.g. [1], [4], [6], [7], [17], [19].

In the research of ring signatures, how to implement the verifiability of the real signer is an important problem, that is, the real signer is able to prove that she actually signed the ring signature. However, in RST ring signature one cannot determine who the real signer is. So far there have been some solutions to this problem. In [6], [8], [12], [13], [17], the verifiability is implemented based on the difficult problems to solve discrete logarithms in a finite field or to factorize the number which is the product of two large prime numbers. The computation complexity of the verification is very high. Some of the schemes can only be verified one time, that is, after a real signer publishes her secret parameters to prove himself, anybody else can do the same thing by using the published secret parameters. In this paper, one extension is proposed to implement the verifiability property. In contrast to the available verifiable ring signatures, this scheme is very simple, secure and efficient. The real signer is able to prove himself any times. The verifiable ring signature in [9] is also simple and efficient, but it requires an extra parameter. Our scheme keeps the form of RST ring signature unchanged.

The other extension of RST ring signature is proposed to construct an anonymous subliminal channel so that the subliminal sender (the real signer) is able to keep herself subliminal anonymous to the subliminal receiver when she wants to deliver military intelligence. With the anonymous subliminal channel the subliminal sender can avoid the risk of the receiver’s exposing her identity to any third party. The subliminal channels discovered by Simmons [15] in 1978 are covert channels established in digital signatures and authentication systems by exploiting the inherent randomness of the cryptosystems and are used to send a secret message to an authorized receiver. Any unauthorized receiver is not able to be aware of the existence of the subliminal channels. To the best of our knowledge, up to now the available subliminal channels such as the channels in [3], [5], [10], [11], [16] are not able to realize the subliminal anonymity which requires two necessary conditions: (a) the creator (such as a signer) of the carrier is anonymous and (b) the encryption of subliminal messages must use public-key encryption algorithms, which requires large subliminal capacity. Obviously ring signatures are the natural carriers because there are many random parameters in ring signatures which can be used to transmitted subliminal messages and in ring signatures the signers are unconditionally anonymous. In addition, if the sender wants to revoke the subliminal anonymity, she is able to use the first extension method.