No abstract

Abstract. Basing signature schemes on strong lattice problems has been a long standing open issue. Today, two families of lattice-based signature schemes are known: the ones based on the hash-andsign construction of Gentry et al.; and Lyubashevsky's schemes, which are based on the Fiat-Shamir framework. In this paper we show for the first time how to adapt the schemes of Lyubashevsky to the ring signature setting. In particular we transform the scheme of ASIACRYPT 2009 into a ring signature scheme that provides strong properties of security under the random oracle model. Anonymity is ensured in the sense that signatures of different users are within negligible statistical distance even under full key exposure. In fact, the scheme satisfies a notion which is stronger than the classical full key exposure setting as even if the keypair of the signing user is adversarially chosen, the statistical distance between signatures of different users remains negligible. Considering unforgeability, the best lattice-based ring signature schemes provide either unforgeability against arbitrary chosen subring attacks or insider corruption in log-sized rings. In this paper we present two variants of our scheme. In the basic one, unforgeability is ensured in those two settings. Increasing signature and key sizes by a factor k (typically 80 − 100), we provide a variant in which unforgeability is ensured against insider corruption attacks for arbitrary rings. The technique used is pretty general and can be adapted to other existing schemes.

No abstract

International audience—Ring signatures were introduced by Rivest, Shamir and Tauman in 2001 [32]. These sig-natures allow a signer to anonymously authenticate a message on behalf of a group of his choice. This concept was then extended by Bresson, Stern and Szydlo into -out-of-(threshold) ring signatures in 2002 [9]. We propose in this article a generalization of Stern's code based identification (and signature) scheme [36] to design a practical -out-of-threshold ring signature scheme. The size of the resulting signatures is in () and does not depend on , contrary to most of the existing protocols. Our scheme is existentially unforge-able under a chosen message attack in the random oracle model assuming the hardness of the minimum distance problem, is unconditionally source hiding, has a very short public key and has an overall complexity in (). This protocol is the first efficient code-based ring signature scheme and the first code-based thresh-old ring signature scheme. Moreover it has a better complexity than number-theory based schemes which have a complexity in (). This paper is an extended version of [2] with complete proofs and definitions

Abstract-Ring signatures were introduced by Rivest, Shamir and Tauman in 2001 [32]. These signatures allow a signer to anonymously authenticate a message on behalf of a group of his choice. This concept was then extended by Bresson, Stern and Szydlo into -out-of-(threshold) ring signatures in 2002 [9]. We propose in this article a generalization of Stern's code based identification (and signature) scheme [36] to design a practical -out-of-threshold ring signature scheme. The size of the resulting signatures is in ( ) and does not depend on , contrary to most of the existing protocols. Our scheme is existentially unforgeable under a chosen message attack in the random oracle model assuming the hardness of the minimum distance problem, is unconditionally source hiding, has a very short public key and has an overall complexity in ( ). This protocol is the first efficient code-based ring signature scheme and the first code-based threshold ring signature scheme. Moreover it has a better complexity than number-theory based schemes which have a complexity in ( ). This paper is an extended version of [2] with complete proofs and definitions.

Abstract. The search for encryption schemes that allow to evaluate functions (or circuits) over encrypted data has attracted a lot of attention since the seminal work on this subject by Rivest, Adleman and Dertouzos in 1978.In this work we define a theoretical object, chained encryption schemes, which allow an efficient evaluation of polynomials of degree d over encrypted data. Chained encryption schemes are generically constructed by concatenating cryptosystems with the appropriate homomorphic properties; such schemes are common in lattice-based cryptography. As a particular instantiation we propose a chained encryption scheme whose IND-CPA security is based on a worst-case/average-case reduction from uSVP.

No abstract

No abstract