Unlinkable and Strongly Accountable Sanitizable Signatures from Verifiable Ring Signatures

Abstract

An Unlinkable Sanitizable Signature scheme (USS) allows a sanitizer to modify some parts of a signed message in such away that nobody can link the modified signature to the original one. A Verifiable Ring Signature scheme (VRS) allows the users to sign messages anonymously within a group where a user can prove a posteriori to a verifier that it is the author of a given signature. In this paper, we first revisit the notion of VRS: we improve the proof capabilities of the users, we give a complete security model for VRS and we give an efficient and secure scheme called EVeR. Our main contribution is GUSS, a Generic USS based on a VRS scheme and an unforgeable signature scheme. We show that GUSS instantiated with EVeR and Schnorr's signature is twice as efficient as the best USS scheme of the literature. Moreover, we propose a stronger definition of accountability: an USS is accountable when the signer can prove whether a signature is sanitized. We formally define the notion of strong accountability where the sanitizer can also prove the origin of a signature. We show that the notion of strong accountability is important in practice. Finally, we prove the security properties of GUSS (including strong accountability) and EVeR under the Decisional Diffie-Hellman (DDH) assumption in the random oracle model.

Efficient Invisible and Unlinkable Sanitizable Signatures

“…We suggest to instantiate our construction with the EQS scheme of Fuchsbauer, Hanser, and Slamanig [20], the PKE scheme obtained by applying the Fujisaki-Okamoto transformation [21] to the ElGamal encryption scheme [? ], and the VRS scheme of Bultel and Lafourcade [9]. The efficiency of such an instantiation is summarized in Table 1 and 2.…”

“…We define slightly simplified and strengthened security definitions for VRS. We note that the existing construction in [9] satisfies all properties defined below.…”

“…This variant of accountability is mutually exclusive with transparency. Several existing works [7,17,29,9] proposed schemes that are both transparent and unlinkable. Recently, Krenn et al [28] propose the "strong" versions of unforgeability, (non-interactive public) accountability, and transparency.…”

Unlinkable and Invisible $$\gamma $$-Sanitizable Signatures

“…Scheme complexity. We use the NIZKPs previously given, the class-equivalence signature presented in Fuchsbauer et al [20], the Fujisaki-Okamoto CCA-transformation [21] on El Gamal [17] as a Public-Key Encryption, and the Ring-Signature presented in Bultel and Lafourcade [10]. Note that this ring-signature is not the most efficient one, however this scheme is verifiable, meaning it makes our scheme accountable according to the generic transformation given in [11].…”

“…To the best our knowledge, this scheme is the only one that achieves these two properties together. They also provide a generic way to add accountability on any sanitizable signature scheme, using verifiable ring signatures [10]. Note that these schemes allow the sanitizer modify parts of the message in an unlimited way.…”