A Linkable Ring Signature Based on Polar Codes with Reusable Authorization

Abstract

Post-quantum digital signatures are needed to protect authentication against quantum attacks. Code-based techniques offer a promising foundation for this goal. Linkable ring signatures additionally provide signer anonymity and public linkage, but repeated membership proofs can incur substantial communication costs. We propose a linkable ring signature based on polar codes with reusable anonymous authorization. The scheme supports independently verifiable messages, public linking across rings, and repeated signing. Under the stated primitive assumptions and honest registration, we prove unforgeability, restricted anonymity, linkability, and non-frameability in the classical random oracle model. For parameters selected against a 128-bit classical generic-attack target, the authorization proof is 98.52% shorter than the selected-matrix implementation of the same relation for a 32-member ring, and each cached online packet occupies 807 bytes. Compared with a direct-proof baseline using the same parameters, certificate reuse reduces total communication from the second message onward for all evaluated ring sizes. A prototype executes key generation, authorization, certificate installation, and online signing and verification with actual polar-code keys. For a 1024-member ring, the authorization certificate occupies 189.5 MB. For a single verifier with pre-distributed rings, total communication is lower than that of a reference linkable ring signature scheme for workloads of at least 6561 messages.

1. Introduction

Large-scale quantum computers threaten public-key authentication based on factoring and discrete logarithms, motivating the development of post-quantum digital signatures. The standardization of ML-DSA and SLH-DSA provides concrete alternatives [1,2], while NIST’s additional-signature evaluation examines complementary constructions, including code-based and symmetric-primitive-based approaches [3]. Deploying these signatures also requires attention to public-key distribution, signature size, and recurring communication costs [4]. Applications involving anonymous reporting or repeated group authentication additionally require a verifier to authenticate a message without identifying its sender.

Ring signatures address this requirement by allowing a member to sign on behalf of a set of public keys while concealing the signing member [5]. Linkable ring signatures further allow a verifier to recognize signatures associated with the same signer without revealing that signer’s identity [6]. This functionality is useful when anonymous submissions must remain individually verifiable while repeated participation is detectable. Post-quantum constructions include the code-based scheme of Liu and Wang [7] and proof-based approaches. Goel et al. developed MPC-in-the-head set-membership proofs with applications to ring signatures [8]. Xue et al. proposed a framework for linkable ring signatures with post-quantum instantiations and reusable offline signing and verification work [9]. These results provide the context for reducing the recurring cost of anonymous authentication.

Code-based signatures offer several ways to build the underlying authentication primitive. CFS uses a secret Goppa-code decoding structure [10], whereas Wave uses preimage sampling over generalized ternary codes [11]. Wave parameter selection illustrates the trade-off between short signatures and large public keys [12]. Syndrome Decoding in the Head instead proves knowledge of a low-weight solution to a public decoding relation [13]. For ring signatures, the additional cost of hiding the signing key makes both the verification relation and the proof representation important design choices.

Repeated use must also be considered within an explicit anonymity model. Bultel and Olivier-Anclin studied anonymity definitions for linkable ring signatures [14], and Tran et al. introduced threshold-based many-time anonymity with a lattice-based construction in the quantum random oracle model [15]. We consider anonymous authentication with public linkage under honestly registered keys. Messages remain independently verifiable, and signatures from the same registered key remain linkable across different rings and online authorizations.

Polar codes are attractive for this setting because they combine a recursive encoding structure with efficient decoding algorithms [16]. Standard polar encoding and successive-cancellation decoding have $O\left(N\log N\right)$ complexity for block length N, and list decoding offers further decoding trade-offs [17]. Forghani et al. adapted modified polar codes to digital signatures in PolarSig [18]. We instantiate its modified-polar key family with a longer mother code and successive-cancellation randomized rounding for member authorization and online message signing. Its short basic signature limits recurring message expansion, while its binary parity-check verification relation provides the structure used in our authorization-circuit optimization.

The MPC-in-the-head paradigm supplies a general method for proving the authorization relation without revealing the member [19]. ZKBoo and ZKB++ provide practical Boolean-circuit instantiations [20,21]. Banquet reduces proof costs through specialized AES checks [22], and recent FAEST optimizations combine witness compression with improved VOLE-in-the-head analysis [23]. These approaches motivate adapting the proof representation to the computation being verified. In our binary verification circuit, selecting the public linear-map outputs instead of a hidden matrix reduces the number of nonlinear gates.

Our objective is to reduce communication when members repeatedly authenticate messages over persistent rings. We propose a linkable ring signature based on polar codes with reusable anonymous authorization. A member establishes an authorization before future messages are known. An accepting verifier can then reuse it for subsequent messages while preserving public linkage. The design combines a smaller authorization circuit with short online signatures. Its evaluation accounts for the initial certificate and public-ring distribution, so the reported savings reflect the complete repeated-authentication workload.

The contributions are as follows.

• Polar-code-based construction and security. We design a linkable ring signature based on polar codes with reusable anonymous authorization. Under the stated primitive assumptions and honest registration, we prove unforgeability, restricted anonymity, linkability, and non-frameability in the classical random oracle model. The scheme supports independently verifiable messages and public linking across rings.
• Smaller anonymous-authorization proofs. We specialize standard linearity and one-hot selection to the authorization relation by evaluating public binary linear maps before selecting the hidden member’s output. A hybrid circuit uses $d\min (L-1,n)$ syndrome AND gates, where L is the ring size and $d\times n$ is the public matrix dimension. For a 32-member ring, the fixed-length FS-ZKB++ proof is 98.52% shorter than the selected-matrix implementation of the same relation.
• Lower communication through authorization reuse. We bind an online signing key and a persistent linking tag to a reusable anonymous certificate, allowing cached online packets of 807 bytes. Relative to a direct-proof baseline with the same parameters, certificate reuse reduces total communication from the second message onward for all four evaluated ring sizes.

Section 2 introduces the notation and primitives. Section 3 defines the security model and presents the construction. Section 4 and Section 5 give its security analysis and circuit instantiation. Section 6 evaluates communication and the integrated prototype, and Section 7 concludes.

2. Preliminaries

2.1. Notation and Primitives

Let $\lambda$ denote the security parameter, $\left[L\right]=\{0,\dots ,L-1\}$, and $\mathrm{wt}\left(e\right)$ the Hamming weight of a binary vector. Matrix operations are over ${\mathbb{F}}_2$. The notation $⟨·⟩$ denotes an injective, length-delimited encoding, and $\parallel$ denotes concatenation.

Polar codes and signatures. Polar codes are binary linear codes obtained through channel polarization. Their recursive structure supports encoding and successive-cancellation decoding in $O\left(N\log N\right)$ operations for block length N [16]. Successive-cancellation list decoding maintains multiple candidate paths to improve decoding performance [17]. PolarSig adapts modified polar codes to digital signatures [18]. Write $\mathsf{PS}=(\mathsf{Gen},\mathsf{Sign},\mathsf{Verify})$ for its algorithms. A public key is a binary matrix $H\in {\mathbb{F}}_2^{d\times n}$, and a signature contains an error vector e and a random string a. Verification checks

$$He=h_{\mathrm{PS}}(M\parallel a)$$

(1)

and $W_{\theta }\left(e\right)=\mathbf{1}[\mathrm{wt}\left(e\right)\le t]$, where t is the prescribed weight upper bound. PolarSig’s EUF-CMA theorem is a parameterized reduction under the CSD and MPD hardness assumptions in the classical random oracle model [18] [Theorem 3].

Noninteractive zero-knowledge arguments. For a relation $\mathcal{R}$, an argument $\mathrm{\Pi }=(\mathsf{Setup},\mathsf{Prove},\mathsf{Vfy})$ allows a prover to establish that a public statement has a valid witness without revealing it. Completeness ensures acceptance of valid proofs, adaptive multi-theorem zero knowledge hides the witness, and simulation-sound extractability permits witness extraction from fresh accepting statements even in the presence of simulated proofs [24] [Definitions 4–5]. The extraction setup preserves the simulator’s public-parameter and trapdoor distribution. Such arguments support anonymous membership and credential verification [8,24].

MPC-in-the-head and Fiat–Shamir. MPC-in-the-head constructs zero-knowledge proofs by simulating a multiparty computation and opening selected execution views [19]. ZKBoo and ZKB++ instantiate this approach for Boolean circuits [20,21]. The Fiat–Shamir transformation derives verifier challenges by hashing the public statement and complete first protocol message [25].

Further analyses address strong unforgeability and binding properties of MPC-in-the-head signatures [26], and Fiat–Shamir and commit-and-open protocols in the quantum random oracle model [27,28].

Hash commitments and domain separation. A randomized hash commitment has the form $C=H(⟨x,\rho ⟩)$, where $\rho$ is a secret random salt. In the random oracle model, the salt hides the committed value, while collision resistance provides computational binding. Domain separation assigns distinct prefixes to different hash functions so that commitments, identifiers, and protocol challenges use separate hash domains.

2.2. Linkable Ring Signatures

A ring signature authenticates a message under a set of public keys without identifying the signing member [5]. A linkable ring signature additionally provides a public test for whether two valid signatures originate from the same signing key [6]. With common public parameters implicit, its algorithmic interface is

$$\begin{array}{cc}\hfill (pk,sk)& \leftarrow \mathsf{LRS}.\mathsf{KeyGen}\left(1^{\lambda }\right),\hfill \\ \hfill \sigma & \leftarrow \mathsf{LRS}.\mathsf{Sign}(s{k}_i,R,m),\hfill \\ \hfill v& \leftarrow \mathsf{LRS}.\mathsf{Verify}(R,m,\sigma )\in \{0,1\},\hfill \\ \hfill b& \leftarrow \mathsf{LRS}.\mathsf{Link}(X_0,X_1)\in \{0,1,\perp \},\hfill \end{array}$$

where $R=(p{k}_0,\dots ,p{k}_{L-1})$ is a ring containing $p{k}_i$, and $X_b=(R_b,m_b,{\sigma }_b)$ is a ring–message–signature tuple. Verification returns 1 for an accepted signature. Linking returns 1 for linked signatures, 0 for unlinked signatures, and ⊥ if either signature is invalid. The linking scope specifies which pairs of rings or application contexts are eligible for comparison.

Verification correctness. For honestly generated keys, every message m, and every ring R containing $p{k}_i$,

$$\mathrm{Pr}\left[\mathsf{LRS}.\mathsf{Verify}\left(R,m,\mathsf{LRS}.\mathsf{Sign}(s{k}_i,R,m)\right)=1\right]\ge 1-\mathrm{negl}\left(\lambda \right).$$

The probability is over key generation and signing randomness.

Linking correctness. Let ${\sigma }_b\leftarrow \mathsf{LRS}.\mathsf{Sign}(s{k}_{i_b},R_b,m_b)$ for $b\in \{0,1\}$, with both tuples in the same linking scope. For distinct, honestly generated member keys, valid signatures satisfy

$$\mathrm{Pr}\left[\mathsf{LRS}.\mathsf{Link}(X_0,X_1)=\mathbf{1}[i_0=i_1]\right]\ge 1-\mathrm{negl}\left(\lambda \right),$$

where $i_0,i_1$ identify member keys, and $\mathbf{1}[·]$ is the indicator function.

Anonymity hides the signing member subject to the information disclosed by public linking [14]. Unforgeability prevents unauthorized message signatures. Linkability prevents a signer from evading the linking test. Non-frameability prevents an adversary from producing a fresh signature attributed by linking to an honest member.

3. Proposed Construction

This section specifies the security model, authorization relation, and algorithms of the polar-code-based linkable ring signature.

3.1. Security Model

We consider a managed group with honestly provisioned, immutable registered keys. A ring is a canonical ordered set of distinct registered keys. $\theta$ fixes the parameters and encoding. The certificate cache contains accepted records bound to their ring and parameter identifier. Linking is global per registered key.

Classical probabilistic polynomial-time adversaries access the registration, authorization, signing, and corruption oracles in Appendix A. Let $\mathcal{C}$, $\mathcal{Q}$, and ${\mathcal{T}}_{\mathrm{issued}}$ denote corrupted member indices, answered ring-message pairs, and issued authorization tags, respectively.

Unforgeability. A winning forgery is an accepted signature on $(R^{*},m^{*})$ with $\mathrm{ids}\left(R^{*}\right)\cap \mathcal{C}=⌀$ and $(R^{*},m^{*})\notin \mathcal{Q}$, where $\mathrm{ids}\left(R\right)$ denotes its registered member indices.

Anonymity. A uniform bit b selects one of two uncorrupted candidates $i_0,i_1\in R$ for the challenge authorization and its messages. The adversary may query further challenge messages and other members, but may neither corrupt nor obtain identity-labeled authorizations or signatures from either candidate before or after the challenge. Its advantage is $\left|\mathrm{Pr}\right[b^{\prime }=b]-1/2|$. Tag and certificate equality remain visible. This model covers managed anonymous reporting in which credentials are provisioned privately and submissions are exposed through pseudonymous tags. An identity-labeled sample from either candidate would identify its persistent tag and all linked submissions.

Linkability. Signatures from the same registered key link. An adversary wins by outputting accepted signatures with more than $\left|\mathcal{C}\right|$ distinct tags outside ${\mathcal{T}}_{\mathrm{issued}}$.

Non-frameability. Given an uncorrupted target’s tag and signatures, the adversary wins by producing an accepted signature with that tag on a fresh ring-message pair. The target’s long-term and online state remains unexposed.

3.2. Overall Framework

The construction anonymously certifies an online key and reuses its certificate for message authentication (Figure 1). Its interface is

$$\begin{array}{cc}\hfill (PK,SK)& \leftarrow \mathsf{KeyGen}(1^{\lambda };\theta ),\hfill \\ \hfill (\mathsf{Cert},\mathsf{st})& \leftarrow \mathsf{Authorize}(SK,R;\theta ),\hfill \\ \hfill D\mathrm{or}\perp & \leftarrow \mathsf{Install}(R,\mathsf{Cert},\mathsf{Cache};\theta ),\hfill \\ \hfill \omega & \leftarrow \mathsf{SignOnline}(\mathsf{st},m;\theta ),\hfill \\ \hfill v& =\mathbf{1}\left[\mathsf{VerifyTag}\right(R,m,\Sigma ;\theta )\ne \perp ],\hfill \\ \hfill b& \leftarrow \mathsf{Link}(X_0,X_1).\hfill \end{array}$$

For a standalone signature $\mathrm{\Sigma }=(\mathsf{Cert},\tau )$, $\mathsf{VerifyTag}$ installs the certificate in an empty cache and invokes $\mathsf{VerifyOnline}$. An installed certificate supports the compact packet $\omega =(D,\tau )$. Boolean verification returns v. Linking uses the accepted tag.

Figure 1. Scheme workflow.

During registration, Algorithm 1 associates a polar-code verification key with a commitment to a linking secret. Algorithm 2 proves that one hidden registered member both possesses this secret and authorizes an independently generated online key. The proof uses the same hidden member index for both checks. This binds the online key to an authorized member while hiding that member’s identity.

Algorithm 3 verifies the authorization and installs its public record. Algorithm 4 uses the authorized polar-code key to sign and verify each message. Its signed encoding includes the certificate identifier and protocol context, preventing a message signature from being transferred to a different authorization. The short polar-code signature is the recurring communication cost, while the membership proof is paid for when the certificate is installed.

The public transcript exposes the ring, messages, online public key, certificate identifier, and linking tag. Equal tags reveal use of the same registered member key. Equal certificate identifiers additionally reveal reuse of an online authorization. The linking tag is derived from the registered member’s secret, independently of the ring and online key. Commitment binding prevents one registered member from obtaining different valid tags, and the joint proof binds every accepted tag to its authorized member. After message verification, Equation (5) compares the tags to implement public linking.

3.3. Authorization Relation

The domain-separated ℓ-bit hashes $H_C,H_T,H_A,H_M$ implement commitments, tags, authorization identifiers, and direct-baseline message digests. Let $\mathrm{\Pi }$ satisfy the properties in Section 2.1.

Member i registers $P{K}_i=(H_i,C_i)$ and keeps $S{K}_i=(s{k}_i,x_i,{\rho }_i)$, where

$$C_i=H_C\left(⟨x_i,{\rho }_i⟩\right),T_i=H_T\left(⟨x_i⟩\right).$$

(2)

Let E be a freshly generated online PolarSig public key. Define

$$D=H_A\left(⟨\theta ,R,T,E⟩\right),B_{\theta }\left(D\right)=⟨\mathtt{member},\theta ,D⟩.$$

(3)

For the statement $S=(\theta ,R,T,D)$ and witness $w=(j,x,\rho ,\sigma )$, the authorization relation is

$${\mathcal{R}}_{\mathrm{auth}}(S,w)=1\iff \left\{\begin{array}{c}j\in \left[L\right],R_j=(H_j,C_j),\hfill \\ H_C\left(⟨x,\rho ⟩\right)=C_j,\hfill \\ H_T\left(⟨x⟩\right)=T,\hfill \\ \mathsf{PS}.\mathsf{Verify}(H_j,B_{\theta }\left(D\right),\sigma )=1.\hfill \end{array}\right.$$

(4)

The same index j selects both the commitment and verification matrix.

3.4. Key Generation and Authorization

Algorithms 1 and 2 generate registered keys and anonymous certificates.

Algorithm 1 Member key generation

Require:  $1^{\lambda },\theta$ Ensure:  $PK=(H,C),SK=(sk,x,\rho )$ 1: $(H,sk)\leftarrow \mathsf{PS}.\mathsf{Gen}(1^{\lambda };\theta )$ 2: $x,\rho \stackrel{\$}{\leftarrow }{\{0,1\}}^{\mathsf{\ell }}$ 3: $C\leftarrow H_C\left(⟨x,\rho ⟩\right)$ 4: return $\left(\right(H,C),(sk,x,\rho \left)\right)$

Algorithm 2 Anonymous authorization

Require:  $S{K}_j=(s{k}_j,x_j,{\rho }_j),R,\theta ,pp$ Ensure:  $\mathsf{Cert}=(T,E,\pi ),\mathsf{st}=(D,esk)$ 1: $(E,esk)\leftarrow \mathsf{PS}.\mathsf{Gen}(1^{\lambda };\theta )$ 2: $T\leftarrow H_T\left(⟨x_j⟩\right)$ 3: $D\leftarrow H_A\left(⟨\theta ,R,T,E⟩\right)$ 4: $\sigma \leftarrow \mathsf{PS}.\mathsf{Sign}(s{k}_j,B_{\theta }\left(D\right))$ 5: $S\leftarrow (\theta ,R,T,D),w\leftarrow (j,x_j,{\rho }_j,\sigma )$ 6: $\pi \leftarrow \mathrm{\Pi }.\mathsf{Prove}(pp,S,w)$ 7: return $\left(\right(T,E,\pi ),(D,esk\left)\right)$

Setup generates $pp\leftarrow \mathrm{\Pi }.\mathsf{Setup}\left(1^{\lambda }\right)$ and $\theta$. Authorization precedes application messages.

3.5. Certificate Installation and Online Signing

Algorithm 3 validates and caches certificates. Algorithm 4 authenticates messages under the certified online key.

Algorithm 3 Certificate installation

Require:  $R,\mathsf{Cert},\mathsf{Cache},\theta ,pp$ Ensure:  D or ⊥; updated $\mathsf{Cache}$ 1: $(T,E,\pi )\leftarrow \mathsf{Cert}$ 2: if ${\mathsf{ValidEnc}}_{\theta }(R,T,E,\pi )=0$ then 3:     return ⊥ 4: end if 5: $D\leftarrow H_A\left(⟨\theta ,R,T,E⟩\right)$ 6: if $\mathrm{\Pi }.\mathsf{Vfy}(pp,(\theta ,R,T,D),\pi )=0$ then 7:       return ⊥ 8: end if 9: $\mathsf{Cache}\left[D\right]\leftarrow (\theta ,R,T,E)$ 10: return D

Algorithm 4 Online signing and verification

1: procedure SignOnline($(D,esk),m;\theta$) 2:       $M\leftarrow ⟨\mathtt{online},\theta ,D,m⟩$ 3:       $\tau \leftarrow \mathsf{PS}.\mathsf{Sign}(esk,M)$ 4:       return $(D,\tau )$ 5: end procedure 6: procedure VerifyOnline($R,m,(D,\tau ),\mathsf{Cache};\theta$) 7:       if $D\notin \mathrm{dom}\left(\mathsf{Cache}\right)$ then 8:             return ⊥ 9:       end if 10:      $({\theta }^{\prime },R^{\prime },T,E)\leftarrow \mathsf{Cache}\left[D\right]$ 11:      if $({\theta }^{\prime },R^{\prime })\ne (\theta ,R)$ then 12:            return ⊥ 13:      end if 14:      $M\leftarrow ⟨\mathtt{online},\theta ,D,m⟩$ 15:      if $\mathsf{PS}.\mathsf{Verify}(E,M,\tau )=0$ then 16:            return ⊥ 17:      end if 18:      return T 19: end procedure

${\mathsf{ValidEnc}}_{\theta }$ checks the header, parameter identifier, ring-size bounds, and exact field lengths; canonical distinct registered keys; registered matrix dimensions and full row rank; online-key dimensions; ℓ-bit commitments and tags; and prescribed proof seeds, commitments, views, ternary challenges, and zero padding. Extra bytes are rejected.

3.6. Public Linking

For two ring-message-signature tuples $X_0,X_1$, the linking procedure resolves their certificates and verifies each message:

$$\mathsf{Link}(X_0,X_1)=\left\{\begin{array}{cc}\perp ,\hfill & \mathsf{VerifyTag}\left(X_0\right)=\perp \vee \mathsf{VerifyTag}\left(X_1\right)=\perp ,\hfill \\ [T_0=T_1],\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(5)

Equation (2) preserves the tag across rings and online keys.

4. Scheme Analysis

We establish correctness and the four security properties defined in Section 3.1.

4.1. Correctness

Proposition 1.

If the underlying signing algorithms return valid signatures and $\mathrm{\Pi }$ is complete, the construction is correct and signatures from the same member link.

Proof. 

Algorithm 2 satisfies all conditions in Equation (4). Completeness and base-signature correctness give acceptance, while Equation (2) fixes each member’s tag. For U registered members, repeated linking secrets and distinct-input tag-hash collisions each have probability at most $U(U-1)/2^{\mathsf{\ell }+1}$. Their union bounds accidental cross-member tag equality by $U(U-1)/2^{\mathsf{\ell }}$. The construction inherits the base signing failure probability.    □

4.2. Unforgeability

Theorem 1.

Assume that the polar-code signature is EUF-CMA secure, $\mathrm{\Pi }$ satisfies Section 2.1, and $H_A$ is collision resistant. Then, the construction is unforgeable in the classical random oracle model under Section 3.1.

Proof. 

Simulate the challenger’s authorization proofs, at cost ${\Delta }_{\mathrm{ZK}}$, and charge $H_A$ collisions to ${\delta }_A$. An unissued payload gives a fresh statement. Apply the extractor to a wrapper returning this authorization alone. Embedding a base-signature challenge key at a uniform registered index requires no member-signing query because authorization proofs are simulated. If the guess matches the extracted index, $\sigma$ forges $B_{\theta }\left(D\right)$. The winning ring excludes corruption of this member.

For an issued payload, guess its online key among the issued authorizations and answer its signing queries through the base signing oracle. Freshness of $(R,m)$ makes $⟨\mathtt{online},\theta ,D,m⟩$ fresh under that key, yielding the forgery $\tau$.

Let ${ϵ}_{\mathrm{SE}}^{\mathrm{\Pi }}(\lambda ,T_W,{\mathbf{Q}}_W,N_{\mathrm{sim}};T_E,{\mathbf{Q}}_E)$ bound the joint event of a fresh accepting wrapper output and invalid extraction in the simulated experiment. Here, $N_{\mathrm{sim}}$ bounds simulated proofs and $\mathbf{Q}$ separates hash domains. Let ${ϵ}_{\mathrm{PS}}(T,Q,q_s)$ denote the maximum base-signature EUF-CMA advantage within time T, Q base-hash queries, and $q_s$ signing queries. For at most U members and $A\ge 1$ authorizations,

$$\begin{array}{cc}\hfill {\mathrm{Adv}}_{\mathrm{UF}}\le & {\Delta }_{\mathrm{ZK}}+{\delta }_A+{ϵ}_{\mathrm{SE}}^{\mathrm{\Pi }}\hfill \\ \hfill & +U{ϵ}_{\mathrm{PS}}(T_1,Q_1,0)+A{ϵ}_{\mathrm{PS}}(T_2,Q_2,q_{\mathrm{sign}}).\hfill \end{array}$$

(6)

The two guesses cost factors U and A, respectively, with budgets

$$\begin{array}{cccc}\hfill T_1& =T_{E,W}+T_{\mathrm{post}},\hfill & \hfill Q_1& =Q_{E,W}^{\mathrm{PS}}+Q_{\mathrm{post}}^{\mathrm{PS}},\hfill \\ \hfill T_2& =T_{\mathcal{B}}+T_{\mathrm{env}}^{\left(2\right)}+T_{\mathrm{post}},\hfill & \hfill Q_2& =Q_{\mathcal{B}}^{\mathrm{PS}}+Q_{\mathrm{env}}^{\left(2\right),\mathrm{PS}}+Q_{\mathrm{post}}^{\mathrm{PS}}.\hfill \end{array}$$

$T_{E,W},{\mathbf{Q}}_{E,W}$ include the extractor, wrapper, registration, simulation, and oracle environment over all rewinding executions. The online environment budgets include registration, other key generation, simulation, verification, and state maintenance. Postprocessing covers witness checking and output. Superscript $\mathrm{PS}$ selects base-hash queries, and $q_{\mathrm{sign}}$ counts signing queries under the guessed online key.    □

4.3. Anonymity

Theorem 2.

Under adaptive zero knowledge of $\mathrm{\Pi }$ and the domain-separated random-oracle assumptions for $H_C$ and $H_T$, the construction satisfies the anonymity game of Section 3.1.

Proof. 

Simulate all authorization proofs needed by the game. The independent commitment and tag domains hide the candidate-to-tag correspondence until an unexposed linking secret is queried. Replacing the challenge tag by a uniform value and switching candidates preserves the independent online-key and message distributions, including their public equality information. Thus

$${\mathrm{Adv}}_{\mathrm{ANON}}\le {\Delta }_{\mathrm{ZK}}^{\mathrm{anon}}+{\delta }_{\mathrm{secret}}.$$

(7)

Let $q=q_C+q_T$ include pre-registration queries. The secret-query event matches any unexposed registered x, or a later registration secret matches an earlier query. An incorrect-salt commitment query counts as an x guess. Conditional on distinct secrets, no public-hash collision, and no earlier hit, each unexposed secret is uniform over at least $2^{\mathsf{\ell }}-q-U$ possibilities. A union bound over registration and query steps yields

$${\delta }_{\mathrm{secret}}\le {\displaystyle \frac{Uq}{2^{\mathsf{\ell }}-q-U}}+{\displaystyle \frac{U(U-1)}{2^{\mathsf{\ell }+1}}}+{\delta }_{\mathrm{col}},q+U<2^{\mathsf{\ell }}.$$

For $q+U\le 2^{\mathsf{\ell }-1}$ the first term is at most $2Uq/2^{\mathsf{\ell }}$. With $N_h$ distinct inputs in domain $h\in \{C,T,A\}$, ${\delta }_{\mathrm{col}}\le {\sum }_h{N}_h(N_h-1)/2^{\mathsf{\ell }+1}$. Query budgets include challenger and verifier evaluations. Proof-programming losses enter ${\Delta }_{\mathrm{ZK}}^{\mathrm{anon}}$.    □

4.4. Linkability and Non-Frameability

Theorem 3.

Under the assumptions of Theorem 1, commitment binding and tag collision resistance, the construction satisfies linkability and non-frameability as defined in Section 3.1.

Proof. 

The challenger knows each registered opening and canonical tag, including those of subsequently corrupted members. A winning linkability output contains an accepted tag outside both ${\mathcal{T}}_{\mathrm{issued}}$ and $\{T_j:j\in \mathcal{C}\}$. A wrapper verifies the outputs and selects the first such authorization. Its statement is fresh because its tag was not issued. Extract once. An uncorrupted extracted member yields the member-level forgery of Theorem 1. A corrupted member has $x\ne x_j$, so its extracted and registered openings collide under $H_C$. The joint extraction-failure term is ${ϵ}_{\mathrm{SE}}^{\mathrm{\Pi }}$. For N outputs, one wrapper run costs $T_{\mathcal{B}}+N{T}_{\mathrm{VerifyTag}}+T_{\mathrm{lookup}}$. Verification queries enter ${\mathbf{Q}}_W$ and all extractor rewinding enters $T_{E,W},{\mathbf{Q}}_{E,W}$.

For non-frameability, consider a fresh accepted message with the target tag. Outside registered-secret and tag collisions, an issued payload carrying that tag belongs to the target and yields an online forgery. A new payload admits fresh-statement extraction: the target member yields a member-level forgery, while another member yields commitment or tag collision. Repeated registered secrets contribute at most $U(U-1)/2^{\mathsf{\ell }+1}$.    □

5. Authorization Circuit and Instantiation

This section realizes the authorization relation as a Boolean circuit and instantiates its proof with Fiat–Shamir ZKB++.

5.1. Selecting Public Linear-Map Outputs

Let $L=2^s$ and encode the hidden index by s witness bits. A binary decoder produces $b_i=[j=i]$. At each internal node, the two children can be computed as $vz$ and $v\oplus vz$. Excluding the first split, the decoder requires $L-2$ AND gates. The selected commitment is

$$C_j={\displaystyle \underset{i=0}{\overset{L-1}{⨁}}}{b}_i{C}_i.$$

(8)

Since every $C_i$ is public, Equation (8) is linear in the witness bits. For the syndrome, use

$$H_{j}e=H_{0}e\oplus {\displaystyle \underset{i=1}{\overset{L-1}{⨁}}}{b}_i\left((H_i\oplus H_0)e\right).$$

(9)

The products $(H_i\oplus H_0)e$ are public linear maps and use only XORs. Each of their d output coordinates then requires one AND with $b_i$. Algorithm 5 evaluates the hidden-member syndrome.

Algorithm 5 Hidden-member syndrome evaluation

Require:  $R={\left((H_i,C_i)\right)}_{i\in \left[L\right]},j,e$ Ensure:  $y=H_{j}e$ 1: $(b_0,\dots ,b_{L-1})\leftarrow \mathsf{Decode}\left(j\right)$ 2: $y\leftarrow H_{0}e$ 3: for $i=1,\dots ,L-1$ do 4:       $z_i\leftarrow (H_i\oplus H_0)e$ 5:       $y\leftarrow y\oplus \left(b_i{z}_i\right)$ 6: end for 7: return y

Proposition 2.

Equation (9) computes $H_{j}e$ with $d(L-1)$ AND gates after index decoding, compared with $dn$ for selecting a secret matrix and multiplying it by e.

Proof. 

For $j=0$, all terms indexed by $i\ge 1$ vanish. Otherwise, only term $i=j$ remains, giving $H_{0}e\oplus (H_j\oplus H_0)e=H_{j}e$. The stated gate count follows from $L-1$ coordinatewise products of length d. In the selected-matrix baseline, each of the $dn$ entries multiplies a secret coordinate of e.    □

The reduction is strict when $L<n+1$. The decoder cost $L-2$ is common to both circuits. Selecting the smaller syndrome circuit gives $d\min (L-1,n)$ AND gates, with $O\left(Ldn\right)$ public XOR work. This specializes standard linearity and one-hot membership selection [8].

5.2. Hash and Weight Constraints

The witness is $(j,x,\rho ,e,a)$ with length

$$I\left(L\right)={\log }_{2}L+2\mathsf{\ell }+n+\left|a\right|.$$

(10)

The circuit outputs commitment, tag, and syndrome residuals, together with the failure bit of the prescribed weight test. Its public target is the all-zero vector of length $d+2\mathsf{\ell }+1$. Using this vector avoids a final conjunction over all comparison bits.

We select SHAKE256 [29] for the concrete hash interfaces. The commitment and tag inputs occupy 65 and 33 bytes. The authorization message has a four-byte prefix and a 32-byte digest. Its 20-bit random string occupies three bytes with four zero padding bits. The hash $h_{\mathrm{PS}}$ returns the first 4179 bits of SHAKE256, requiring four 1088-bit output blocks. Each private-input hash fits one absorption block. The commitment and tag each use one Keccak-f[1600] permutation, and $h_{\mathrm{PS}}$ uses four, including the additional squeeze permutations. The six permutations contribute 230,400 AND gates, or 61.22% of the $L=32$ budget. Public authorization hashing and Fiat–Shamir transcript hashing are outside the witness circuit.

For weight evaluation, pad e to $B=2^{\lceil {\log }_{2}n\rceil }$ bits and use a balanced addition tree. A full-adder carry is

$$c^{\prime }=u\oplus \left((u\oplus v)\wedge (u\oplus c)\right).$$

(11)

The tree uses $2B-{\log }_{2}B-2$ AND gates. A constant comparison uses at most ${\log }_{2}B+1$ additional gates. With $n=6144$, the budget before constant-dependent gate elimination is 16,383 gates.

5.3. Parameters and Proof Encoding

Table 1 specifies the modified-polar instance used for member and online keys. We select it against a 128-bit classical generic-attack target.

Table 1. Reference parameters.

Parameter	Value
Mother-code length $N_0$	8192
Base information/additional unfrozen positions	1720/245
Punctured positions	2048
Code length n/dimension k/syndrome length d	6144/1965/4179
Weight upper bound t	1600
Design channel/Bhattacharyya samples	BSC(0.24)/300
PolarSig random string a/signature	20 bits/771 bytes
$x,\rho ,C,T,D$	256 bits each
Proof field/parallel repetitions r	${\mathbb{F}}_2$/329
View seed/commitment	256/256 bits
Packed online public key K	3,209,472 bytes
Packet header b	4 bytes

Finite-length key generation and signing. In ${\mathsf{Gen}}_{\mathrm{MC}}$, the information set consists of the 1720 smallest estimated Bhattacharyya parameters for BSC(0.24), obtained from 300 Monte Carlo synthetic-channel samples. Starting from the polar transform $F^{\otimes 13}$, key generation uniformly unfreezes 245 other positions and punctures 2048 coordinates, resampling punctures until the generator has rank 1965. For a full-rank parity-check matrix $H^{\prime }$, the public key is $H=S{H}^{\prime }P$, where S is uniform in $\mathrm{GL}(4179,2)$ and P is a uniform coordinate permutation. These are the frozen-set randomization, puncturing, and masking operations of the modified-polar family [18].

Signing first inverts S on the hashed syndrome and forms a systematic preimage under $H^{\prime }$. It randomly fills punctured coordinates and applies successive-cancellation randomized rounding for BSC(0.24) [30]. The original frozen positions remain zero, except that the 245 additionally unfrozen positions receive independent random bits. The punctured quantization error is permuted back to public coordinates. A fresh 20-bit salt and fresh rounding randomness are sampled until its weight is at most 1600.

Concrete generic-attack estimates. An invertible d-column submatrix $H_J$ gives the public forgery trial

$$e_J=H_J^{-1}{h}_{\mathrm{PS}}(M\parallel a),e_{\left[n\right]\setminus J}=0.$$

Its acceptance probability for a fresh hash input is

$$p(d,t)=2^{-d}{\displaystyle \sum _{w=0}^t}\left({\displaystyle \genfrac{}{}{0pt}{}{d}{w}}\right).$$

The parameters of Table 1 give $-{\log }_{2}p=171.89$. General decoding estimates must account for the many solutions: at weight t, their expected number is $\left({\displaystyle \genfrac{}{}{0pt}{}{n}{t}}\right)/2^d\approx 2^{897.96}$. Table 2 reports the evaluated classical attacks. The fixed-syndrome values use CryptographicEstimators 2.1.1 with this solution count [31]. The DS-DOOM value uses the authors’ multi-target estimator at $2^{128}$ targets [32]. The collision-DOOM model [33] is also evaluated with unlimited free targets and zero target-conversion cost. Within its searched auxiliary-length range ${\mathsf{\ell }}_{\mathrm{D}}\le 512$, summing all weights up to t improves the relevant collision probability by at most a factor 4.42. The table conservatively subtracts 2.15 bits from that model’s 145.20-bit estimate.

Table 2. Classical generic-attack estimates.

Attack Model	${\log }_2$ Work	Unit
Public invertible-submatrix trial	171.89	Hash queries
Prange/Stern/Dumer	207.50/172.96/172.38	Bit operations
May–Ozerov/BJMM	169.31/165.80	Bit operations
DS-DOOM, $2^{128}$ targets	167.48	Bit operations
Collision-DOOM, free unlimited targets, $\mathrm{wt}\le t$	143.05	Model column operations

Instantiation assumptions and structural attacks. Theorems 1–3 hold under the CSD and MPD assumptions for the key distribution specified above and the stated proof-system and hash assumptions. Bardet et al. recover permuted polar codes using minimum-weight codewords and recursive code equivalence [34]. Random unfreezing of 245 positions and puncturing of 2048 coordinates of the $N_0=8192$ mother code modify the information set and full-length structure used by that attack [18]. The masks S and P preserve permutation-invariant code properties. The published attack does not directly establish a key-recovery cost for this modified distribution. Structural security remains conditional on its MPD assumption. Table 2 evaluates classical generic attacks. Its 128-bit target is not an established concrete security level against structural or distribution-specific attacks.

FS-ZKB++ instantiation. The public circuit target is $y_{\mathrm{pub}}=0^{d+2\mathsf{\ell }+1}$. Each repetition uses independent uniform 256-bit seeds. A view commitment binds the seed and canonical view to the parameter identifier, statement, repetition, and party indices. Seed expansion, commitments, and challenges have disjoint domains, separate from $H_C,H_T,H_A,H_M,h_{\mathrm{PS}}$. Proof simulation programs only proof-system domains. The Fiat–Shamir hash binds the statement and complete first message, including all output shares and view commitments. Uniform ternary challenges are sampled by rejecting two-bit value 11. The verifier reconstructs the opened views, obtains the unopened output share by XORing the public target with the two opened shares, and checks the recomputed challenge against the encoded vector. This uses ZKB++ output-share compression [21] and the classical-ROM adaptive zero-knowledge and simulation-extraction results of [24] [Lemmas 3–4 and Corollary 1].

For $r=329$, the knowledge-error term $(Q+1){(2/3)}^r$ is below $2^{-128}$ when $Q\le 2^{64}$ [35]. Seed-and-view commitments give quasi-unique-response error at most $Q_{\mathrm{com}}^2/2^{256}$ [24] [Lemma 4]. The extraction resources are represented separately in Equation (6).

A repetition contains one unopened-view commitment, two opened-view seeds, one AND transcript, and a fixed input-share field. The challenge vector uses two bits per repetition. Unused input-share fields and trailing padding bits are checked zeros. Using the smaller syndrome circuit at each ring size,

$$G\left(L\right)=230400+(L-2)+4179\min (L-16144)+16383.$$

(12)

Applying the ZKB++ view encoding [21] with byte-aligned, fixed-length fields gives

$$P\left(L\right)=⌈{\displaystyle \frac{2r}{8}}⌉+r\left(96+⌈{\displaystyle \frac{G\left(L\right)}{8}}⌉+⌈{\displaystyle \frac{I\left(L\right)}{8}}⌉\right).$$

(13)

The four-byte packet header identifies the version, parameter set, ring-size exponent, and record type. Matrices are packed continuously by rows. Equation (13) fixes the proof length.

6. Performance Analysis and Comparison

This section quantifies the communication cost of authorization and online authentication. We compare the optimized circuit with a selected-matrix baseline and derive the savings from certificate reuse. We then evaluate the complete protocol and compare repeated-authentication structures with Liu and Wang [7] and Xue et al. [9], using Xue et al.’s published reference for the numerical communication comparison.

6.1. Circuit Comparison

Table 3 compares Equation (9) with the selected-matrix baseline. Both use the same relation, hashes, repetition count, and proof format. The baseline replaces the syndrome cost $d(L-1)$ by $dn$.

Table 3. Authorization proof sizes.

Ring Size L	Proposed AND Gates	Baseline Proof (Bytes)	Proposed Proof (Bytes)	Reduction
8	276,042	1,066,371,991	11,658,856	98.91%
32	376,362	1,066,373,307	15,784,845	98.52%
128	777,642	1,066,377,255	32,287,485	96.97%
1024	4,522,922	1,066,414,103	186,312,125	82.53%

6.2. Certificate Reuse

Let $s_T,c,s_{\sigma }$ be the byte lengths of the tag, certificate identifier, and basic signature. A certificate occupies

$$C_{\mathrm{cert}}=b+s_T+K+P,$$

(14)

and an online packet occupies $b+c+s_{\sigma }$. In the reference instance, these are $P+\mathrm{3,209,508}$ and 807 bytes. A standalone signature carrying the certificate occupies $C_{\mathrm{cert}}+s_{\sigma }$.

The direct-proof baseline signs each public digest $H_M\left(⟨\theta ,R,T,m⟩\right)$ under the hidden member key and proves Equation (4) for that digest. Its circuit and proof length are identical to the authorization circuit. Both schemes share the public ring, and the baseline sends its tag only once. For q messages,

$$\begin{array}{cc}\hfill L_{\mathrm{direct}}\left(q\right)& =b+s_T+q(b+P),\hfill \\ \hfill L_{\mathrm{cached}}\left(q\right)& =b+s_T+K+P+q(b+c+s_{\sigma }).\hfill \end{array}$$

(15)

Proposition 3.

Cached authorization reduces total communication relative to the direct-proof baseline exactly when

$$(q-1)P>K+q(c+s_{\sigma }).$$

(16)

Proof. 

Subtract the second expression in Equation (15) from the first and cancel the common header and tag terms.    □

When $P>c+s_{\sigma }$, the minimum integer satisfying Equation (16) is

$$q_{\min }=⌊{\displaystyle \frac{K+P}{P-c-s_{\sigma }}}⌋+1.$$

(17)

It equals two for all four instances in Table 3. For $L=32$ and $q=2$, the direct-proof and cached constructions require 31,569,734 and 18,995,967 bytes, respectively, a 39.83% reduction. Table 4 includes the initial certificate in the per-message averages.

Table 4. Certificate and amortized communication (bytes).

L	Certificate	Standalone Signature	Average, $\mathit{q}=128$	Average, $\mathit{q}=1024$
8	14,868,364	14,869,135	116,966.09	15,326.89
32	18,994,353	18,995,124	149,200.38	19,356.17
128	35,496,993	35,497,764	278,127.26	35,472.03
1024	189,521,633	189,522,404	1,481,444.76	185,886.72

Public-ring distribution excluded.

For h certificate transmissions, total communication is $h{C}_{\mathrm{cert}}+q(b+c+s_{\sigma })$. Table 5 summarizes the cryptographic operations.

Table 5. Primitive calls.

Operation	Cached Authorization Construction
Authorize	$1\mathsf{PS}.\mathsf{Gen}+1\mathsf{PS}.\mathsf{Sign}+1\mathrm{\Pi }.\mathsf{Prove}$
Install	$1\mathrm{\Pi }.\mathsf{Vfy}$
Sign each message	$1\mathsf{PS}.\mathsf{Sign}$
Verify each message	$1\mathsf{PS}.\mathsf{Verify}$ and a cache lookup

6.3. Experimental Evaluation

We evaluate signing performance and complete protocol execution using the parameters in Table 1. The prototype implements polar-code key generation and signing, authorization, certificate installation, and cached online signing and verification.

Experimental setup. The prototype uses Python 3.12.14 and NumPy 2.3.5 on Windows and a C++17 ZKB++ prover and verifier on Ubuntu 26.04 (WSL2), compiled with GCC 15.2.0 (-O2 -std=c++17). Measurements use one worker pinned to logical CPU 0 of an Intel Xeon Gold 5218R at 2.10 GHz. Protocol timings include serialization, process launch, and file I/O.

Test inputs. Eight independently generated, full-rank masked member keys form a canonical ring. One member creates three authorizations, each with an independently generated online key, and signs 32 distinct messages per authorization. Each authorization digest is computed from the actual parameter identifier, ring, tag, and online key as in Equation (3). Installation verifies the proof using only the public statement and stores the resulting online key and tag.

Results. All three authorizations installed successfully, and all 96 online signatures verified and linked to the same member tag. Every proof contained 11,658,856 bytes, matching Equation (13), and every online packet contained 807 bytes. Table 6 reports the measurements. The independent base-signing test produced 140 valid signatures on three masked keys in 187 attempts, averaging 1.34 attempts with a maximum of 4. Additional correctness and tampering checks passed. Peak RSS of the C++ proof processes was 98.81 MiB for proving and 66.94 MiB for verification.

Table 6. Integrated execution times.

Operation	Median (ms)	Min–Max (ms)	Samples
Registered key generation	27,866.67	20,537.12–53,416.39	8
Authorize	49,604.94	46,184.72–67,599.10	3
Install	7363.98	7293.43–7449.19	3
SignOnline	77.65	69.56–308.12	96
VerifyOnline	4.09	3.24–6.50	96

The results demonstrate complete protocol execution and certificate reuse for repeated, publicly linkable message authentication at $L=8$. For fixed code parameters, proving and proof-verification work scales as $O\left(r\right[Ldn+G\left(L\right)\left]\right)$, which is linear in L at fixed r. Larger-ring proof sizes and communication costs in Table 3 and Table 4 are derived analytically from the circuit and serialization formulas.

6.4. Published-Scheme Comparison

Liu and Wang [7] bind each Stern-type proof transcript to its message. Xue et al. [9] reuse offline signing and verification work, while each signature retains a message-bound signature of knowledge. Our authorization certificate binds an independent online key before subsequent messages are known. Table 7 summarizes these published formats. Liu and Wang report numerical parameters at 80-bit security, so we use their scheme for this structural comparison.

Table 7. Repeated-authentication structure.

Scheme	Membership Evidence Transmitted	Reused Across Messages
Liu and Wang [7]	Message-bound Stern-type proof	Public keys and parameters
Xue et al. [9]	Message-bound signature of knowledge	Offline signing and verification work
Proposed	Certificate once, then identifier and basic signature	Installed certificate and online key

For the numerical comparison, our instance uses the 128-bit classical generic-attack target and CSD/MPD assumptions of Section 5.3, and Xue et al. use their published 128-bit configuration. For $L=1024$, we use their approximate 29 KiB reference as $S_X=\mathrm{29,696}$ bytes [9,36]. With the hybrid circuit, Equations (12) and (13) give $G=\mathrm{4,522,922}$, a 186,312,125-byte proof, a 189,521,633-byte certificate, and a 189,522,404-byte standalone signature. The public ring occupies

$$C_R=4+L(K+32)=\mathrm{3,286,532,100}\mathrm{bytes}.$$

(18)

Table 8 gives analytical communication costs with the full initial certificate and matching public-key-list distribution: both lists are available, or each is sent once. All messages reuse one certificate at one recipient. Xue et al.’s reported 32-byte public keys give $C_{R,X}=32L$ bytes.

Table 8. Communication comparison.

	Both Lists Already Available		Each List Distributed Once
Messages $\mathit{q}$	Proposed	Xue et al. [9]	Proposed	Xue et al. [9]
128	1,481,444.76	29,696.00	27,157,476.79	29,952.00
1024	185,886.72	29,696.00	3,395,390.72	29,728.00
8192	23,941.96	29,696.00	425,129.97	29,700.00
65,536	3698.87	29,696.00	53,847.37	29,696.50
131,072	2252.94	29,696.00	27,327.19	29,696.25
262,144	1529.97	29,696.00	14,067.09	29,696.13

Bytes per message. $L=1024$, one recipient, one certificate installation.

Let s count list distributions under the same convention for both schemes, and h count certificate installations. Then

$$\begin{array}{cc}\hfill L_P(q;s,h)& =s{C}_R+h{C}_{\mathrm{cert}}+807q,\hfill \\ \hfill L_X(q;s)& =s{C}_{R,X}+q{S}_X.\hfill \end{array}$$

(19)

For $S_X>807$ and $h\ge 1$, the strict crossover is

$$q_{\min }=⌊{\displaystyle \frac{h{C}_{\mathrm{cert}}+s(C_R-C_{R,X})}{S_X-807}}⌋+1.$$

With $h=1$, $S_X=\mathrm{29,696}$, and $C_{R,X}=\mathrm{32,768}$, the thresholds at one recipient are 6561 messages for $s=0$ and 120,324 for $s=1$. At $q=\mathrm{131,072}$ with each ring distributed once, the calculated communication is 27,327.19 versus 29,696.25 bytes per message, approximately 7.98% lower under this reference workload.

The 3.29 GB public ring and 189.5 MB certificate favor long-lived rings, persistent verifier caches, and many messages per certificate. A candidate workload is periodic pseudonymous monitoring by privately provisioned devices reporting to one persistent collector. At one report per minute under an unchanged certificate, 120,324 messages accumulate in about 84 days. A replacement certificate starts a new amortization period.

6.5. Lifecycle and Deployment Conditions

A certificate binds an exact canonical ring: membership changes require a new authorization, while old certificates refer to the old ring unless that context is rejected. There is no built-in expiration or cryptographic revocation. An authenticated external rejection list may invalidate identifiers or ring versions and remove cache records. Storage eviction requires certificate re-verification before accepting compact packets. Online-key compromise permits further signing under that certificate. Rejection of one identifier applies only to that authorization. Long-term compromise exposes the linking secret and permits future authorizations.

Global tags link a registered key across rings and time. If a side channel identifies one tag, its entire recorded history becomes attributable. Global linking supports cross-context duplicate detection. A scoped extension using $H_T\left(⟨x,\mathsf{scope}⟩\right)$ would require binding the scope in the statement, identifier, cache, and linking rule. MPC-friendly hashes, preprocessing-based MPC-in-the-head, Banquet, and VOLE-in-the-head provide alternative instantiation directions [22,23,37].

Analytical variants. A systematic $[I_d\mid A]$ key would use $dk$ bits (1,026,467 bytes), subject to compatible syndrome-basis and trapdoor transformations and security analysis. An opening-only membership relation could omit the member-level PolarSig verification. Under the same layout, its 32-member proof would occupy 3,212,768 bytes. The member-level signature check establishes authorization under a registered verification key in addition to possession of the linking-secret opening.

7. Conclusions

We presented a linkable ring signature based on polar codes with cached anonymous authorization. A certificate binds a hidden member’s authorization signature, a global tag, and an independent online key. Public linear-map evaluation before hidden selection reduces the authorization circuit’s nonlinear cost, while certificate reuse removes the membership proof from subsequent online packets. For parameters selected against a 128-bit classical generic-attack target, the FS-ZKB++ instance provides a 98.52% proof-size reduction against the selected-matrix baseline for a 32-member ring and 807-byte cached online packets. The integrated prototype executes actual key generation, authorization, installation, and online signing and verification. Under the stated primitive assumptions and honest registration, the construction supports repeated anonymous authentication with independently verifiable messages in the classical random oracle model.