Forward-Secure Linkable Ring Signatures from Bilinear Maps

Abstract

We present the first linkable ring signature scheme with both unconditional anonymity and forward-secure key update: a powerful tool which has direct applications in elegantly addressing a number of simultaneous constraints in remote electronic voting. We propose a comprehensive security model, and construct a scheme based on the hardness of finding discrete logarithms, and (for forward security) inverting bilinear or multilinear maps of moderate degree to match the time granularity of forward security. We prove efficient security reductions—which, of independent interest, apply to, and are much tighter than, linkable ring signatures without forward security, thereby vastly improving the provable security of these legacy schemes. If efficient multilinear maps should ever admit a secure realisation, our contribution would elegantly address a number of problems heretofore unsolved in the important application of (multi-election) practical Internet voting. Even if multilinear maps are never obtained, our minimal two-epoch construction instantiated from bilinear maps can be combinatorially boosted to synthesise a polynomial time granularity, which would be sufficient for Internet voting and more.

1. Introduction

Ring signatures, and especially linkable ring signatures, garner much interest in the applied cryptographic community for their promise to simplify certain aspects of the notoriously hard problem of remote electronic voting, which has conflicting and often frustrating security requirements. In particular, linkability [1] or the closely related notion of traceability [2], make it easy to detect when the same signer has signed twice on the same matter, thereby preventing double spending in an electronic cash system, double voting in the same election. This, when combined with the anonymity properties of ring signatures, provides a secure mechanism to validate votes without breaking privacy. This paper is an extended version of our work in [3].

However, thus far, these signatures have not assisted in simultaneously resolving two critical issues in electronic voting. These two issues are: (1) how to register voters; and (2) how to ensure the voters’ long term privacy. Indeed, at present, most proposed electronic voting schemes use cryptography which is likely to allow adversaries to break the privacy of the voters at some point in the future.

To address these issues, an offline key update mechanism would allow the potentially costly registration of a voter’s public key to happen once, whereafter the corresponding private key can be refreshed or updated multiple times, efficiently and non-interactively, for use in subsequent elections. In this context, forward security refers to the notion that the leakage or compromise of an updated private key will not compromise one’s privacy in a past election—or let an attacker forge signatures ostensibly in the past, which could be linked to real votes. For practical electoral systems in particular, it is important that the public-key update mechanism be efficient and non-interactive. The ideal public-key update is the identity function, or “no-op.” The private-key update serves to provide forward security to protect old elections against future data exposure and compromises.

The related but different notion of unconditional anonymity refers to the inability, even by a computationally unbounded attacker, to identify a signer without knowledge of their private key. This notion is important to protect the voter against future increases in computational power (or cryptanalytic attacks, or quantum computers), once they have destroyed their private key after it is no longer needed. Together with linkability, these features make substantially easier the task of designing a secure and useable remote election protocol. Our forward-secure linkable ring signature scheme, when dropped into a number of existing election protocols, directly results in a straightforward and secure electronic voting solution without the cumbersome and procedurally risky steps that would normally be necessary to manage a dedicated key for each election. The additional improvements we detail in this extended version mean that, in many cases, the new scheme would also be more efficient.

Unfortunately—as often with the contradictory requirements of voting—it is easy to convince oneself that anonymity can only hold unconditionally if no authentic private key for the relevant signing ring is ever leaked, not even after having been updated. Indeed, if an adversary knows a voter’s authentic private key, he can always trivially deanonymise their current and future votes using the linkability feature. The same is true for past votes if a past private key can be recovered, by brute force or by breaking a hardness assumption, from a current key. It is an interesting area of future research to see if a key update mechanism, perhaps context dependent, could be developed which would prevent the discovery of past private keys from future keys even for a computationally unbounded adversary. However, such a mechanism would seem to have too many interesting applications to not have been discovered already, unless it were highly non-trivial. In light of this, we deliberately choose to focus on the problem of achieving unconditional anonymity against outsiders, but only computational forward security against insiders in the sense of unforgeability and anonymity after key update.

1.1. Our Results

We present the first linkable ring signature with unconditional anonymity and forward-secure key update, which is a tool that enables significantly more simple and secure remote electronic voting, even within the framework of existing electronic voting protocols, and opens the door to a number of simplified general anonymous authentication protocols for online systems.

To achieve our result, we construct a linkable ring signature from unconditionally hiding commitments, and make sparing use of a bilinear pairing or multilinear map [4,5] to lift it to multiple time periods or “epochs”. Without forward security or key update, our results are inspired by the linkable ring scheme from [1]—which we incidentally vastly improve via much tighter security reductions. (The original linkable ring signatures of Liu et al. [1,6] had proofs with losses exponential in the number of users, due to nested use of the forking lemma [7] on Pedersen commitments [8] in the random-oracle model. Our updated proofs and reductions are independent of the number of users, thanks to a single consolidated use of the forking lemma, and the same techniques directly apply to their construction.)

To get forward security, we build from an l-multilinear map an $\mathcal{O}$$(k^l)$-time one-way private-key update mechanism which requires no public-key update—for some choice of k. We prove the scheme information-theoretically anonymous, and its other security properties from Discrete Logarithm and two multilinear-map hardness assumptions—one of which amounts to a natural generalisation of the neo-classic Multilinear Decoding Problem [4] and the other is a natural generalisation of Decisional Diffie–Hellman. Notably, a mere 2-linear map (also known as bilinear pairing) already gives us forward security for $\mathcal{O}$$(k^2)$ time periods.

This extended paper expands on our original [3] in numerous ways. The main new technical contribution is a new combinatorial trick which allows us to gain a quadratic number of time periods from bilinear maps. This is accompanied by updated and improved definitions and proofs. The updated definitions increase the adversary’s powers, to better model insider attacks in particular. We have also taken advantage of the increased space available to provide more detailed discussion, including complexity analysis.

1.2. Related Work

Group signatures were introduced by Chaum et al. [9]. They allow the members of a group to generate signatures which can only be verified as emanating from one authorised signer within that group, with the additional property that the signature can be “opened” to reveal the true signer. The ability to open a signature is an important requirement in certain managed applications, but presents an unacceptable privacy loophole in the context of electronic voting. (In the UK, there is a requirement that a judge be able to order a voter’s ballot revealed. Group signatures would be perfect for such subtle voter intimidation, although Continentals would of course disapprove.)

Ring signatures are a variation of group signatures which allow neither pre-authorisation of keys nor deanonymisation of signatures, and hence, do not have those privacy issues. Ring signatures were first presented by Rivest et al. [10] as a way to leak secrets anonymously. Rivest et al.’s initial suggested application was the leaking of information by a cabinet minister. Their scheme also had the nice property that the keys involved could belong to different public key schemes, which made setup very flexible. Since then, many variants have been proposed to suit a large number of applications. For elections, double voting is a major issue which vanilla ring signatures are not readily able to rectify. Linkable ring signatures [6] and traceable ring signatures [2] have been proposed as a way to address this issue. Nevertheless, neither of [2,6] or their variants provides forward security; hence, in a voting application they would require impractically frequent re-registration of new keys to ensure acceptable levels of privacy.

Subsequent notable results in that area include Liu et al. [1], who presented a linkable ring signature with unconditional anonymity, but still without forward security. Our scheme addresses this shortcoming, by providing an offline (non-interactive) private-key-update mechanism with forward security (as well as much improved security reduction tightness over the previous schemes). There are also emerging variants based on cryptographic accumulators as well as post-quantum variants.

1.2.1. Multilinear Maps

Following the blockbuster impact of bilinear maps on cryptography, the question of using multilinear maps for cryptographic applications was first studied at a theoretical level by Boneh and Silverberg [11]. Nearly a decade later, Garg et al. [4] proposed the first practical candidate construction, based on lattice problems. There have since been several additional candidates from lattice- and number-based assumptions, as well as attacks and repair attempts [5,12,13,14,15], with the side of the “offence” presently having the upper hand.

Generally speaking, multilinear maps are useful in allowing more complicated structures in cryptographic constructions. For instance, Diffie–Hellman key exchange in a group supports two parities, with a bilinear map three parties, but on an l-linear map would support l parties. The added structure also allows new techniques to be used which have no equivalence on bilinear maps or standard groups.

Our basic scheme relies on a multilinear generalisation of the Discrete Logarithm problem, which is a weaker assumption than the myriad of Diffie–Hellman variants and extensions typically found in cryptographic constructions based on bilinear or multilinear maps. Our combinatorially boosted version relies on natural generalisations of Computational and Decisional Diffie–Hellman. However, it should be noted that there are no currently unbroken candidates for multilinear maps, and hence the construction in this work is currently only realisable with bilinear pairings.

Our vastly improved security reductions for this class of unconditionally anonymous linkable ring signature scheme with or without forward security still apply, although, providing substantial improvements to the concrete security of [1,6]. We discuss in Section 3.2 the major issues at hand regarding the known multilinear-map candidate constructions.

1.2.2. Voting Systems

In the world of election systems research, the recent Helios [16] protocol is, perhaps, the best known secure Internet voting scheme. It has seen a significant variety of expansions and applications [17,18], but one of its shortcomings is that the voters have to place (too) much trust on the election authority. Our linkable ring signature construction would fit nicely within the Helios protocol to enable powerful anonymous authentication and achieve privacy against the election authority, a property which is not achieved by most implementations of Helios. (In its standardised version [19], Helios relies on a mixnet technique to distribute the election authority’s ability to deanonymise. Even for Helios implementations that use this technique, the ability to enforce anonymity in the authentication mechanism itself would provide stronger privacy guarantees.) More generally, and beyond election systems, our new signature scheme can be used as a general rate-limited (rate limitation in the context of authentication refers to an intentional bound on the number of uses, typically one, that can be made of a credential on a given target) anonymous authentication system with forward secrecy and information-theoretic privacy.

2. Definitions

A forward secure linkable ring signature (FS-LRS) scheme is a tuple of three probabilistic polynomial time algorithms (Setup, KeyGen, and Sign) and four deterministic polynomial time algorithms (Verify, Link, PubKeyUpd, and PriKeyUpd). (Our definitions are fairly direct forward-secure variants of Liu et al. [1].)

• param ← Setup($\lambda ,\mathcal{T}$) on input security parameter $\lambda$ and number of time periods $\mathcal{T}$, returns a public setup param.
• $(s{k}_i,p{k}_i)\leftarrow$KeyGen(param) given param returns a key pair $(s{k}_i,p{k}_i)$.
• $\sigma \leftarrow \mathbf{Sign}(\mathbf{param},event,n,\overrightarrow{pk}{}_t,sk,M,t)$ given an event-id $event$, a group size n, a set ${\overrightarrow{pk}}_t$ of n public keys, a private key $sk$ whose corresponding public key is in ${\overrightarrow{pk}}_t$, a message M and a time t, produces a signature $\sigma$.
• accept|reject ← Verify$(\mathbf{param},event,n,{\overrightarrow{pk}}_t,M,\sigma ,t)$ given an event-id $event$, a group size n, a set ${\overrightarrow{pk}}_t$ of n public keys, a message-signature pair $(M,\sigma )$, and time t, returns accept or reject. We define a signature $\sigma$ as valid for ($event,n,{\overrightarrow{pk}}_t,M,t$) if Verify outputs accept.
• linked|unlinked←Link$(\mathbf{param},event,t,n_1,n_2,\overrightarrow{p{k}_{t_1}},\overrightarrow{p{k}_{t_2}},M_1,M_2,{\sigma }_1,{\sigma }_2)$ given an event-id $event$, time t, two group sizes $n_1,n_2,$ two sets $\overrightarrow{p{k}_{t_1}},\overrightarrow{p{k}_{t_2}}$ of $n_1,n_2$ public keys respectively, and two valid signature and message pairs $(M_1,{\sigma }_1,M_2,{\sigma }_2),$ outputs linked or unlinked.
• $Z_{t+1}\leftarrow$PubKeyUpd$(\mathbf{param},Z_t)$ given a public key, Z at time t, produces a public key for time $t+1$.
• $s{k}_{t+1}\leftarrow$PriKeyUpd$(\mathbf{param},s{k}_t)$ given a private key $sk$ at time t, produces the corresponding private key for time $t+1$.

We stress that in our current definitions PubKeyUpd and PriKeyUpd are deterministic functions. While it is interesting to consider systems where these functions might be randomised, this would need to be carefully considered. We are particularly concerned that randomised functions might severely limit the applications in which the signatures could be deployed.

2.1. Correctness Notions

To be functional, an FS-LRS scheme must satisfy the following:

• Verification correctness: Signatures signed correctly will verify.
• Updating correctness: For any time period of the system, the secret key derived from the private-key update function will create a valid signature on a ring, verifiable using the public key derived using the public-key update.
• Linking correctness: Two honestly created signatures on the same event and time period will link if and only if they have the same signer. (This is implied by the two security notions of linkability and non-slanderability; see below.)

2.2. Security Model

Security of FS-LRS has five aspects: unconditional anonymity, linkability, non-slanderability, forward-secure unforgeability, and forward-secure anonymity. (Ideally, we would be able to achieve forward-secure unconditional anonymity, and hence combine the first and last security properties. However, intuitively this property appears to be too strong to be achievable.)

2.2.1. Reflections

In our initial paper, we presented our definitions following fairly directly from Liu et al. in [1]. In this paper, we have made a few changes; primarily, we have strengthened the adversary’s powers in the anonymity definitions. We have also modified the signing oracle to allow the adversary access to genuine signatures where the adversary does not know who the signer is. This is to better reflect the real adversary’s powers in electronic voting. We note that our definitions and reductions are strictly stronger and tighter than Liu et al.

If a forward-secure linkable ring signature could be developed with much stronger privacy than any present solution, this would dramatically simply the security definitions. However, at present it is difficult to write definitions which closely match the expected level of security without being overly verbose. For instance, Liu et al.’s definition of privacy does not provide the adversary with access to genuine signatures, other than the challenge. In any deployed scheme, the adversary would having access to such signatures and hence the model clearly fails to capture reality. However, Liu et al.’s scheme appears to have a minimal loss of privacy under a differential privacy attack. This case highlights both the inadequacies of the model and the strength of the scheme. In summary, we believe our definitions capture well the intuitive definition of security; nevertheless, it is an interesting area of future research to present a scheme with stronger privacy that allows the simplification of the security model.

2.2.2. Oracles

The following oracles model the ability of the adversary to break the scheme:

• $p{k}_{i,t}\leftarrow$$\mathcal{JO}$$(t)$. The Joining Oracle, upon request, adds a new user to the system, and returns the public key $pk$ of the new user at the time t.
• $s{k}_{i,t}\leftarrow$$\mathcal{CO}$$(p{k}_i,t)$. The Corruption Oracle, on input a previously joined public key $p{k}_i$, returns the matching secret key $s{k}_i$ at the time t.
• ${\sigma }^{\prime }\leftarrow$$\mathcal{SO}$$(event,n,{\overrightarrow{pk}}_t,{\overrightarrow{pk}}_{\Pi },M,t)$. The Signing Oracle, on input an event-id $event$, a group size n, a set ${\overrightarrow{pk}}_t$ of n public keys, a set of public keys of possible signers ${\overrightarrow{pk}}_{\Pi }\subset {\overrightarrow{pk}}_t$, a message M, and a time t, returns a valid signature ${\sigma }^{\prime }$.

We omit the time and user subscripts $t,i$ when clear from context. In particular, our public key does not undergo updating, so $p{k}_t$ will be independent of t.

• $h\leftarrow$$\mathcal{H}$$(x).$ The Random Oracle, on input x, returns h independently and uniformly at random. If an x is repeated, the same h will be returned again.

2.2.3. Unconditional Anonymity

It should not be possible for an adversary $\mathcal{A}$ to tell the public key of the signer with a probability larger than $1/n^{\prime }$, where $n^{\prime }$ is the number of uncorrupted keys in the ring, even if the adversary has unlimited computing resources. Specifically, FS-LRS unconditional anonymity is defined in a game between a challenger $\mathcal{C}$ and an unbounded adversary $\mathcal{A}$ with access to $\mathcal{JO}$, $\mathcal{SO}$, $\mathcal{CO}$:

• $\mathcal{C}$ generates and gives $\mathcal{A}$ the system parameters param.
• $\mathcal{A}$ may query $\mathcal{JO}$,$\mathcal{SO}$, and $\mathcal{CO}$ according to any adaptive strategy.
• $\mathcal{A}$ gives $\mathcal{C}$ an event-id e, a time t, a group size n, a set of ${\overrightarrow{pk}}_t$ of n public keys such that all of the public keys in ${\overrightarrow{pk}}_t$ are query outputs of $\mathcal{JO}$ and no key in ${\overrightarrow{pk}}_t$ has been input to $\mathcal{SO}$ in a set which was not a superset of ${\overrightarrow{pk}}_t$, a message M, and a time t. Parsing the set ${\overrightarrow{pk}}_t$ as {$p{k}_1,\dots ,p{k}_n$}, $\mathcal{C}$ picks $\pi \in$ {$1,\dots ,n$} uniformly from the uncorrupted subset and computes ${\sigma }_{\pi }=$ Sign($e,n,{\overrightarrow{pk}}_t,s{k}_{\pi },M,t$), where $s{k}_{\pi }$ is a valid private key corresponding to $p{k}_{\pi }$ at time t. The signature ${\sigma }_{\pi }$ is given to $\mathcal{A}$.
• $\mathcal{A}$ outputs a guess ${\pi }^{\prime }\in$ {$1,\dots ,n$}.

We denote the adversary’s advantage by ${\mathbf{Adv}}_{\mathcal{A}}^{Anon}(\lambda )=|Pr[\pi ={\pi }^{\prime }]-\frac{1}{n^{\prime }}|$.

Definition 1.

Unconditional Anonymity. AnFS-LRS scheme is unconditionally anonymous if, for all unbounded adversaries$\mathcal{A}$, ${\mathit{Adv}}_{\mathcal{A}}^{Anon}(\lambda )$is zero.

2.2.4. Linkability

It should be infeasible for the same signer to generate two signatures for the same event and time, such that they are determined to be unlinked. Linkability for an FS-LRS scheme is defined in a game between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$ with access to oracles $\mathcal{JO}$, $\mathcal{CO}$, $\mathcal{SO}$ and $\mathcal{H}$:

• $\mathcal{C}$ generates and gives $\mathcal{A}$ the system parameters param.
• $\mathcal{A}$ may query the oracles according to any adaptive strategy.
• $\mathcal{A}$ gives $\mathcal{C}$ an event-id $event$, a time t, two sets $\overrightarrow{p{k}_{t_1}},\overrightarrow{p{k}_{t_2}}$ of public keys of sizes $n_1,n_2$, two messages $M_1,M_2$, and two signatures ${\sigma }_1,{\sigma }_2$.

$\mathcal{A}$ wins the game if:

• All of the public keys in ${\overrightarrow{pk}}_{t_i}$ are query outputs of $\mathcal{JO}$;
• Verify$(event,n_i,\overrightarrow{p{k}_{t_i}},M_i,{\sigma }_i,$t$)=\mathbf{accept}$ for ${\sigma }_1,{\sigma }_2$ not outputs of $\mathcal{SO}$;
• At most one query has been made to $\mathcal{CO}$; and
• Link(${\sigma }_1$, ${\sigma }_2$) = unlinked.

We denote the adversary’s advantage as ${\mathbf{Adv}}_{\mathcal{A}}^{Link}(\lambda )=Pr[\mathcal{A}\mathrm{wins}\mathrm{the}\mathrm{game}]$.

Definition 2.

Linkability. AnFS-LRSscheme is linkable if for all Probabilistic Polynomial-Time (PPT) adversaries$\mathcal{A}$, ${\mathit{Adv}}_{\mathcal{A}}^{Link}(\lambda )$is negligible.

2.2.5. Non-Slanderability

Non-slanderability ensures that no signer can generate a signature which is determined to be linked with another signature not generated by the signer. FS-LRS non-slanderabilty is defined in a game between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$ with access to the oracles $\mathcal{JO}$, $\mathcal{CO}$, $\mathcal{SO}$ and $\mathcal{H}$:

• $\mathcal{C}$ generates and gives $\mathcal{A}$ the system parameters param.
• $\mathcal{A}$ may query the oracles according to any adaptive strategy.
• $\mathcal{A}$ gives $\mathcal{C}$ an event-id $event$, a time t, a group size n, a message M, a set of n public keys ${\overrightarrow{pk}}_t$, and the public key of an insider $p{k}_{\pi }\in {\overrightarrow{pk}}_t$. $\mathcal{C}$ uses the private key $s{k}_{\pi }$ correspoing to $p{k}_{\pi }$ to run Sign($event,n,{\overrightarrow{pk}}_t,s{k}_{\pi },M,t$) and to produce a signature ${\sigma }^{\prime }$ given to $\mathcal{A}$.
• $\mathcal{A}$ queries oracles adaptively. In particular, $\mathcal{A}$ is allowed to query any public key which is not $p{k}_{\pi }$ to $\mathcal{CO}$.
• $\mathcal{A}$ outputs $n^{\ast }$, $n^{\ast }$ public keys ${\overrightarrow{pk}}_t^{\ast }$, a message $M^{\ast }$, and a signature ${\sigma }^{\ast }\ne {\sigma }^{\prime }$.

A wins the game if:

• Verify($event,n^{\ast },{\overrightarrow{pk}}_t^{\ast },M^{\ast },{\sigma }^{\ast }$, t) = accept on ${\sigma }^{\ast }$ not an output of $\mathcal{SO}$;
• all of the public keys in ${\overrightarrow{pk}}_t^{\ast }$, ${\overrightarrow{pk}}_t$ are query outputs of $\mathcal{JO}$;
• $p{k}_{\pi }$ has not been queried to $\mathcal{CO}$; and
• Link(${\sigma }^{\ast },{\sigma }^{\prime }$) = linked.

We denote the adversary’s advantage by ${\mathbf{Adv}}_{\mathcal{A}}^{NS}(\lambda )=Pr[\mathcal{A}\mathrm{wins}\mathrm{the}\mathrm{game}]$.

Definition 3.

Non-slanderabilty. AnFS-LRSscheme is non-slanderable if for any PPT adversaries$\mathcal{A}$, ${\mathit{Adv}}_{\mathcal{A}}^{NS}(\lambda )$is negligible.

2.2.6. Forward-Secure Unforgeability

Forward-secure unforgeability ensures that it is not feasible for an adversary with a private key for a time period strictly greater than t to create valid signatures for any period less than or equal to t. Forward-secure unforgeability is defined in the following game between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$ given access to the oracles $\mathcal{JO}$, $\mathcal{CO}$, $\mathcal{SO}$ and $\mathcal{H}$:

• $\mathcal{C}$ generates and gives $\mathcal{A}$ the system parameters param.
• $\mathcal{A}$ may query the oracles according to any adaptive strategy.
• $\mathcal{A}$ gives $\mathcal{C}$ an event-id e, a group size n, a set ${\overrightarrow{pk}}_t$ of n public keys, a message M, a time t and a signature $\sigma$.

A wins the game if:

• Verify$(e,n,{\overrightarrow{pk}}_t,M,\sigma ,t)=\mathbf{accept}$;
• all of the public keys in ${\overrightarrow{pk}}_t$ are query outputs of $\mathcal{JO}$;
• no public keys in ${\overrightarrow{pk}}_t$ have been input to $\mathcal{CO}$ at time t or earlier; and
• $\sigma$ is not a query output of $\mathcal{SO}$.

We denote the adversary’s advantage by ${\mathbf{Adv}}_{\mathcal{A}}^{FS-Unf}(\lambda )=Pr[\mathcal{A}\mathrm{wins}\mathrm{the}\mathrm{game}]$.

Definition 4.

Forward-Secure Unforgability. AnFS-LRSscheme is forward-secure against forgeries if for PPT adversaries$\mathcal{A}$, ${\mathit{Adv}}_{\mathcal{A}}^{FS-Unf}(\lambda )$is negligible.

2.2.7. Forward-Secure Anonymity

Forward-secure anonymity ensures that it is not feasible for an adversary with a private key for a time period strictly greater than t to de-anonymise signatures for any time period less than or equal to t. Forward-secure anonymity is defined in a game between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$ given access to oracles $\mathcal{JO}$, $\mathcal{CO}$, and $\mathcal{SO}$ and the random oracle:

• $\mathcal{C}$ generates and gives $\mathcal{A}$ the system parameters param.
• $\mathcal{A}$ may query the oracles according to any adaptive strategy.
• $\mathcal{A}$ gives $\mathcal{C}$ an event-id e, a time t, a group size n, a set of ${\overrightarrow{pk}}_t$ of n public keys such that all of the public keys in ${\overrightarrow{pk}}_t$ are query outputs of $\mathcal{JO}$, and a message M, Parsing the set ${\overrightarrow{pk}}_t$ as {$p{k}_1,\dots ,p{k}_n$}. $\mathcal{C}$ randomly picks $\pi \in$ {$1,\dots ,n$}, and computes ${\sigma }_{\pi }=$ Sign($e,n,{\overrightarrow{pk}}_t,s{k}_{\pi },M,t$), where $s{k}_{\pi }$ is a valid private key corresponding to $p{k}_{\pi }$ at time t. The signature ${\sigma }_{\pi }$ is given to $\mathcal{A}$.
• $\mathcal{A}$ outputs a guess ${\pi }^{\prime }\in$ {$1,\dots ,n$}.

A wins the game if:

• $\pi ={\pi }^{\prime }$;
• e and t have never been input together to $\mathcal{SO}$; and
• no public keys in ${\overrightarrow{pk}}_t$ have been input to $\mathcal{CO}$ at time t or earlier.

We denote the adversary’s advantage by ${\mathbf{Adv}}_{\mathcal{A}}^{FS-Anon}(\lambda )=Pr[\mathcal{A}\mathrm{wins}\mathrm{the}\mathrm{game}]$.

Definition 5.

Forward-Secure Anonymity. AnFS-LRSscheme is forward-secure anonymous if for any PPT adversaries$\mathcal{A}$, ${\mathit{Adv}}_{\mathcal{A}}^{FS-Anon}(\lambda )$is negligible.

3. Multilinear Maps

Since multilinear maps can be naturally presented as a generalisation of bilinear maps, and conversely bilinear maps as a concrete case of multilinear maps, we present the rest of our work using the the following multilinear map notation.

Our notation is similar to that used by Zhandry in [20]. Let $\epsilon$ be an $l—$linear map over additive cyclic groups ${[\mathbb{G}]}_1,..,{[\mathbb{G}]}_l$ of prime order q, where ${[\mathbb{G}]}_0={\mathbb{Z}}_q$ and all ${[\mathbb{G}]}_i$ for $i=1,\dots ,l$ are homomorphic to $({\mathbb{Z}}_q,+)$. Let ${[\alpha ]}_i$ denote the element $\alpha \in {\mathbb{Z}}_q$ raised to the level-i group ${[\mathbb{G}]}_i$, for $i\in (0,..,l)$. Let $\alpha {\in }_R{[\mathbb{G}]}_i$ denote the random sampling of an element in ${[\mathbb{G}]}_i$. We have access to efficient functions:

• Addition, Add or +: Given two elements ${[\alpha ]}_i,{[\beta ]}_i$ returns ${[\alpha +\beta ]}_i$.
• Negation, Neg or −: Given one element ${[\alpha ]}_i$ returns ${[-\alpha ]}_i$.
• Cross-level multiplication or multilinear Map, denoted $\epsilon$: Given two elements ${[\alpha ]}_i,{[\beta ]}_j$, returns ${[\alpha \ast \beta ]}_{i+j}$.

The cryptographic security of multilinear maps requires, among other things, that multiplication within any ${[\mathbb{G}]}_i$ be hard for $i>0$.

We generalise the notation above and denote by ${[\overrightarrow{a}]}_i\in {[{\mathbb{G}}^n]}_i$ a vector of n elements in ${[\mathbb{G}]}_i$. Such a vector ${[\overrightarrow{a}]}_i$ is then also denoted by $({[a_1]}_i,\dots ,{[a_n]}_i)$.

3.1. Multilinear Assumptions

The discrete log problem when stated using multilinear map notation is as follows:

Definition 6

(Multilinear Discrete-log Problem (MDLP) [4]). For any PPT algorithm $\mathcal{A}$, the probability $Pr[\mathcal{A}({[\alpha ]}_1)={[\alpha ]}_0]$ is negligible, where $\alpha {\in }_R{\mathbb{Z}}_q$.

This definition generalises to i-Decoding Problem (i-DP) to which the unforgability of our initial results reduced.

Definition 7

(i-Decoding Problem (i-DP) [4]). For any PPT algorithm $\mathcal{A}$, the probability $Pr[\mathcal{A}({[\delta ]}_i)={[\delta ]}_j]$ is negligible, where $j<i$ and $\delta {\in }_R{\mathbb{Z}}_q$.

A related assumption to i-Decoding Problem is the k-Sub-exponent Multilinear Decoding Problem (k-SMDP). We note in passing that a specific case of k-SMDP where $k=3$ on a Bilinear pairing is the Bilinear Computational Diffie–Hellman Problem.

Definition 8

(k-Sub-exponent Multilinear Decoding Problem.). For any PPT algorithm $\mathcal{A}$, the probability $Pr[\mathcal{A}({[\overrightarrow{\alpha }]}_1)=({[\overrightarrow{e}]}_0,{[\prod a_i^{e_i}]}_{\sum e_i-1})]$ is negligible, where ${[\overrightarrow{\alpha }]}_1{\in }_R{[{\mathbb{G}}^k]}_1$, and $\sum e_i\le l$. The adversary $\mathcal{A}$ is given access to an oracle $\mathcal{HO}$ which given ${[\overrightarrow{w}]}_0$ returns ${[a_i^{w_i}]}_{\sum w_i-1}$. $\mathcal{A}$ only wins if $[\overrightarrow{e}]$ cannot be trivially derived from any $[\overrightarrow{w}]$.

It is to the k-Sub-exponent Multilinear Decoding Problem that our combinatorial boosted variant’s unforgability reduces. All three of the definitions presented so far are specific cases of the ($k,b$)-Generalised Multilinear Decoding Problem (($k,b$)-GMDP).

Definition 9

(($k,b$)-Generalised Multilinear Decoding Problem.). For any PPT algorithm $\mathcal{A}$, the probability $Pr[\mathcal{A}({[\overrightarrow{\alpha }]}_b)=({[\overrightarrow{e}]}_0,{[\prod a_i^{e_i}]}_{b\ast \sum e_i-1})]$ is negligible, where ${[\overrightarrow{\alpha }]}_b{\in }_R{[{\mathbb{G}}^k]}_b$ and b $\ast \sum e_i\le l$. The adversary $\mathcal{A}$ is given access to an oracle $\mathcal{HO}$ which given ${[\overrightarrow{w},q]}_0$ returns ${[a_i^{w_i}]}_q$. $\mathcal{A}$ only wins if ${[\prod a_i^{e_i}]}_{b\ast \sum e_i-1}$ cannot be trivially derived from any ${[a_i^{w_i}]}_q$.

In our unforgeability-related reductions, we reduce to the ($k,b$)-Generalised Multilinear Decoding Problem for convenience and conciseness. Depending on the parameters with which our scheme was instantiated, this means the proof implies a reduction to one of the three specific cases:

• If configured similar to Liu et al. [1], it reduces to $MDLP$.
• If configured similar to our initial results, it reduces to i-DP.
• If configured to exploit the combinatorial trick, it reduces to k-SMDP.

In the same way that the Discrete Log Problem is generalised to Multilinear Discrete Log Problem (MDLP), the Decisional Diffie–Hellman problem generalises to Multilinear Decisional Diffie–Hellman (MDDH) problem. Intuitively, given three group elements, it is infeasible to tell if one is the product of the others, provided that the sum of any two levels is greater than maximum allowed.

Definition 10

(Multilinear Decisional Diffie–Hellman Problem i-(MDDH)). For any PPT $\mathcal{A}$, the distinguishing probability $Pr[\mathcal{A}({[\alpha ]}_i,{[\beta ]}_{l-i+1},{[\gamma ]}_l)=“\mathit{true}”-\mathcal{A}({[\alpha ]}_i,{[\beta ]}_{l-i+1},{[\alpha \beta ]}_l)=“\mathit{true}”]$ is negligible, where $\alpha ,\beta ,\gamma {\in }_R{\mathbb{Z}}_q$ and $i\ge 1$.

The parallel to k-SMDP for anonymity is k-Sub-exponent Multilinear Decisional Diffie–Hellman. We, again, note in passing that a specific case of k-SMDDH where $k=3$ on a Bilinear pairing is the Bilinear Decisional Diffie–Hellman Problem.

Definition 11

(Sub-exponent Multilinear Decisional Diffie–Hellman Problem k-(SMDDH)). For any PPT $\mathcal{A}$, the distinguishing probability $Pr[\mathcal{A}({[\overrightarrow{e}]}_0,{[\overrightarrow{\alpha }]}_1,{[\beta ]}_{l-\sum e_i+1},{[\gamma ]}_l)=“\mathit{true}”-\mathcal{A}({[\overrightarrow{e}]}_0,{[\overrightarrow{\alpha }]}_1,{[\beta ]}_{l-\sum e_i+1},{[{\alpha }_i^{e_i}\beta ]}_l)=“\mathit{true}”]$ is negligible, where ${[\overrightarrow{\alpha }]}_1{\in }_r{[{\mathbb{G}}^k]}_1$ and $\beta ,\gamma {\in }_R{\mathbb{Z}}_q$ and $\sum e_i\ge 1$. The adversary $\mathcal{A}$ is given access to an oracle $\mathcal{HO}$ which given ${[\overrightarrow{w}]}_0$ returns ${[a_i^{w_i}]}_{\sum w_i-1}$. $\mathcal{A}$ only wins if $[\overrightarrow{e}]$ cannot be trivially derived from any $[\overrightarrow{w}]$.

As with the previous set of assumptions we present a generalised assumption which includes both MDDH and SMDDH as specific cases. We call this assumption Generalised Sub-exponent Multilinear Decisional Diffie–Hellman Problem $(k,b)$.

Definition 12

(Generalised Sub-exponent Multilinear Decisional Diffie–Hellman Problem $(k,b)$-(GMDDH)). For any PPT $\mathcal{A}$, the distinguishing probability $Pr[\mathcal{A}({[\overrightarrow{e}]}_0,{[\overrightarrow{\alpha }]}_b,{[\beta ]}_{l-b\ast \sum e_i+1},{[\gamma ]}_l)=“\mathit{true}”-\mathcal{A}({[\overrightarrow{e}]}_0,{[\overrightarrow{\alpha }]}_b,{[\beta ]}_{l-b\ast \sum e_i+1},{[{\alpha }_i^{e_i}\beta ]}_l)=“\mathit{true}”]$ is negligible, where ${[\overrightarrow{\alpha }]}_b{\in }_r{[{\mathbb{G}}^k]}_b$ and $\beta ,\gamma {\in }_R{\mathbb{Z}}_q$ and $b\ast \sum e_i\ge 1$. The adversary $\mathcal{A}$ is given access to an oracle $\mathcal{HO}$ which given ${[\overrightarrow{w},q]}_0$ returns ${[a_i^{w_i}]}_q$. $\mathcal{A}$ only wins if ${[\prod a_i^{e_i}]}_{b\ast \sum e_i-1}$ cannot be trivially derived from any ${[a_i^{w_i}]}_q$.

In our forward-anonymity reduction, we reduce to the ($k,b$)-Generalised Sub-exponent Multilinear Decisional Diffie–Hellman Problem for convenience and conciseness. Depending on the parameters with which our scheme was instantiated, this means the proof implies a reduction to one of the three specific cases:

• If configured similar to Liu et al. [1], it reduces to $DDH$.
• If configured similar to our initial results, it reduces to i-MDDH.
• If configured to exploit the combinatorial trick, it reduces to k-SMDDH.

3.2. Is Multilinearity Achievable?

Three major multilinear map candidates have been proposed in [4,14,15]. Since their introduction, they have been the targets of many attacks, patches, and more attacks that remain unpatched.

One powerful class of attacks on multilinear maps are the so-called “zeroising” attacks; they run in polynomial time but require the availability of an encoding of zero in the lower levels of the multilinear ladder [4,21]. There are also sub-exponential and quantum attacks [22,23,24]. Further to this, recently Miles et al. introduced a class of “annihilation” attacks on multilinear maps [25].

There are reasons to believe that multilinear maps may be unrealisable. In particular, their near-equivalence to indistinguishability obfuscation [26]—an extremely powerful tool which in an even stronger variant is known not to exist [27]—is worrying. Furthermore, Boneh and Silverberg [11], in their original paper on applications of hypothetical multilinear maps, presented several results which cast doubt on the likeliness of multilinear maps’ existence, and soberingly conclude that “such maps might have to either come from outside the realm of algebraic geometry, or occur as ‘unnatural’ computable maps arising from geometry.”

If multilinear maps fail to be repaired, bilinear maps still give us an efficient two-period FS-LRS scheme that can be combinatorially boosted to multiple periods.

4. Construction

4.1. Notation

For conciseness, we use a number of specific notations. We use $a\mathrm{mod}b$ to denote the remainder of a divided by b. Given two vectors of group elements of equal length ${\overrightarrow{a}}^1$ and ${\overrightarrow{a}}^2$ we will use ${\overrightarrow{a}}^{\delta }$ to refer to $(a_1^1-a_1^2,\dots ,a_n^1-a_n^2)$, we also let ${\overrightarrow{a}}^{{\delta }^{\prime }}$ refer to $(a_1^2-a_1^1,\dots ,a_n^2-a_n^1)$.

4.2. Intuition

We now give the basic intuition of the scheme. We note that the first two paragraphs apply to almost all schemes following from Liu et al. [1]. The formal details follow in Section 4.6.

To ensure unconditional anonymity in spite of linkability, a Pedersen commitment can provide unconditional hiding with computational binding of the private key in the public key. The Pedersen commitment uses a common reference string consisting of two elements $[g]$ and $[h]$ of unknown relation. The private key is a pair $[x]$ and $[y]$ whose commitment, $[gx+hy]$ is the public key. A multilinear map can then raise and ratchet the private key at each time period, which provides forward security.

In the signature, we use the Fiat–Shamir heuristic on two knowledge-of-discrete-logarithm proofs, rolled into one. Using a topic specific value d, the signer proves firstly that they know x behind $f=dx$, and secondly that they know x and y such that $gx+hy$ is one of the public keys. Random challenges $c_i$ serve as decoys for the other public keys. Since both the real challenge c and the decoy challenges $c_i$ are uniformly random, an adversary is unable to discern which party signed.

This basic system, described above, is adapted with a combinatorial trick which, for a choice of k, leverages an l-linear map for ${\sum }_{i=1}^l\left(\genfrac{}{}{0pt}{}{k+i-1}{i}\right)$ time periods. (See our preliminary results in [3] for a clean presentation of the basic system with full details. We stress that the general system, presented here, implies the preliminary results but is more complicated in its presentation.) The value $k\ge 1$ may be freely chosen but the public key and private key sizes are linear in k.

4.3. Explanation of Parameters

We wish to avoid presenting, and proving, the generalised version—based on the combinatorial trick—separately from our initial result. For this reason, the presentation that follows is deliberately abstract and parameterised so that both the general version and the original result are special cases. This is necessary since neither version is a special cases of the other. The abstract presentation also means that the proofs are the same for both. We parameterise on four inputs:

• The multilinear map size l
• The combinatorial constant k
• The initial public key level b
• The number of time periods $\mathcal{T}$

Our initial result in [3] is a special case of the following construction where k $=1$ and b $=l$. The variant including the combinatorial trick is a special case where b $=1$. To make the paper easier to read, we present a slightly simplified construction which requires that b is either 1 or l. We believe that the more general construction for an arbitrary choice of b ≤ l works but since it significantly complicates the presentation we omit the details.

4.4. Time t to Key Indices

The public key for a time period t is a particular multiplicative combination of public key vector. For instance, for the case of l $=2,$ k $=3,$ b $=1$, the initial public key vector is ${[Z_1]}_1,{[Z_2]}_1,{[Z_3]}_1$ and private key vector is $({[x_1]}_0,{[y_1]}_0),({[x_2]}_0,{[y_2]}_0)$,$({[x_3]}_0,{[y_3]}_0$). After the signer generates the initial private key vector, they store ${[x_1]}_1,{[x_2]}_1,{[x_3]}_1,{[x_{1}h]}_1,{[x_{2}h]}_1,{[x_{3}h]}_1,{[y_1]}_0,{[y_2]}_0,{[y_3]}_0$ for the length of the election, and temporally store ${[x_1]}_0,{[x_2]}_0,{[x_3]}_0$. We call the vector stored for the length of the election the semi-private key vector since it need only be kept secret for unconditional anonymity but even if it where public, it would not allow an adversary to break privacy without breaking (k,b)-GMDDH.

To sign at time t, the signer needs the private key for that time and the semi-private key vector. The nine time periods have the following states, shown in Table 1.

Table 1. Overview of state changes.

Time Period	Public Key	Private Key	Private Store
0	${[Z_1]}_1$	${[x_1]}_0$	${[x_1^2]}_1,{[x_2]}_0,{[x_3]}_0$
1	${[Z_1^2]}_2$	${[x_1^2]}_1$	${[x_2]}_0,{[x_3]}_0$
2	${[Z_2]}_1$	$[x_2]$	${[x_2{x}_1]}_1,{[x_2^2]}_1{[x_3]}_0$
3	${[Z_2{Z}_1]}_2$	$[x_2{x}_1]$	${[x_2^2]}_1{[x_3]}_0$
4	${[Z_2^2]}_2$	$[x_2^2]$	${[x_3]}_0$
5	${[Z_3]}_1$	${[x_3]}_0$	${[x_3{x}_1]}_1,{[x_3{x}_2]}_1,{[x_3^2]}_1$
6	${[Z_3{Z}_1]}_2$	${[x_3{x}_1]}_1$	${[x_3{x}_2]}_1,{[x_3^2]}_1$
7	${[Z_3{Z}_2]}_2$	${[x_3{x}_2]}_1$	${[x_3^2]}_1$
8	${[Z_3^2]}_2$	${[x_3^2]}_1$

We denote $PK$$(t\in$$\mathcal{T}$) the function which when given a time period t returns the set of indices needed to generate public key for that time period. We denote the output of $PK$$(t)$ as $\tau$ and the cardinality of $\tau$ as $\kappa$. This function is very easy to evaluate if the value for $t-1$ is known, so in high-use situations it would be practical to remember the previous value and increment. However, if a more direct method is desirable, one possible implementation follows in Algorithm 1.

Algorithm 1: Index generation for time period t.

4.5. Public Key Structure

When b = l, as in our original results, the public keys have a very simple structure. However, the public key in the extended version, for a time t and $\tau$ = $PK$$(t)$, is of the form ${[{\prod }_{i\in \tau }{Z}_i]}_{\kappa }$. For example, if $\tau$ $=(1,2)$, then the public key is $[g^2{x}_1{x}_2+g{x}_{1}h{y}_2+g{x}_{2}h{y}_1+h^2{y}_1{y}_2]$. To simply the presentation, we let $KP$$(i,\tau ,\overrightarrow{x},\overrightarrow{y})={\sum }_{j\in \left(\genfrac{}{}{0pt}{}{\tau }{i}\right)j^{\prime }\in \left(\genfrac{}{}{0pt}{}{\tau /j}{k-i}\right)}({\prod }_{\iota \in j}{x}_{\iota }{\prod }_{\iota \in j^{\prime }}{y}_{\iota })$. In the example above, $KP$$(0,(1,2),\overrightarrow{x},$$\overrightarrow{y})=y_1{y}_2,$ $KP$$(1,(1,2),\overrightarrow{x},\overrightarrow{y})=x_1{y}_2+x_2{y}_1$ and $KP$$(2,(1,2),\overrightarrow{x},\overrightarrow{y})=x_1{x}_2$. The public key can be generated as ${\sum }_{i=0}^{\kappa }{g}^i{h}^{\kappa -i}$$KP$$(i,\tau ,\overrightarrow{x},\overrightarrow{y})$. We sometimes just write $KP$$(i)$, when $\tau ,\overrightarrow{x},\overrightarrow{y}$ are clear from context.

4.6. Formal Description

4.6.1. Setup($\lambda ,\mathcal{T}$)(k,l,b)

Take as input: The multilinear map size l, the combinatorial constant k, the initial key level b, and the number of time periods $\mathcal{T}$ $\ge 1$. It is required that bk $+{\sum }_{i=b+1}^l\left(\genfrac{}{}{0pt}{}{k+i-1}{i}\right)\ge$ $\mathcal{T}$. Denote by $t\in (0,1,2,\dots ,$$\mathcal{T}$ $-1)$ the current time period. Run a multilinear map setup algorithm to construct a bounded-level l-multilinear map and obtain its public parameters mmpp. Let $H_i$ denote the ith element in a family of hash functions H such that $H_i$: ${\{0,1\}}^{\ast }\to {[\mathbb{G}]}_i$. Construct ${[g]}_0=H_0($“Generator-g”) and ${[h]}_b=H_b($“Generator-h”). The public param are $(\mathbf{mmpp},k,b,{[g]}_0,{[h]}_b,H,$“Generator-g”,“Generator-h”).

4.6.2. KeyGen(param)

Sample ${[\overrightarrow{x}]}_0,{[\overrightarrow{y}]}_0{\in }_R{[{\mathbb{G}}^k]}_0$ and let ${[\overrightarrow{Z}]}_b=({[Z_1]}_b,\dots ,{[Z_k]}_b)$, where ${[Z_i]}_b=$ $\epsilon$$(\epsilon ({[g]}_0,{[x_i]}_0),{[1]}_b)+\epsilon ({[h]}_b,{[y_i]}_0)={[g\ast x_i+h\ast y_i]}_b$. The public key is $pk={[\overrightarrow{Z}]}_b$ and initial secret key $sk=({[\overrightarrow{x}]}_0,{[\overrightarrow{y}]}_0)$. Store $({[\overrightarrow{x}]}_b,({[x_{0}h]}_b,\dots ,{[x_{k}h]}_b),{[\overrightarrow{y}]}_0)$ for the duration of the election and ${[\overrightarrow{x}]}_0$ temporarily.

4.6.3. Sign$(\mathbf{param},event,n,{\overrightarrow{pk}}_t,s{k}_{\pi },M,t)$

On input $(event,n,{\overrightarrow{pk}}_t,s{k}_{\pi },M,t)$, with: $event$ some description, n the ring size, $\overrightarrow{pk}=\{p{k}_1,\dots ,p{k}_n\}=\{{[{\overrightarrow{Z}}_1]}_b,\dots ,{[{\overrightarrow{Z}}_n]}_b\}$ the ring public keys, $s{k}_{\pi }$ the signer’s secret key with public key $p{k}_{\pi }\in {\overrightarrow{pk}}_t$ (without loss of generality (w.l.o.g.) $\pi \in [1,n]$), M the message, and t the time period. The signer runs $PK$$(t)$ and gets $\tau$ whose cardinality we denote $\kappa$, and generates the specific public keys for time t as ${[{\overrightarrow{pk}}^{\prime }]}_{\kappa \ast b}$ where ${[p{k}_i^{\prime }]}_{\kappa \ast b}={[{\prod }_{j\in \tau }{Z}_{i,j}]}_{\kappa \ast b}.$ Let $\nu$ = $\kappa$ + ($\mathcal{T}$ mod b) − 1. The signer (holder of $s{k}_{\pi }=({[{\prod }_{j\in \tau }{x}_j]}_{\nu },\dots ,{[{\prod }_{j\in \tau }{y}_j]}_0$) does the following:

• Hash ${[d]}_{l-\nu }=H_{l-\nu }(t||event)$, and multilinearly map ${[f]}_l=\epsilon ({[d]}_{l-\nu },{[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)]}_{\nu })$.
• For $i\in (0,\dots ,\kappa )$ sample ${[r_i]}_0{\in }_R{[\mathbb{G}]}_0$ and ${[c_1]}_0,\dots ,{[c_{\pi -1}]}_0,{[c_{\pi +1}]}_0,\dots ,{[c_n]}_0{\in }_R{[\mathbb{G}]}_0$.
• Compute ${[K]}_l$ = ${\sum }_{i=0}^{\kappa }\epsilon ({[r_i]}_i,{[g^i{h}^{\kappa -i}]}_{l-i})+{\sum }_{i=1,i\ne \pi }^n\epsilon ({[p{k}_i^{\prime }]}_l,{[c_i]}_0)$, and ${[K^{\prime }]}_l$ = $\epsilon ({[d]}_{l-\nu },{[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}{r}_i]}_{\nu })+\epsilon ({[f]}_l,{\sum }_{i=1,i\ne \pi }^n{[c_i]}_0)$.
• Find ${[c_{\pi }]}_0$ s.t. ${[c_{\pi }]}_0=H_0({\overrightarrow{pk}}_t\left|\right|event\left|\right|{[f]}_l\left|\right|M\left|\right|{[K]}_l\left|\right|{[K^{\prime }]}_l\left|\right|t)-{\sum }_{i=1,i\ne \pi }^n{[c_i]}_0$.
• Compute ${[{\tilde{r}}_0]}_0={[r_0-c_{\pi }KP(0)]}_0$ and ${[{\tilde{r}}_1]}_{\nu }={\sum }_{i=1}^{\kappa }\epsilon ([g^{i-\kappa }{h}^{\kappa -i}],[r_i-c_{\pi }KP(i)])$.
• Output the signature $\sigma =({[f]}_l,{[{\tilde{r}}_0]}_0,{[{\tilde{r}}_1]}_{\nu },{[c_1]}_0,\dots ,{[c_n]}_0)$.

4.6.4. Verify$(\mathbf{param},event,n,{\overrightarrow{pk}}_t,M,\sigma ,t)$

On input $(event,n,{\overrightarrow{pk}}_t,M,\sigma ,t)$, first run $PK$$(t)$ and get $\tau$, and generate the specific public keys for time t as ${[{\overrightarrow{pk}}^{\prime }]}_{\kappa \ast b}$ where ${[p{k}_i^{\prime }]}_{\kappa \ast b}={[{\prod }_{j\in \tau }{Z}_{i,j}]}_{\kappa \ast b}$. Let $\nu$ = $\kappa$ + ($\mathcal{T}$$mod$b) − 1 and ${[d]}_{l-\nu }=H_{l-\nu }(t||event)$ and, using the components of $\sigma =({[f]}_l,{[{\tilde{r}}_0]}_0,{[{\tilde{r}}_1]}_{\nu },{[c_1]}_0,\dots ,{[c_n]}_0)$, compute

$${[K]}_l=\epsilon ({[{\tilde{r}}_0]}_0,{[h^{\kappa }]}_l)+\epsilon ({[{\tilde{r}}_1]}_{\nu },{[g^{\kappa }]}_{l-\nu +1})+{\sum }_{i=1}^n\epsilon ({[p{k}_i^{\prime }]}_l,{[c_i]}_0)$$

$${[K^{\prime }]}_l=\epsilon ({[d]}_{l-\nu },{[{\tilde{r}}_1]}_{\nu })+\epsilon ({[f]}_l,{\sum }_{i=1}^n{[c_i]}_0)$$

$$\mathrm{and}\hspace{1em}{[c_0]}_0=H_0({\overrightarrow{pk}}_t\left|\right|event\left|\right|{[f]}_l\left|\right|M\left|\right|{[K]}_l\left|\right|{[K^{\prime }]}_l\left|\right|t)$$

then check and output whether ${\sum }_{i=1}^n{[c_i]}_0={[c_0]}_0$.

4.6.5. Link$(\mathbf{param},event,t,n_1,n_2,\overrightarrow{p{k}_{t_1}},\overrightarrow{p{k}_{t_2}},M_1,M_2,{\sigma }_1,{\sigma }_2)$

On input two signatures ${\sigma }_1=({[f_1]}_l,\ast )$ and ${\sigma }_2=({[f_2]}_l,\ast )$, two messages $M_1$ and $M_2$, an event description $event$, and a time t, first check whether the two signatures are valid. If yes, output linked if ${[f_1]}_l={[f_2]}_l$; else output unlinked.

4.6.6. Private-Key Update(param, $s{k}_t$)

In a given time period t, to update the private key store for time period $t+1$, run $PK$$(t)$ and get $\tau$. Let $\nu$ = $\kappa$ + ($\mathcal{T}$$mod$b) − 1. Remove $({[{\prod }_{j\in \tau }{x}_j]}_{\nu }$ from the private key store and, if $\nu <$l.

If $b=1$, for all $\alpha \in (1,\dots ,{\tau }_{\kappa })$ add to the store ${[x_{\alpha }{\prod }_{j\in \tau }{x}_j]}_{\nu +1}$, else add to the store ${[{\prod }_{j\in \tau }{x}_j]}_{\nu +1}$. (We note again that this can be done very efficiently incrementally but we present a more general approach).

If $\nu$ = l no update is required.

4.6.7. Public-Key Update(param, $Z_t$)

The public key does not need to be updated in our scheme.

4.7. Space and Time Complexity

We briefly detail the complexity of the scheme when instantiated on bilinear maps. The complexity is parameterised over the size of the ring n and the number of time periods $\mathcal{T}$. The complexity is shown in Table 2.

Table 2. Space and time complexity analysis.

Complexity Analysis
Property	Complexity
Signature Size (Group Elements)	$n+3$
Public Key Size (Group Elements)	$\sqrt{\mathcal{T}}$
Secret Key Size (Group Elements)	$3\ast \sqrt{\mathcal{T}}$
Signing Complexity (Pairings and Multiplications)	$\mathcal{O}(n)$
Verifying Complexity (Pairings and Multiplications)	$\mathcal{O}(n)$
Link Complexity (on Verified Signatures)	1
Private-Key Update Complexity (Pairings and Multiplications)	$\sqrt{\mathcal{T}}$
Public-Key Update Complexity (Pairings and Multiplications)	0

The exact complexity of the signing and verifying algorithms depends on what optimisations are used, which in turn depends on the context of deployment, in all cases the constant is small. The table makes clear the main advantage of our construction; namely, that the key size is sublinear in the number of time periods which preserving the asymptotic complexity of singing and verifying.

5. Correctness

5.1. Verification Correctness

For verification correctness, it suffices to show that the verification values K and $K^{\prime }$ calculated by each party are the same. We denote by $[K_s]$ and $[K_v]$, K as calculated by the signer and verifier respectively; we adopt the same notation for $K^{\prime }$. The equations below show that $[K_s]=[K_v]$ and $[K_s^{\prime }]=[K_v^{\prime }]$ by applying the definitions of $[{\tilde{r}}_0]$ and $[{\tilde{r}}_1]$.

For K:

$$\begin{array}{ll}[K_s]& =\sum _{i=0}^{\kappa }[r_i{g}^i{h}^{\kappa -i}]+\sum _{i=1,i\ne \pi }^n[p{k}_i^{\prime }{c}_i]\\ & =[{\tilde{r}}_0{h}^{\kappa }]+[h^{\kappa }{c}_{\pi }KP(0)]+[{\tilde{r}}_1{g}^{\kappa }]+[\sum _{i=1}^{\kappa }{c}_{\pi }KP(i)g^i{h}^{\kappa -i}]+\sum _{i=1,i\ne \pi }^n[p{k}_i^{\prime }{c}_i]\\ & =[{\tilde{r}}_0{h}^{\kappa }]+[{\tilde{r}}_1{g}^{\kappa }]+\sum _{i=1}^n[p{k}_i^{\prime }{c}_i]\\ & =[K_v]\end{array}$$

For $K^{\prime }$:

$$\begin{array}{ll}[K_s^{\prime }]& =[d\sum _{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}{r}_i]+[f\sum _{i=1,i\ne \pi }^n{c}_i])\\ & =[d{\tilde{r}}_1]+[c_{\pi }d\sum _{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)]+[f\sum _{i=1,i\ne \pi }^n{c}_i]\\ & =[d{\tilde{r}}_1]+[f\sum _{i=1}^n{c}_i]\\ & =[K_v^{\prime }]\end{array}$$

5.2. Linking Correctness

For a given event $event$, time t, and private key, the linking component ${[f]}_l$, computed from ${[d]}_{l-\nu }=H_{l-\nu }(t||event)$, is completely deterministic. Since the linking component is deterministic, under the above conditions, given any two signatures a simple equality check on the linking component suffices. Conversely, for a given event $event$, time t, and two different private keys, the linking element will be different. (While it is possible for two different private keys to have the same public key, violating the assertion above, this would also break the Pedersen commitments and reveal the relationship between g and h. It is also possible for the hash function to collide. These events are assumed of negligible probability.)

5.3. Update Correctness

To simplify the presentation we present the argument for b$=1$ and b = l separately.

If b = l, the “effective” public key for the first l time periods will be ${[x_{1}g+y_{1}h]}_l$ and then ${[x_{2}g+y_{2}h]}_l$ for the next l and so on. At every time period, the signer must be able to calculate the private key $({[x_{t/l}]}_{tmodl},{[y_{t/l}]}_0)$. The private key update ensures the signer will always be able to generate private keys for the remaining “effective” public keys. First, notice that the signer always has ${[\overrightarrow{y}]}_0$ and that they start with ${[\overrightarrow{x}]}_0$. Secondly, the private key update for a time t removes ${[x_{t/l}]}_{tmodl}$ from the private key store and, and adds to the store ${[x_{t/l}]}_{(tmodl)+1}$.

If $b=1$, then the public keys are defined as a multiplicative combination of the initial public keys $({[Z_1]}_1,\dots ,{[Z_k]}_1)$. Although the order in which the keys are used is optimised to reduce the private key size, the set of public keys for all time periods is composed of all the ways to choose k initial keys, with replacement, at level k for all $k\in (1,\dots ,l)$; we denote these combinations by $\tau$. For each public key denoted ${[{\prod }_{j\in \tau }{Z}_j]}_{\kappa }$, the corresponding private key is $({[{\prod }_{j\in \tau }{x}_j]}_{\nu },\dots ,{[{\prod }_{j\in \tau }{y}_j]}_0)$. To see that private key update ensures the signer will always be able to generate private key for the remaining public keys: First, notice that the signer always has ${[\overrightarrow{y}]}_0$ and that they start with ${[\overrightarrow{x}]}_0$. Secondly, the private key update removes the current private key ${[{\prod }_{j\in \tau }{x}_j]}_{\nu }$ from the private key store, and adds to the store ${[x_{\alpha }{\prod }_{j\in \tau }{x}_j]}_{\nu +1}$ for $\alpha \in (1,\dots ,{\tau }_{\kappa })$.

6. Security

The proofs (other than the forward security ones) are similar to those of Liu et al. [1]. Despite the structural similarities, all of our reductions are exponentially more efficient.

Theorem 1.

The FS-LRS scheme is forward-secure against forgeries in the random-oracle model, if (k,b)-GMDP is hard.

Proof. 

We show that the ability of the adversary to make corruption queries at times later than t does not allow it to calculate the private key or forge signatures at time t, without breaking ($k,b$)-GMDP.

Given an ($k,b$)-GMDP instance $({[\overrightarrow{\alpha }]}_b)$, $\mathcal{B}$ is asked to output some (${[\overrightarrow{e}]}_0,{[{\alpha }_i^{e_i}]}_{b\ast \sum e_i-1}$) where $\sum e_i\le l)$. $\mathcal{B}$ picks ${[g]}_0,{[h^{\prime }]}_0{\in }_R{[\mathbb{G}]}_0$ and sets ${[h]}_b=\epsilon ({[h^{\prime }g]}_0,{[1]}_b)$. $\mathcal{B}$ simulates the oracles thus:

• Random Oracles$H_i$: For query input $H_0$(“GENERATOR-g”), $\mathcal{B}$ returns ${[g]}_0$. For query input $H_b$(“GENERATOR-h”), $\mathcal{B}$ returns ${[h]}_b$. For other queries, $\mathcal{B}$ randomly picks ${[\lambda ]}_0{\in }_R{[\mathbb{G}]}_0,$ sets ${[a]}_i=\epsilon ({[\lambda ]}_0,{[1]}_i)$ and returns ${[a]}_i$.
• Joining Oracle$\mathcal{JO}$: Assume $\mathcal{A}$ can only query $\mathcal{JO}$ for a maximum $n^{\prime }$ times, where $n^{\prime }\ge n$. W.l.o.g., ($1,\dots ,n$) will be the indices for which $\mathcal{B}$ does not know the private keys and embeds the challenge, and ($n+1,\dots ,n^{\prime }$) be the indices for which a private key is known. For the first n indices, $\mathcal{B}$ chooses ${[\overrightarrow{x}]}_0,{[\overrightarrow{y}]}_0{\in }_R{[{\mathbb{G}}^k]}_0$ and sets ${[\overrightarrow{Z}]}_b=({[Z_1]}_b,\dots ,{[Z_k]}_b)$ where ${[Z_i]}_b={[g{\alpha }_i{x}_i]}_b+{[h{y}_i]}_b$. For the remaining indices it generates the public/private key pair as in the scheme. Upon the jth query, $\mathcal{B}$ returns the matching public key.
• Corruption Oracle$\mathcal{CO}$: On input a public key $p{k}_i$ obtained from $\mathcal{JO}$, and a time t, $\mathcal{B}$ checks whether it is corresponding to $[n+1,n^{\prime }]$, if yes, then $\mathcal{B}$ returns the private key. Otherwise, $\mathcal{B}$ calls $\mathcal{O}(\tau ,\nu )$ returns $s{k}_i=({[{\prod }_{j\in \tau }{x}_{i,j}{\alpha }_j]}_{\nu },\dots ,{[{\prod }_{j\in \tau }{y}_{i,j}]}_0)$.
• Signing Oracle$\mathcal{SO}$: On input a signing query for event $event$, a set of public key ${\overrightarrow{pk}}_t=\{{[{\overrightarrow{Z}}_1]}_b,\dots ,{[{\overrightarrow{Z}}_n]}_b\}$, the public key for the signer ${[{\overrightarrow{Z}}_{\pi }]}_b$, where $\pi \in [1,n]$, and a message M, and time t, $\mathcal{B}$ simulates as follows:
  • If the query of $H_{l-\nu }(t||event)$ has not been made, carry out the H-query of $t\left|\right|event$ as described above. Set ${[d]}_{l-\nu }$ to $H_{l-\nu }(t||event)$. Note that $\mathcal{B}$ knows the ${[\lambda ]}_0$ that corresponds to ${[d]}_{l-\nu }$. $\mathcal{B}$ sets ${[f]}_l={[d\ast {\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)]}_l$, which it can compute from the challenge ${[\overrightarrow{\alpha }]}_b$.
  • If $\pi \in (n+1,\dots ,n^{\prime })$, $\mathcal{B}$ knows the private key and computes the signature according to the algorithm.
  • Otherwise, $\mathcal{B}$ randomly chooses ${[{\tilde{r}}_0]}_0{\in }_R{[\mathbb{G}]}_0$ and ${[{\tilde{r}}_1]}_{\nu }{\in }_R{[\mathbb{G}]}_{\nu }$ and ${[c_i]}_0{\in }_R{[\mathbb{G}]}_0$ for all $i\in [1,n]$ and sets the $H_0$ oracle output of

    $$\begin{array}{l}{H}_0({\overrightarrow{pk}}_t{\left|\right|event\left|\right|[f]}_l\left|\right|M\left|\right|\epsilon ({[{\tilde{r}}_0]}_0,{[h^{\kappa }]}_1)+\epsilon ({[{\tilde{r}}_1]}_{\nu },{[g^{\kappa }]}_{l-\nu })+\\ {\sum }_{i=1}^n\epsilon ({[p{k}_i^{\prime }]}_l,{[c_i]}_0)\left|\right|\epsilon ({[d]}_{l-\nu },{[{\tilde{r}}_1]}_{\nu })+\epsilon ({[f]}_l,{\sum }_{i=1}^n{[c_i]}_0)\left|\right|t)\end{array}$$
  • $\mathcal{B}$ returns the signature $\sigma =({[f]}_l,{[{\tilde{r}}_0]}_0,{[{\tilde{r}}_1]}_{\nu },{[c_1]}_0,\dots ,{[c_n]}_0)$. $\mathcal{A}$ cannot distinguish between $\mathcal{B}$’s simulation and real life.

For one successful simulation, suppose the forgery returned by $\mathcal{A}$, on an event $event$, time t and a set of public keys ${\overrightarrow{pk}}_t^{{}^{″}}\in [1,\dots ,n]$, is ${\sigma }^1=({[f]}_l,{[{\tilde{r}}_0^1]}_0,{[{\tilde{r}}_1^1]}_{\nu },{[c_1^1]}_0,\dots ,{[c_n^1]}_0)$. In the random-oracle model, $\mathcal{A}$ must have queried $H_{l-\nu }(t||event)$, denoted by ${[d]}_{l-\nu }$, and queried $H_0({\overrightarrow{pk}}^{″}{\left|\right|event\left|\right|[f]}_l{\left|\right|M\left|\right|[K]}_l\left|\right|{[K^{\prime }]}_l\left|\right|t)$ where

$${[K]}_l=\epsilon ({[{\tilde{r}}_0^1]}_0,{[h^{\kappa }]}_l)+\epsilon ({[{\tilde{r}}_1^1]}_{\nu },{[g^{\kappa }]}_{l-\nu })+{\sum }_{i=1}^n\epsilon ({[p{k}_i^{\prime }]}_l,{[c_i^1]}_0) \mathrm{and}$$

$${[K^{\prime }]}_l=\epsilon ({[d]}_{l-\nu },{[{\tilde{r}}_1^1]}_{\nu })+\epsilon ({[f]}_l,{\sum }_{i=1}^n{[c_i^1]}_0)$$

After a successful rewind, we get another ${\sigma }^2=({[f]}_l,{[{\tilde{r}}_0^2]}_0,{[{\tilde{r}}_1^2]}_{\nu },{[c_1^2]}_0,\dots ,{[c_n^2]}_0)$. Note that ${[f]}_l,{[K]}_l,$ and ${[K^{\prime }]}_l$ must be the same in both signatures since we rewind only to the point of random oracle query. In the rewound execution, we force a change in the $H_0$ oracle output to the query which determines ${\sum }_{i=1}^n[c_i]$. Let $\lambda$ denote those points $\in (1,\dots ,n)$ where $c_i^1\ne c_i^2$. We can the extract ${[{\prod }_{j\in \tau }{\alpha }_j]}_{\nu }$ as ${[\frac{{\tilde{r}}_0^{\delta }{h}^{\kappa }+{\tilde{r}}_1^{\delta }{g}^{\kappa }-{\sum }_{i\in \lambda }{c}_i^{{\delta }^{\prime }}{\sum }_{j=0}^{\kappa -1}{g}^j{h}^{\kappa -j}KP(j)}{g^{\kappa }{\sum }_{i\in \lambda }{c}_i^{{\delta }^{\prime }}{\prod }_{j\in \tau }{x}_{i,j}}]}_{\nu }$. We demonstrate the correctness of the extraction, below, by showing that since $[K]$ simultaneously satisfies two equations the correctness follows by simple algebraic manipulation and the format of the keys.

$$\begin{array}{cc}\hfill [K]& =[K]\hfill \end{array}$$

We begin by substituting $[K]$ for the two equations it satisfies,

$$\begin{array}{cc}\hfill [{\tilde{r}}_0^1{h}^{\kappa }]+[{\tilde{r}}_1^1{g}^{\kappa }]+\sum _{i=1}^n[p{k}_i^{\prime }{c}_i^1]& =[{\tilde{r}}_0^2{h}^{\kappa }]+[{\tilde{r}}_1^2{g}^{\kappa }]+\sum _{i=1}^n[p{k}_i^{\prime }{c}_i^2]\hfill \end{array}$$

By subtraction, we have

$$\begin{array}{cc}\hfill [{\tilde{r}}_0^{\delta }{h}^{\kappa }]+[{\tilde{r}}_1^{\delta }{g}^{\kappa }]& =[\sum _{i\in \lambda }p{k}_i^{\prime }{c}_i^{{\delta }^{\prime }}]\hfill \end{array}$$

By definition of $p{k}_i^{\prime }$,

$$\begin{array}{cc}\hfill [{\tilde{r}}_0^{\delta }{h}^{\kappa }]+[{\tilde{r}}_1^{\delta }{g}^{\kappa }]& ={[\sum _{i\in \lambda }{c}_i^{{\delta }^{\prime }}(g^{\kappa }\prod _{j\in \tau }{x}_{i,j}{a}_j+\sum _{j=0}^{\kappa -1}{g}^j{h}^{\kappa -j}KP(j))]}_l\hfill \end{array}$$

By subtraction, we have

$$\begin{array}{cc}\hfill [{\tilde{r}}_0^{\delta }{h}^{\kappa }+{\tilde{r}}_1^{\delta }{g}^{\kappa }-\sum _{i\in \lambda }{c}_i^{{\delta }^{\prime }}\sum _{j=0}^{\kappa -1}{g}^j{h}^{\kappa -j}KP(j)]& =[\sum _{i\in \lambda }{c}_i^{{\delta }^{\prime }}{g}^{\kappa }\prod _{j\in \tau }{x}_{i,j}{\alpha }_j]\hfill \end{array}$$

By division,

$$\begin{array}{cc}\hfill {[\frac{{\tilde{r}}_0^{\delta }{h}^{\kappa }+{\tilde{r}}_1^{\delta }{g}^{\kappa }-{\sum }_{i\in \lambda }{c}_i^{{\delta }^{\prime }}{\sum }_{j=0}^{\kappa -1}{g}^j{h}^{\kappa -j}KP(j)}{g^{\kappa }{\sum }_{i\in \lambda }{c}_i^{{\delta }^{\prime }}{\prod }_{j\in \tau }{x}_{i,j}}]}_{\nu }& ={[\prod _{j\in \tau }{\alpha }_j]}_{\nu }\hfill \end{array}$$

By the forking lemma [7], the chance of each successful rewind simulation is at least $\xi /4$, where $\xi$ is the probability that $\mathcal{A}$ successfully forges a signature. Hence, the probability that for a given adversary $\mathcal{A}$ we can extract ${[{\prod }_{j\in \tau }{\alpha }_j]}_{\nu }$ is $\frac{\xi }{4}$ times the probability that ${\overrightarrow{pk}}_t^{″}\subseteq (1,\dots ,n)$. □

Theorem 2.

The FS-LRS scheme is unconditionally anonymous.

Proof. 

The proof of unconditional anonymity is largely unchanged from [1], since both schemes rely on Pederson commitments. For each $\mathcal{JO}$ query, a value $[\overrightarrow{Z}]=([Z_1],\dots ,[Z_k])$ where $[Z_i]=(\epsilon ([g],[x_i])+\epsilon ([h],[y_i])$ is returned for some random pair $([\overrightarrow{x}],[\overrightarrow{y}])$. The challenge signature is created from the key of a random user in the ring. In contrast to Liu et al., we do allow the adversary access to the signing oracle. The access we grant gives the adversary the ability to learn, and therefore we assume knowledge of, the set of all genuine $[{\overrightarrow{x}}_i]$ in the challenge ring. Crucially, it does not grant the ability to learn which key part belongs to which public key.

In what follows, we show that the advantage of the adversary is information- theoretically zero. The proof is divided into three parts. First, we show that given a signature $\sigma =({[f]}_l,{[{\tilde{r}}_0]}_0,{[{\tilde{r}}_1]}_{\nu },{[c_1]}_0,\dots ,{[c_n]}_0)$ for a ring $([p{k}_1^{\prime }],\dots ,[p{k}_n^{\prime }])$ on message M, event $event$ and time t, there exists a matching private key $([KP(\kappa )],\dots ,[KP(0)])$ for each possible public key $[{\prod }_{i\in \tau }{Z}_{\pi ,i}]$, for any $\pi \in \{1,\dots ,n\},$ that can construct the linking tag $[f]$. That is, $[f]=\epsilon (H_{l-\nu }(t||event),{[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)]}_{\nu })=\epsilon ([d],[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)])$, where $[d]=H_{l-\nu }(t||event)$. Second, given a private key $([{\prod }_{i\in \tau }{x}_{\pi ,i}],\dots ,[{\prod }_{i\in \tau }{y}_{\pi ,i}])$, there exists a tuple $([r_{0_{\pi }}],\dots ,[r_{{\kappa }_{\pi }}])$ so that $\sigma$ matches $([{\prod }_{i\in \tau }{x}_{\pi ,i}],\dots ,[{\prod }_{i\in \tau }{y}_{\pi ,i}])$ using randomness $([r_{0_{\pi }}],\dots ,[r_{{\kappa }_{\pi }}])$. Finally, for any $\pi \in \{1,\dots ,n\}$, the distribution of the tuple ($[{\prod }_{i\in \tau }{x}_{\pi ,i}],\dots ,[{\prod }_{i\in \tau }{y}_{\pi ,i}],[r_{0_{\pi }}],\dots ,[r_{{\kappa }_{\pi }}]$) defined in parts one and two is identical.

Therefore, in the view of the adversary, the signature $\sigma$ is independent to the value $\pi$, the index of the actual signer. We conclude that even an unbounded adversary cannot guess the value of $\pi$ better than at random. In details:

• Part I. Let $x,y$ be so that $[f]=\epsilon ([d],[x])$ and $[g]=\epsilon ([h],[y])$. Let $[z_i]$ be so that $[p{k}_i^{\prime }]=\epsilon ([g^{\kappa }],[z_i])$ for $i=1$ to n. For each $\pi \in \{1,\dots ,n\}$, consider the values
  $[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)]=[x],$ and $[g^{-\kappa }KP(0)]=\epsilon ([z_{\pi }]-[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)],[y^{\kappa }])$
  Obviously, ($[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)],[g^{-\kappa }KP(0)]$) corresponds to the private key related to the public key $[p{k}_{\pi }^{\prime }]$ (since $[p{k}_{\pi }^{\prime }]=\epsilon ([g^{\kappa }],[z_{\pi }])=\epsilon ([g^{\kappa }],[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)]+[h^{\kappa }{g}^{-\kappa }KP(0)])=[{\sum }_{i=0}^{\kappa }{g}^i{h}^{k-i}KP(i)])$) and $[f]=\epsilon ([d],[x]])=\epsilon ([d],[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{k-i}KP(i)])$.
• Part II. For each possible $([{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)],[g^{-\kappa }KP(0)])$ defined in Part I, consider the values

  $$\begin{array}{c}[r_{0_{\pi }}]:=[{\tilde{r}}_0]+\epsilon ([c_{\pi }],[g^{-\kappa }KP(0)]),\hspace{1em}\hspace{1em}\mathrm{and}\\ [{\sum }_{i=1}^{\kappa }{g}^{\kappa -i}{h}^{\kappa -i}{r}_{i_{\pi }}]:=[{\tilde{r}}_1]+\epsilon ([c_{\pi }],[{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)]),\end{array}$$
  It can be seen that $\sigma$ can be created by the private key $([{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)],[g^{-\kappa }KP(0)])$ using the randomness $([r_{0_{\pi }}],[{\sum }_{i=1}^{\kappa }{g}^{\kappa -i}{h}^{\kappa -i}{r}_{i_{\pi }}])$, for any $\pi \in \{1,\dots ,n\}$.
• Part III. The distribution of $([{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)],[g^{-\kappa }KP(0)],[r_{0_{\pi }}],[{\sum }_{i=1}^{\kappa }{g}^{\kappa -i}{h}^{\kappa -i}{r}_{i_{\pi }}])$ for each possible $\pi$ is identical to that of a signature created by a signer with public key $[p{k}_{\pi }^{\prime }]$.

In other words, the signatures $\sigma$ can be created by any signer equipped with private key $([{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)],[g^{-\kappa }KP(0)])$ for any $\pi \in \{1,\dots ,n\}$ using randomness $([r_{0_{\pi }}],[{\sum }_{i=1}^{\kappa }{g}^{\kappa -i}{h}^{\kappa -i}{r}_{i_{\pi }}])$. Even if the unbounded adversary can compute $([{\sum }_{i=1}^{\kappa }{g}^{i-\kappa }{h}^{\kappa -i}KP(i)],[g^{-\kappa }KP(0)],[r_{0_{\pi }}],[{\sum }_{i=1}^{\kappa }{g}^{\kappa -i}{h}^{\kappa -i}{r}_{i_{\pi }}])$ for all $\pi \in [n]$, it cannot discern, amongst the $n^{\prime }$ possible unknown choices, who the signer is.

We use the fact that a public key in our construction corresponds to multiple secret keys. For each public key in the ring of possible signers, there exists a unique corresponding private key, possibly unknown, that fits the given linking tag. □

Theorem 3.

The FS-LRS scheme is linkable in the Random Oracle Model (ROM), if the (k,b)-GMDP is hard.

Proof. 

If $\mathcal{A}$ can produce two valid and unlinked signatures from just one private key, we can use this successfully to break GMDP.

Given an ($1,b$)-GMDP instance $({[\alpha ]}_b)$, $\mathcal{B}$ is asked to output some (${[e]}_0,{[{\alpha }^e]}_{b\ast e-1}$) where $e\le l)$. $\mathcal{B}$ picks ${[g]}_0,{\in }_R{[\mathbb{G}]}_0$ and sets ${[h]}_b=\epsilon ({[\alpha ]}_b)$. $\mathcal{B}$ simulates the oracles thus:

• Random Oracles$H_i$: For query input $H_0$(“GENERATOR-g”), $\mathcal{B}$ returns ${[g]}_0$. For query input $H_b$(“GENERATOR-h”), $\mathcal{B}$ returns ${[h]}_b$. For other queries, $\mathcal{B}$ randomly picks ${[\lambda ]}_0{\in }_R{[\mathbb{G}]}_0,$ sets ${[a]}_i=\epsilon ({[\lambda ]}_0,{[1]}_i)$ and returns ${[a]}_i$.
• Joining Oracle$\mathcal{JO}$: $\mathcal{B}$ generates the public/private key pair as in the scheme. Upon the jth query, $\mathcal{B}$ returns the matching public key.
• Corruption Oracle$\mathcal{CO}$: On input a public key $p{k}_i$ obtained from $\mathcal{JO}$, and a time t, $\mathcal{B}$ returns the private key.
• Signing Oracle$\mathcal{SO}$: On input a signing query for event $event$, a set of public key ${\overrightarrow{pk}}_t=\{{[{\overrightarrow{Z}}_1]}_b,\dots ,{[{\overrightarrow{Z}}_n]}_b\}$, the public key for the signer ${[{\overrightarrow{Z}}_{\pi }]}_b$, where $\pi \in [1,n]$, and a message M, and time t, $\mathcal{B}$ simulates as follows:
  • If the query of $H_{l-\nu }(t||event)$ has not been made, carry out the H-query of $t\left|\right|event$ as described above. Set ${[d]}_{l-\nu }$ to $H_{l-\nu }(t||event)$. Note that $\mathcal{B}$ knows the ${[\lambda ]}_0$ that corresponds to ${[d]}_{l-\nu }$. $\mathcal{B}$ sets ${[f]}_l={[d\ast {\prod }_{j\in \tau }{\alpha }_j{x}_{\pi ,j}]}_l$, which it can compute from the challenge ${[\overrightarrow{\alpha }]}_b$.
  • $\mathcal{B}$ computes the signature according to the algorithm.

If given a pair of ${\sigma }^i=({[f^i]}_l,{[{\tilde{r}}_0^i]}_0,{[{\tilde{r}}_1^i]}_{\nu },{[c_1^i]}_0,\dots ,{[c_n^i]}_0)$ on an event $event$, time t, two sets of public keys ${\overrightarrow{pk}}_{t_i}$, and two messages $M_i$, then, in the random-oracle model, $\mathcal{A}$ must have queried $H_{l-\nu }(t||event)$ which are denoted by ${[d]}_{l-\nu }$, and two queries $H_0({\overrightarrow{pk}}_{t_i}{\left|\right|event\left|\right|[f]}_l\left|\right|M_i\left|\right|{[K^i]}_l\left|\right|{[K^{\prime i}]}_l\left|\right|t)$ where

$${[K^i]}_l=\epsilon ({[{\tilde{r}}_0^i]}_0,{[h^{\kappa }]}_l)+\epsilon ({[{\tilde{r}}_1^i]}_{\nu },{[g^{\kappa }]}_{l-\nu })+{\sum }_{i=1}^n\epsilon ({[p{k}_{t_j}^{\prime }]}_l,{[c_j^i]}_0)$$

$${[K^{\prime i}]}_l=\epsilon ({[d]}_{l-\nu },{[{\tilde{r}}_1^i]}_{\nu })+\epsilon ({[f]}_l,{\sum }_{j=1}^n{[c_j^i]}_0)$$

Since ${\sigma }^1\ne {\sigma }^2$ and they are unlinked, by definition of linkability, we have ${[f^1]}_l\ne {[f^2]}_l$. Since, by definition of the game, the ${\sigma }^i$ are both valid for the same time and event, ${[d^1]}_{l-\nu }=H_{l-\nu }(t||event)={[d^2]}_{l-\nu }$. Write ${[f^i]}_l$ as ${[d^i{x}_i]}_l$, where we have shown ${[d^1]}_{l-\nu }={[d^2]}_{l-\nu }$. Hence, ${[x_1]}_{\nu }\ne {[x_2]}_{\nu }$. Therefore, at most one ${[f^i]}_l$, and hence ${\sigma }^i$, encodes the pair $({\prod }_{i\in \tau }{x}_{\pi ,i},\dots ,{\prod }_{i\in \tau }{y}_{\pi ,i})$ which we gave to the adversary. We extract on the unrelated signature. Therefore, we have ${[{\tilde{r}}_0^1]}_{\kappa -1}\ne {[{\tilde{r}}_0^2]}_{\kappa -1}$ and find a response ${[\alpha ]}_{\kappa -1}$ to the GMDP challenge as:

$$\begin{array}{c}\hfill {[{\alpha }^{\kappa }]}_{\nu }=[\frac{{\sum }_{i\in \lambda }{c}_i^{{\delta }^{\prime }}({\sum }_{j=1}^{\kappa }{g}^j{h}^{\kappa -j}KP(j))-{\tilde{r}}_1^{\delta }{g}^{\kappa }}{{\tilde{r}}_0^{\delta }-{\sum }_{i\in \lambda }{c}_i^{{\delta }^{\prime }}KP(0)}]\end{array}$$

We demonstrate the correctness of the extraction, below, by showing that since $[K]$ simultaneously satisfies two equations the correctness follows by simple algebraic manipulation and the format of the keys.

$$\begin{array}{cc}\hfill [K]& =[K]\hfill \end{array}$$

We begin by substituting $[K]$ for the two equations it satisfies,

$$\begin{array}{cc}\hfill [{\tilde{r}}_0^1{\alpha }^{\kappa }]+[{\tilde{r}}_1^1{g}^{\kappa }]+\sum _{i=1}^n[p{k}_i^{\prime }{c}_i^1]& =[{\tilde{r}}_0^2{\alpha }^{\kappa }]+[{\tilde{r}}_1^2{g}^{\kappa }]+\sum _{i=1}^n[p{k}_i^{\prime }{c}_i^2]\hfill \end{array}$$

By subtraction, we have

$$\begin{array}{cc}\hfill [{\tilde{r}}_0^{\delta }{\alpha }^{\kappa }]+[{\tilde{r}}_1^{\delta }{g}^{\kappa }]& =[\sum _{i\in \lambda }p{k}_i^{\prime }{c}_i^{{\delta }^{\prime }}]\hfill \end{array}$$

By definition of $p{k}_i^{\prime }$,

$$\begin{array}{cc}\hfill [{\tilde{r}}_0^{\delta }{\alpha }^{\kappa }]+[{\tilde{r}}_1^{\delta }{g}^{\kappa }]& ={[\sum _{i\in \lambda }{c}_i^{{\delta }^{\prime }}({\alpha }^{\kappa }KP(0)+\sum _{j=1}^{\kappa }{g}^j{h}^{\kappa -j}KP(j))]}_l\hfill \end{array}$$

By subtraction, we have

$$\begin{array}{cc}\hfill [{\tilde{r}}_0^{\delta }{\alpha }^{\kappa }]-[\sum _{i\in \lambda }{c}_i^{{\delta }^{\prime }}({\alpha }^{\kappa }KP(0))]& =[\sum _{i\in \lambda }{c}_i^{{\delta }^{\prime }}(\sum _{j=1}^{\kappa }{g}^j{h}^{\kappa -j}KP(j))]-[{\tilde{r}}_1^{\delta }{g}^{\kappa }]\hfill \end{array}$$

By distributivity, we have

$$\begin{array}{cc}\hfill [{\alpha }^{\kappa }({\tilde{r}}_0^{\delta }-\sum _{i\in \lambda }{c}_i^{{\delta }^{\prime }}KP(0))]& =[\sum _{i\in \lambda }{c}_i^{{\delta }^{\prime }}(\sum _{j=1}^{\kappa }{g}^j{h}^{\kappa -j}KP(j))-{\tilde{r}}_1^{\delta }{g}^{\kappa }]\hfill \end{array}$$

By division, we have

$$\begin{array}{cc}\hfill [{\alpha }^{\kappa }]& =[\frac{{\sum }_{i\in \lambda }{c}_i^{{\delta }^{\prime }}({\sum }_{j=1}^{\kappa }{g}^j{h}^{\kappa -j}KP(j))-{\tilde{r}}_1^{\delta }{g}^{\kappa }}{{\tilde{r}}_0^{\delta }-{\sum }_{i\in \lambda }{c}_i^{{\delta }^{\prime }}KP(0)}]\hfill \end{array}$$

By the forking lemma [7], the chance of each successful rewind simulation is at least $\xi /4$, where $\xi$ is the probability that $\mathcal{A}$ successfully forges a signature. Hence, the probability that for a given adversary $\mathcal{A}$ we can extract ${[{\prod }_{j\in \tau }{\alpha }_j]}_{\nu }$ is $\frac{\xi }{4}\frac{1}{2}$. □

Theorem 4.

The FS-LRS is non-slanderable in the ROM, if (k,b)-GMDP is hard.

Proof. 

We use the setting of Theorem 1. $\mathcal{A}$ can query any oracle other than to submit a chosen public key $p{k}_{\pi }$ to $\mathcal{CO}$ or include $p{k}_{\pi }\in {\overrightarrow{pk}}_{\pi }$ to $\mathcal{SO}$. It then gives $\mathcal{B}$: the key $p{k}_{\pi }$, a list of public keys ${\overrightarrow{pk}}_t\ni p{k}_{\pi }$ (w.l.o.g., we have $|{\overrightarrow{pk}}_t|=n$), a message M, a description $event$, and a time t. In return, $\mathcal{B}$ generates a signature $\sigma ({[f]}_l,\dots )$ using the standard method for the signing oracle, and gives it back to $\mathcal{A}$. Recall, we let ${[f]}_l={[d\ast {\prod }_{j\in \tau }{a}_j{x}_{\pi ,j}]}_l$. $\mathcal{A}$ continues to query various oracles, expect that it is not allowed to submit $p{k}_{\pi }$ to $\mathcal{CO}$.

Suppose $\mathcal{A}$ produces another valid signature ${\sigma }^{\ast }=({[f^{\prime }]}_l,.)$ that was not an output from $\mathcal{SO}$ but is linkable to $\sigma$. Since they are linkable, we have ${[f^{\prime }]}_l={[f]}_l$ and hence $\frac{{[{\prod }_{i\in \tau }{a}_i{x}_{\pi ,i}]}_l}{{[d]}_0}=\frac{{[{\prod }_{i\in \tau }{a}_i{x}_{\pi ,i}]}_l}{{[d]}_0}$. Recall that, by definition of the game, ${\sigma }^{\ast }\ne {\sigma }^{{}^{\prime }}$ which implies that $[{\tilde{r}}_i^{\ast }]\ne [{\tilde{r}}_i^{\prime }]$ and hence $[r_i^{\ast }]\ne [r_i^{{}^{\prime }}]$. We then extract ${[{\prod }_{j\in \tau }{\alpha }_j]}_{\nu }$ from ${\sigma }^{\ast }$ as outlined in Theorem 1.

The probability that, for a given adversary $\mathcal{A}$, we can extract ${[{\prod }_{j\in \tau }{\alpha }_j]}_{\nu }$ is $\frac{\xi }{4n}$. □

Theorem 5.

The FS-LRS scheme is forward-secure anonymous in the random-oracle model, if MDDH is hard.

Proof. 

We show that the ability of the adversary to make corruption queries at times later than t does not allow it to de-anonymise signatures at time t or earlier, without breaking ($\kappa$,b)-MDDH, and hence the system achieves forward-secure anonymity. In this proof, we start by guessing the break point t at which the adversary’s will choose to be challenged.

Given an MDDH instance $({[\overrightarrow{e}]}_0,{[\overrightarrow{\alpha }]}_{\nu /\kappa },{[\beta ]}_{l-\nu },{[\gamma ]}_l)$, $\mathcal{B}$ is asked to decide whether ${[\gamma ]}_l={[{\prod }_{i\in k}{\alpha }_i^{e_i}\beta ]}_l$. Where $\overrightarrow{e}$ produces the same selection of keys as $\tau$ = $PK$$(t)$. $\mathcal{B}$ picks ${[g]}_0,{[h]}_0{\in }_R{[\mathbb{G}]}_0$ and sets ${[h]}_b=\epsilon ({[h]}_0,{[1]}_b)$. $\mathcal{B}$ simulates:

• Random Oracles$H_i$: For query input $H_0$(“GENERATOR-g”), $\mathcal{B}$ returns ${[g]}_0$. For query input $H_b$(“GENERATOR-h”), $\mathcal{B}$ returns ${[h]}_b$. For other queries, $\mathcal{B}$ randomly picks ${[\lambda ]}_0{\in }_R{[\mathbb{G}]}_0,$ sets ${[a]}_i=\epsilon ({[\lambda ]}_0,{[1]}_i)$ and returns ${[a]}_i$.
• Joining Oracle$\mathcal{JO}$: Assume $\mathcal{A}$ can only query $\mathcal{JO}$ for a maximum $n^{\prime }$ times, where $n^{\prime }\ge n$. W.l.o.g., ($1,\dots ,n$) will be the indices for which $\mathcal{B}$ does not know the private keys and embeds the challenge, and ($n+1,\dots ,n^{\prime }$) be the indices for which a private key is known. For the first n indices, $\mathcal{B}$ chooses ${[\overrightarrow{x}]}_0,{[\overrightarrow{y}]}_0{\in }_R{[{\mathbb{G}}^k]}_0$ and sets ${[\overrightarrow{Z}]}_b=({[Z_1]}_b,\dots ,{[Z_k]}_b)$ where ${[Z_i]}_b={[g{\alpha }_i{x}_i]}_b+{[h{y}_i]}_b$. For the remaining indices it generates the public/private key pair as in the scheme. Upon the jth query, $\mathcal{B}$ returns the matching public key.
• Corruption Oracle$\mathcal{CO}$: On input a public key $p{k}_i$ obtained from $\mathcal{JO}$, and a time t, $\mathcal{B}$ checks whether it is corresponding to $[n+1,n^{\prime }]$, if yes, then $\mathcal{B}$ returns the private key. Otherwise, $\mathcal{B}$ calls $\mathcal{O}(\tau ,\nu )$ returns $s{k}_i=({[{\prod }_{j\in \tau }{x}_{i,j}{\alpha }_j]}_{\nu },\dots ,{[{\prod }_{j\in \tau }{y}_{i,j}]}_0)$.
• Signing Oracle$\mathcal{SO}$: On input a signing query for event $event$, a set of public keys ${\overrightarrow{pk}}_t=\{{[Z_1]}_l,\dots ,{[Z_n]}_l\}$, the public key for the signer ${[Z_{\pi }]}_l$ where $\pi \in [1,n]$, a message M, and a time t, $\mathcal{B}$ simulates as follows:
  • If the query of $H_{l-\nu }(t||event)$ has not been made, carry out the H-query of $t\left|\right|event$ as described above. Set ${[d]}_{l-\nu }$ to $H_{l-\nu }(t||event)$. Note that $\mathcal{B}$ knows the ${[\lambda ]}_0$ that corresponds to ${[d]}_{l-\nu }$.
  • $\mathcal{B}$ randomly chooses ${[{\tilde{r}}_0]}_0{\in }_R{[\mathbb{G}]}_0$ and ${[{\tilde{r}}_1]}_{\nu }{\in }_R{[\mathbb{G}]}_{\nu }$ and ${[c_i]}_0{\in }_R{[\mathbb{G}]}_0$ for all $i\in [1,n]$ and sets the $H_0$ oracle output of

    $$\begin{array}{c}{H}_0({\overrightarrow{pk}}_t{\left|\right|event\left|\right|[f]}_l\left|\right|M\left|\right|\epsilon ({[{\tilde{r}}_0]}_0,{[h^{\kappa }]}_l)+\epsilon ({[{\tilde{r}}_1]}_{\nu },{[g^{\kappa }]}_{l-\nu })+\\ {\sum }_{i=1}^n\epsilon ({[p{k}_i^{\prime }]}_l,{[c_i]}_0)\left|\right|\epsilon ({[d]}_{l-\nu },{[{\tilde{r}}_1]}_{\nu })+\epsilon ({[f]}_l,{\sum }_{i=1}^n{[c_i]}_0)\left|\right|t)\end{array}$$
  • $\mathcal{B}$ returns the signature $\sigma =({[f]}_l,{[{\tilde{r}}_0]}_0,{[{\tilde{r}}_1]}_{\nu },{[c_1]}_0,\dots ,{[c_n]}_0)$. $\mathcal{A}$ cannot distinguish between $\mathcal{B}$’s simulation and real life.

At some point, $\mathcal{A}$ requests to be challenged on $e,t,n,{\overrightarrow{pk}}_t,M$. $\mathcal{B}$ sets $H_{l-\nu }(e||t)={[\beta ]}_{l-\nu }$, samples $i\in [n]$, sets ${[f]}_l={[\gamma {\prod }_{i\in \tau }{x}_i^{\prime }+\beta {\sum }_{i=1}^{\kappa -1}{g}^{i-\kappa }{h}^{\kappa -i}KP(i)]}_l$, and then performs the remaining steps of the signing oracle as above. Notice that if ${[\gamma ]}_l$ is equal to ${[{\prod }_{i=1}^{\kappa }{a}_i^{e_i}\beta ]}_l$ then this signature is normally formed; however, if ${[\gamma ]}_l$ is a random group element than the linking element is random, while the rest of the signature is independent of the signer. If $\mathcal{A}$ successfully guesses i then $\mathcal{B}$ guesses that $[\gamma ]=[\alpha \beta ]$, otherwise $\mathcal{B}$ guesses that $[\gamma ]$ is random. □

7. Conclusions

We have presented the first linkable ring signature scheme with both unconditional anonymity and forward-secure key update. By expanding upon of our work in [3], we have shown how a combinatorial trick can allow bilinear pairings to synthesise a polynomial time granularity for forward security. This is a powerful tool which has direct applications in elegantly addressing a number of simultaneous constraints in remote electronic voting. We have also presented a comprehensive security model which better reflects real requirements than existing definitions. We then proved our construction secure under these definitions by reducing to natural bilinear or multilinear generalisations of the computational and decisional Diffie–Hellman Problems.