A new logarithmic-size signature scheme LS-LSAG

A new logarithmic-size signature scheme LS-LSAG
From: 'Ed Hughes' via Bitcoin Development Mailing List @ 2024-07-11  7:11 UTC (permalink / raw)
  To: Bitcoin Development Mailing List


[-- Attachment #1.1: Type: text/plain, Size: 1727 bytes --]

Hello all,

I'd like to propose an idea of a simple logarithmic-size ring signature 
scheme 
which can be used in the blockchain and related applications. The signature 
is 
called LS-LSAG, a draft of it is available at 
https://eprint.iacr.org/2024/921 

In making this announcement I'd like to ask the community to comment on 
the idea if anyone is interested.

LS-LSAG has such a design so that it can drop-in replace the well-known 
linear-size
LSAG/CLSAG signature. Also, it looks compatible with the full-chain Curve 
Trees, 
which in turn can drop-in replace both LS-LSAG and LSAG/CLSAG at the price 
of
using one more curve with specific properties.

In more detail, LS-LSAG is built up of almost the same systems of equations 
as
LSAG/CLSAG. However, it makes a call to the inner-product argument instead 
of 
doing the sequential challenges. This results in the size reduction from 
linear to logarithmic and in the compatibility with LSAG/CLSAG. 
Particularly, LS-LSAG and 
LSAG has the same key image.

Formally, LS-LSAG is a log-size linkable ring signature without trusted 
setup in a 
pairings-free prime-order group of EC points under the DL assumption. 
Unforgeability of LS-LSAG follows from the DL and collision-resistance of 
the 
standard hash-to-curve function, the draft contains a detailed proof sketch 
of this.


-- 
2: Type: text/html, Size: 2211 bytes --]

 permalink raw reply	[|nested]