Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I spent all day trying to figure ring signature schemes out but apparently I wasted time.
I read the original ring signature paper (Rivest's How to leak a secret).
I'm having numerous problems. Let's just say that a nice and simple example would make everything clear.

I'm talking about something like this example for RSA.

The problem is that no one provides this. I read 12 papers and… nothing. I would like to have an example with small numbers. Is this even possible? Could you provide such a “toy” example?

If I can be more specific: my problem with the original paper is step 4:

solve for…

I have no idea how to solve an equation where on the left side I have the encryption (known key) of an unknown value and a value on the right side.

share|improve this question

1 Answer 1

Here is an explanation of step 4.
Look at Figure 2 of the paper.
Lets say $y_s$ is $y_3$ at 6 o'clock.
Start at 12 o'clock and calculate going clockwise until you arrive at 6 o'clock. Denote the result by $r$.
Start again at 12 o'clock and calculate going counter-clockwise until you arrive at 6 o'clock. Denote the result by $l$.
Now $l =r \oplus y_s$, which gives the solution $y_s =r \oplus l$.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.