Return to Question

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-voting, E-cash and Attestation, but I'm not sure about two things:

1. Does it actually require a group manager or did I miss something? I need a solution where the signer sets-up the signature with no need for a trusted party.

2. The paper's Appendix A doesn't include a setup for the SLRS, and I don't trust myself with an implementation, I prefer something that went through some public review. I'm looking specifically for EC, not RSA.

I'd appreciate any help in either clarifying these issues about the above paper or alternatively suggesting some reviewed source for another implementation.

EDIT - DETAILED DESCRIPTION OF THE USE CASE:

A system manages resources for many (>1M) users. Every user has exactly the same quota of resources as all other users, lets say $n$ resources (~300K resources per user). When a user allocates a resources, the user has to prove, among other, that the user is within their quota, but without revealing the user's identity (the resources cannot be traced to their owning users, not even by the system). The public keys of all users are known in the system and to all users, but no other information is revealed about the user. The solution is that every request to allocate a resource will be signed by the requesting user in a linkable ring signature that mixes-in other random users, where the message is $i$ such that $0<i<n$. When a user requests the system to allocate a resource the system can verify that the request is valid:

• With the ring signature the system can verify that the request was issued by some valid user.
• The message $i$ will allow the system to verify that the request is within the quota range (i.e. less than $n$).
• The linkability will reveal if a user tries to double spend the same $i$ value for two resources.

The above bodes very well with "classic" ring signatures, except that the cost of each signature in terms of space is significant, particularly if we want good anonymity, hence a ring with many users. Furthermore, I want to start off with an implementation that will smoothly translate later in the future to a quantum resistant public key system, therefore making the space consideration even more cardinal.

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-voting, E-cash and Attestation, but I'm not sure about two things:

1. Does it actually require a group manager or did I miss something? I need a solution where the signer sets-up the signature with no need for a trusted party.

2. The paper's Appendix A doesn't include a setup for the SLRS, and I don't trust myself with an implementation, I prefer something that went through some public review. I'm looking specifically for EC, not RSA.

I'd appreciate any help in either clarifying these issues about the above paper or alternatively suggesting some reviewed source for another implementation.

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-voting, E-cash and Attestation, but I'm not sure about two things:

1. Does it actually require a group manager or did I miss something? I need a solution where the signer sets-up the signature with no need for a trusted party.

2. The paper's Appendix A doesn't include a setup for the SLRS, and I don't trust myself with an implementation, I prefer something that went through some public review. I'm looking specifically for EC, not RSA.

I'd appreciate any help in either clarifying these issues about the above paper or alternatively suggesting some reviewed source for another implementation.

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-voting, E-cash and Attestation, but I'm not sure about two things:

1. Does it actually require a group manager or did I miss something? I need a solution where the signer sets-up the signature with no need for a trusted party.

2. The paper's Appendix A doesn't include a setup for the SLRS, and I don't trust myself with an implementation, I prefer something that went through some public review. I'm looking specifically for EC, not RSA.

I'd appreciate any help in either clarifying these issues about the above paper or alternatively suggesting some reviewed source for another implementation.

EDIT - DETAILED DESCRIPTION OF THE USE CASE:

A system manages resources for many (>1M) users. Every user has exactly the same quota of resources as all other users, lets say $n$ resources (~300K resources per user). When a user allocates a resources, the user has to prove, among other, that the user is within their quota, but without revealing the user's identity (the resources cannot be traced to their owning users, not even by the system). The public keys of all users are known in the system and to all users, but no other information is revealed about the user. The solution is that every request to allocate a resource will be signed by the requesting user in a linkable ring signature that mixes-in other random users, where the message is $i$ such that $0<i<n$. When a user requests the system to allocate a resource the system can verify that the request is valid:

• With the ring signature the system can verify that the request was issued by some valid user.
• The message $i$ will allow the system to verify that the request is within the quota range (i.e. less than $n$).
• The linkability will reveal if a user tries to double spend the same $i$ value for two resources.

The above bodes very well with "classic" ring signatures, except that the cost of each signature in terms of space is significant, particularly if we want good anonymity, hence a ring with many users. Furthermore, I want to start off with an implementation that will smoothly translate later in the future to a quantum resistant public key system, therefore making the space consideration even more cardinal.

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-voting, E-cash and Attestation, but I'm not sure about two things:

a. Does it actually require a group manager or did I miss something? I need a solution where the signer sets-up the signature with no need for a trusted party.

b. The paper's Appendix A doesn't include a setup for the SLRS, and I don't trust myself with an implementation, I prefer something that went through some public review. I'm looking specifically for EC, not RSA.

I'd appreciate any help in either clarifying these issues about the above paper or alternatively suggesting some reviewed source for another implementation.

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-voting, E-cash and Attestation, but I'm not sure about two things:

1. Does it actually require a group manager or did I miss something? I need a solution where the signer sets-up the signature with no need for a trusted party.

2. The paper's Appendix A doesn't include a setup for the SLRS, and I don't trust myself with an implementation, I prefer something that went through some public review. I'm looking specifically for EC, not RSA.

I'd appreciate any help in either clarifying these issues about the above paper or alternatively suggesting some reviewed source for another implementation.