I have two linkable ring signatures, each signed with the same key pair. Therefore, the signer's public key will appear in each of the rings. However, the set of other public keys appearing in each ring are different.

Is it possible to tell that the same person signed both rings, or can this only be known if each ring contains exactly the same public keys?

  • $\begingroup$ please write the question precisely in mathematical notation. what does "have pk inside it" mean? $\endgroup$
    – kodlu
    Commented Oct 26, 2022 at 17:35
  • $\begingroup$ @kodlu I dont know how to use the mathematical notation $\endgroup$ Commented Oct 26, 2022 at 18:23
  • $\begingroup$ @שחרכהן not exactly 101, however, we have a meta for $\LaTeX$/MathJax, see here $\endgroup$
    – kelalaka
    Commented Oct 26, 2022 at 19:22

1 Answer 1


Yes, it will be immediately obvious that the same person signed again.

In an EC-based linkable ring signature, if the signer's (private, public) key pair is $(a, A)$, the protocol would typically require the 'key image' to be $K=a\cdot H_p(A)$, where $H_p()$ means to hash the input to a curve point.

This means that the same key image $K$ would appear in any ring that is signed under the protocol by a particular signer, regardless of the message or other members of the ring.

You can also decide that your protocol should only provide linkability within a particular domain. This would be achieved with a protocol that required key images to be in the form $K=a\cdot H_p(A \mathbin\| \texttt{domain identifier})$.

Now, you can only tell if the same signer signed more than one ring signature for a particular domain identifier.


Not the answer you're looking for? Browse other questions tagged or ask your own question.