3
$\begingroup$

I was going through some text related to designated verifier signature (DVS). I came to know that DVS can be thought of as the two party ring signature. Can we extend this concept and say that ring signature is nothing but multi user DVS.

$\endgroup$
1
  • $\begingroup$ Can you provide a link, or copy of, the text relating ring signatures to DVS? That might help to more accurately answer. $\endgroup$
    – Morrolan
    Feb 24, 2023 at 11:05

2 Answers 2

1
$\begingroup$

I don't quite see the connection you speak of. Briefly, ring-signatures preserve the anonymity of the signing party within a group of parties allowed to sign. Designated-verifier signatures preserve the privacy of the signing party by only allowing a designated verifier to verify the signature. That is they provide a less strict form of the non-repudiation property of classical signature schemes.

In more detail:

In a ring signature we have a set of parties $\{P_i\}$ - each with their keys - any one of which is able to create a signature $\sigma$ of a message $m$. Verification can then be done by anyone (a rather standard assumption when it comes to signature schemes), but there is no way to learn which of the parties issued the signature. Crucially if I receive a message and valid signature, I can show the $(\sigma, m)$ tuple to anyone else, and convince them that it is a valid signature.

In a designated-verifier signature scheme the signing party $S$ designates a single (or multiple) verifying parties $\{V_i\}$, each with their own keys. $S$ then generates a set of signatures $\{\sigma_i\}$ for a fixed message $m$. Any verifier $V_i$ is then able to verify that $\sigma_i$ constitutes a valid signature for $m$ issued by $S$, but is not able to convince anyone else of such.

Now it should certainly seem possible to combine Ring and designated-verifier signatures, and a cursory search did indeed produce papers doing this, such as this one by Behrouz et al. With those you have the combined properties that:

  • Given a signature you cannot learn which of the potential signing parties issued it
  • Given a signature you cannot convince anyone else that it actually is a valid signature issued by one of the signing parties

Another connection is that ring signatures can seemingly serve as building blocks for designated-verifier signatures, such as in this paper by Man Ho Au and Willy Susilo.

$\endgroup$
3
  • 1
    $\begingroup$ "I don't quite see the connection you speak of." <- It's simple - if the designated verifier has public key P, and the signer has public key Q, then the DVS is a simple ring signature that can be publicly verified as being signed by either P or Q. Publicly, that means Q can plausibly deny having made the signature. However, P knows that P did not sign, and so P knows it must have been signed by Q. P cannot prove to the world that it did not sign, because a ring signature is perfectly hiding. Therefore, only P knows for sure that Q signed (unless, of course, P's private key had leaked) $\endgroup$
    – knaccc
    Feb 24, 2023 at 20:19
  • $\begingroup$ @knaccc ah, of course, there is that equivalence in the two-party case - thanks! At first glance a naïve multi-DVS construction using a ring signature would seem limiting though, in that a verifier observing a valid signature would have no way of knowing if it had been issued by the signer, or is a simulation by another verifier. I suppose it would impose limitations on how signatures are assumed to propagate. $\endgroup$
    – Morrolan
    Feb 24, 2023 at 21:36
  • $\begingroup$ @Morrrolan I've only seen the 2-party case before - I'm not sure what the scheme is for having more than one designated verifier, where the designated verifiers do not trust each other. I'd be interested in how such a scheme would be implemented - does the paper you linked to have a solution for that situation? $\endgroup$
    – knaccc
    Feb 24, 2023 at 22:09
1
$\begingroup$

In the question what do you mean by “Multi User” Designated Verifier Signature is not clear. Do you have a definition in mind?

In the case that by “Multi User Designated Verifier Signature” you mean having multiple signers and one designated verifier (DV), then indeed the generalization that you mentioned is correct and it also adds anonymity to the signers. The reason is that if you consider a ring signature scheme in which one of the signers is a designated verifier, then every signer can sign anonymously and only the designated verifier can verify the validity of the signatures, since it can “simulate” signatures, by using the same signing algorithm. In this scenario the signers are anonymous to the designated verifier, which is different from DVS signatures.

In case that you consider Linkable Ring Signatures (LRS) then the generalization that you have in mind doesn’t hold, because the linking tag plays the role of pseudoidentity which links signatures of the same signer. And since the DV is also a member of the ring, the signatures of the DV are distinguishable from the signers’ signatures.

The combination of DVS and LRS is achieved by Behrouz et al. in DVLRS where the signers can sign messages anonymously, the messages of each signer are linked using the linking tag and the DV can simulate signatures with any linking tag. This was later improved in Balla et al. in UDVLRS, where they achieved unconditional anonymity.

These two schemes indeed provide a kind of MultiDVS functionality (assuming the above definition of MultiDVS). It is not clear, however, if the opposite is also true, i.e., could a MultiDVS scheme provide the ring signatures functionality (probably not, as anonymity towards the DV does not typically hold in a MultiDVS scheme).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.