I spent all day trying to figure ring signature schemes out but apparently I wasted time.
I read the original ring signature paper (Rivest's How to leak a secret).
I'm having numerous problems. Let's just say that a nice and simple example would make everything clear.

I'm talking about something like this example for RSA.

The problem is that no one provides this. I read 12 papers and… nothing. I would like to have an example with small numbers. Is this even possible? Could you provide such a “toy” example?

If I can be more specific: my problem with the original paper is step 4:

solve for…

I have no idea how to solve an equation where on the left side I have the encryption (known key) of an unknown value and a value on the right side.


1 Answer 1


Here is an explanation of step 4.
Look at Figure 2 of the paper.
Lets say $y_s$ is $y_3$ at 6 o'clock.
Start at 12 o'clock and calculate going clockwise until you arrive at 6 o'clock. Denote the result by $r$.
Start again at 12 o'clock and calculate going counter-clockwise until you arrive at 6 o'clock. Denote the result by $l$.
Now $l =r \oplus y_s$, which gives the solution $y_s =r \oplus l$.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.