# O(1) EC Linkable Ring Signature Without Group Manager

I'm looking for a practical example for creating an EC Ring Signature, very much at the level of detail as found in the CryptoNote Whitepaper but with O(1). I saw Short Linkable Ring Signatures for E-voting, E-cash and Attestation, but I'm not sure about two things:

1. Does it actually require a group manager or did I miss something? I need a solution where the signer sets-up the signature with no need for a trusted party.

2. The paper's Appendix A doesn't include a setup for the SLRS, and I don't trust myself with an implementation, I prefer something that went through some public review. I'm looking specifically for EC, not RSA.

I'd appreciate any help in either clarifying these issues about the above paper or alternatively suggesting some reviewed source for another implementation.

• What's your view on using bilinear pairings? These are in the CRS so need some 'trusted party' to generate parameters and then through away the material that would allow a malicious party to forge proofs, but yield constant size ring signatures? If so then you have at least this, if you're okay with ROM (necessary due to an impossibility result) as well as work on snarks, etc. – bekah May 7 '17 at 11:10
• @bekah thanks, I'll first go over the article you linked – stromboli May 7 '17 at 11:37
• @bekah Yes the article is very interesting. To further discuss I edited the question with a detailed description of my use case, and opened a chat room which, I hope, is more convenient then the comment system. The chat is at chat.stackexchange.com/rooms/58358/…, I hope to discuss with you over there. – stromboli May 7 '17 at 19:03

The other option at this point in time is using a signature scheme in which the signature grows logarithmically with the size of the group over which it is signed -- even with constant size ring signatures, the verification may be O(n) in which case a group of 1 million would be infeasible. If log(n) sized signatures are okay, then something like this could be used, which doesn't need a trusted setup/group manager (the protocol is secure even if the CRS is generated maliciously).