In our process of digital checks for banking - which needs to work online and offline - the receiver needs to know the chain of all generated signatures without consulting an Internet service. In this scheme the sender gets offline in order to compute his real last balance to accept or to refuse the transaction. This is to prevent an offline multi-spend of the value of the balance, and making an overdraft.

Has someone ever build a scheme to make a signature, like ECDSA, linkable?

I know that it exists for ring signatures, but I need it for simple ECC signature.


closed as unclear what you're asking by Squeamish Ossifrage, Maeher, Maarten Bodewes Mar 12 at 10:19

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ I've tried to make the question more readable, but the first section is still tricky to read and maybe I misunderstood things while cleaning it up. Could you have another look? Especially the second sentence is not clear to me. Why would the sender go offline - what does "gets offline" mean? $\endgroup$ – Maarten Bodewes Oct 2 '18 at 16:40
  • $\begingroup$ Conventional (EC)DSA signatures are linkable per se. Specifically, since verifiers need the public key to verify the signature, it seems logical to assume that the public key related to the private key used for issuing each signature is always available. Thus, you only need to check if two signatures are related to the same public key. Still, I leave it here as a comment instead of an answer, as I am not sure of understanding your needs completely. $\endgroup$ – Ginswich Oct 2 '18 at 19:32
  • $\begingroup$ @Ginswich yes, DSA sigs are linkable, but this term seems re-defined in this context. $\endgroup$ – Vadym Fedyukovych Oct 4 '18 at 11:36
  • $\begingroup$ Ignoring the anonymity property, that linkability is precisely what linkable ring signatures provide. Since the linkablility property of linkable ring signatures is used as reference in the question, it seems logical to be asking for a similar type of linkablility. But yes, the context not clear and the requirements may be different... $\endgroup$ – Ginswich Oct 4 '18 at 21:36