In our process of digital checks for banking - which needs to work online and offline - the receiver needs to know the chain of all generated signatures without consulting an Internet service. In this scheme the sender gets offline in order to compute his real last balance to accept or to refuse the transaction. This is to prevent an offline multi-spend of the value of the balance, and making an overdraft.

Has someone ever build a scheme to make a signature, like ECDSA, linkable?

I know that it exists for ring signatures, but I need it for simple ECC signature.

  • $\begingroup$ I've tried to make the question more readable, but the first section is still tricky to read and maybe I misunderstood things while cleaning it up. Could you have another look? Especially the second sentence is not clear to me. Why would the sender go offline - what does "gets offline" mean? $\endgroup$ – Maarten Bodewes Oct 2 '18 at 16:40
  • $\begingroup$ Conventional (EC)DSA signatures are linkable per se. Specifically, since verifiers need the public key to verify the signature, it seems logical to assume that the public key related to the private key used for issuing each signature is always available. Thus, you only need to check if two signatures are related to the same public key. Still, I leave it here as a comment instead of an answer, as I am not sure of understanding your needs completely. $\endgroup$ – Ginswich Oct 2 '18 at 19:32
  • $\begingroup$ @Ginswich yes, DSA sigs are linkable, but this term seems re-defined in this context. $\endgroup$ – Vadym Fedyukovych Oct 4 '18 at 11:36
  • $\begingroup$ Ignoring the anonymity property, that linkability is precisely what linkable ring signatures provide. Since the linkablility property of linkable ring signatures is used as reference in the question, it seems logical to be asking for a similar type of linkablility. But yes, the context not clear and the requirements may be different... $\endgroup$ – Ginswich Oct 4 '18 at 21:36