Does the One-Time Hash-based Signature Scheme render Ring Signatures useless?

Question

On the Bitcoin community, to maintain privacy, they recommend using one-time spend addresses. CryptoNote, Monero et al. prefer Ring Signatures to maintain that privacy. There are some issues regarding double-spends in the Ring Signatures realm, so Linkable Ring Signatures + One-Time Key Images are used to avoid that. Both one-time spend addresses and CryptoNote's Ring Signatures approaches will be vulnerable to Quantum Computers in a near future, 'cause they rely on either Elliptic Curves or RSA, tho.

My point is, due the one-time nature of Hash-based Digital Signatures, we should use Merkle Trees to maintain an identity (although signing other public keys embedded in the message also works). But it's optional on that Signature Algorithm. Ring Signatures are used to maintain privacy for Signatures schemes which aren't One-Time, right? If so, are One-Time Signatures more "powerful" than other types of signature schemes?

Despite that question which I asking, One-Time Signatures are unsafe in the case of Network Splits / Hard-Forks. They freeze forever your funds on the other chain. This is a reason which I see Merkle Trees of Public Keys as needed, in the case of forks they're very helpful.

I'm writing a simple but not yet validated One-Time Hash-based Signatures library here (https://github.com/marcoonroad/hieroglyphs) - disclaimer: I'm not an information security and cryptography expert, but I try to do my best. I wonder if I need to implement the Ring Signatures algorithm to hide / protect identities, mostly due the possibility to navigate the chain/history of signatures in a network and track/guess identities by grouping discovered related public keys.

As a side note, there other approaches outside the Digital Signatures realm to implement Blockchains and sort of that. The Elixxir team (who David Chaum is a member and CEO) seems to plan to use Commitment Schemes instead of Digital Signatures, it's really interesting how hashes could be used for almost anything.

Thanks in advance!

Answer 1

I see several misunderstandings in your question. Let me provide some clarification:

1. One-time addresses don't provide privacy at satisfiable level. At first glance, it's impossible to associate some one-time address with some identity (person). But analysis of the graph of transactions could reveal relations between one-time addresses. E.g., despite the fact you use one-time addresses to receive payments, then, to spend this money (buy a car) you would need to aggregate all the addresses in a single transaction. This will reveal all you wanted to hide. Even if you try to make a confusing chain of transfers between one-time addresses, someone like Sherlock Holmes is able to unravel a tangle step-by-step.
2. One-time signatures (OTS) is not a feature, but a restriction. You cannon say that OTS "more powerful than other types of signature schemes". Vice-versa, they are limited/hard to use.
3. Ring signatures, at least in original cryptographic meaning (https://en.wikipedia.org/wiki/Ring_signature), don't provide privacy by itself. They could be used just as a building block of a complex cryptosystem like Cryptonote/Monero. But if you use the term "ring signature" as the cryptosystem provided by Monero, you're right - its goal is a privacy, including unlinking senders and receivers of transaction and impossibility to associate relations between addresses.
4. There're several definitions of privacy in payments, several levels of privacy. And several solutions, the most noted are: 1) Cryptonote/Monero, 2) Bitcoin confidential transactions, ZkSNARKs based solutions of 3) Zcash and 4) Ethereum, 5)Bulletproof-based solutions for Bitcoin. For example, Bitcoin Confidential Transactions provides only confidentiality of amounts of a transaction but doesn't hide senders and receivers. So, different systems achieve different aspects/levels of privacy. It's even so except bugs/attacks.

So, answering your question, OTS doesn't make Ring signatures useless in any sense, since:

• one-time addresses doesn't provide privacy, while solutions based on ring-signatures (such as Monero) do;
• OTS and one-time addresses are difficult/inconvenient to use, comparing to multi-time ones; e.g., in order to receive recurring payments, you constantly need to inform your payers with fresh addresses.