On the Bitcoin community, to maintain privacy, they recommend using one-time spend addresses. CryptoNote, Monero et al. prefer Ring Signatures to maintain that privacy. There are some issues regarding double-spends in the Ring Signatures realm, so Linkable Ring Signatures + One-Time Key Images are used to avoid that. Both one-time spend addresses and CryptoNote's Ring Signatures approaches will be vulnerable to Quantum Computers in a near future, 'cause they rely on either Elliptic Curves or RSA, tho.

My point is, due the one-time nature of Hash-based Digital Signatures, we should use Merkle Trees to maintain an identity (although signing other public keys embedded in the message also works). But it's optional on that Signature Algorithm. Ring Signatures are used to maintain privacy for Signatures schemes which aren't One-Time, right? If so, are One-Time Signatures more "powerful" than other types of signature schemes?

Despite that question which I asking, One-Time Signatures are unsafe in the case of Network Splits / Hard-Forks. They freeze forever your funds on the other chain. This is a reason which I see Merkle Trees of Public Keys as needed, in the case of forks they're very helpful.

I'm writing a simple but not yet validated One-Time Hash-based Signatures library here (https://github.com/marcoonroad/hieroglyphs) - disclaimer: I'm not an information security and cryptography expert, but I try to do my best. I wonder if I need to implement the Ring Signatures algorithm to hide / protect identities, mostly due the possibility to navigate the chain/history of signatures in a network and track/guess identities by grouping discovered related public keys.

As a side note, there other approaches outside the Digital Signatures realm to implement Blockchains and sort of that. The Elixxir team (who David Chaum is a member and CEO) seems to plan to use Commitment Schemes instead of Digital Signatures, it's really interesting how hashes could be used for almost anything.

Thanks in advance!

  • 2
    $\begingroup$ With a one time signature you can still link the incoming with the outgoing transaction since they refer to the same public key. Ring signatures (with a large enough ring etc.) make linking the outgoing transaction to the public key (and by extension to the incoming transaction) impossible. (At least in theory, protocol and implementation issues can of course break all of this.) $\endgroup$
    – Maeher
    Commented Nov 25, 2018 at 8:42
  • $\begingroup$ Thanks. So Ring Signatures are used to unlink the transaction sender from the transaction receiver, while still making the transaction valid and verifiable, right? In the case of going a step further and concealing the transaction amount, should I resort to other tools (e.g, Zero-Knowledge Proofs)? $\endgroup$ Commented Nov 25, 2018 at 12:58
  • 1
    $\begingroup$ I'm not sure concealing transaction amounts is desirable/feasible with cryptocurrencies, but yes, using zkp is usually a nice way to guarantee whichever anonymity feature you like - see e.g. zcash. Also, Maeher's comment looks like it could be turned into an answer. $\endgroup$ Commented Nov 25, 2018 at 15:22

1 Answer 1


I see several misunderstandings in your question. Let me provide some clarification:

  1. One-time addresses don't provide privacy at satisfiable level. At first glance, it's impossible to associate some one-time address with some identity (person). But analysis of the graph of transactions could reveal relations between one-time addresses. E.g., despite the fact you use one-time addresses to receive payments, then, to spend this money (buy a car) you would need to aggregate all the addresses in a single transaction. This will reveal all you wanted to hide. Even if you try to make a confusing chain of transfers between one-time addresses, someone like Sherlock Holmes is able to unravel a tangle step-by-step.
  2. One-time signatures (OTS) is not a feature, but a restriction. You cannon say that OTS "more powerful than other types of signature schemes". Vice-versa, they are limited/hard to use.
  3. Ring signatures, at least in original cryptographic meaning (https://en.wikipedia.org/wiki/Ring_signature), don't provide privacy by itself. They could be used just as a building block of a complex cryptosystem like Cryptonote/Monero. But if you use the term "ring signature" as the cryptosystem provided by Monero, you're right - its goal is a privacy, including unlinking senders and receivers of transaction and impossibility to associate relations between addresses.
  4. There're several definitions of privacy in payments, several levels of privacy. And several solutions, the most noted are: 1) Cryptonote/Monero, 2) Bitcoin confidential transactions, ZkSNARKs based solutions of 3) Zcash and 4) Ethereum, 5)Bulletproof-based solutions for Bitcoin. For example, Bitcoin Confidential Transactions provides only confidentiality of amounts of a transaction but doesn't hide senders and receivers. So, different systems achieve different aspects/levels of privacy. It's even so except bugs/attacks.

So, answering your question, OTS doesn't make Ring signatures useless in any sense, since:

  • one-time addresses doesn't provide privacy, while solutions based on ring-signatures (such as Monero) do;
  • OTS and one-time addresses are difficult/inconvenient to use, comparing to multi-time ones; e.g., in order to receive recurring payments, you constantly need to inform your payers with fresh addresses.
  • $\begingroup$ Just a follow-up for your answer, actually some folks formalized a group signature scheme based solely on Merkle Trees of One-time Signatures and Cryptographic Permutations. It's the most efficient quantum-robust group signature scheme without any decrease on security upper-bounds. The paper is called G-Merkle: A Hash-Based Group Signature Scheme From Standard Assumptions, and it's pretty worth the reading. Now I'm looking forward into (possible?) Hash-based Ring Signatures Constructions using underlying Multi-Party Computations ceremonies. $\endgroup$ Commented Nov 12, 2019 at 18:42
  • $\begingroup$ In simpler words, OTS + Merkle Tree + PRP enable group public key for verification of signatures made by anonymous but traceable secret keys. $\endgroup$ Commented Nov 12, 2019 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.