# Regarding application of ring signatures

Another application, also described in the original paper, is for deniable signatures. Here the sender and the recipient of a message form a group for the ring signature, then the signature is valid to the recipient, but anyone else will be unsure whether the recipient or the sender was the actual signer. Thus, such a signature is convincing, but cannot be transferred beyond its intended recipient.

Can someone please explain the practical application of this concept? I can not make any sense of it? In what scenario it could be useful?

To understand the application, it is useful to contrast this with the use of regular signatures.

Imagine Alice sends a message $$m$$ to Bob together with a signature $$\sigma$$ of $$m$$ under her own public key $$\mathsf{pk}_A$$. A regular signature scheme now has two important properties:

1. It's publicly verifiable, i.e., anyone can verify that the $$\sigma$$ is a valid signature of $$m$$ under $$\mathsf{pk}_A$$.
2. It's unforgeable, i.e., only someone in possession of the corresponding signing key $$\mathsf{sk}_A$$ could have produced a valid $$\sigma$$.

The combination of the two, together with the assumption that Alice has a strong incentive to keep her signing key secret¹, leads to a property called non-repudiation. This means that the recipient can prove to a third party that the Alice really did send $$m$$ simply by producing $$(m,\sigma)$$.

Now, say $$m$$ is something legally or morally incriminating. Then, among other things, this opens Alice up to blackmail. Bob can threaten to release $$(m,\sigma)$$ which would prove to the public or some third party that Alice said $$m$$.

Alice understandably would like to prevent that. So this is where ring signatures come in. If we replace the signature scheme above with a ring signature scheme, then Alice would be sending $$m$$ together with a ring signature $$\sigma$$ of $$m$$ under the set² of her own public key and Bob's public key $$\{\mathsf{pk}_A,\mathsf{pk}_B\}$$.

A ring signature is still publicly verifiable, however the unforgeability now only guarantees that the signer must have known one of $$\mathsf{pk}_A$$ or $$\mathsf{pk}_B$$. This means that Bob can no longer prove to a third party that Alice sent $$m$$, since Bob himself could have simply computed $$\sigma$$ himself.

He can of course still try to blackmail Alice, but he can no longer rely on the security of the signature scheme to do so.

¹ This is where this argument could break down in practice.

² Sometimes also called ring, even though the name ring signature actually comes from the way the first such scheme computed it's signatures.

• Can it be extended to $n$ parties? – kelalaka Jan 14 at 10:22
• @kelalaka Most Ring signature schemes I'm aware of work for sets of arbitrary size. However, the computational cost will usually scale with the number of keys, making very large sets impractical. – Maeher Jan 14 at 10:40
• Though of course the point here is, that with the protocol for two parties Bob, will have confidence that Alice signed the message, since he himself did not. However if you use a set of three keys, i.e. two recipients, say Bob and Carol, Bob will be unable to tell whether Alice or Carol signed the message. – Maeher Jan 14 at 10:43
• Of course, Bob must agree to use such a scheme, plausible deniability is better, in this case. In some countries, the judicial system doesn't care and will jail both of them :) – kelalaka Jan 14 at 10:45
• "Bob must agree to use such a scheme" Not necessarily. E.g. the RSA version of the original ring signature scheme specifically makes it possible to use other people's regular RSA public keys without their consent or cooperation. – Maeher Jan 14 at 10:58