2
$\begingroup$

This is a follow-up to the first comment of this answer.

A message is signed with the private key of $A$, $s_A$. We know $p_B$, the public key of $B$, but not $s_B$, their private key. Is it possible, using neither secret key, to create a ring signature that has $A$ as the signer and $B$ as a non-signer?

I've quickly run through the math behind ring signatures (and understood half of it), and it looks like the operation is not possible without $s_A$ or $s_B$ —but I'm hoping cryptography will once again surprise me about that!


So, the real question appears to be: Can a message be signed by a ring, not knowing $s_A$ but being in possession of that same message signed with $s_A$?

$\endgroup$
2
$\begingroup$

This is not possible, unfortunately, at least with a standard ring signature construction.

Ring signatures are verified by checking that a ring of commitments exist, where each commitment depends on the commitment from the previous entry in the ring.

This creates a "time travel" problem for the person trying to create the ring signature. This is because when creating the first entry, they can't know in advance what entry will precede it in the ring.

Knowing the private key for one of the public keys will allow them to make up a random commitment for the first entry they create for their new ring signature. They can then later on join the ring together by forcing the last entry they create in the ring to produce the exact commitment that their first entry in the ring was expecting to see.

Unfortunately, once they "join" the ring when constructing it, they have committed to a specific list of public keys occurring in a specific order within the ring. It is therefore not possible for any outsider to add in additional possible public keys as members of the ring, unless they know the private key corresponding to one of those public keys.

Even if the existing (non-ring) signature were of exactly the right type (e.g. a Schnorr signature to be grafted into a Schnorr-based ring signature), that non-ring signature would not have been created for the correct "challenge". That challenge can only be known once all public keys to be included in the ring are known.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.