Security of the Concrete Scheme Sample Clauses

Security of the Concrete Scheme. Proofs of security for the above scheme are omitted in [2]. However work in later chapters relies on the security of this scheme, so we now present security results for the above ring signature scheme. Theorem 3.1 The ring signature scheme presented in Section 3.5 is perfectly anonymous assuming that H is a random oracle. Proof: Consider any ring signature σ = (s, h1, .., hn) produced by RingSign on input a message m, a list of public keys R = {X1, X2, .., Xn}, and a private key xsig which corresponds to a public key Xsig in position sig of R. Each hi for i ƒ= sig is selected randomly from Zq, so these values are distributed uniformly at random in Zq. Now hsig depends on an output from H, but since H is a random oracle, the outputs of H are distributed uniformly at random over G, and therefore hsig is uniformly distributed over Zq. Since s depends on randomly selected t, s also has uniform distribution on Zq. The hi values and s are not independent since for each valid signature the following equation holds: 1 Σ hi mod q = H(X1, .., Xn, m, gsXh1 · · · Xhn mod p) However this equation holds for all valid signatures and the inputs all have equal distributions, so any two valid signatures generated by RingSign on R and m are indistin- guishable, irrespective of which private key was used in each case. Therefore no adversary has advantage greater than 1 of winning the anonymity game of Section 3.4.2. Q We note that if we assume that the outputs of H are only computationally indistin- guishable from random, then our concrete ring signature is anonymous (but not perfectly anonymous). Theorem 3.2 The ring signature scheme presented in Section 3.5 is unforgeable, assuming the unforgeability of the Xxxxxxx signature scheme [99].

Security of the Concrete Scheme. 4.7.1 Security of the NIDV EDL proof system 4.1 The NIDV EDL proof system of Section 4.6.3 is correct. Proof: It is trivial to verify that if NIDV EDL PGen is run on input (XP , XV , xP , m, σ) where (m, σ) ∈ L(XP ) and produces a proof π = (w, r, h, d), then NIDV EDL PVerify on input (XP , XV , m, σ, π) will output accept. Q