Paper 2019/654

Compact linkable ring signatures and applications

Brandon Goodell and Sarang Noether and RandomRun

Abstract

We introduce an efficient linkable ring multisignature construction, compact linkable spontaneous anonymous group (CLSAG) signatures. These admit d-dimensional keys with a specified linking coordinate but do not have signature sizes directly proportional to d. Compared to existing constructions used for signer-ambiguous confidential transactions without trusted setup, CLSAG signatures are smaller and more efficient in terms of both proving and verification time. CLSAG signatures also satisfy some rigorous security definitions: unforgeability depends upon the k-OMDL hardness assumption, linkability depends on unforgeability as well as the collision resistance of key aggregation, and signer-ambiguity depends on the DDH assumption. We demonstrate an application for CLSAG signatures for use in transacting multiple assets over ring signature-based transaction protocols.