Strongly Unforgeable Ring Signature Scheme from Lattices in the Standard Model

Abstract

In a ring signature scheme, a user selects an arbitrary ring to be able to sign a message on behalf of the ring without revealing the signer’s identity. Whistle-blowers especially find this useful. To date, various ring signature schemes have been proposed, all considered to be secure as existentially unforgeable with respect to insider corruption; that is, an adversary who chooses ring-message pairs for which he requests signatures, corrupts honest users, and obtains their signing keys can not produce forgeries for new ring-message pairs. Lattice-based ring signature schemes offer lower computational overhead and security from quantum attacks. In this paper, we offer a lattice-based scheme. We begin by showing that the existing ring signature schemes are not sufficiently secure, because existential unforgeability still permits a signer to potentially produce a new signature on previously signed messages. Furthermore, we show that existing ring signature schemes from lattices are not even existentially unforgeable with respect to insider corruption. We then improve previous schemes by applying, for the first time, the concept of strong unforgeability with respect to insider corruption to a ring signature scheme in lattices. This offers more security than any previous ring signature scheme: adversaries cannot produce new signatures for any ring-message pair, including previously signed ring-message pairs.

1. Introduction

Ring signatures were first introduced by Rivest et al. in 2001 in order to provide anonymity to signers [1]. The classic case of a signer who wishes to remain anonymous would be a whistle-blower, who wants to identify a problem without exposing himself as the source. Anyone seeking to expose wrongdoing or leak a secret would want to remain anonymous. Prior to the advent of the ring signature, group signatures were the best way to achieve this; however, group signatures have a group manager who can identify the signer and so complete anonymity is not possible. By contrast, a signer can select a ring for the signature, and no one can trace which member of the ring is the actual signer.

In 2004, Dodis et al. proposed a ring signature scheme in the random oracle model using the Fiat-Shamir transformation [2, 3]. In 2006, Bender et al. proposed new definitions of anonymity and existential unforgeability and first proposed ring signature schemes in the standard model [4]. In 2007, Shacham and Waters proposed efficient ring signature schemes in the standard model based on bilinear groups [5]. In addition to these, various ring signature schemes have been studied [6–11].

All of these early ring signatures used nonlattice based approaches. These cryptographic systems were based on integer factorization and discrete logarithmic problems based on average case problems. These nonlattice based approaches did not offer security against quantum computing attacks [12]. These early ring signatures also entailed more computational overhead because they require exponentiation, although they did offer existential unforgeability with respect to insider corruption and anonymity against full key exposure. Lattice-based cryptographic systems held promise in reducing computational overhead since they only require linear operations on matrices [13–18].

In order to try to reduce computational overhead and make ring signatures secure against quantum computing attacks, Brakerski and Kalai introduced the first lattice-based system for ring signatures in 2010, using ring trapdoor functions [19]. The lattice-based approach is based on worst-case problems, which offers the sought for security against quantum computing attacks; however, Brakerski-Kalai’s ring signature scheme did not satisfy existential unforgeability with respect to insider corruption. In 2010, Cayrel et al. proposed a threshold ring signature scheme over ideal lattices (ideal lattices are described as ideals of certain polynomial rings; that is, ideal lattices are a special case of lattices) in the random oracle model; however, Cayrel et al.’s threshold ring signature scheme did not satisfy existential unforgeability with respect to insider corruption [20]. In 2011, Wang and Sun proposed two ring signature schemes, one in the random oracle model and one in the standard model, using lattice-based delegation techniques [21]. They claimed their ring signature schemes offered the existential unforgeability that had been lacking in Brakerski-Kalia’s ring signature scheme, but they in fact did not (see Section 3). In 2013, Aguilar Melchor et al. proposed a new ring signature scheme over ideal lattices; however, Aguilar Melchor et al.’s ring signature scheme is only existentially unforgeable with respect to insider corruption in the random oracle model [22]. Table 1 shows the comparison of ring signature schemes.

Table 1 

Comparison of ring signature schemes.

In addition to showing that Wang and Sun’s ring signature scheme does not offer existential unforgeability, we introduce a novel lattice-based ring signature scheme that reduces the computational overhead inherent in nonlattice based schemes while successfully offering existential unforgeability with respect to insider corruption. Indeed, we are the first to suggest strong unforgeability for ring signatures, which is stronger than existential unforgeability.

Before the work on strong unforgeability [23–25], if a signature scheme is existentially unforgeable, it has been considered to be secure. In other words, an adversary who chooses messages for which she requests signatures should not be able to produce signatures for new messages. However, in an existentially unforgeable signature scheme, the adversary could potentially produce a new signature on one or more of the previously signed messages. By contrast, if a signature scheme is strongly unforgeable, the adversary cannot ever produce a new signature for any message, including previously signed messages. Strongly unforgeable signature schemes can be especially useful in constructing chosen ciphertext secure encryption schemes and group signature schemes.

Similarly, existentially unforgeable ring signature schemes have been considered to be secure. In other words, an adversary who chooses ring-message pairs for which she requests signatures is not able to produce signatures for new ring-message pairs. In this paper, we are the first to design a securer ring signature scheme, implementing the concept of strong unforgeability and ensuring that the adversary cannot ever produce a new signature for any ring-message pair, including previously signed ring-message pairs. That is, suppose an adversary chooses some ring-message pairs, requests their signatures, and obtains a tuple of ring, message, and signature (𝖱,𝗆,𝜎) along with other tuples of rings, messages, and signatures. If the adversary cannot ever produce a new signature 𝜎^′ for (𝖱,𝗆), or any signatures for any of the ring-message pairs, we say that the ring signature scheme is strongly unforgeable.

We accomplish this strong unforgeability using lattices in the standard model. Our ring signature scheme uses new trapdoor algorithms for lattices proposed by Micciancio and Peikert in 2012 [18]. They are much simpler, tighter, faster, and smaller than the existing algorithms. More concretely, their trapdoor algorithms do not run any expensive operation such as matrix inverse computations; their new trapdoor algorithms improved the quality 𝑠 from 𝑠≈20𝑛lg𝑞 to 𝑠≈1.6𝑛lg𝑞 for some small 𝑞=poly(𝑛) and a security parameter 𝑛; using their new trapdoor algorithms reduces the lattice dimension 𝑚 from 𝑚>5𝑛lg𝑞 to 𝑚≈2𝑛lg𝑞. Therefore, our ring signature scheme is also much simpler, tighter, faster, and smaller than the existing lattice-based ring signature schemes. In fact, the lattice dimension of our ring signature scheme is 𝑚≈2(1+𝑙)𝑛lg𝑞 for the number of ring users instead of 𝑚>5(1+𝑙)𝑛lg𝑞. Our ring signature scheme not only maintains anonymity against full key exposure but also offers strong unforgeability with respect to insider corruption in the standard model.

1.1. Our Contribution

Our work makes three significant contributions. First, we show that all of Wang-Sun’s ring signature schemes are insecure with respect to existential unforgeability. Second, we suggest the concept of strong unforgeability, which is a stronger notion than existential unforgeability, for ring signatures. None of the existing lattice-based ring signature schemes satisfy the conditions of strong unforgeability. Third, based on our new model, we construct a new ring signature scheme from lattices that is both anonymous against full key exposure and strongly unforgeable with respect to insider corruption in the standard model.

1.2. Our Approach

As with most existing ring signature schemes for lattices, we design our ring signature scheme using trapdoor delegation techniques for lattices, which afford anonymity against full key exposure. In addition, in our ring signature scheme, like most of the existing signature schemes from lattices, the “hash-and-sign” paradigm is used. Wang and Sun also used the “hash-and-sign” paradigm, but they did so in a way that failed to ensure the security of their schemes. Both of Wang-Sun’s ring signature schemes only hash the message, so that anyone can add a ring member and add another message, making it possible for anyone to produce a forgery. We address this problem in our ring signature scheme by hashing the message along with the ring and a random number. Because the ring is included in the hash value, an adversary cannot change the ring. We have drawn on the concept of strong unforgeability in signature schemes from lattices to extend strong unforgeability to a ring signature scheme. One of the features of the existing strongly unforgeable signature schemes is that the signature algorithm samples a signature in a coset of the lattice (not in the original lattice). Our ring signature scheme uses this signature algorithm. This is the defining feature that makes our ring signature scheme strongly unforgeable with respect to insider corruption in the standard model.

1.3. Organization of the Paper

The remainder of our paper is organized as follows. In Section 2, we describe related work and preliminaries. We will describe early ring signature schemes, existing lattice-based schemes, and chameleon hash functions. In Section 3, we analyze Wang-Sun’s ring signature schemes and show that they do not provide existential unforgeability as they purport to do. In Section 4, we address our security model for ring signatures, describing anonymity against full key exposure and our new concept of strong unforgeability. In Section 5, we construct our ring signature scheme and demonstrate that it is secure in both of these respects. In Section 6, we will make our concluding comments.

2. Preliminaries

The security parameter in this paper is 𝑛. We denote the real numbers and integers by ℝ and ℤ, respectively. For a positive integer 𝑘, we let [1,𝑘]={1,…,𝑘}. We denote vectors by lower-case bold letters (e.g., 𝐯) and assume that 𝐯 is a column vector. ‖𝐯‖ means the Euclidean norm of  𝐯. We denote matrices by upper-case bold letters (e.g., 𝐀) and represent the 𝑛-by-𝑛 identity matrix as 𝐈_𝑛. We use standard big-𝑂 notation, and, if 𝑓(𝑘)=𝑂(𝑔(𝑘)⋅log^𝑐𝑘) for any fixed integer 𝑐, then we denote 𝑓(𝑘)=𝑂(𝑔(𝑘)). 𝑞=poly(𝑘) means 𝑞∈Θ(𝑘^𝑐) for some positive integer 𝑐. If |𝑓(𝑘)|<1/𝑘^𝑐 for sufficiently large 𝑘 and any 𝑐>0, then a function 𝑓∶ℝ→ℝ is negligible. We denote any negligible function by negl(𝑛). An overwhelming probability is greater than or equal to 1−𝑓(𝑘), where 𝑓(𝑘) is a negligible function. When 𝐯 is randomly chosen from a set 𝖱, we use the notation 𝐯←𝖱. The statistical distance between two distributions 𝑋 and 𝑌 over a countable domain 𝒟 is denoted by Δ(𝑋,𝑌)=1/2⋅∑_𝑖∈𝒟|𝑋(𝑖)−𝑌(𝑖)|.

2.1. Lattices

In this paper, we consider 𝑚-dimensional integer lattices. An 𝑚-dimensional integer lattice Λ is defined as follows: Λ=𝐁𝐳=^𝑚_𝑖=1𝑧_𝑖𝐛_𝑖∶𝐳∈ℤ^𝑚⊆ℤ^𝑚, (1) where 𝐁={𝐛₁,…,𝐛_𝑚}⊂ℤ^𝑚 is a basis. The dual lattice Λ^∗ of Λ is defined as follows: Λ^∗=𝐱∈ℤ^𝑚∶^∀𝐲∈Λ,⟨𝐱,𝐲⟩∈ℤ⊆ℤ^𝑚. (2)

We use a 𝑞-ary lattice, which is one of 𝑚-dimensional integer lattices. For a parity-check matrix 𝐀∈ℤ_𝑞^𝑛×𝑚, a 𝑞-ary lattice Λ^⟂(𝐀) is defined as follows: Λ^⟂(𝐀)=𝐳∈ℤ^𝑚∶𝐀𝐳=𝟎mod𝑞⊆ℤ^𝑚, (3) where 𝑛 and 𝑞 are positive integers and 𝟎∈ℤ^𝑛_𝑞 is a zero vector. Next, we define a coset of Λ^⟂(𝐀). For a syndrome 𝐮∈ℤ^𝑛_𝑞, a coset Λ^⟂_𝐮(𝐀) of Λ^⟂(𝐀) is defined as follows: Λ^⟂_𝐮(𝐀)=𝐳∈ℤ^𝑚∶𝐀𝐳=𝐮mod𝑞=Λ^⟂(𝐀)+𝐳, (4) where 𝐀𝐳=𝐮(mod𝑞) for 𝐳∈ℤ^𝑚.

The SIS (short integer solution) problem in lattices is defined as follows.

Definition 1. Given a uniformly random matrix 𝐀∈ℤ_𝑞^𝑛×𝑚 for any desired 𝑚=poly(𝑛), the SIS_𝑞,𝛽 problem is to find a nonzero vector 𝐯∈ℤ^𝑚 such that 𝐀𝐯=𝟎(mod𝑞) and ‖𝐯‖≤𝛽.

The hardness of the SIS problem follows from [13, 26, 27]. For 𝑞≥𝛽⋅√𝑛⋅𝜔(log𝑛), the SIS problem in the average case is known to be as hard as approximating the SIVP (shortest independent vectors problem) under quantum reductions to within 𝑂(𝛽⋅√𝑛) factors in the worst case.

We now review Gaussian distributions over lattices. First, we recall the Gaussian function as follows: 𝜌_{ℋ,𝑠,𝐜}(𝐱)−𝜋‖‖=exp𝐱−𝐜²𝑠², (5) where ℋ is a 𝑑-dimensional subspace of ℝ^𝑚, 𝑚≥1, 𝑠>0, 𝐱∈ℋ, and the Gaussian function centered at 𝐜∈ℋ. The continuous distribution with density function is defined as follows: 𝒟_{ℋ,𝑠,𝐜}(𝐱)=𝜌_{ℋ,𝑠,𝐜}(𝐱)𝑠^𝑑,where𝑠^𝑑=_𝐱∈ℋ𝜌_𝑠,𝐜(𝐱)𝑑𝐱. (6)

Then, the discrete distribution with density function over a lattice Λ is defined as follows: 𝒟_Λ,𝑠,𝐜(𝐱)=𝒟_{ℋ,𝑠,𝐜}(𝐱)𝒟_{ℋ,𝑠,𝐜}(Λ), (7) where Λ⊂ℋ spans ℋ and 𝐱∈Λ. Next, we define the Gaussian parameter which is a lattice quantity.

Definition 2 (see [27, 28]). For an 𝑚-dimensional integer lattice Λ and a real number 𝜖>0, the Gaussian parameter 𝜂_𝜖(Λ) is the smallest 𝑠 such that 𝜌_ℋ,1/𝑠(Λ^∗⧵{𝟎})≤𝜖, where 𝜌_ℋ,1/𝑠(⋅) is the Gaussian function (centered at 𝟎) for 1/𝑠,  Λ⊂ℋ spans ℋ, and Λ^∗ is the dual lattice of Λ.

In this paper, we also use the following fact.

Lemma 3 (see [18, 29]). For 𝜖∈(0,1), 𝑠≥𝜂_𝜖(Λ), and 𝐜∈span(Λ): Pr𝒟_Λ,𝑠,𝐜≥𝑠⋅√𝑚≤2^−𝑚⋅1+𝜖,1−𝜖 (8) where Λ⊂ℝ^𝑚 is a lattice.

2.2. Basic Algorithms for Lattices

The trapdoor generation algorithm 𝖦𝖾𝗇𝖳𝗋𝖺𝗉(𝐀,𝐇) proposed by Micciancio and Peikert in 2012 [18] has the following properties.

Lemma 4 (see [18]). There exists a probabilistic polynomial time algorithm 𝖦𝖾𝗇𝖳𝗋𝖺𝗉(𝐀,𝐇) that takes a parity-check matrix 𝐀∈ℤ^𝑛×𝑚_𝑞, an invertible matrix 𝐇∈ℤ_𝑞^𝑛×𝑛, 𝑛≥1, 𝑚=𝑂(𝑛log𝑞), 𝑞≥2, and outputs a parity-check matrix 𝐀∈ℤ_𝑞^𝑛×𝑚 with its trapdoor 𝐓 such that(i)𝖦𝖾𝗇𝖳𝗋𝖺𝗉(𝐀,𝐇) uses some fixed primitive matrix 𝐆∈ℤ_𝑞^{𝑛×𝑛𝑘} whose columns generate all of ℤ^𝑛_𝑞;(ii)𝖦𝖾𝗇𝖳𝗋𝖺𝗉(𝐀,𝐇) chooses a matrix 𝐓←𝒟^{𝑚×𝑛𝑘}_{ℤ,𝜔(log𝑛)}, where 𝑚=𝑚+𝑛𝑘 and 𝑘=𝑂(log𝑛);(iii)𝖦𝖾𝗇𝖳𝗋𝖺𝗉(𝐀,𝐇) computes 𝐀=[𝐀‖𝐇𝐆−𝐀𝐓]∈ℤ_𝑞^𝑛×𝑚;(iv)the statistical distance between the distribution of 𝐀 and the uniform distribution is negligible;(v)𝑠₁(𝐓)=𝑠_𝑇⋅𝑂(√𝑚+√𝑛𝑘) holds with an overwhelming probability, where 𝑠₁(𝐓) is the maximal singular value of 𝐓 and 𝑠_𝑇>0;(vi)𝖦𝖾𝗇𝖳𝗋𝖺𝗉(𝐀) means 𝖦𝖾𝗇𝖳𝗋𝖺𝗉(𝐀,𝐈_𝑛).
The trapdoor Gaussian sampling algorithm 𝖲𝖺𝗆𝗉𝗅𝖾𝖣(𝐀,𝐓,𝐇,𝐮,𝑠) proposed by Micciancio and Peikert in 2012 [18] has the following properties.

Lemma 5 (see [18]). There exists a probabilistic polynomial time algorithm 𝖲𝖺𝗆𝗉𝗅𝖾𝖣(𝐀,𝐓,𝐇,𝐮,𝑠) that takes a parity-check matrix 𝐀∈ℤ_𝑞^𝑛×𝑚 with its trapdoor 𝐓, an invertible matrix 𝐇∈ℤ_𝑞^𝑛×𝑛, a syndrome 𝐮∈ℤ^𝑛_𝑞, 𝑠=𝑂(𝑛log𝑞)≥𝑠_𝐺⋅𝑠₁(𝐓) (where 𝑠_𝐺=2 if 𝑞 is a power of 2, or 𝑠_𝐺=√5 otherwise), 𝑛≥1,  𝑚=𝑂(𝑛log𝑞),  𝑞≥2, and outputs a vector 𝐯 such that(i)𝖲𝖺𝗆𝗉𝗅𝖾𝖣(𝐀,𝐓,𝐇,𝐮,𝑠) uses some fixed primitive matrix 𝐆∈ℤ_𝑞^{𝑛×𝑛𝑘} whose columns generate all of ℤ^𝑛_𝑞;(ii)the statistical distance between the distribution of 𝐯 and the distribution of 𝒟_{Λ⟂𝐮(𝐀),𝑠⋅𝜔(log𝑛)} is negligiblel;(iii)𝖲𝖺𝗆𝗉𝗅𝖾𝖣(𝐀,𝐓,𝐮,𝑠) means 𝖲𝖺𝗆𝗉𝗅𝖾𝖣(𝐀,𝐓,𝐈_𝑛,𝐮,𝑠).
The trapdoor delegation algorithm 𝖣𝖾𝗅𝖳𝗋𝖺𝗉(𝐀^′=[𝐀‖𝐀₁],𝐓,𝐇^′,𝑠^′) proposed by Micciancio and Peikert in 2012 [18] has the following properties.

Lemma 6 (see [18]). There exists a probabilistic polynomial time algorithm 𝖣𝖾𝗅𝖳𝗋𝖺𝗉(𝐀^′=[𝐀‖𝐀₁],𝐓,𝐇^′,𝑠^′) that takes a parity-check matrix 𝐀^′=[𝐀‖𝐀₁]∈ℤ_𝑞^{𝑛×(𝑚+𝑛𝑘)}, a trapdoor 𝐓 corresponding to 𝐀, an invertible matrix 𝐇^′∈ℤ_𝑞^𝑛×𝑛, and 𝑠^′≥𝜂_𝜖(Λ^⟂(𝐀)), where 𝑛≥1, 𝑚=𝑂(𝑛log𝑞), 𝑞≥2, 𝑘=𝑂(log𝑛), and outputs a trapdoor 𝐓^′ corresponding to 𝐀^′=[𝐀‖𝐀₁] such that(i)𝖣𝖾𝗅𝖳𝗋𝖺𝗉(𝐀^′=[𝐀‖𝐀₁],𝐓,𝐇^′,𝑠^′) uses some fixed primitive matrix 𝐆∈ℤ_𝑞^{𝑛×𝑛𝑘} whose columns generate all of ℤ^𝑛_𝑞;(ii)the statistical distance between the distribution of 𝐓^′ and the Gaussian distribution with 𝑠^′ is negligible;(iii)𝑠₁(𝐓^′)≤𝑠^′⋅𝑂(√𝑚+√𝑛𝑘) holds with an overwhelming probability;(iv)𝖣𝖾𝗅𝖳𝗋𝖺𝗉 works even if the columns of 𝐀^′=[𝐀‖𝐀₁] are randomly permuted;(v)𝖣𝖾𝗅𝖳𝗋𝖺𝗉(𝐀^′=[𝐀‖𝐀₁],𝐓,𝑠^′) means 𝖣𝖾𝗅𝖳𝗋𝖺𝗉(𝐀^′=[𝐀‖𝐀₁],𝐓,𝐈_𝑛,𝑠^′).

2.3. Properties of ℛ^∗

We use a set of invertible elements in a certain ring ℛ=ℤ_𝑞/𝑓(𝑥) introduced by Micciancio and Peikert in 2012 [18].

Lemma 7 (see [18]). Let 𝑓(𝑥)=𝑥^𝑛+𝑎_𝑛−1𝑥^𝑛−1+⋯+𝑎₁𝑥+𝑎₀∈ℤ[𝑥] be a monic 𝑛-degree polynomial. Then, one defines ℛ^∗ as a set of invertible elements in the ring ℛ=ℤ_𝑞[𝑥]/𝑓(𝑥) with the following properties:(i)an arbitrary subset-sum in ℛ^∗ is also an invertible element in ℛ^∗;(ii)there exists a ring homomorphism ℎ(⋅)∶ℛ^∗→ℤ_𝑞^𝑛×𝑛 that maps from 𝑎∈ℛ^∗ to an invertible matrix 𝐇=ℎ(𝑎);(iii)the number of elements in ℛ^∗ is at most (𝑝−1)⋅𝑛, where 𝑝 is the smallest prime dividing 𝑞.

2.4. Chameleon Hash Function

A family of chameleon hash functions 𝖧(⋅,⋅)∶{0,1}^∗×{0,1}^𝑚→{0,1}^ℎ was proposed by Cash et al. in 2010 [15].

Lemma 8 (see [15]). If the 𝑆𝐼𝑆_𝑞,𝛽 problem for 𝑞≥|𝗆|+4⋅𝑠²⋅𝑚⋅√𝑛⋅𝜔(log𝑛) and 𝛽=|𝗆|+4⋅𝑠²⋅𝑚 is hard, the hash function 𝖧(⋅,⋅)∶{0,1}^∗×{0,1}^𝑚→{0,1}^ℎ has the trapdoor property and the collision resistance property, where |𝗆| is the bit length of the message, ℎ is the bit length of the hash value, 𝑠 is a Gaussian parameter, 𝑛≥1, 𝑚=𝑂(𝑛log𝑞), and 𝑞≥2. The properties of 𝖧(⋅,⋅) are as follows.(i)The trapdoor property. For any 𝖧(𝗆,𝐫) and 𝗆^′, we can sample 𝐫^′ with trapdoor information such that 𝖧(𝗆,𝐫)=𝖧(𝗆^′,𝐫^′).(ii)The collision resistance property. It is hard to find (𝗆,𝐫) and (𝗆^′,𝐫^′) without trapdoor information such that 𝖧(𝗆,𝐫)=𝖧(𝗆^′,𝐫^′) and (𝗆,𝐫)≠(𝗆^′,𝐫^′).

2.5. Ring Signatures

A ring signature scheme 𝖱𝖲 is a triple set of algorithms {𝖱𝖲.𝖦𝖾𝗇,𝖱𝖲.𝖲𝗂𝗀𝗇,𝖱𝖲.𝖵𝗋𝖿𝗒}.(i)𝖱𝖲.𝖦𝖾𝗇(1^𝑛): on input of a security parameter 𝑛, this algorithm outputs a signing key 𝑠𝑘_𝑖 and verification key 𝑣𝑘_𝑖 pair.(ii)𝖱𝖲.𝖲𝗂𝗀𝗇(𝑠𝑘_𝑖,𝖱,𝗆): on input of a signing key 𝑠𝑘_𝑖, a ring 𝖱, and a message 𝗆, this algorithm outputs a ring signature 𝜎, where 𝖱 is an ordered set of verification keys.(iii)𝖱𝖲.𝖵𝗋𝖿𝗒(𝖱,𝗆,𝜎): on input of a ring 𝖱, a message 𝗆, and a ring signature 𝜎, this algorithm outputs 1 if the ring signature is valid and 0 otherwise.

Correctness. A ring signature scheme 𝖱𝖲 is correct if, for any valid ring signature 𝜎 corresponding to (𝖱,𝗆), the 𝖱𝖲.𝖵𝗋𝖿𝗒(𝖱,𝗆,𝜎) algorithm outputs 1 with an overwhelming probability.

Generally, ring signatures should be required to satisfy conditions of anonymity and unforgeability. Definitions of anonymity against full key exposure and existential unforgeability with respect to insider corruption were proposed by Bender et al. [4].

3. Related Work

In this section, we review the existing ring signature schemes from lattices. In 2010, Brakerski and Kalai proposed the first ring signature scheme from lattices, using ring trapdoor functions [19]. However, the Brakerski-Kalai’s ring signature scheme is only existentially unforgeable under chosen subring attacks; that is, the Brakerski-Kalai’s ring signature scheme does not guarantee that their scheme is existentially unforgeable with respect to insider corruption, because existential unforgeability under chosen subring attacks is a weaker security notion than the existential unforgeability with respect to insider corruption.

In 2011, Wang and Sun proposed two ring signature schemes in the random oracle model and in the standard model, using lattice-based delegation techniques [21]. They claimed that Wang-Sun’s ring signature schemes offered existential unforgeability with respect to insider corruption, but Wang-Sun’s ring signature schemes in fact did not. In this section, we discuss the definition of existential unforgeability with respect to insider corruption and show that all of Wang-Sun’s ring signature schemes are not existentially unforgeable with respect to insider corruption.

3.1. Existential Unforgeability with respect to Insider Corruption

In 2006, Bender et al. developed the definitions of anonymity and existential unforgeability for ring signatures [4]. Bender et al. developed four kinds of anonymity and three kinds of existential unforgeability, with anonymity against full key exposure and existential unforgeability with respect to insider corruption being the securest of these. The insider corruption means that an adversary can corrupt honest users and obtain their signing keys. Since then, most existing ring signature schemes are based on Bender et al.’s definitions. In 2011, Wang and Sun proposed two ring signature schemes and claimed that these two ring signature schemes were existentially unforgeable with respect to insider corruption, so we now discuss existential unforgeability with respect to insider corruption, before concluding that their ring signature schemes are not existentially unforgeable.

Existential unforgeability with respect to insider corruption for a ring signature scheme 𝖱𝖲={𝖱𝖲.𝖦𝖾𝗇,𝖱𝖲.𝖲𝗂𝗀𝗇,𝖱𝖲.𝖵𝗋𝖿𝗒} is defined by the game 𝖦𝖺𝗆𝖾^𝖾𝗎_𝖱𝖲,ℱ(𝑛) between a challenger 𝒞 and a forger ℱ as follows.(i)Setup. 𝒞 runs 𝖱𝖲.𝖦𝖾𝗇(1^𝑛)𝑡 times to obtain {(𝑠𝑘₁,𝑣𝑘₁),…,(𝑠𝑘_𝑡,𝑣𝑘_𝑡)}. 𝒞 sends an ordered set 𝖲={𝑣𝑘₁,…,𝑣𝑘_𝑡} of verification keys to ℱ. 𝒞 sets 𝖢𝖴←∅, where 𝖢𝖴 is a set of corrupted users.(ii)Signing Queries. ℱ sends (𝑒,𝖱,𝗆) such that 𝑣𝑘_𝑒∈𝖱∩𝖲 to 𝒞. We note that 𝖱 may not be a subset of 𝖲. 𝒞 runs 𝖱𝖲.𝖲𝗂𝗀𝗇(𝑠𝑘_𝑒,𝖱,𝗆) to obtain 𝜎 and returns it to ℱ.(iii)Corruption Queries. ℱ sends 𝑖 such that 𝑣𝑘_𝑖∈𝖲 to 𝒞. 𝒞 returns 𝑠𝑘_𝑖 to ℱ and adds 𝑣𝑘_𝑖 to 𝖢𝖴.(iv)Output. ℱ outputs (𝖱^∗,𝗆^∗,𝜎^∗). If 𝖱𝖲.𝖵𝗋𝖿𝗒(𝖱^∗,𝗆^∗,𝜎^∗)=1, ℱ did not send (⋅,𝖱^∗,𝗆^∗) to 𝒞, and 𝖱^∗⊆𝖲⧵𝖢𝖴, then ℱ wins the game 𝖦𝖺𝗆𝖾^𝖾𝗎_𝖱𝖲,ℱ(𝑛).

The advantage of ℱ in the above game is defined as follows: 𝖠𝖽𝗏^𝖾𝗎_𝖱𝖲,ℱ(𝑛)=Prℱwinsthegame𝖦𝖺𝗆𝖾^𝖾𝗎_𝖱𝖲,ℱ(𝑛). (9)

3.2. Analysis of Wang-Sun’s Ring Signature Schemes

Here, we show that Wang-Sun’s ring signature schemes are not existentially unforgeable with respect to insider corruption. Wang-Sun’s ring signature scheme 𝖶𝖲.𝖱𝖲={𝖶𝖲.𝖦𝖾𝗇,𝖶𝖲.𝖲𝗂𝗀𝗇,𝖶𝖲.𝖵𝗋𝖿𝗒} in the random oracle model consists of the following algorithms.(i)𝖶𝖲.𝖦𝖾𝗇(1^𝑛): this algorithm runs the trapdoor generation algorithm 𝖣𝖾𝗅𝖳𝗋𝖺𝗉 to obtain (𝐀_𝑖,𝐓_𝑖). The signing key is 𝑠𝑘_𝑖=𝐓_𝑖∈ℤ^𝑚×𝑚 and the verification key is 𝑣𝑘_𝑖=𝐀_𝑖∈ℤ_𝑞^𝑛×𝑚.(ii)𝖶𝖲.𝖲𝗂𝗀𝗇(𝑠𝑘_𝑖,𝖱,𝗆): on input of 𝑠𝑘_𝑖=𝐓_𝑖, 𝖱={𝑣𝑘₁,…,𝑣𝑘_𝑙}={𝐀₁,…,𝐀_𝑙}, and 𝗆, this algorithm computes 𝐮=𝖧(𝗆)∈ℤ^𝑛_𝑞 and constructs 𝐀_𝖱=[𝐀₁‖⋯‖𝐀_𝑙]∈ℤ_𝑞^{𝑛×𝑙𝑚}, where 𝖧(⋅) is a hash function. The algorithm samples and outputs 𝐯∈ℤ^𝑙𝑚 from 𝒟_Λ^⟂_{𝐮(𝐀𝖱),𝑠} using the Gaussian sampling algorithm 𝖲𝖺𝗆𝗉𝗅𝖾𝖣 and the trapdoor delegation algorithm 𝖣𝖾𝗅𝖳𝗋𝖺𝗉 with 𝑠𝑘_𝑖=𝐓_𝑖, where 𝑠 is a Gaussian parameter.(iii)𝖶𝖲.𝖵𝗋𝖿𝗒(𝖱,𝗆,𝐯): on input of 𝖱={𝑣𝑘₁,…,𝑣𝑘_𝑙}={𝐀₁,…,𝐀_𝑙}, 𝗆, and 𝐯, this algorithm constructs 𝐀_𝖱=[𝐀₁‖⋯‖𝐀_𝑙]∈ℤ_𝑞^{𝑛×𝑙𝑚}. Then, the algorithm outputs 1 if(i)‖𝐯‖≤𝑠⋅√𝑙𝑚;(ii)𝐀_𝖱⋅𝐯=𝖧(𝗆)(mod𝑞). Otherwise, the algorithm outputs 0.

We now show that we can construct a forger ℱ mounting an existential forgery attack with a nonnegligible success probability. Let 𝒞 be a challenger in the game of existential unforgeability. ℱ sends (𝑒,𝖱,𝗆^∗) to 𝒞 in the Signing Queries phase and receives a ring signature 𝐯 corresponding to (𝑒,𝖱,𝗆^∗). Then, ℱ makes a forgery (𝖱^∗,𝗆^∗,𝐯^∗) such that 𝖱^∗ is a proper (or strict) superset of 𝖱 (i.e.; 𝖱⊊𝖱^∗).

For example, ℱ chooses 𝖱=(𝑣𝑘₁,𝑣𝑘₃) in the Signing Queries phase. In this case, 𝐀_𝖱=[𝐀₁‖𝐀₃]∈ℤ^𝑛×2𝑚. ℱ chooses 𝖱^∗=(𝑣𝑘₁,𝑣𝑘₃,𝑣𝑘₄) in the Output phase. In this case, 𝐀_𝖱^∗=[𝐀₁‖𝐀₃‖𝐀₄]∈ℤ^𝑛×3𝑚. Then, ℱ constructs 𝐯^∗=[^𝐯_𝟎] by inserting zeros into 𝐯, where 𝐯∈ℤ^2𝑚 and 𝟎∈ℤ^𝑚. Note that the following equation holds: 𝐀₁𝐀₃𝐀₄⋅𝐯^∗=𝐀₁𝐀₃𝐀₄⋅𝐯𝟎=𝐀₁‖𝐀₃𝗆⋅𝐯=𝖧^∗mod𝑞. (10) Clearly, the Euclidean norms of 𝐯 and 𝐯^∗ are the same, and the tuple (𝖱^∗,𝗆^∗,𝐯^∗) satisfies the verification algorithm (i.e.; 𝖶𝖲.𝖵𝗋𝖿𝗒(𝖱^∗,𝗆^∗,𝐯^∗)=1). Therefore, Wang-Sun’s ring signature scheme in the random oracle model is not existentially unforgeable with respect to insider corruption. Wang-Sun’s ring signature scheme in the standard model can similarly be broken.

4. Security Model of Ring Signatures

4.1. Anonymity against Full Key Exposure

We first recall the definition of anonymity against full key exposure in [4]. Anonymity against full key exposure for a ring signature scheme 𝖱𝖲={𝖱𝖲.𝖦𝖾𝗇,𝖱𝖲.𝖲𝗂𝗀𝗇,𝖱𝖲.𝖵𝗋𝖿𝗒} is defined by the following game 𝖦𝖺𝗆𝖾^𝖺𝗇_{𝖱𝖲,𝒜}(𝑛) between a challenger 𝒞 and an adversary 𝒜.(i)Setup. 𝒞 runs 𝖱𝖲.𝖦𝖾𝗇(1^𝑛)𝑡 times to obtain {(𝑠𝑘₁,𝑣𝑘₁),…,(𝑠𝑘_𝑡,𝑣𝑘_𝑡)}. 𝒞 sends an ordered set 𝖲={𝑣𝑘₁,…,𝑣𝑘_𝑡} of verification keys to 𝒜. 𝒞 sets 𝖢𝖴←∅, where 𝖢𝖴 is a set of corrupted users.(ii)Signing Queries. 𝒜 sends (𝑒,𝖱,𝗆) such that 𝑣𝑘_𝑒∈𝖱∩𝖲 to 𝒞. We note that 𝖱 may not be a subset of 𝖲. 𝒞 runs 𝖱𝖲.𝖲𝗂𝗀𝗇(𝑠𝑘_𝑒,𝖱,𝗆) to obtain 𝜎 and returns 𝜎 to 𝒜.(iii)Corruption Queries. 𝒜 sends 𝑖 such that 𝑣𝑘_𝑖∈𝖲 to 𝒞. 𝒞 returns 𝑠𝑘_𝑖 to 𝒜 and adds 𝑣𝑘_𝑖 to 𝖢𝖴.(iv)Challenge. 𝒜 sends (𝑒₀,𝑒₁,𝖱,𝗆) such that 𝑣𝑘_𝑒0∈𝖱∩𝖲 and 𝑣𝑘_𝑒1∈𝖱∩𝖲 to 𝒞. We note that 𝖱 may not be a subset of 𝖲. 𝒞 randomly chooses a bit 𝑏 and returns 𝜎←𝖱𝖲.𝖲𝗂𝗀𝗇(𝑠𝑘_𝑒𝑏,𝖱,𝗆) to 𝒜.(v)Output. 𝒜 guesses and outputs 𝑏^′. If 𝑏=𝑏^′, then 𝒜 wins the game 𝖦𝖺𝗆𝖾^𝖺𝗇_{𝖱𝖲,𝒜}(𝑛). We note that 𝑣𝑘_𝑒0 or 𝑣𝑘_𝑒1 may be in 𝖢𝖴.

The advantage of 𝒜 in the above game is defined as follows: 𝖠𝖽𝗏^𝖺𝗇_{𝖱𝖲,𝒜}(𝑛)=Prℱwinsthegame𝖦𝖺𝗆𝖾^𝖺𝗇_{𝖱𝖲,𝒜}(𝑛−1)2. (11)

4.2. Strong Unforgeability with respect to Insider Corruption

We propose strong unforgeability with respect to insider corruption for ring signatures. This is a stronger condition than existential unforgeability. The strong unforgeability of ring signatures is based on the existential unforgeability defined in [4].

Strong unforgeability with respect to insider corruption for a ring signature scheme 𝖱𝖲={𝖱𝖲.𝖦𝖾𝗇,𝖱𝖲.𝖲𝗂𝗀𝗇,𝖱𝖲.𝖵𝗋𝖿𝗒} is defined by the following game 𝖦𝖺𝗆𝖾^𝗌𝗎_𝖱𝖲,ℱ between a challenger 𝒞 and a forger ℱ.(i)Setup. 𝒞 runs 𝖱𝖲.𝖦𝖾𝗇(1^𝑛)𝑡 times to obtain {(𝑠𝑘₁,𝑣𝑘₁),…,(𝑠𝑘_𝑡,𝑣𝑘_𝑡)}. 𝒞 sends an ordered set 𝖲={𝑣𝑘₁,…,𝑣𝑘_𝑡} of verification keys to ℱ. 𝒞 sets a set of corrupted users 𝖢𝖴←∅.(ii)Signing Queries. For 1≤𝑖≤𝑞_𝑠, ℱ sends (𝑒_𝑖,𝖱_𝑖,𝗆_𝑖) such that 𝑣𝑘_𝑒𝑖∈𝖱_𝑖∩𝖲 to 𝒞. We note that 𝖱_𝑖 may not be a subset of 𝖲. 𝒞 runs 𝖱𝖲.𝖲𝗂𝗀𝗇(𝑠𝑘_𝑒𝑖,𝖱_𝑖,𝗆_𝑖) to obtain 𝜎_𝑖 and returns 𝜎_𝑖 to ℱ.(iii)Corruption Queries. For 1≤𝑗≤𝑡, ℱ sends 𝑗 such that 𝑣𝑘_𝑗∈𝖲 to 𝒞. 𝒞 returns 𝑠𝑘_𝑗 to ℱ and adds 𝑣𝑘_𝑗 to 𝖢𝖴.(iv)Output. ℱ outputs (𝖱^∗,𝗆^∗,𝜎^∗). If 𝖱𝖲.𝖵𝗋𝖿𝗒(𝖱^∗,𝗆^∗,𝜎^∗)=1, 𝜎^∗ is not made for (𝖱^∗,𝗆^∗) through signing queries, and 𝖱^∗⊆𝖲⧵𝖢𝖴, then ℱ wins the game 𝖦𝖺𝗆𝖾^𝗌𝗎_𝖱𝖲,ℱ(𝑛).

The advantage of ℱ in the above game is defined as follows: 𝖠𝖽𝗏^𝗌𝗎_𝖱𝖲,ℱ(𝑛)=Prℱwinsthegame𝖦𝖺𝗆𝖾^𝗌𝗎_𝖱𝖲,ℱ(𝑛). (12)

Note that ℱ can send (⋅,𝖱^∗,𝗆^∗) in the Signing Queries phase of the game, whereas ℱ cannot send (⋅,𝖱^∗,𝗆^∗) in the existential unforgeability game.

5. Our Construction

5.1. Sets and Parameters

In this section, we propose our ring signature scheme 𝖲𝖱𝖲={𝖲𝖱𝖲.𝖦𝖾𝗇,𝖲𝖱𝖲.𝖲𝗂𝗀𝗇,𝖲𝖱𝖲.𝖵𝗋𝖿𝗒} in the standard model. First, we define the following parameters.(i)𝑛 is a security parameter.(ii)𝑚=𝑚+(𝑙+1)⋅𝑛𝑘 is the dimension of the ring signature, where 𝑚=𝑂(𝑛𝑘), 𝑘=𝑂(log𝑛), and 𝑙 is the number of ring users.(iii)ℎ≤(𝑝−1)⋅𝑛 is the bit length of a hash value, where 𝑝 is the smallest prime dividing 𝑞. That is, a hash value space is {0,1}^ℎ.(iv)𝑠=𝑂(𝑛𝑘⋅√ℎ𝑙)⋅𝜔(log𝑛)³ is a parameter used in the 𝖲𝖺𝗆𝗉𝗅𝖾𝖣 algorithm and 𝑠^′=𝑂(√ℎ𝑛𝑘)⋅𝜔(log𝑛)² is a parameter used in the 𝖣𝖾𝗅𝖳𝗋𝖺𝗉 algorithm.(v)𝑞=𝑂(ℎ⋅𝑙⋅𝑛^5/2⋅𝑘²)⋅𝜔(log𝑛)⁵ and 𝛽=𝑂(ℎ⋅𝑙⋅𝑛²⋅𝑘²)⋅𝜔(log𝑛)⁴ are parameters for the SIS problem and SIVP.(vi)𝐆∈ℤ_𝑞^{𝑛×𝑛𝑘} is a primitive matrix whose columns generate all of ℤ^𝑛_𝑞.(vii)𝗉𝖺𝗋𝖺𝗆𝗌={𝐆,𝐀,𝐂₀,…,𝐂_ℎ,𝐮,𝖧(⋅,⋅)} are public parameters, where 𝐀←ℤ^𝑛×𝑚_𝑞, 𝐂₀,…,𝐂_ℎ←ℤ_𝑞^{𝑛×𝑛𝑘}, 𝐮←ℤ^𝑛_𝑞, and 𝖧(⋅,⋅)∶{0,1}^∗×{0,1}^𝑚→{0,1}^ℎ is a hash function.

5.2. Our Ring Signature Scheme

Our ring signature scheme 𝖲𝖱𝖲={𝖲𝖱𝖲.𝖦𝖾𝗇,𝖲𝖱𝖲.𝖲𝗂𝗀𝗇,𝖲𝖱𝖲.𝖵𝗋𝖿𝗒} consists of the following algorithms.(i)𝖲𝖱𝖲.𝖦𝖾𝗇(1^𝑛): on input of the security parameter 𝑛, this algorithm chooses 𝐓_𝑖←𝒟^{𝑚×𝑛𝑘}_{ℤ,𝜔(log𝑛)} and computes 𝐀_𝑖=[𝐆−𝐀𝐓_𝑖]. The signing key is 𝑠𝑘_𝑖=𝐓_𝑖 and the verification key is 𝑣𝑘_𝑖=𝐀_𝑖.(ii)𝖲𝖱𝖲.𝖲𝗂𝗀𝗇(𝑠𝑘_𝑖,𝖱,𝗆): on input of 𝑠𝑘_𝑖=𝐓_𝑖, 𝖱={𝑣𝑘₁,…,𝑣𝑘_𝑙}={𝐀₁,…,𝐀_𝑙}, and 𝗆, this algorithm computes 𝖧(𝖱‖𝗆,𝐫)=𝜇=(𝜇₁,…,𝜇_ℎ)∈{0,1}^ℎ and 𝐂_𝜇=𝐂₀+∑^ℎ_𝑗=1𝜇_𝑗𝐂_𝑗∈ℤ_𝑞^{𝑛×𝑛𝑘}, where 𝐫←{0,1}^𝑚 and 𝜇_𝑗 is the 𝑗th element in 𝜇. The algorithm constructs 𝐀_𝖱,𝜇=[𝐀‖𝐀_𝖱‖𝐂_𝜇]∈ℤ_𝑞^𝑛×𝑚, where 𝐀_𝖱=[𝐀₁‖⋯‖𝐀_𝑙] is the ordered concatenation of matrices in 𝖱. The algorithm samples 𝐯∈ℤ^𝑚 from 𝒟_Λ^⟂_{𝐮(𝐀𝖱,𝜇),𝑠} using the 𝖲𝖺𝗆𝗉𝗅𝖾𝖣 and 𝖣𝖾𝗅𝖳𝗋𝖺𝗉 algorithms with 𝑠𝑘_𝑖=𝐓_𝑖. The algorithm outputs a ring signature 𝜎=(𝐯,𝐫).(iii)𝖲𝖱𝖲.𝖵𝗋𝖿𝗒(𝖱,𝗆,𝜎): on input of 𝖱={𝑣𝑘₁,…,𝑣𝑘_𝑙}={𝐀₁,…,𝐀_𝑙}, 𝗆, and 𝜎=(𝐯,𝐫), this algorithm computes 𝖧(𝖱‖𝗆,𝐫)=𝜇=(𝜇₁,…,𝜇_ℎ)∈{0,1}^ℎ and 𝐂_𝜇=𝐂₀+∑^ℎ_𝑗=1𝜇_𝑗𝐂_𝑗∈ℤ_𝑞^{𝑛×𝑛𝑘}, where 𝜇_𝑗 is the 𝑗th element in 𝜇. The algorithm constructs 𝐀_𝖱,𝜇=[𝐀‖𝐀_𝖱‖𝐂_𝜇]∈ℤ_𝑞^𝑛×𝑚, where 𝐀_𝖱=[𝐀₁‖⋯‖𝐀_𝑙] is the ordered concatenation of matrices in 𝖱. Then, the algorithm outputs 1 if(i)𝐀_𝖱,𝜇⋅𝐯=𝐮(mod𝑞);(ii)‖𝐯‖≤𝑠⋅√𝑚. Otherwise, the algorithm outputs 0.

Correctness. We show that our ring signature scheme 𝖲𝖱𝖲 is correct. The 𝖲𝖱𝖲.𝖲𝗂𝗀𝗇(𝑠𝑘_𝑖,𝖱,𝗆) algorithm can sample 𝐯 from a distribution whose statistical distance from 𝒟_Λ^⟂_{𝐮(𝐀𝖱,𝜇),𝑠} is negligible using the 𝖲𝖺𝗆𝗉𝗅𝖾𝖣 and 𝖣𝖾𝗅𝖳𝗋𝖺𝗉 algorithms with 𝐓_𝑖 such that 𝐀_𝖱,𝜇⋅𝐯=𝐮(mod𝑞) and ‖𝐯‖≤𝑠⋅√𝑚 with an overwhelming probability [15, 18, 27]. Therefore, our ring signature scheme 𝖲𝖱𝖲 is correct.

5.3. Anonymity against Full Key Exposure of Our Construction

We now show that our ring signature scheme 𝖲𝖱𝖲 is anonymous against full key exposure in the standard model.

Theorem 9. 𝖲𝖱𝖲={𝖲𝖱𝖲.𝖦𝖾𝗇,𝖲𝖱𝖲.𝖲𝗂𝗀𝗇,𝖲𝖱𝖲.𝖵𝗋𝖿𝗒} is anonymous against full key exposure in the standard model.

Proof of Theorem 9. Recall that (𝑒₀,𝑒₁,𝖱,𝗆) is sent by 𝒜 in the Challenge phase of the game of anonymity. A challenge signature 𝜎_𝑏=(𝐯_𝑏,𝐫_𝑏)←𝖱𝖲.𝖲𝗂𝗀𝗇(𝑠𝑘_𝑒𝑏,𝖱,𝗆) is then returned to 𝒜.
The signing algorithm with 𝑠𝑘_𝑒𝑖=𝐓_𝑖 samples 𝐯_𝑖 from a distribution whose statistical distance from 𝒟_Λ^⟂_{𝐮(𝐀𝖱,𝜇),𝑠} is negligible. Therefore, the statistical distance between the distribution of 𝐯₀ and the distribution of 𝐯₁ is negligible. We also note that the distributions of 𝐫₀ and 𝐫₁ are the same. Therefore, the advantage 𝖠𝖽𝗏^𝖺𝗇_{𝖲𝖱𝖲,𝒜} of 𝒜 is negligible.

5.4. Strong Unforgeability with respect to Insider Corruption of Our Construction

We now show that our ring signature scheme 𝖲𝖱𝖲 is strongly unforgeable with respect to insider corruption in the standard model.

Theorem 10. If the 𝑆𝐼𝑆_𝑞,𝛽 problem for 𝑞≥|𝖱|+|𝗆|+4⋅𝑠²⋅𝑚⋅√𝑛⋅𝜔(log𝑛) and 𝛽=|𝖱|+|𝗆|+4⋅𝑠²⋅𝑚 and 𝑞≥𝑂(ℎ⋅𝑙⋅𝑛^5/2⋅𝑘²)⋅𝜔(log𝑛)⁵ and 𝛽=𝑂(ℎ⋅𝑙⋅𝑛²⋅𝑘²)⋅𝜔(log𝑛)⁴ is hard, the ring signature scheme 𝖲𝖱𝖲={𝖲𝖱𝖲.𝖦𝖾𝗇,𝖲𝖱𝖲.𝖲𝗂𝗀𝗇,𝖲𝖱𝖲.𝖵𝗋𝖿𝗒} proposed here is strongly unforgeable with respect to insider corruption in the standard model, where |𝖱| is the ring size and |𝗆| is the message bit length.

Proof of Theorem 10. We show that, if a forger exists ℱ with a nonnegligible probability, we can construct an algorithm 𝒜 solving the SIS_𝑞,𝛽 problem.
Assume that ℱ outputs a forgery (𝖱^∗,𝗆^∗,𝜎^∗=(𝐯^∗,𝐫^∗)) in the game of strong unforgeability. Then, there exist three cases.(1)𝜇^∗=𝖧(𝖱^∗‖𝗆^∗,𝐫^∗)=𝖧(𝖱_𝑖‖𝗆_𝑖,𝐫_𝑖) for some 𝑖∈[1,𝑞_𝑠] such that 𝖱^∗≠𝖱_𝑖, 𝗆^∗≠𝗆_𝑖, or 𝐫^∗≠𝐫_𝑖.(2)𝜇^∗=𝖧(𝖱^∗‖𝗆^∗,𝐫^∗)=𝖧(𝖱_𝑖‖𝗆_𝑖,𝐫_𝑖) for some 𝑖∈[1,𝑞_𝑠] such that 𝖱^∗=𝖱_𝑖, 𝗆^∗=𝗆_𝑖, and 𝐫^∗=𝐫_𝑖.(3)𝜇^∗=𝖧(𝖱^∗‖𝗆^∗,𝐫^∗)≠𝖧(𝖱_𝑖‖𝗆_𝑖,𝐫_𝑖) for all 𝑖∈[1,𝑞_𝑠].
Note that the number of signing queries is at most 𝑞_𝑠, and (𝖱_𝑖,𝗆_𝑖,𝐫_𝑖) are used in the 𝑖th signing queries.
For the first case, we can construct 𝒜 conducting a collision attack on 𝖧(⋅,⋅) using ℱ. 𝒜 simulates the game of strong unforgeability with ℱ as follows.(i) Setup. 𝒜 takes a hash function 𝖧(⋅,⋅) as input and chooses {𝐆,𝐀,𝐂₀,…,𝐂_ℎ,𝐮} at random. For 1≤𝑖≤𝑡, 𝒜 chooses 𝐓_𝑖←𝒟^{𝑚×𝑛𝑘}_{ℤ,𝜔(log𝑛)} and computes 𝐀_𝑖=[𝐆−𝐀𝐓_𝑖]. 𝒜 sends {𝗉𝖺𝗋𝖺𝗆𝗌,𝖲} to ℱ, where 𝗉𝖺𝗋𝖺𝗆𝗌={𝐆,𝐀,𝐂₀,…,𝐂_ℎ,𝐮,𝖧(⋅,⋅)} and 𝖲={𝑣𝑘₁,…,𝑣𝑘_𝑡}={𝐀₁,…,𝐀_𝑡}. 𝒜 sets 𝖢𝖴←∅, where 𝖢𝖴 is a set of corrupted users.(ii) Signing Queries.  ℱ sends (𝑒,𝖱,𝗆) such that 𝑣𝑘_𝑒∈𝖱∩𝖲 to 𝒜. 𝒜 chooses 𝐫←{0,1}^𝑚 and computes 𝖧(𝖱‖𝗆,𝐫)=𝜇=(𝜇₁,…,𝜇_ℎ)∈{0,1}^ℎ. 𝐀_𝖱,𝜇 is represented as [𝐀‖𝐀_𝖱‖𝐂_𝜇], where 𝐀_𝖱 is the ordered concatenation of matrices in 𝖱, 𝐂_𝜇=𝐂₀+∑^ℎ_𝑗=1𝜇_𝑗𝐂_𝑗∈ℤ_𝑞^{𝑛×𝑛𝑘}, and 𝜇_𝑗 is the 𝑗th element in 𝜇. The maximal singular value of 𝑠𝑘_𝑒=𝐓_𝑒 (where 𝑠_𝑇>0) is as follows: 𝑠₁𝐓_𝑒=𝑠_𝑇⋅𝑂√𝑚+√𝑛𝑘=𝑠_𝑇⋅𝑂√𝑛𝑘+√𝑛𝑘=𝑠_𝑇⋅𝑂√𝑛𝑘. (13) 𝒜 calculates 𝐓←𝖣𝖾𝗅𝖳𝗋𝖺𝗉(𝐀_𝖱,𝜇,𝐓_𝑒,𝑠^′), where 𝑠^′=𝑂(√ℎ𝑛𝑘)⋅𝜔(log𝑛)². Then, the maximal singular value of 𝐓 is as follows: 𝑠₁(𝐓)≤𝑠^′⋅𝑂√𝑚+𝑛𝑘+√√𝑙𝑛𝑘=𝑂ℎ𝑛𝑘⋅𝜔log𝑛²⋅𝑂√𝑛𝑘+𝑛𝑘+√√𝑙𝑛𝑘=𝑂ℎ𝑛𝑘⋅𝜔log𝑛²⋅𝑂√𝑛𝑘+√√𝑙𝑛𝑘=𝑂ℎ𝑛𝑘⋅𝜔log𝑛²⋅𝑂√√𝑙𝑛𝑘=𝑂𝑛𝑘⋅ℎ𝑙⋅𝜔log𝑛². (14) 𝒜 calculates 𝐯←𝖲𝖺𝗆𝗉𝗅𝖾𝖣(𝐀_𝖱,𝜇,𝐓,𝐮,𝑂(𝑛𝑘⋅√ℎ𝑙)⋅𝜔(log𝑛)²) from a distribution whose statistical distance from 𝒟_Λ^⟂_{𝐮(𝐀𝖱,𝜇),𝑠} is negligible, where 𝑠=𝑂(𝑛𝑘⋅√ℎ𝑙)⋅𝜔(log𝑛)³. 𝒜 returns 𝜎=(𝐯,𝐫) to ℱ.(iii) Corruption Queries. ℱ sends 𝑖 such that 𝑣𝑘_𝑖∈𝖲 to 𝒜. 𝒜 returns 𝑠𝑘_𝑖=𝐓_𝑖 to ℱ and adds 𝑣𝑘_𝑖=𝐀_𝑖 to 𝖢𝖴.(iv) Output. 𝒜 outputs (𝖱^∗,𝗆^∗,𝜎^∗=(𝐯^∗,𝐫^∗)). For any 𝑖, 𝜇^∗=𝖧(𝖱^∗‖𝗆^∗,𝐫^∗)=𝖧(𝖱_𝑖‖𝗆_𝑖,𝐫_𝑖)∈{𝖧(𝖱₁‖𝗆₁,𝐫₁),…,𝖧(𝖱_𝑞𝑠‖𝗆_𝑞𝑠,𝐫_𝑞𝑠)}, where 𝖱^∗≠𝚁_𝑖, 𝗆^∗≠𝗆_𝑖, or 𝐫^∗≠𝐫_𝑖. 𝒜 outputs two pairs {(𝖱^∗‖𝗆^∗,𝐫^∗),(𝖱_𝑖‖𝗆_𝑖,𝐫_𝑖)} as a collision on 𝖧(⋅,⋅).
To reduce the average-case SIS problem to the worst-case SIVP in lattices, 𝑞≥𝛽⋅√𝑛⋅𝜔(log𝑛) should hold. Therefore, 𝑞≥𝛽⋅√𝑛⋅𝜔=log𝑛|𝖱|+|𝗆|+4⋅𝑠²⋅𝑚⋅√𝑛⋅𝜔log𝑛. (15)
Naturally, 𝖠𝖽𝗏^SIS_𝒜≥𝖠𝖽𝗏^𝖼𝗋_{𝖧(⋅,⋅),𝒜}≥𝖠𝖽𝗏^𝗌𝗎_{𝖲𝖱𝖲,ℱ}. (16)
For the second case, we can construct 𝒜 attacking the SIS_𝑞,𝛽 problem using ℱ. Assume that the number of corrupted users is at most 𝑙. 𝒜 simulates the game of strong unforgeability with ℱ as follows.(i) Setup. 𝒜 chooses a primitive matrix 𝐆∈ℤ_𝑞^{𝑛×𝑛𝑘}. 𝒜 takes as input 𝐀^′∈ℤ^𝑛×(_𝑞^{𝑚+𝑙𝑛𝑘+1)} as an SIS instance and parses 𝐀^′ as [𝐀‖𝐮^′]=[𝐀‖𝐀^∗₁‖⋯‖𝐀^∗_𝑙‖𝐮^′], where 𝐀∈ℤ^𝑛×𝑚_𝑞, 𝐀^∗₁,…,𝐀^∗_𝑙∈ℤ_𝑞^{𝑛×𝑛𝑘}, and 𝐮^′∈ℤ^𝑛_𝑞. 𝒜 chooses a chameleon hash function 𝖧(⋅,⋅) with trapdoor information and distinct hash values {𝜇₁,…,𝜇_𝑞𝑠}, where 𝜇_𝑖←{0,1}^ℎ for 1≤𝑖≤𝑞_𝑠. 𝒜 randomly selects 𝜇^′∈{𝜇₁,…,𝜇_𝑞𝑠}. For 0≤𝑗≤ℎ, 𝒜 computes 𝐇_𝑗 as follows: 𝐇_𝑗=(−1)^𝜇′𝑗⋅ℎ𝑢_𝑗{}−𝑗∈1,…,ℎ_ℎ𝑘=1𝜇^′_𝑘⋅𝐇_𝑘𝑗=0, (17) where 𝜇^′_𝑗 is the 𝑗th element in 𝜇^′ and ℎ(⋅) is a ring homomorphism. For 0≤𝑗≤ℎ, 𝒜 chooses 𝐑_𝑗←𝒟^{𝑚×𝑛𝑘}_{ℤ,𝜔(log𝑛)} and computes the following: 𝐂_𝑗=𝐇_𝑗𝐆−𝐀𝐑_𝑗. (18) If 𝜇_𝑖=𝜇^′, 𝐇₀+∑^ℎ_𝑗=1𝜇_𝑖,𝑗𝐇_𝑗=𝟎∈ℤ^𝑛×𝑛, where 𝜇_𝑖,𝑗 is the 𝑗th element in 𝜇_𝑖. Otherwise, 𝐇₀+∑^ℎ_𝑗=1𝜇_𝑖,𝑗𝐇_𝑗≠𝟎∈ℤ^𝑛×𝑛 is an invertible matrix. 𝒜 chooses 𝐯←𝒟_ℤ^{𝑚+(𝑙+1)𝑛𝑘}_,𝑠 and computes 𝐮=[𝐀‖𝐂_𝜇′]⋅𝐯, where 𝐂_𝜇′=𝐂₀+∑^ℎ_𝑗=1𝜇^′_𝑗𝐂_𝑗 and 𝜇^′_𝑗 is the 𝑗th element in 𝜇^′. 𝒜 randomly chooses 𝐭=(𝑡₁,…,𝑡_𝑡)←{0,1}^𝑡 such that the number of 1s in 𝐭 is 𝑙. If 𝑡_𝑘=1 for 1≤𝑘≤𝑡, 𝒜 sets 𝐀_𝑘=𝐀^∗_𝑖 for 1≤𝑖≤𝑙 in turn. Otherwise, 𝒜 chooses 𝐓_𝑘←𝒟^{𝑚×𝑛𝑘}_{ℤ,𝜔(log𝑛)} and computes 𝐀_𝑘=[𝐆−𝐀𝐓_𝑘]. 𝒜 sends {𝗉𝖺𝗋𝖺𝗆𝗌,𝖲} to ℱ, where 𝗉𝖺𝗋𝖺𝗆𝗌={𝐆,𝐀,𝐂₀,…,𝐂_ℎ,𝐮,𝖧(⋅,⋅)} and 𝖲={𝑣𝑘₁,…,𝑣𝑘_𝑡}={𝐀₁,…,𝐀_𝑡}. 𝒜 sets 𝖢𝖴←∅, where 𝖢𝖴 is a set of corrupted users.(ii) Signing Queries. For 1≤𝑖≤𝑞_𝑠, ℱ sends (𝑒_𝑖,𝖱_𝑖,𝗆_𝑖) such that 𝑣𝑘_𝑒𝑖∈𝖱_𝑖∩𝖲 to 𝒜. 𝒜 samples 𝐫_𝑖 with trapdoor information such that 𝜇_𝑖=𝖧(𝖱_𝑖‖𝗆_𝑖,𝐫_𝑖).(1)For 𝜇_𝑖=𝜇^′: if 𝐀≠[𝐀‖𝐀_𝖱𝑖], 𝒜 aborts. Otherwise, 𝒜 returns 𝜎_𝑖=(𝐯,𝐫_𝑖) to ℱ. Note that the distributions of 𝐯 and 𝒟_Λ^⟂_{𝐮(𝐀‖𝐂𝜇′),𝑠} are the same.(2)For 𝜇_𝑖≠𝜇^′: 𝐀_{𝖱𝑖,𝜇𝑖} is represented as [𝐀‖𝐀_𝖱𝑖‖𝐇𝐆−𝐀𝐑], where 𝐇=𝐇₀+∑^ℎ_𝑗=1𝜇_𝑖,𝑗𝐇_𝑗≠𝟎∈ℤ^𝑛×𝑛 and 𝐑=𝐑₀+∑^ℎ_𝑗=1𝜇_𝑖,𝑗𝐑_𝑗. The maximal singular value of 𝐑 is as follows: 𝑠₁(𝐑)=√ℎ+1⋅𝑂√𝑚+√𝑛𝑘⋅𝜔=√log𝑛ℎ+1⋅𝑂√𝑛𝑘+√𝑛𝑘⋅𝜔=√log𝑛ℎ+1⋅𝑂√𝑛𝑘⋅𝜔√log𝑛=𝑂ℎ𝑛𝑘⋅𝜔log𝑛. (19) 𝒜 calculates 𝐑^′←𝖣𝖾𝗅𝖳𝗋𝖺𝗉(𝐀_{𝖱𝑖,𝜇𝑖},𝐑,𝑠^′), where 𝑠^′=𝑂(√ℎ𝑛𝑘)⋅𝜔(log𝑛)². Then, the maximal singular value of 𝐑^′ is as follows: 𝑠₁𝐑^′≤𝑠^′⋅𝑂√𝑚+𝑛𝑘+√√𝑙𝑛𝑘=𝑂ℎ𝑛𝑘⋅𝜔log𝑛²⋅𝑂√𝑛𝑘+𝑛𝑘+√√𝑙𝑛𝑘=𝑂ℎ𝑛𝑘⋅𝜔log𝑛²⋅𝑂√𝑛𝑘+√√𝑙𝑛𝑘=𝑂ℎ𝑛𝑘⋅𝜔log𝑛²⋅𝑂√√𝑙𝑛𝑘=𝑂𝑛𝑘⋅ℎ𝑙⋅𝜔log𝑛². (20) 𝒜 calculates 𝐯_𝑖←𝖲𝖺𝗆𝗉𝗅𝖾𝖣(𝐀_{𝖱𝑖,𝜇𝑖},𝐑^′,𝐮,𝑂(𝑛𝑘⋅√ℎ𝑙)⋅𝜔(log𝑛)²) from a distribution whose statistical distance from 𝒟_Λ^⟂_{𝐮(𝐀𝖱𝑖𝑖,𝜇),𝑠} is negligible, where 𝑠=𝑂(𝑛𝑘⋅√ℎ𝑙)⋅𝜔(log𝑛)³. 𝒜 returns 𝜎_𝑖=(𝐯_𝑖,𝐫_𝑖) to ℱ.(iii) Corruption Queries. If ℱ asks for 𝑠𝑘_𝑗, where 𝑡_𝑗=1, 𝒜 aborts. Otherwise, 𝒜 returns 𝑠𝑘_𝑗=𝐓_𝑗 and adds 𝑣𝑘_𝑗=𝐀_𝑗 to 𝖢𝖴.(iv) Output. ℱ outputs (𝖱^∗,𝗆^∗,𝜎^∗=(𝐯^∗,𝐫^∗)). If 𝜇^∗=𝖧(𝖱^∗‖𝗆^∗,𝐫^∗)≠𝜇^′, 𝒜 aborts. Otherwise, 𝐀_𝖱^∗_,𝜇∗=[𝐀‖𝐂_𝜇′]=[𝐀‖𝐀^∗₁‖⋯‖𝐀^∗_𝑙‖−𝐀𝐑^∗], where 𝐇^∗=𝐇₀+∑^ℎ_𝑗=1𝜇^∗_𝑗𝐇_𝑗=𝟎∈ℤ^𝑛×𝑛 and 𝐑^∗=𝐑₀+∑^ℎ_𝑗=1𝜇^∗_𝑗𝐑_𝑗. Therefore, we obtain the following equation: 𝐀‖𝐂_𝜇′⋅𝐯=𝐀‖𝐂_𝜇′⋅𝐯^∗=𝐮mod𝑞. (21) From the above equation, we have that 𝐀‖𝐂_𝜇′⋅𝐯^∗=−𝐯𝐀𝐀^∗₁⋯𝐀^∗_𝑙−𝐀𝐑^∗⋅𝐯^∗𝐈−𝐯=𝐀^𝑚−𝐑^∗𝐈_𝑙𝑛𝑘⋅𝐯^∗−𝐯=𝟎mod𝑞. (22) Let 𝐳∈ℤ^{𝑚+𝑙𝑛𝑘} be ^{𝐈𝑚−𝐑∗}_{𝐈𝑙𝑛𝑘}⋅(𝐯^∗−𝐯) and let 𝐳^′∈ℤ^{𝑚+𝑙𝑛𝑘+1} be [^𝐳₀]. Then, 𝐀𝐳=𝟎(mod𝑞) and 𝐀^′𝐳^′=𝐀‖𝐮^′𝐳0=𝟎mod𝑞. (23) 𝒜 outputs 𝐳^′ as a SIS solution to 𝐀^′.The Euclidean norm of 𝐯^∗ is as follows: 𝐯^∗≤𝑠⋅√𝑚=𝑂𝑛𝑘⋅√ℎ𝑙⋅𝜔log𝑛³⋅()√𝑚+𝑙+1⋅𝑛𝑘=𝑂𝑛𝑘⋅ℎ𝑙⋅𝜔log𝑛³⋅𝑂()√𝑛𝑘+𝑙+1⋅𝑛𝑘=𝑂𝑛𝑘⋅ℎ𝑙⋅𝜔log𝑛³⋅𝑂√ℎ𝑙𝑛𝑘=𝑂^1/2⋅𝑙⋅𝑛^3/2⋅𝑘^3/2⋅𝜔log𝑛³. (24)
Because ‖𝐯‖=‖𝐯^∗‖=𝑂(ℎ^1/2⋅𝑙⋅𝑛^3/2⋅𝑘^3/2)⋅𝜔(log𝑛)³ and 𝐯^∗−𝐯≠𝟎, ‖𝐳^′‖=‖𝐳‖=𝑂(ℎ⋅𝑙⋅𝑛²⋅𝑘²)⋅𝜔(log𝑛)⁴=𝛽.
To reduce the average-case SIS problem to the worst-case SIVP in lattices, 𝑞≥𝛽⋅√𝑛⋅𝜔(log𝑛) should hold. Therefore, 𝑞≥𝛽⋅√𝑛⋅𝜔log𝑛=𝑂ℎ⋅𝑙⋅𝑛²⋅𝑘²⋅𝜔log𝑛⁴⋅√𝑛⋅𝜔log𝑛=𝑂ℎ⋅𝑙⋅𝑛^5/2⋅𝑘²⋅𝜔log𝑛⁵. (25)
We note that 𝒜 succeeds in its forgery if it correctly guesses 𝜇^′ and 𝐭. The probability of 𝒜 correctly guessing 𝜇^′ is 1/𝑞_𝑠, and the probability of correctly guessing 𝐭 is 1/_𝑡𝐶_𝑙. Therefore, 𝖠𝖽𝗏^SIS_𝒜≥_𝑡1𝐶_𝑙⋅𝑞_𝑠⋅𝖠𝖽𝗏^𝗌𝗎_{𝖲𝖱𝖲,ℱ}, (26) where 𝑡 is the number of users and 𝑙 is the upper bound of the number of corrupted users.
For the third case, we can construct 𝒜 attacking the SIS_𝑞,𝛽 problem using ℱ. Assume that the number of corrupted users is at most 𝑙. 𝒜 simulates the game of strong unforgeability with ℱ as follows.(i) Setup. 𝒜 chooses a primitive matrix 𝐆∈ℤ_𝑞^{𝑛×𝑛𝑘}. 𝒜 takes as input 𝐀^′∈ℤ^𝑛×(_𝑞^{𝑚+𝑙𝑛𝑘+1)} as a SIS instance and parses 𝐀^′ as [𝐀‖𝐮]=[𝐀‖𝐀^∗₁‖⋯‖𝐀^∗_𝑙‖𝐮], where 𝐀∈ℤ^𝑛×𝑚_𝑞,  𝐀^∗₁,…,𝐀^∗_𝑙∈ℤ_𝑞^{𝑛×𝑛𝑘}, and 𝐮∈ℤ^𝑛_𝑞. 𝒜 chooses a chameleon hash function 𝖧(⋅,⋅) with trapdoor information and distinct hash values {𝜇₁,…,𝜇_𝑞𝑠}, where 𝜇_𝑖←{0,1}^ℎ for 1≤𝑖≤𝑞_𝑠. 𝒜 constructs a set 𝑃 of all shortest strings 𝑝∈{0,1}^≤ℎ such that each element of {𝜇₁,…,𝜇_𝑞𝑠} has no 𝑝 as a prefix. There exists an efficient algorithm for computing 𝑃, and the number of elements in 𝑃 is at most (ℎ−1)⋅𝑞_𝑠+1 [15, 17, 18]. 𝒜 chooses 𝑝 from 𝑃 at random. |𝑝|≤ℎ, where |𝑝| is the bit length of 𝑝. For 0≤𝑗≤ℎ, 𝒜 computes 𝐇_𝑗 as follows: 𝐇_𝑗=ℎ(0)𝑝()=𝟎𝑗>−1^𝑝𝑗⋅ℎ𝑢_𝑗𝑝−𝑗∈1,…,_|𝑝|𝑘=1𝑝_𝑘⋅𝐇_𝑘𝑗=0, (27) where 𝑝_𝑗 is the 𝑗th element in 𝑝 and ℎ(⋅) is a ring homomorphism. For 0≤𝑗≤ℎ, 𝒜 chooses 𝐑_𝑗←𝒟^{𝑚×𝑛𝑘}_{ℤ,𝜔(log𝑛)} and computes the following: 𝐂_𝑗=𝐇_𝑗𝐆−𝐀𝐑_𝑗. (28) If any 𝜇_𝑖 has 𝑝 as a prefix, 𝐇₀+∑^ℎ_𝑗=1𝜇_𝑖,𝑗𝐇_𝑗=𝟎∈ℤ^𝑛×𝑛, where 𝜇_𝑖,𝑗 is the 𝑗th element in 𝜇_𝑖. Otherwise, 𝐇₀+∑^ℎ_𝑗=1𝜇_𝑖,𝑗𝐇_𝑗≠𝟎∈ℤ^𝑛×𝑛 is an invertible matrix. 𝒜 randomly chooses 𝐭=(𝑡₁,…,𝑡_𝑡)←{0,1}^𝑡 such that the number of 1s in 𝐭 is 𝑙. If 𝑡_𝑘=1 for 1≤𝑘≤𝑡, 𝒜 sets 𝐀_𝑘=𝐀^∗_𝑖 for 1≤𝑖≤𝑙 in turn. Otherwise, 𝒜 chooses 𝐓_𝑘←𝒟^{𝑚×𝑛𝑘}_{ℤ,𝜔(log𝑛)} and computes 𝐀_𝑘=[𝐆−𝐀𝐓_𝑘]. 𝒜 sends {𝗉𝖺𝗋𝖺𝗆𝗌,𝖲} to ℱ, where 𝗉𝖺𝗋𝖺𝗆𝗌={𝐆,𝐀,𝐂₀,…,𝐂_ℎ,𝐮,𝖧(⋅,⋅)} and 𝖲={𝑣𝑘₁,…,𝑣𝑘_𝑡}={𝐀₁,…,𝐀_𝑡}. 𝒜 sets 𝖢𝖴←∅, where 𝖢𝖴 is a set of corrupted users.(ii) Signing Queries. For 1≤𝑖≤𝑞_𝑠, ℱ sends (𝑒_𝑖,𝖱_𝑖,𝗆_𝑖) such that 𝑣𝑘_𝑒𝑖∈𝖱_𝑖∩𝖲 to 𝒜. 𝒜 samples 𝐫_𝑖 with trapdoor information such that 𝜇_𝑖=𝖧(𝖱_𝑖‖𝗆_𝑖,𝐫_𝑖). 𝐀_{𝖱𝑖,𝜇𝑖} is represented as [𝐀‖𝐀_𝖱𝑖‖𝐇𝐆−𝐀𝐑], where 𝐇=𝐇₀+∑^ℎ_𝑗=1𝜇_𝑖,𝑗𝐇_𝑗≠𝟎∈ℤ^𝑛×𝑛 and 𝐑=𝐑₀+∑^ℎ_𝑗=1𝜇_𝑖,𝑗𝐑_𝑗. The maximal singular value of 𝐑 is as follows: 𝑠₁(𝐑)=√ℎ+1⋅𝑂√𝑚+√𝑛𝑘⋅𝜔=√log𝑛ℎ+1⋅𝑂√𝑛𝑘+√𝑛𝑘⋅𝜔=√log𝑛ℎ+1⋅𝑂√𝑛𝑘⋅𝜔√log𝑛=𝑂ℎ𝑛𝑘⋅𝜔log𝑛. (29) 𝒜 calculates 𝐑^′←𝖣𝖾𝗅𝖳𝗋𝖺𝗉(𝐀_{𝖱𝑖,𝜇𝑖},𝐑,𝑠^′), where 𝑠^′=𝑂(√ℎ𝑛𝑘)⋅𝜔(log𝑛)². Then, the maximal singular value of 𝐑^′ is as follows: 𝑠₁𝐑^′≤𝑠^′⋅𝑂√𝑚+𝑛𝑘+√√𝑙𝑛𝑘=𝑂ℎ𝑛𝑘⋅𝜔log𝑛²⋅𝑂√𝑛𝑘+𝑛𝑘+√√𝑙𝑛𝑘=𝑂ℎ𝑛𝑘⋅𝜔log𝑛²⋅𝑂√𝑛𝑘+√√𝑙𝑛𝑘=𝑂ℎ𝑛𝑘⋅𝜔log𝑛²⋅𝑂√√𝑙𝑛𝑘=𝑂𝑛𝑘⋅ℎ𝑙⋅𝜔log𝑛². (30) 𝒜 calculates 𝐯_𝑖←𝖲𝖺𝗆𝗉𝗅𝖾𝖣(𝐀_{𝖱𝑖,𝜇𝑖},𝐑^′,𝐮,𝑂(𝑛𝑘⋅√ℎ𝑙)⋅𝜔(log𝑛)²) from a distribution whose statistical distance from 𝒟_Λ^⟂_{𝐮(𝐀𝖱𝑖𝑖,𝜇),𝑠} is negligible, where 𝑠=𝑂(𝑛𝑘⋅√ℎ𝑙)⋅𝜔(log𝑛)³. 𝒜 returns 𝜎_𝑖=(𝐯_𝑖,𝐫_𝑖) to ℱ.(iii) Corruption Queries. If ℱ asks for 𝑠𝑘_𝑖, where 𝑡_𝑖=1, 𝒜 aborts. Otherwise, 𝒜 returns 𝑠𝑘_𝑖=𝐓_𝑖 and adds 𝑣𝑘_𝑖=𝐀_𝑖 to 𝖢𝖴.(iv) Output. ℱ outputs (𝖱^∗,𝗆^∗,𝜎^∗=(𝐯^∗,𝐫^∗)). If 𝜇^∗=𝖧(𝖱^∗‖𝗆^∗,𝐫^∗) has no 𝑝 as a prefix or 𝐀≠[𝐀‖𝐀_𝖱^∗], 𝒜 aborts. Otherwise, 𝐀_𝖱^∗_,𝜇∗ is represented as [𝐀‖𝐀_𝖱^∗‖−𝐀𝐑^∗], where 𝐇^∗=𝐇₀+∑^ℎ_𝑗=1𝜇^∗_𝑗𝐇_𝑗=𝟎∈ℤ^𝑛×𝑛 and 𝐑^∗=𝐑₀+∑^ℎ_𝑗=1𝜇^∗_𝑗𝐑_𝑗. Therefore, we obtain the following equation: 𝐀_𝖱^∗_,𝜇∗⋅𝐯^∗=𝐀𝐀_𝖱^∗−𝐀𝐑^∗⋅𝐯^∗=𝐀‖𝐀_𝖱^∗𝐈_𝑚−𝐑^∗𝐈_𝑙𝑛𝑘⋅𝐯^∗𝐈=𝐀⋅^𝑚−𝐑^∗𝐈_𝑙𝑛𝑘⋅𝐯^∗=𝐮mod𝑞. (31) Let 𝐳∈ℤ^{𝑚+𝑙𝑛𝑘} be ^{𝐈𝑚−𝐑∗}_{𝐈𝑙𝑛𝑘}⋅𝐯^∗ and let 𝐳^′∈ℤ^{𝑚+𝑙𝑛𝑘+1} be [^𝐳₋₁]. Then, 𝐀𝐳=𝐮(mod𝑞) and 𝐀^′𝐳^′=[]𝐳𝐀‖𝐮.−1=𝐮−𝐮=𝟎mod𝑞 (32) 𝒜 outputs 𝐳^′ as a SIS solution to 𝐀^′.
The Euclidean norm of 𝐯^∗ is as follows: 𝐯^∗≤𝑠⋅√𝑚=𝑂𝑛𝑘⋅√ℎ𝑙⋅𝜔log𝑛³⋅()√𝑚+𝑙+1⋅𝑛𝑘=𝑂𝑛𝑘⋅ℎ𝑙⋅𝜔log𝑛³⋅𝑂()√𝑛𝑘+𝑙+1⋅𝑛𝑘=𝑂𝑛𝑘⋅ℎ𝑙⋅𝜔log𝑛³⋅𝑂√ℎ𝑙𝑛𝑘=𝑂^1/2⋅𝑙⋅𝑛^3/2⋅𝑘^3/2⋅𝜔log𝑛³. (33)
Because ‖𝐯^∗‖≤𝑠⋅√𝑚=𝑂(ℎ^1/2⋅𝑙⋅𝑛^3/2⋅𝑘^3/2)⋅𝜔(log𝑛)³, ‖𝐳^′‖≈‖𝐳‖=𝑂(ℎ⋅𝑙⋅𝑛²⋅𝑘²)⋅𝜔(log𝑛)⁴=𝛽.
To reduce the average-case SIS problem to the worst-case SIVP in lattices, 𝑞≥𝛽⋅√𝑛⋅𝜔(log𝑛) should hold. Therefore, 𝑞≥𝛽⋅√𝑛⋅𝜔log𝑛=𝑂ℎ⋅𝑙⋅𝑛²⋅𝑘²⋅𝜔log𝑛⁴⋅√𝑛⋅𝜔log𝑛=𝑂ℎ⋅𝑙⋅𝑛^5/2⋅𝑘²⋅𝜔log𝑛⁵. (34)
We note that 𝒜 succeeds in its forgery if 𝒜 correctly guesses 𝜇^∗ and 𝐭 such that 𝜇^∗ has 𝑝 as a prefix. The probability of 𝒜 correctly guessing 𝜇^∗ such that 𝜇^∗ has 𝑝 as a prefix is 1/((ℎ−1)⋅𝑞_𝑠+1). The probability that 𝒜 correctly guesses 𝐭 is 1/_𝑡𝐶_𝑙. Therefore, 𝖠𝖽𝗏^SIS_𝒜≥_𝑡1𝐶_𝑙⋅(ℎ−1)⋅𝑞_𝑠+1⋅𝖠𝖽𝗏^𝗌𝗎_{𝖲𝖱𝖲,ℱ}, (35) where 𝑡 is the number of users and 𝑙 is the upper bound of the number of corrupted users.
Our ring signature scheme has the property that the upper bound of the number of corrupted users should be constant. In proving strong unforgeability with respect to insider corruption for our ring signature scheme, the advantage of a forger is limited by the advantage of the SIS problem solver factored by _𝑡𝐶_𝑙, where 𝑡 is the number of users and 𝑙 is the upper bound of the number of corrupted users. The lower and upper bounds of _𝑡𝐶_𝑙 are as follows [30]: 𝑡𝑙^𝑙≤_𝑡𝐶_𝑙≤𝑒𝑡𝑙^𝑙. (36)
If 𝑙=𝑡/2 (i.e., the maximal value of _𝑡𝐶_𝑙), the lower and upper bounds on _𝑡𝐶_𝑙 are as follows: 2^𝑡/2≤_𝑡𝐶_𝑡/2≤(2𝑒)^𝑡/2. (37)
Thus, the value of _𝑡𝐶_𝑡/2 grows exponentially if 𝑙 grows polynomially; that is, the upper bound of corrupted users, 𝑙, in our ring signature scheme needs to be some constant.
Therefore, our ring signature scheme 𝖲𝖱𝖲 is strongly unforgeable with respect to insider corruption in the standard model.

6. Conclusion

In this paper, we have shown that all of Wang-Sun’s ring signature schemes are not in fact existentially unforgeable. We then have developed the more secure concept of strong unforgeability for ring signatures and have suggested a new ring signature scheme from lattices in the standard model that satisfies strong unforgeability. Our ring signature scheme is anonymous against full key exposure and is strongly unforgeable with respect to insider corruption in the standard model.

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.

Acknowledgments

This research was partly supported by Basic Science Research Programs through the National Research Foundation of Korea (NRF) funded by the Ministry of Science, ICT, and Future Planning (NRF-2012R1A1A3005550, 2013R1A2A2A01068200).