Move Signature Block Proof with airSlate SignNow

Group signature transcript

hi welcome to the presentation of the paper signatures from sequential or proofs my name is Patrick Harrison and this is joint work with mcvish James and Christine Johnson or from tu Darmstadt and just a quick heads-up before we get going I will be taking part in a live session on May 13th so if you have any questions about this work on my presentation I'll be happy to take him there okay so let me start with a bit of motivation for a work this paper is about security proofs for group and ring signature schemes these are special signature schemes where one individual can sign a message on behalf of an entire group of users without revealing who specifically put the signature and there are many variants of group and ring signature schemes out there but usually the difference between these two primitives is that ring signatures can be generated spontaneously and cannot be the anonymized while group signatures require some form of setup and can be opened by a designated Authority now a one possible design strategy to actually build these signature schemes is to base them on Sigma protocols and on a high level this works as follows so consider a group or ring of users and suppose that Alice here on top wants to sign a message M on behalf of all of them she would first generate a commitment for her own protocol and simulate protocol executions for all the other parties in the group and then she would somehow combine all the public information available so far to obtain a challenge for herself and since she knows her own secret key she can answer this challenge and the final signature is then somehow derived from the sequence of all the transcripts so a bit more abstractly a group or ring signature in this setting is nothing but a proof that the signer knows the secret key corresponding to one of the public keys in the group with the challenge somehow derived from all the protocol executions and the message to be signed now in practice this computation of the challenge usually involves a hash function which in security proofs is then abstracted to a random Oracle and usually the security proofs of these schemes rely on the so called rewinding technique so what happens here is the adversary is first executed then its internal state is played back and the random Oracle is reprogrammed to a different value and then the adversary is executed again and this proves that forging signatures implies being able to extract a witness which is supposed to be hard now the main goal of this work was to study the existence and feasibility of security proofs for these types of signature schemes but in the non programmable random Oracle model so in a model where the hash function is indeed model as a random Oracle but the security reduction is not allowed to reprogram it and we...