Quantum Oracle Distribution Switching and its Applications to Fully Anonymous Ring Signatures

TL;DR

This paper advances the security analysis of post-quantum ring signatures by providing four rigorous security reductions in the quantum-accessible random oracle model, enhancing their reliability for quantum-resistant applications.

Contribution

It introduces four security reductions for two generic ring signature constructions in the QROM, formalizes the ring trapdoor paradigm, and develops new techniques for quantum oracle analysis.

Findings

Four security reductions in the QROM for ring signatures.

Formalization of the ring trapdoor construction paradigm.

Development of new quantum oracle analysis techniques.

Abstract

Ring signatures are a powerful primitive that allows a member to sign on behalf of a group, without revealing their identity. Recently, ring signatures have received additional attention as an ingredient for post-quantum deniable authenticated key exchange, e.g., for a post-quantum version of the Signal protocol, employed by virtually all end-to-end-encrypted messenger services. While several ring signature constructions from post-quantum assumptions offer suitable security and efficiency for use in deniable key exchange, they are currently proven secure in the random oracle model (ROM) only, which is insufficient for post-quantum security. In this work, we provide four security reductions in the quantum-accessible random oracle model (QROM) for two generic ring signature constructions: two for the AOS framework and two for a construction paradigm based on ring trapdoors, whose generic backbone we formalize. The two security proofs for AOS ring signatures differ in their requirements on the underlying sigma protocol and their tightness. The two reductions for the ring-trapdoor-based ring signatures exhibit various differences in requirements and the security they provide. We employ the measure-and-reprogram technique, QROM straightline extraction tools based on the compressed oracle, history-free reductions and QROM reprogramming tools. To make use of R\'enyi divergence properties in the QROM, we study the behavior of quantum algorithms that interact with an oracle whose distribution is based on one of two different distributions over the set of outputs. We provide tight bounds for the statistical distance, show that the R\'enyi divergence can not be used to replace the entire oracle and provide a workaround.