🤖 AI Summary
This work proposes a novel accountable and revocable signature scheme that simultaneously guarantees pre-claim anonymity for signers and enables secure identity revocation. Built upon the Fiat–Shamir with aborts paradigm, the construction realizes an accountable ring signature by black-boxing a one-out-of-N signature to achieve anonymity even under full key exposure, and employs binding signatures together with hidden-index commitments to confirm claims without revealing any signer-derived information. It is the first lattice-based construction to realize extended accountable signatures without requiring explicit transmission of the signer’s offset, offering unforgeability and claimability even in the presence of internal corruption. The scheme is rigorously proven secure in the (quantum) random oracle model, relying on the hardness of the decisional MLWE and MSIS problems, lattice-based one-out-of-many proofs, and hint-free full-t Dilithium-style signatures, thereby establishing a new paradigm for post-quantum privacy-enhancing signatures.
📝 Abstract
We extend the extended withdrawable signatures of Liu, Susilo and Baek to lattice-based constructions built on the Fiat-Shamir with aborts paradigm. Departing from an earlier draft that transported a per-signer shift in the clear, which leaks the signer, we realise extended withdrawable signatures as a claimable ring signature: signer ambiguity is provided by a one-out-of-N signature used as a black box (anonymity under full key exposure), and confirmation is the signer's claim, a binding signature together with the opening of a hiding index commitment bound into the transcript. No signer-derived value is published in the clear. We give complete proofs of correctness, extended withdrawability (as anonymity-until-claim), unforgeability under insider corruption, and claimability soundness, reducing to decisional MLWE (commitment hiding), MSIS (commitment binding), the anonymity of the one-out-of-$N$ scheme, and the EUF-CMA security of the base signature, in the (quantum) random-oracle model. We instantiate the base signature with a no-hint, full-$t$ Dilithium-style scheme and the one-out-of-$N$ layer with an established lattice one-out-of-many proof.