Anonymous t-out-of-N Threshold Signature Schemes

In many multi-user cryptographic applications (e.g., electronic voting, digital lotteries, e-cash application, anonymous access to some resources, etc.), anonymity pops up as one of the main security objectives. Protecting private information about the involved users is not only desirable but crucial for existence and proper working of these applications. Group signatures were the first signatures to provide anonymity of the signer(s): the members of the group can anonymously sign messages on behalf of the group using specially designed keys. The keys used by the individual members of the group are generated and distributed by a trusted group manager. Hence, group signatures are suitable for cooperative groups that have some preexisting structure. They are not suitable for groups that can be formed in an ad-hoc manner. To solve this problem, Rivest, Shamir and Tauman (ASIACRYPT 2001) introduced the notion of ring signature schemes. Unlike group signatures, ring signatures have no group managers. Any user can select a set (ring) of possible signers that includes himself, and using his private key and the public key of the other member of the ring, he can sign on behalf of the ring. Bresson, Stern and Szydlo (CRYPTO 2002) extend the notion to a threshold setting where some minimum number t of members of the group has to cooperate in order to sign a message. The complexity of the threshold ring signature scheme proposed by Bresson et al is prohibitively large even for relatively small sets of signers.