Borromean Ring Signatures ∗

In 2002, Abe, Ohkubo, and Suzuki developed a new type of ring signature based on the discrete logarithm problem, which used a novel commitment structure to gain significant savings in size and verification time for ring signatures[AOS02]. Ring signatures are signatures using n verification keys which require knowledge of one of the corresponding secret keys. They can therefore be considered a signature of a disjunctive statement “I know x1 OR I know x2 OR . . . ”. We generalise their construction to handle conjunctive statements “I know one of {x1,x2,x3, . . .} AND one of {x4,x5,x6, . . .} AND . . . ” and thereby gain the ability to express knowledge of any monotone boolean function of the signing keys. This can be trivially done by use of multiple independent ring signatures; our construction saves space relative to this by sharing commitments across the individual rings. We also describe a new way of thinking about these ring signatures, and ordinary Schnorr signatures, in terms of “causal loops” which may provide a framework for further generalisations. ∗This work was sponsored by Blockstream. †greg@xiph.org, apoelstra@wpsoftware.net