{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,13]],"date-time":"2025-11-13T07:26:03Z","timestamp":1763018763241,"version":"3.41.2"},"reference-count":224,"publisher":"International Association for Cryptologic Research","issue":"1","license":[{"start":{"date-parts":[[2025,1,14]],"date-time":"2025-01-14T00:00:00Z","timestamp":1736812800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2025,3,11]]},"abstract":"<jats:p>Modern security systems depend fundamentally on the ability of users to authenticate their communications to other parties in a network. Unfortunately, cryptographic authentication can substantially undermine the privacy of users. One possible solution to this problem is to use privacy-preserving cryptographic authentication. These protocols allow users to authenticate their communications without revealing their identity to the verifier. In the non-interactive setting, the most common protocols include blind, ring, and group signatures, each of which has been the subject of enormous research in the security and cryptography literature. These primitives are now being deployed at scale in major applications, including Intel's SGX software attestation framework. The depth of the research literature and the prospect of large-scale deployment motivate us to systematize our understanding of the research in this area. This work provides an overview of these techniques, focusing on applications and efficiency. <\/jats:p>","DOI":"10.62056\/a3wa3z10k","type":"journal-article","created":{"date-parts":[[2025,4,8]],"date-time":"2025-04-08T21:23:17Z","timestamp":1744147397000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":1,"title":["SoK: Privacy-Preserving Signatures"],"prefix":"10.62056","volume":"2","author":[{"given":"Alishah","family":"Chator","sequence":"first","affiliation":[{"name":"Boston University","place":["USA"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Matthew","family":"Green","sequence":"additional","affiliation":[{"name":"Johns Hopkins University","place":["USA"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Pratyush","family":"Tiwari","sequence":"additional","affiliation":[{"name":"Eternis Labs","place":["USA"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"48349","published-online":{"date-parts":[[2025,4,8]]},"reference":[{"key":"ref1:diffieHellman","doi-asserted-by":"publisher","DOI":"10.1109\/tit.1976.1055638","article-title":"New Directions in Cryptography","author":"Whitfield Diffie","year":"1976","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref2:chaum85","doi-asserted-by":"publisher","DOI":"10.1145\/4372.4373","article-title":"Security Without Identification: Transaction Systems to Make\n  Big Brother Obsolete","author":"David Chaum","year":"1985","journal-title":"Commun. ACM"},{"volume-title":"TPM Library Specification","year":"2014","author":"TPM","key":"ref3:tpm20"},{"key":"ref4:nytZcash","article-title":"Zcash, a Harder-to-Trace Virtual Currency, Generates Price\n  Frenzy","author":"Nathaniel Popper","year":"2016","journal-title":"The New York Times"},{"key":"ref5:noether15","article-title":"Ring Signature Confidential Transactions for Monero","author":"Shen Noether","year":"2015","journal-title":"IACR Cryptology ePrint Archive"},{"volume-title":"Vehicle Safety Communications Security Studies: Technical\n  Design of the Security Credential Management System","year":"2014","author":"Thorsten Hehn","key":"ref6:camp"},{"key":"ref7:irtfRSABlind","doi-asserted-by":"publisher","DOI":"10.17487\/rfc9474","volume-title":"RSA Blind Signatures","author":"Frank Denis","year":"2023"},{"key":"ref8:chaum82","doi-asserted-by":"publisher","first-page":"199","DOI":"10.1007\/978-1-4757-0602-4_18","article-title":"Blind signatures for untraceable payments","author":"David Chaum","year":"1982"},{"key":"ref9:chaum04","doi-asserted-by":"publisher","first-page":"38","DOI":"10.1109\/msecp.2004.1264852","article-title":"Secret-Ballot Receipts: True Voter-Verifiable Elections","volume":"2","author":"David Chaum","year":"2004","journal-title":"IEEE Security & Privacy"},{"key":"ref10:chaum84","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4684-4730-9_14","article-title":"Blind Signature System","author":"David Chaum","year":"1983"},{"key":"ref11:ps96","doi-asserted-by":"publisher","first-page":"252","DOI":"10.1007\/bfb0034852","article-title":"Provably Secure Blind Signature Schemes","volume":"1163 of LNCS","author":"David Pointcheval","year":"1996"},{"key":"ref12:okamoto93","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48071-4_3","article-title":"Provably Secure and Practical Identification Schemes and\n  Corresponding Signature Schemes","author":"Tatsuaki Okamoto","year":"1993"},{"key":"ref13:pointcheval98","doi-asserted-by":"publisher","DOI":"10.1007\/bfb0054141","article-title":"Strengthened security for blind signatures","author":"David Pointcheval","year":"1998"},{"key":"ref14:mss98","doi-asserted-by":"publisher","DOI":"10.1007\/bfb0055857","article-title":"On the Security of Some Variants of the RSA Signature\n  Scheme","author":"Markus Michels","year":"1998"},{"key":"ref15:bnps03","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-002-0120-1","article-title":"The One-More-RSA-Inversion Problems and the Security of\n  Chaum's Blind Signature Scheme","volume":"16","author":"Mihir Bellare","year":"2003"},{"key":"ref16:jlo97","doi-asserted-by":"publisher","first-page":"150","DOI":"10.1007\/bfb0052233","article-title":"Security of Blind Digital Signatures (Extended Abstract)","volume":"1294 of LNCS","author":"Ari Juels","year":"1997"},{"key":"ref17:lindell03","doi-asserted-by":"publisher","DOI":"10.1145\/780542.780641","article-title":"Bounded-concurrent secure two-party computation without\n  setup assumptions","author":"Yehuda Lindell","year":"2003"},{"key":"ref18:fs10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-13190-5_10","article-title":"On the Impossibility of Three-Move Blind Signature Schemes","author":"Marc Fischlin","year":"2010"},{"key":"ref19:ksy11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-19571-6_37","article-title":"Impossibility of Blind Signatures from One-Way\n  Permutations","author":"Jonathan Katz","year":"2011"},{"key":"ref20:su12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30057-8_39","article-title":"Security of Blind Signatures Revisited","author":"Dominique Schr\u00f6der","year":"2012"},{"key":"ref21:gmw87","doi-asserted-by":"publisher","first-page":"218","DOI":"10.1145\/3335741.3335755","article-title":"How to Play any Mental Game or A Completeness Theorem for\n  Protocols with Honest Majority","author":"Oded Goldreich","year":"1987"},{"key":"ref22:yao86","doi-asserted-by":"publisher","first-page":"162","DOI":"10.1109\/sfcs.1986.25","article-title":"How to Generate and Exchange Secrets","author":"Andrew Yao","year":"1986"},{"key":"ref23:chaum87a","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-39118-5_21","article-title":"Blinding for Unanticipated Signatures","author":"David Chaum","year":"1988"},{"key":"ref24:cp92","doi-asserted-by":"publisher","first-page":"89","DOI":"10.1007\/3-540-48071-4_7","article-title":"Wallet databases with observers","volume":"740 of LNCS","author":"David Chaum","year":"1992"},{"key":"ref25:cps94","doi-asserted-by":"publisher","DOI":"10.1007\/bfb0053458","article-title":"Blind signatures based on the discrete logarithm problem","author":"Jan L. Camenisch","year":"1995"},{"key":"ref26:fty96","doi-asserted-by":"publisher","DOI":"10.1007\/bfb0034855","article-title":"\"Indirect Discourse Proof\": Achieving Efficient Fair\n  Off-Line E-cash","author":"Yair Frankel","year":"1996"},{"key":"ref27:sn92","doi-asserted-by":"publisher","DOI":"10.1016\/0167-4048(92)90193-U","article-title":"On blind signatures and perfect crimes","author":"Sebastiaan H. von Solms","year":"1992","journal-title":"Comput. Secur."},{"key":"ref28:spc95","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-49264-x_17","article-title":"Fair Blind Signatures","author":"Markus Stadler","year":"1995"},{"key":"ref29:ao01","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45682-1_34","article-title":"Provably Secure Fair Blind Signatures with Tight\n  Revocation","author":"Masayuki Abe","year":"2001"},{"key":"ref30:ht07","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-73489-5_14","article-title":"Fair Blind Signatures Revisited","author":"Emeline Hufschmitt","year":"2007"},{"key":"ref31:fv10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-12678-9_2","article-title":"Fair Blind Signatures without Random Oracles","author":"Georg Fuchsbauer","year":"2010"},{"key":"ref32:rs10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-12678-9_3","article-title":"Fair Partially Blind Signatures","author":"Markus R\u00fcckert","year":"2010"},{"key":"ref33:brands93a","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48329-2_26","article-title":"Untraceable Off-line Cash in Wallets with Observers\n  (Extended Abstract)","author":"Stefan Brands","year":"1993"},{"key":"ref34:af96","doi-asserted-by":"publisher","DOI":"10.1007\/bfb0034851","article-title":"How to Date Blind Signatures","author":"Masayuki Abe","year":"1996"},{"key":"ref35:ao00","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-44598-6_17","article-title":"Provably Secure Partially Blind Signatures","author":"Masayuki Abe","year":"2000"},{"key":"ref36:kastner2023abe","doi-asserted-by":"publisher","first-page":"279","DOI":"10.1007\/978-3-031-22972-5_10","article-title":"The Abe-Okamoto partially blind signature scheme\n  revisited","author":"Julia Kastner","year":"2023"},{"key":"ref37:boldyreva03","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-36288-6_3","article-title":"Threshold Signatures, Multisignatures and Blind Signatures\n  Based on the Gap-Diffie-Hellman-Group Signature Scheme","author":"Alexandra Boldyreva","year":"2003"},{"key":"ref38:zk02","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-36178-2_33","article-title":"ID-Based Blind Signature and Ring Signature from Pairings","author":"Fangguo Zhang","year":"2002"},{"key":"ref39:ghk06","doi-asserted-by":"publisher","DOI":"10.1007\/11935230_12","article-title":"On the Generic Construction of Identity-Based Signatures\n  with Additional Properties","author":"David Galindo","year":"2006"},{"key":"ref40:ckw04","doi-asserted-by":"publisher","first-page":"134","DOI":"10.1007\/978-3-540-30598-9_10","article-title":"Efficient Blind Signatures without Random Oracles","volume":"3352 of LNCS","author":"Jan Camenisch","year":"2004"},{"key":"ref41:Fischlin06","doi-asserted-by":"publisher","DOI":"10.1007\/11818175_4","article-title":"Round-Optimal Composable Blind Signatures in the Common\n  Reference String Model","author":"Marc Fischlin","year":"2006"},{"key":"ref42:grssu11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-22792-9_36","article-title":"Round Optimal Blind Signatures.","author":"Sanjam Garg","year":"2011"},{"key":"ref43:bfpv13","doi-asserted-by":"publisher","DOI":"10.3233\/jcs-130477","article-title":"Short blind signatures","author":"Olivier Blazy","year":"2013"},{"key":"ref44:fhks16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-44618-9_21","article-title":"Practical Round-Optimal Blind Signatures in the Standard\n  Model from Weaker Assumptions","author":"Georg Fuchsbauer","year":"2016"},{"key":"ref45:ghadafi2017efficient","doi-asserted-by":"publisher","first-page":"455","DOI":"10.1007\/978-3-319-70972-7_26","article-title":"Efficient round-optimal blind signatures in the standard\n  model","author":"Essam Ghadafi","year":"2017"},{"key":"ref46:blazy2020round","doi-asserted-by":"publisher","first-page":"213","DOI":"10.5220\/0009888702130224","article-title":"Round-optimal Constant-size Blind Signatures.","author":"Olivier Blazy","year":"2020"},{"key":"ref47:katsumata2021round","doi-asserted-by":"publisher","first-page":"404","DOI":"10.1007\/978-3-030-77870-5_15","article-title":"Round-optimal blind signatures in the plain model from\n  classical and quantum standard assumptions","author":"Shuichi Katsumata","year":"2021"},{"key":"ref48:hanzlik2023non","doi-asserted-by":"publisher","first-page":"722","DOI":"10.1007\/978-3-031-30589-4_25","article-title":"Non-interactive blind signatures for random messages","author":"Lucjan Hanzlik","year":"2023"},{"key":"ref49:benhamouda2022security","doi-asserted-by":"publisher","first-page":"25","DOI":"10.1007\/s00145-022-09436-0","article-title":"On the (in) security of ROS","volume":"35","author":"Fabrice Benhamouda","year":"2022","journal-title":"Journal of Cryptology"},{"key":"ref50:schnorr2001security","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/3-540-45600-7_1","article-title":"Security of blind discrete log signatures against\n  interactive attacks","author":"Claus Peter Schnorr","year":"2001"},{"key":"ref51:ps00","doi-asserted-by":"publisher","first-page":"361","DOI":"10.1007\/s001450010003","article-title":"Security Arguments for Digital Signatures and Blind\n  Signatures","volume":"13","author":"David Pointcheval","year":"2000","journal-title":"Journal of Cryptology"},{"key":"ref52:kastner2022pairing","doi-asserted-by":"publisher","first-page":"468","DOI":"10.1007\/978-3-030-97131-1_16","article-title":"On pairing-free blind signature schemes in the algebraic\n  group model","author":"Julia Kastner","year":"2022"},{"key":"ref53:katz2021boosting","doi-asserted-by":"publisher","first-page":"468","DOI":"10.1007\/978-3-030-92068-5_16","article-title":"Boosting the security of blind signature schemes","author":"Jonathan Katz","year":"2021"},{"key":"ref54:chairattana2022pi","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1007\/978-3-031-15982-4_1","article-title":"PI-Cut-Choo and Friends: Compact Blind Signatures via\n  Parallel Instance Cut-and-Choose and More","author":"Rutchathon Chairattana-Apirom","year":"2022"},{"key":"ref55:hanzlik2023rai","doi-asserted-by":"publisher","first-page":"753","DOI":"10.1007\/978-3-031-30589-4_26","article-title":"Rai-choo! Evolving blind signatures to the next level","author":"Lucjan Hanzlik","year":"2023"},{"key":"ref56:hauck2020lattice","doi-asserted-by":"publisher","first-page":"500","DOI":"10.1007\/978-3-030-56880-1_18","article-title":"Lattice-based blind signatures, revisited","author":"Eduard Hauck","year":"2020"},{"key":"ref57:bgss17","doi-asserted-by":"publisher","DOI":"10.1109\/isit.2017.8007023","article-title":"A code-based blind signature","author":"O. Blazy","year":"2017"},{"key":"ref58:agrawal2022practical","doi-asserted-by":"publisher","first-page":"39","DOI":"10.1145\/3548606.3560650","article-title":"Practical, round-optimal lattice-based blind signatures","author":"Shweta Agrawal","year":"2022"},{"key":"ref59:alkeilani2021blindor","doi-asserted-by":"publisher","first-page":"95","DOI":"10.1007\/978-3-030-92548-2_6","article-title":"BlindOR: an efficient lattice-based blind signature scheme\n  from or-proofs","author":"Nabil Alkeilani Alkadri","year":"2021"},{"key":"ref60:lyubashevsky2022efficient","doi-asserted-by":"publisher","first-page":"498","DOI":"10.1007\/978-3-030-97131-1_17","article-title":"Efficient lattice-based blind signatures via Gaussian\n  one-time signatures","author":"Vadim Lyubashevsky","year":"2022"},{"key":"ref61:del2022new","doi-asserted-by":"publisher","first-page":"306","DOI":"10.1007\/978-3-031-15979-4_11","article-title":"A new framework for more efficient round-optimal\n  lattice-based (partially) blind signature via trapdoor sampling","author":"Rafael del Pino","year":"2022"},{"key":"ref62:tessaro2022short","doi-asserted-by":"publisher","first-page":"782","DOI":"10.1007\/978-3-031-07085-3_27","article-title":"Short pairing-free blind signatures with exponential\n  security","author":"Stefano Tessaro","year":"2022"},{"key":"ref63:crites2023snowblind","doi-asserted-by":"publisher","first-page":"710","DOI":"10.1007\/978-3-031-38557-5_23","article-title":"Snowblind: A Threshold Blind Signature in Pairing-Free\n  Groups","author":"Elizabeth Crites","year":"2023"},{"key":"ref64:abe2000provably","doi-asserted-by":"publisher","first-page":"271","DOI":"10.1007\/3-540-44598-6_17","article-title":"Provably secure partially blind signatures","author":"Masayuki Abe","year":"2000"},{"key":"ref65:okamoto06","doi-asserted-by":"publisher","first-page":"80","DOI":"10.1007\/11681878_5","article-title":"Efficient Blind and Partially Blind Signatures Without\n  Random Oracles","volume":"3876 of LNCS","author":"Tatsuaki Okamoto","year":"2006"},{"key":"ref66:gs08","doi-asserted-by":"publisher","first-page":"415","DOI":"10.1007\/978-3-540-78967-3_24","article-title":"Efficient Non-interactive Proof Systems for Bilinear\n  Groups","volume":"4965 of LNCS","author":"Jens Groth","year":"2008"},{"key":"ref67:chaum91","series-title":"EUROCRYPT'91","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-46416-6_22","article-title":"Group Signatures","author":"David Chaum","year":"1991"},{"key":"ref68:bbl07","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2011.63","article-title":"Enhanced Privacy ID: A Direct Anonymous Attestation\n  Scheme with Enhanced Revocation Capabilities","author":"Ernie Brickell","year":"2007"},{"key":"ref69:bmw03","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-39200-9_38","article-title":"Foundations of Group Signatures: Formal Definitions,\n  Simplified Requirements, and a Construction Based on General Assumptions","author":"Mihir Bellare","year":"2003"},{"key":"ref70:ky06","doi-asserted-by":"publisher","first-page":"24","DOI":"10.1504\/ijsn.2006.010821","article-title":"Secure scalable group signature with dynamic joins and\n  separable authorities","volume":"1","author":"Aggelos Kiayias","year":"2006","journal-title":"Int. J. Secur. Networks"},{"key":"ref71:bootle2016foundations","doi-asserted-by":"publisher","first-page":"117","DOI":"10.1007\/978-3-319-39555-5_7","article-title":"Foundations of fully dynamic group signatures","author":"Jonathan Bootle","year":"2016"},{"key":"ref72:backes2019membership","doi-asserted-by":"publisher","first-page":"2181","DOI":"10.1145\/3319535.3354257","article-title":"Membership privacy for fully dynamic group signatures","author":"Michael Backes","year":"2019"},{"key":"ref73:camsta97","doi-asserted-by":"publisher","first-page":"410","DOI":"10.1007\/bfb0052252","article-title":"Efficient Group Signature Schemes for Large Groups","volume":"1296 of LNCS","author":"Jan Camenisch","year":"1997"},{"key":"ref74:chase2006signatures","doi-asserted-by":"publisher","first-page":"78","DOI":"10.1007\/11818175_5","article-title":"On signatures of knowledge","author":"Melissa Chase","year":"2006"},{"key":"ref75:cp94","doi-asserted-by":"publisher","DOI":"10.1007\/BFb0053433","article-title":"New Group Signature Schemes (Extended Abstract)","author":"Lidong Chen","year":"1994"},{"key":"ref76:cm98","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-49649-1_14","article-title":"A Group Signature Scheme with Improved Efficiency","author":"Jan Camenisch","year":"1998"},{"key":"ref77:actj00","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-44598-6_16","article-title":"A Practical and Provably Secure Coalition-Resistant Group\n  Signature Scheme","author":"Giuseppe Ateniese","year":"2000"},{"key":"ref78:BBS04","doi-asserted-by":"publisher","first-page":"45","DOI":"10.1007\/978-3-540-28628-8_3","article-title":"Short Group Signatures","volume":"3152 of LNCS","author":"Dan Boneh","year":"2004"},{"key":"ref79:tessaro2023revisiting","doi-asserted-by":"publisher","first-page":"691","DOI":"10.1007\/978-3-031-30589-4_24","article-title":"Revisiting BBS Signatures","author":"Stefano Tessaro","year":"2023"},{"key":"ref80:bw06a","doi-asserted-by":"publisher","DOI":"10.1007\/11761679_26","article-title":"Compact Group Signatures Without Random Oracles","author":"Xavier Boyen","year":"2006"},{"key":"ref81:ateniese2005practical","article-title":"Practical group signatures without random oracles","author":"Giuseppe Ateniese","year":"2005","journal-title":"Cryptology ePrint Archive"},{"key":"ref82:bichsel2010get","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15317-4_24","article-title":"Get shorty via group signatures without encryption","author":"Patrik Bichsel","year":"2010"},{"key":"ref83:derler2018highly","doi-asserted-by":"publisher","first-page":"551","DOI":"10.1145\/3196494.3196507","article-title":"Highly-efficient fully-anonymous dynamic group signatures","author":"David Derler","year":"2018"},{"key":"ref84:adM03","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-40061-5_15","article-title":"Efficient Group Signatures without Trapdoors","author":"Giuseppe Ateniese","year":"2003"},{"key":"ref85:libert2012scalable","doi-asserted-by":"publisher","first-page":"609","DOI":"10.1007\/978-3-642-29011-4_36","article-title":"Scalable group signatures with revocation","author":"Beno\u00eet Libert","year":"2012"},{"key":"ref86:libert2012group","doi-asserted-by":"publisher","first-page":"571","DOI":"10.1007\/978-3-642-32009-5_34","article-title":"Group signatures with almost-for-free revocation","author":"Beno\u00eet Libert","year":"2012"},{"key":"ref87:bcc04","doi-asserted-by":"publisher","DOI":"10.1145\/1030083.1030103","article-title":"Direct Anonymous Attestation","author":"Ernie Brickell","year":"2004"},{"volume-title":"Intel\u00ae Software Guard Extensions Remote\n  Attestation End-to-End Example","year":"2016","key":"ref88:sgxEPID"},{"key":"ref89:libert2021bifurcated","doi-asserted-by":"publisher","first-page":"521","DOI":"10.1007\/978-3-030-77883-5_18","article-title":"Bifurcated signatures: folding the accountability vs.\n  anonymity dilemma into a single private signing scheme","author":"Beno\u00eet Libert","year":"2021"},{"key":"ref90:nguyen2022multimodal","doi-asserted-by":"publisher","first-page":"792","DOI":"10.1007\/978-3-031-15979-4_27","article-title":"Multimodal Private Signatures","author":"Khoa Nguyen","year":"2022"},{"key":"ref91:garms2019group","doi-asserted-by":"publisher","first-page":"190","DOI":"10.1007\/978-3-030-17253-4_7","article-title":"Group signatures with selective linkability","author":"Lydia Garms","year":"2019"},{"key":"ref92:fraser2021selectively","doi-asserted-by":"publisher","first-page":"200","DOI":"10.1007\/978-3-030-92548-2_11","article-title":"Selectively linkable group signatures\u2014stronger security\n  and preserved verifiability","author":"Ashley Fraser","year":"2021"},{"key":"ref93:diaz2021group","doi-asserted-by":"publisher","first-page":"360","DOI":"10.1007\/978-3-030-75245-3_14","article-title":"Group signatures with user-controlled and sequential\n  linkability","author":"Jesus Diaz","year":"2021"},{"key":"ref94:camenisch2020short","doi-asserted-by":"publisher","first-page":"401","DOI":"10.1007\/978-3-030-57990-6_20","article-title":"Short threshold dynamic group signatures","author":"Jan Camenisch","year":"2020"},{"key":"ref95:llls13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-42045-0_3","article-title":"Lattice-Based Group Signatures with Logarithmic Signature\n  Size","author":"Fabien Laguillaumie","year":"2013"},{"key":"ref96:del2018lattice","doi-asserted-by":"publisher","first-page":"574","DOI":"10.1145\/3243734.3243852","article-title":"Lattice-based group signatures and zero-knowledge proofs of\n  automorphism stability","author":"Rafa\u00ebl Del Pino","year":"2018"},{"key":"ref97:lyubashevsky2021shorter","doi-asserted-by":"publisher","first-page":"218","DOI":"10.1007\/978-3-030-92068-5_8","article-title":"Shorter lattice-based group signatures via \u201calmost free\u201d\n  encryption and other optimizations","author":"Vadim Lyubashevsky","year":"2021"},{"key":"ref98:katsumata2019group","doi-asserted-by":"publisher","first-page":"312","DOI":"10.1007\/978-3-030-17659-4_11","article-title":"Group signatures without NIZK: from lattices in the standard\n  model","author":"Shuichi Katsumata","year":"2019"},{"key":"ref99:ling2018constant","doi-asserted-by":"publisher","first-page":"58","DOI":"10.1007\/978-3-319-76581-5_3","article-title":"Constant-size group signatures from lattices","author":"San Ling","year":"2018"},{"key":"ref100:beullens2023group","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/s10623-023-01192-x","article-title":"Group signatures and more from isogenies and lattices:\n  generic, simple, and efficient","author":"Ward Beullens","year":"2023","journal-title":"Designs, Codes and Cryptography"},{"key":"ref101:ellnw15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-48797-6_12","article-title":"A Provably Secure Group Signature Scheme from Code-Based\n  Assumptions","author":"Martianus Frederic Ezerman","year":"2015"},{"key":"ref102:ezerman2020provably","doi-asserted-by":"publisher","first-page":"5754","DOI":"10.1109\/tit.2020.2976073","article-title":"Provably secure group signature schemes from code-based\n  assumptions","volume":"66","author":"Martianus Frederic Ezerman","year":"2020","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref103:pointcheval2016short","doi-asserted-by":"publisher","first-page":"111","DOI":"10.1007\/978-3-319-29485-8_7","article-title":"Short randomizable signatures","author":"David Pointcheval","year":"2016"},{"key":"ref104:bs04","doi-asserted-by":"publisher","first-page":"168","DOI":"10.1145\/1030083.1030106","article-title":"Group signatures with Verifier-Local revocation","author":"Dan Boneh","year":"2004"},{"key":"ref105:rst01","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45682-1_32","article-title":"How to Leak a Secret","author":"Ronald L. Rivest","year":"2001"},{"key":"ref106:crdasc94","doi-asserted-by":"publisher","first-page":"174","DOI":"10.1007\/3-540-48658-5_19","article-title":"Proofs of Partial Knowledge and Simplified Design of Witness\n  Hiding Protocols","volume":"839 of LNCS","author":"Ronald Cramer","year":"1994"},{"volume-title":"CryptoNote v 2.0","year":"2013","author":"Nicolas van Saberhagen","key":"ref107:saberhagen13"},{"key":"ref108:bkm06","doi-asserted-by":"publisher","DOI":"10.1007\/11681878_4","article-title":"Ring Signatures: Stronger Definitions, and Constructions\n  Without Random Oracles","author":"Adam Bender","year":"2006","journal-title":"Theory of Cryptography, Third Theory of Cryptography\n  Conference, TCC"},{"key":"ref109:park2019wasn","doi-asserted-by":"publisher","first-page":"159","DOI":"10.1007\/978-3-030-26954-8_6","article-title":"It wasn\u2019t me! Repudiability and claimability of ring\n  signatures","author":"Sunoo Park","year":"2019"},{"key":"ref110:gonzalez2019shorter","doi-asserted-by":"publisher","first-page":"99","DOI":"10.1007\/978-3-030-17253-4_4","article-title":"Shorter ring signatures from standard assumptions","author":"Alonso Gonz\u00e1lez","year":"2019"},{"key":"ref111:aos02","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-36178-2_26","article-title":"1-out-of-n Signatures from a Variety of Keys","author":"Masayuki Abe","year":"2002"},{"key":"ref112:branco2023universal","doi-asserted-by":"publisher","first-page":"249","DOI":"10.1007\/978-3-031-22972-5_9","article-title":"Universal Ring Signatures in the Standard Model","author":"Pedro Branco","year":"2023"},{"key":"ref113:bgls03","doi-asserted-by":"publisher","first-page":"416","DOI":"10.1007\/3-540-39200-9_26","article-title":"Aggregate and Verifiably Encrypted Signatures from Bilinear\n  Maps","volume":"2656 of LNCS","author":"Dan Boneh","year":"2003"},{"key":"ref114:cwly06","doi-asserted-by":"publisher","DOI":"10.1145\/1128817.1128861","article-title":"Ring Signatures without Random Oracles","author":"Sherman S. M. Chow","year":"2006","journal-title":"ASIACCS"},{"key":"ref115:Boyen07","doi-asserted-by":"publisher","first-page":"210","DOI":"10.1007\/978-3-540-72540-4_12","article-title":"Mesh signatures: How to leak a secret with unwitting and\n  unwilling participants","author":"Xavier Boyen","year":"2007"},{"key":"ref116:ss10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14577-3_12","article-title":"A CDH-Based Ring Signature Scheme with Short Signatures and\n  Public Keys","author":"Sven Sch\u00e4ge","year":"2010"},{"key":"ref117:sw07","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-71677-8_12","article-title":"Efficient Ring Signatures Without Random Oracles","author":"Hovav Shacham","year":"2007"},{"key":"ref118:dkns04","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24676-3_36","article-title":"Anonymous Identification in Ad Hoc Groups","author":"Yevgeniy Dodis","year":"2004"},{"key":"ref119:cl02full","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45708-9_5","article-title":"Dynamic Accumulators and Application to Efficient Revocation\n  of Anonymous Credentials","author":"Jan Camenisch","year":"2002"},{"key":"ref120:gk15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-46803-6_9","article-title":"One-Out-of-Many Proofs: Or How to Leak a Secret and Spend a\n  Coin","author":"Jens Groth","year":"2015"},{"key":"ref121:libert2018logarithmic","doi-asserted-by":"publisher","first-page":"288","DOI":"10.1007\/978-3-319-98989-1_15","article-title":"Logarithmic-size ring signatures with tight security from\n  the DDH assumption","author":"Beno\u00eet Libert","year":"2018"},{"key":"ref122:cgs07","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-73420-8_38","article-title":"Ring Signatures of Sub-linear Size Without Random Oracles","author":"Nishanth Chandran","year":"2007"},{"key":"ref123:ms17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-70697-9_5","volume-title":"Efficient Ring Signatures in the Standard Model","author":"Giulio Malavolta","year":"2017"},{"key":"ref124:backes2018signatures","doi-asserted-by":"publisher","first-page":"405","DOI":"10.1007\/978-3-030-03329-3_14","article-title":"Signatures with flexible public key: Introducing equivalence\n  classes for public keys","author":"Michael Backes","year":"2018"},{"key":"ref125:backes2019ring","doi-asserted-by":"publisher","first-page":"281","DOI":"10.1007\/978-3-030-17659-4_10","article-title":"Ring signatures: logarithmic-size, no setup\u2014from standard\n  assumptions","author":"Michael Backes","year":"2019"},{"key":"ref126:haque2022logarithmic","doi-asserted-by":"publisher","first-page":"437","DOI":"10.1007\/978-3-030-97131-1_15","article-title":"Logarithmic-size (linkable) threshold ring signatures in the\n  plain model","author":"Abida Haque","year":"2022"},{"volume-title":"Borromean ring signatures","year":"2015","author":"Greg Maxwell","key":"ref127:mp15"},{"key":"ref128:noether2020triptych","doi-asserted-by":"publisher","first-page":"337","DOI":"10.1007\/978-3-030-66172-4_22","article-title":"Triptych: logarithmic-sized linkable ring signatures with\n  applications","author":"Sarang Noether","year":"2020"},{"key":"ref129:liu2019lattice","doi-asserted-by":"publisher","first-page":"726","DOI":"10.1007\/978-3-030-29959-0_35","article-title":"A lattice-based linkable ring signature supporting stealth\n  addresses","author":"Zhen Liu","year":"2019"},{"key":"ref130:bk10","first-page":"86","article-title":"A Framework for Efficient Signatures, Ring Signatures and\n  Identity Based Encryption in the Standard Model","author":"Zvika Brakerski","year":"2010","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref131:llnw16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-49896-5_1","article-title":"Zero-Knowledge Arguments for Lattice-Based Accumulators:\n  Logarithmic-Size Ring Signatures and Group Signatures Without Trapdoors","author":"Beno\u00eet Libert","year":"2016"},{"key":"ref132:esgin2019matrict","doi-asserted-by":"publisher","first-page":"567","DOI":"10.1145\/3319535.3354200","article-title":"MatRiCT: efficient, scalable and post-quantum blockchain\n  confidential transactions protocol","author":"Muhammed F Esgin","year":"2019"},{"key":"ref133:esgin2022matrict+","doi-asserted-by":"publisher","first-page":"1281","DOI":"10.1109\/sp46214.2022.9833655","article-title":"MatRiCT+: More efficient post-quantum private blockchain\n  payments","author":"Muhammed F Esgin","year":"2022"},{"key":"ref134:esgin2019lattice","doi-asserted-by":"publisher","first-page":"115","DOI":"10.1007\/978-3-030-26948-7_5","article-title":"Lattice-based zero-knowledge proofs: new techniques for\n  shorter and faster constructions and applications","author":"Muhammed F Esgin","year":"2019"},{"key":"ref135:chatterjee2022note","doi-asserted-by":"publisher","first-page":"407","DOI":"10.1007\/978-3-030-97131-1_14","article-title":"A note on the post-quantum security of (ring) signatures","author":"Rohit Chatterjee","year":"2022"},{"key":"ref136:chatterjee2021compact","doi-asserted-by":"publisher","first-page":"282","DOI":"10.1007\/978-3-030-84242-0_11","article-title":"Compact ring signatures from learning with errors","author":"Rohit Chatterjee","year":"2021"},{"key":"ref137:yuen2021dualring","doi-asserted-by":"publisher","first-page":"251","DOI":"10.1007\/978-3-030-84242-0_10","article-title":"DualRing: generic construction of ring signatures with\n  efficient instantiations","author":"Tsz Hon Yuen","year":"2021"},{"key":"ref138:lyubashevsky2021smile","doi-asserted-by":"publisher","first-page":"611","DOI":"10.1007\/978-3-030-84245-1_21","article-title":"SMILE: set membership from ideal lattices with applications\n  to ring signatures and confidential transactions","author":"Vadim Lyubashevsky","year":"2021"},{"key":"ref139:zheng2007code","first-page":"154","article-title":"Code-based Ring Signature Scheme.","volume":"5","author":"Dong Zheng","year":"2007","journal-title":"Int. J. Netw. Secur."},{"key":"ref140:branco2019traceable","doi-asserted-by":"publisher","first-page":"387","DOI":"10.1007\/978-3-030-25510-7_21","article-title":"A traceable ring signature scheme based on coding theory","author":"Pedro Branco","year":"2019"},{"key":"ref141:branco2018code","doi-asserted-by":"publisher","first-page":"203","DOI":"10.1007\/978-3-030-01446-9_12","article-title":"A code-based linkable ring signature scheme","author":"Pedro Branco","year":"2018"},{"key":"ref142:beullens2020calamari","doi-asserted-by":"publisher","first-page":"464","DOI":"10.1007\/978-3-030-64834-3_16","article-title":"Calamari and Falafl: logarithmic (linkable) ring signatures\n  from isogenies and lattices","author":"Ward Beullens","year":"2020"},{"key":"ref143:katz2018improved","doi-asserted-by":"publisher","first-page":"525","DOI":"10.1145\/3243734.3243805","article-title":"Improved non-interactive zero knowledge with applications to\n  post-quantum signatures","author":"Jonathan Katz","year":"2018"},{"key":"ref144:derler2018post","doi-asserted-by":"publisher","first-page":"419","DOI":"10.1007\/978-3-319-79063-3_20","article-title":"Post-quantum zero-knowledge proofs for accumulators with\n  applications to ring signatures from symmetric-key primitives","author":"David Derler","year":"2018"},{"key":"ref145:goel2022efficient","doi-asserted-by":"publisher","first-page":"304","DOI":"10.2478\/popets-2022-0047","article-title":"Efficient set membership proofs using MPC-in-the-head","volume":"2022","author":"Aarushi Goel","year":"2022","journal-title":"Proceedings on Privacy Enhancing Technologies"},{"key":"ref146:liu2004linkable","doi-asserted-by":"publisher","first-page":"325","DOI":"10.1007\/978-3-540-27800-9_28","article-title":"Linkable spontaneous anonymous group signature for ad hoc\n  groups","volume":"4","author":"Joseph K Liu","year":"2004"},{"volume-title":"Concise Linkable Ring Signatures and Forgery Against\n  Adversarial Keys","year":"2019","author":"Brandon Goodell","key":"ref147:cryptoeprint:2019\/654"},{"volume-title":"Thring Signatures and their Applications to\n  Spender-Ambiguous Digital Currencies","year":"2018","author":"Brandon Goodell","key":"ref148:cryptoeprint:2018\/774"},{"key":"ref149:bresson2002threshold","doi-asserted-by":"publisher","first-page":"465","DOI":"10.1007\/3-540-45708-9_30","article-title":"Threshold ring signatures and applications to ad-hoc\n  groups","author":"Emmanuel Bresson","year":"2002"},{"key":"ref150:haque2020threshold","doi-asserted-by":"publisher","first-page":"423","DOI":"10.1007\/978-3-030-45388-6_15","article-title":"Threshold ring signatures: new definitions and post-quantum\n  security","author":"Abida Haque","year":"2020"},{"key":"ref151:aranha2022count","doi-asserted-by":"publisher","first-page":"379","DOI":"10.1007\/978-3-030-97131-1_13","article-title":"Count me in! extendability for threshold ring signatures","author":"Diego F Aranha","year":"2022"},{"key":"ref152:avitabile2023extendable","doi-asserted-by":"publisher","first-page":"281","DOI":"10.1007\/978-3-031-31368-4_11","article-title":"Extendable Threshold Ring Signatures with Enhanced\n  Anonymity","author":"Gennaro Avitabile","year":"2023"},{"key":"ref153:xu2004accountable","doi-asserted-by":"publisher","first-page":"271","DOI":"10.1007\/1-4020-8147-2_18","article-title":"Accountable ring signatures: A smart card approach","author":"Shouhuai Xu","year":"2004"},{"key":"ref154:bootle2016short","doi-asserted-by":"publisher","first-page":"243","DOI":"10.1007\/978-3-319-24174-6_13","article-title":"Short accountable ring signatures based on DDH","author":"Jonathan Bootle","year":"2016"},{"key":"ref155:feng2021traceable","doi-asserted-by":"publisher","first-page":"1111","DOI":"10.1007\/s10623-021-00863-x","article-title":"Traceable ring signatures: general framework and\n  post-quantum security","volume":"89","author":"Hanwen Feng","year":"2021","journal-title":"Designs, Codes and Cryptography"},{"key":"ref156:naor2002deniable","doi-asserted-by":"publisher","first-page":"481","DOI":"10.1007\/3-540-45708-9_31","article-title":"Deniable ring authentication","author":"Moni Naor","year":"2002"},{"key":"ref157:komano2006toward","doi-asserted-by":"publisher","first-page":"174","DOI":"10.1007\/11605805_12","article-title":"Toward the fair anonymous signatures: Deniable ring\n  signatures","author":"Yuichi Komano","year":"2006"},{"key":"ref158:lin2022repudiable","doi-asserted-by":"publisher","first-page":"103562","DOI":"10.1016\/j.csi.2021.103562","article-title":"Repudiable ring signature: Stronger security and\n  logarithmic-size","volume":"80","author":"Hao Lin","year":"2022","journal-title":"Computer Standards & Interfaces"},{"key":"ref159:cg18","doi-asserted-by":"publisher","first-page":"40","DOI":"10.1109\/eurospw.2018.00012","article-title":"How to squeeze a crowd: reducing bandwidth in mixing\n  cryptocurrencies","author":"Alishah Chator","year":"2018"},{"volume-title":"Bitcoin: A peer-to-peer electronic cash system, 2009","year":"2012","author":"S. Nakamoto","key":"ref160:nakamoto"},{"volume-title":"Elliptic Enterprises Limited","year":"2013","author":"Elliptic","key":"ref161:Elliptic13"},{"volume-title":"Chainalysis","year":"2014","author":"Blockchain Analysis","key":"ref162:BlockChainAnalaysis14"},{"volume-title":"Chainalysis Inc","year":"2015","author":"Chainalysis","key":"ref163:Chainalysis15"},{"key":"ref164:zerocoin","series-title":"SP '13","doi-asserted-by":"publisher","first-page":"397","DOI":"10.1109\/sp.2013.34","article-title":"Zerocoin: Anonymous Distributed E-Cash from Bitcoin","author":"Ian Miers","year":"2013"},{"key":"ref165:sasson2014zerocash","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2014.36","article-title":"Zerocash: Decentralized anonymous payments from Bitcoin","author":"Eli Ben Sasson","year":"2014"},{"key":"ref166:stark","article-title":"Scalable, transparent, and post-quantum secure computational\n  integrity","author":"Eli Ben-Sasson","year":"2018","journal-title":"IACR Cryptol. ePrint Arch."},{"key":"ref167:brakedown","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-38545-2_7","article-title":"Brakedown: Linear-time and post-quantum SNARKs for R1CS","author":"Alexander Golovnev","year":"2020"},{"key":"ref168:fractal","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-45721-1_27","article-title":"Fractal: Post-quantum and Transparent Recursive Proofs from\n  Holography","author":"Alessandro Chiesa","year":"2020"},{"key":"ref169:paquin11","volume-title":"U-prove cryptographic specification v1. 1","author":"Christian Paquin","year":"2011","journal-title":"Technical Report, Microsoft Corporation"},{"volume-title":"Microsoft open-sources clever U-Prove identity framework","year":"2010","author":"Peter Bright","key":"ref170:uproveArticle"},{"key":"ref171:bl13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-42045-0_5","article-title":"On the Security of One-Witness Blind Signature Schemes","author":"Foteini Baldimtsi","year":"2013"},{"volume-title":"An Efficient On-line Electronic Cash System Based on the\n  Representation Problem","year":"1993","author":"Stefan Brands","key":"ref172:brands93b"},{"key":"ref173:baldimtsi2013anonymous","doi-asserted-by":"publisher","first-page":"1087","DOI":"10.1145\/2508859.2516687","article-title":"Anonymous credentials light","author":"Foteini Baldimtsi","year":"2013"},{"volume-title":"Private ECDSA Verification using ZK: Motivation,\n  Optimizations & Security","year":"2023","author":"Pratyush Ranjan Tiwari","key":"ref174:blogECDSA"},{"key":"ref175:arom","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-30617-4_13","article-title":"Proof-Carrying Data from Arithmetized Random Oracles","author":"Megan Chen","year":"2023"},{"key":"ref176:prom","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-38551-3_8","article-title":"The Pseudorandom Oracle Model and Ideal Obfuscation","author":"Aayush Jain","year":"2023"},{"volume-title":"2017 Cadillac CTS Now Standard With V2V Technology","year":"2017","author":"Kelly Pleskot","key":"ref177:gmcRollout"},{"key":"ref178:sokAnonCred","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-30731-7_6","article-title":"SoK: Anonymous Credentials","author":"Saqib A. Kakvi","year":"2023"},{"key":"ref179:nakanishi2010revocable","doi-asserted-by":"publisher","first-page":"50","DOI":"10.1587\/transfun.e93.a.50","article-title":"Revocable group signature schemes with constant costs for\n  signing and verifying","volume":"93","author":"Toru Nakanishi","year":"2010","journal-title":"IEICE transactions on fundamentals of electronics,\n  communications and computer sciences"},{"key":"ref180:libert2009group","doi-asserted-by":"publisher","first-page":"498","DOI":"10.1007\/978-3-642-10433-6_34","article-title":"Group signatures with verifier-local revocation and backward\n  unlinkability in the standard model","author":"Beno\u00eet Libert","year":"2009"},{"key":"ref181:attrapadung2014revocable","doi-asserted-by":"publisher","first-page":"419","DOI":"10.1007\/978-3-319-07536-5_25","article-title":"A revocable group signature scheme from identity-based\n  revocation techniques: Achieving constant-size revocation list","author":"Nuttapong Attrapadung","year":"2014"},{"key":"ref182:cl02","doi-asserted-by":"publisher","first-page":"61","DOI":"10.1007\/3-540-45708-9_5","article-title":"Dynamic Accumulators and Application to Efficient Revocation\n  of Anonymous Credentials","author":"Jan Camenisch","year":"2002"},{"key":"ref183:baldimtsi2017accumulators","doi-asserted-by":"publisher","first-page":"301","DOI":"10.1109\/eurosp.2017.13","article-title":"Accumulators with applications to anonymity-preserving\n  revocation","author":"Foteini Baldimtsi","year":"2017"},{"key":"ref184:barpfi97","doi-asserted-by":"publisher","first-page":"480","DOI":"10.1007\/3-540-69053-0_33","article-title":"Collision-free accumulators and fail-stop signature schemes\n  without trees","volume":"1233 of LNCS","author":"Niko Bari\u0107","year":"1997"},{"key":"ref185:fujoka97b","doi-asserted-by":"publisher","first-page":"16","DOI":"10.1007\/bfb0052225","article-title":"Statistical Zero Knowledge Protocols to Prove Modular\n  Polynomial Relations","volume":"1294 of LNCS","author":"Eiichiro Fujisaki","year":"1997"},{"key":"ref186:galbraith2008pairings","doi-asserted-by":"publisher","first-page":"3113","DOI":"10.1016\/j.dam.2007.12.010","article-title":"Pairings for cryptographers","volume":"156","author":"Steven D Galbraith","year":"2008","journal-title":"Discrete Applied Mathematics"},{"key":"ref187:Joux04","doi-asserted-by":"publisher","first-page":"263","DOI":"10.1007\/s00145-004-0312-y","article-title":"A One Round Protocol for Tripartite Diffie-Hellman","volume":"17","author":"Antoine Joux","year":"2004","journal-title":"J. Cryptol."},{"key":"ref188:barreto2005pairing","doi-asserted-by":"publisher","DOI":"10.1007\/11693383_22","article-title":"Pairing-friendly elliptic curves of prime order","author":"Paulo SLM Barreto","year":"2005"},{"key":"ref189:nfs","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-53018-4_20","article-title":"Extended Tower Number Field Sieve: A New Complexity for\n  the Medium Prime Case","author":"Taechan Kim","year":"2016"},{"volume-title":"Switch from BN254 to BLS12-381","year":"2017","author":"Sean Bowe","key":"ref190:zcashswitch"},{"key":"ref191:brassard1983relativized","doi-asserted-by":"publisher","first-page":"877","DOI":"10.1109\/tit.1983.1056754","article-title":"Relativized cryptography","volume":"29","author":"Gilles Brassard","year":"1983","journal-title":"IEEE Transactions on Information Theory"},{"key":"ref192:br93","series-title":"CCS '93","article-title":"Random Oracles Are Practical: A Paradigm for Designing\n  Efficient Protocols","author":"Mihir Bellare","year":"1993"},{"key":"ref193:cgh04","doi-asserted-by":"publisher","DOI":"10.1145\/1008731.1008734","article-title":"The Random Oracle Methodology, Revisited","author":"Ran Canetti","year":"2004","journal-title":"J. ACM"},{"key":"ref194:boneh2011random","doi-asserted-by":"publisher","first-page":"41","DOI":"10.1007\/978-3-642-25385-0_3","article-title":"Random oracles in a quantum world","author":"Dan Boneh","year":"2011"},{"key":"ref195:shoup1997lower","doi-asserted-by":"publisher","first-page":"256","DOI":"10.1007\/3-540-69053-0_18","article-title":"Lower bounds for discrete logarithms and related problems","author":"Victor Shoup","year":"1997"},{"key":"ref196:maurer2005abstract","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/11586821_1","article-title":"Abstract models of computation in cryptography","author":"Ueli Maurer","year":"2005"},{"key":"ref197:dent2002adapting","doi-asserted-by":"publisher","first-page":"100","DOI":"10.1007\/3-540-36178-2_6","article-title":"Adapting the weaknesses of the random oracle model to the\n  generic group model","author":"Alexander W Dent","year":"2002"},{"key":"ref198:fuchsbauer2018algebraic","doi-asserted-by":"publisher","first-page":"33","DOI":"10.1007\/978-3-319-96881-0_2","article-title":"The algebraic group model and its applications","author":"Georg Fuchsbauer","year":"2018"},{"key":"ref199:10.1145\/3335741.3335757","isbn-type":"print","doi-asserted-by":"publisher","first-page":"329","DOI":"10.1145\/3335741.3335757","volume-title":"Providing Sound Foundations for Cryptography: On the Work of\n  Shafi Goldwasser and Silvio Micali","author":"Manuel Blum","year":"2019","ISBN":"https:\/\/id.crossref.org\/isbn\/9781450372664"},{"key":"ref200:canetti2007cryptography","doi-asserted-by":"publisher","first-page":"249","DOI":"10.1109\/focs.2007.70","article-title":"Cryptography from sunspots: How to use an imperfect\n  reference string","author":"Ran Canetti","year":"2007"},{"key":"ref201:fiat1986prove","doi-asserted-by":"publisher","first-page":"186","DOI":"10.1007\/3-540-47721-7_12","article-title":"How to prove yourself: Practical solutions to identification\n  and signature problems","author":"Amos Fiat","year":"1986"},{"key":"ref202:canetti2018fiat","doi-asserted-by":"publisher","first-page":"91","DOI":"10.1007\/978-3-319-78381-9_4","article-title":"Fiat-Shamir and correlation intractability from strong\n  KDM-secure encryption","author":"Ran Canetti","year":"2018"},{"key":"ref203:impagliazzo1995personal","doi-asserted-by":"publisher","first-page":"134","DOI":"10.1109\/sct.1995.514853","article-title":"A personal view of average-case complexity","author":"Russell Impagliazzo","year":"1995"},{"volume-title":"Secrecy, authentication, and public key systems.","year":"1979","author":"Ralph Charles Merkle","key":"ref204:merkle1979secrecy"},{"key":"ref205:bitansky2019complexity","doi-asserted-by":"publisher","first-page":"422","DOI":"10.1007\/978-3-030-36030-6_17","article-title":"On the complexity of collision resistant hash functions: New\n  and old black-box separations","author":"Nir Bitansky","year":"2019"},{"key":"ref206:abdalla2004minimal","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1007\/978-3-540-30191-2_1","article-title":"On the minimal assumptions of group signature schemes","author":"Michel Abdalla","year":"2004"},{"key":"ref207:goldwasser1988digital","doi-asserted-by":"publisher","first-page":"281","DOI":"10.1137\/0217017","article-title":"A digital signature scheme secure against adaptive\n  chosen-message attacks","volume":"17","author":"Shafi Goldwasser","year":"1988","journal-title":"SIAM Journal on computing"},{"key":"ref208:an2002security","doi-asserted-by":"publisher","first-page":"83","DOI":"10.1007\/3-540-46035-7_6","article-title":"On the security of joint signature and encryption","author":"Jee Hea An","year":"2002"},{"key":"ref209:bsz05","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30574-3_11","article-title":"Foundations of Group Signatures: The Case of Dynamic\n  Groups","author":"Mihir Bellare","year":"2005"},{"key":"ref210:chaum87b","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-47721-7_10","article-title":"A Secure and Privacy-Protecting Protocol for Transmitting\n  Personal Information Between Organizations","author":"David Chaum","year":"1987"},{"key":"ref211:lrsw99","series-title":"SAC '99","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-46513-8_14","article-title":"Pseudonym Systems","author":"Anna Lysyanskaya","year":"2000"},{"key":"ref212:brands00","isbn-type":"print","doi-asserted-by":"publisher","DOI":"10.7551\/mitpress\/5931.001.0001","volume-title":"Rethinking Public Key Infrastructures and Digital\n  Certificates: Building in Privacy","author":"Stefan A. Brands","year":"2000","ISBN":"https:\/\/id.crossref.org\/isbn\/0262024918"},{"key":"ref213:cl01","doi-asserted-by":"publisher","first-page":"93","DOI":"10.1007\/3-540-44987-6_7","article-title":"An Efficient System for Non-transferable Anonymous\n  Credentials with Optional Anonymity Revocation","volume":"2045 of LCNS","author":"Jan Camenisch","year":"2001"},{"key":"ref214:cl04","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-28628-8_4","article-title":"Signature Schemes and Anonymous Credentials from Bilinear\n  Maps","author":"Jan Camenisch","year":"2004"},{"key":"ref215:bcckls09","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-03356-8_7","article-title":"Randomizable Proofs and Delegatable Anonymous Credentials","author":"Mira Belenkiy","year":"2009"},{"key":"ref216:ggm14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23253","article-title":"Decentralized Anonymous Credentials","author":"Christina Garman","year":"2014"},{"volume-title":"Specification of the Identity Mixer Cryptographic Library","year":"2010","author":"Jan Camenisch","key":"ref217:camenisch10"},{"key":"ref218:cdh16","doi-asserted-by":"publisher","DOI":"10.1145\/2994620.2994625","article-title":"Scalable Revocation Scheme for Anonymous Credentials Based\n  on N-times Unlinkable Proofs","author":"Jan Camenisch","year":"2016"},{"key":"ref219:satter_2018","volume-title":"Emails: Lawyer who met Trump Jr. tied to Russian officials","author":"Raphael Satter","year":"2018","journal-title":"AP NEWS"},{"volume-title":"Authenticating Email Using DKIM and ARC, or How We Analyzed\n  the Kasowitz Emails","year":"2017","author":"Jeremy B. Merrill","key":"ref220:merrill_2017"},{"volume-title":"Here\u2019s how The Post analyzed Hunter Biden\u2019s laptop","year":"2022","author":"Craig Timberg","key":"ref221:timberg_2022"},{"key":"ref222:EpochalSigs","doi-asserted-by":"publisher","first-page":"1677","DOI":"10.1109\/sp40001.2021.00058","article-title":"Epochal Signatures for Deniable Group Chats","author":"Andreas H\u00fclsing","year":"2021"},{"key":"ref223:tds","doi-asserted-by":"publisher","first-page":"79","DOI":"10.56553\/popets-2023-0071","article-title":"Time-Deniable Signatures","volume":"2023","author":"Gabrielle Beck","year":"2023","journal-title":"Proc. Priv. Enhancing Technol."},{"key":"ref224:shortlived","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-22969-5_17","article-title":"Short-lived zero-knowledge proofs and signatures","author":"Arasu Arun","year":"2022"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2025,4,8]],"date-time":"2025-04-08T21:23:50Z","timestamp":1744147430000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/2\/1\/10"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4,8]]},"references-count":224,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,4,8]]}},"URL":"https:\/\/doi.org\/10.62056\/a3wa3z10k","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"type":"electronic","value":"3006-5496"}],"subject":[],"published":{"date-parts":[[2025,4,8]]},"assertion":[{"value":"2025-01-14","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-03-11","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc2-1-12"}}