@InBook{RST06,
  author =       { Ronald L. Rivest and Adi Shamir and Yael Tauman },
  title =        { How to Leak a Secret: Theory and Application of Ring Signatures },
  date =         { 2006-01 },
  editor =       { Oded Goldreich and Arnold L. Rosenberg and Alan L. Selman },                  
  bookTitle =    { Theoretical Computer Science: Essays in Memory of Shimon Even },
  publisher =    { Springer },
  pages =        { 164--186 },                  
  abstract =     { In this work we formalize the notion of a ring
                  signature, which makes it possible to specify a set
                  of possible signers without revealing which member
                  actually produced the signature. Unlike group
                  signatures, ring signatures have no group managers,
                  no setup procedures, no revocation procedures, and
                  no coordination: any user can choose any set of
                  possible signers that includes himself, and sign any
                  message by using his secret key and the others'
                  public keys, without getting their approval or
                  assistance. Ring signatures provide an elegant way
                  to leak authoritative secrets in an anonymous way,
                  to sign casual email in a way that can only be
                  verified by its intended recipient, and to solve
                  other problems in multiparty computations.  
                  \par
                  Our main
                  contributio n lies in the presentation of efficient
                  constructions of ring signatures; the general
                  concept itself (under different terminology) was
                  first introduced by Cramer et al. [CDS94].
                  Our constructions of such signatures are unconditionally
                  signer-ambiguous, secure in the random oracle model,
                  and exceptionally efficient: adding each ring member
                  increases the cost of signing or verifying by a
                  single modular multiplication and a single symmetric
                  encryption. We also describe a large number of
                  extensions, modifications and applications of ring
                  signatures which were published after the original
                  version of this work (in Asiacrypt 2001).  },
  isbn =         { 978-3-540-32881-0 },
  doi =          { 10.1007/11685654_7 },
  url =          { https://doi.org/10.1007/11685654_7 },
}