Design and analysis of "flexible" k-out-of-n signatures

This paper presents a new kind of (k,n)-threshold ring signature ((k,n)-ring signature) which is just a combination of k (1,n)-ring signatures. Our construction guarantees that a single signer can close at most one ring so the result of the combination is the required (k,n)-ring signature. This construction is useful in, for example, electronic negotiations or games where gradual revelation on how many people signed a given document is required. It also provides flexibility of the threshold k. The threshold-flexibility means that, in our scheme, we can change a (k,n)-ring signature into a (k′,n)-ring signature for any k′ ≤ n without revoking the original (k,n)-ring signature. This is useful for signers to withdraw their signatures afterward and/or is useful for new signers to add their (partial of the ring) signatures into the original ring signature. In addition, when k′ < k, this modification requires no extra computation. The security of the proposed scheme is proved in the random oracle model based on the hardness of the discrete logarithm problem and the intractability of inverting cryptographic one-way hash functions.