<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd"> <html><body> <span id="mailbox-conversation"><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">Is anyone aware of any implementation of EC ring signatures *not* using pairing-based crypto? (If not, does anyone have any good ideas on the strategy to pursue in, e.g., Ed25519?)</span></div> <div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div> <div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">(I know that the original RST ("How to leak a secret") scheme has been shown insecure if public keys in the ring are been adversarially chosen. Though the citation is eluding me after several searches, I believe there is a scheme using ZAPs to fix this.)</span></div> <div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div> <div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">- David</span></div> <div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div> <div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">(PS If you are also on Messaging, apologies for the duplication; I mistakenly posted this there originally.)</span></div></span><div class="mailbox_signature">—<br>Sent using alpine: an Alternatively Licensed Program for Internet News and Email</div> </body></html>