Keisuke Hara

TCS Journal 2025 Journal Article

A linkable ring signature scheme with unconditional anonymity in the standard model

• Keisuke Hara

Ring signatures allow a user to sign messages as a member of a set of users, which is called a ring. This primitive ensures that anybody can check that one of the members in a ring generate a signature, but cannot detect which member does. Linkable ring signature is a novel extension of ring signature in the sense that anyone can verify whether two signatures were generated by the same user or not. One of the desirable features on (linkable) ring signature is unconditional anonymity which provides signers everlasting anonymity. In 2014, Liu, Au, Susilo, and Zhou proposed the first linkable ring signature scheme with unconditional anonymity. Their scheme is only secure in the random oracle model and leaves to construct a scheme in the standard model as an open problem. In this paper, we solve their open problem and propose the first linkable ring signature scheme with unconditional anonymity in the standard model. Our scheme is constructed based on a non-interactive proof of knowledge, a (standard) signature scheme, a commitment scheme, and a vector commitment scheme with specializable universal common reference string.

TCS Journal 2024 Journal Article

A logarithmic-sized accountable ring signature scheme in the standard model

• Keisuke Hara

Ring signature and group signature are two major cryptographic primitives providing users anonymity and authentication simultaneously. While both primitives enable any user to sign messages as a member of a set of users, the feature of ring signature is that a signer can choose a group in an ad-hoc manner, which is called a ring, by itself. Conversely, in group signature, a group membership is managed by some trusted third party, which is called a group manager, and an (appropriate) accountability is provided for the group manager to identify illegal anonymous signers. Accountable ring signature (ARS) is a cryptographic primitive combining the features of ring signature and group signature. ARS allows signers to choose their groups (rings) in an ad-hoc manner, and at the same time, maintain accountability by forcing them to select a designated opener who can identify them. In this paper, we propose the first ARS scheme with O ( log ⁡ n ) signature size in the standard model (without depending on the random oracle methodology), where n is the size of a ring. More precisely, we propose a new generic construction of ARS based on (standard) signature, (standard) public key encryption, non-interactive zero-knowledge proof system, somewhere perfectly binding hash function, and public key encryption with non-interactive opening. All building blocks for our ARS scheme can be obtained under the decisional linear (DLIN) assumption over bilinear groups.

TCS Journal 2021 Journal Article

Tightly secure ring signatures in the standard model

• Keisuke Hara
• Keisuke Tanaka

Ring signatures allow a user to sign messages as a member of a set of users, which is called the ring. This primitive ensures that nobody can detect which member in the ring signs the message. Libert, Peters, and Qian (2018) [24] proposed the first tightly secure ring signature scheme with O ( log ⁡ n ) signature size in the random oracle model, where n is the size of a ring. To our knowledge, a tightly secure ring signature scheme has never been reported without depending on the random oracle methodology. In this paper, we propose two generic constructions of tightly secure ring signatures in the standard model. Our first (resp. , second) construction is secure in the common reference string model (resp. , the plain model). Both of our constructions are secure under the decisional linear assumption over the pairing groups. Our first generic construction has a more efficient instantiation than our second one. While our second generic construction does not have an efficient instantiation, its signature size achieves O ( log ⁡ n ) asymptotically, which is the same as one of the Libert et al. 's scheme.

TCS Journal 2019 Journal Article

Simulation-based receiver selective opening CCA secure PKE from standard computational assumptions

• Keisuke Hara
• Fuyuki Kitagawa
• Takahiro Matsuda
• Goichiro Hanaoka
• Keisuke Tanaka

In the situation where there are one sender and multiple receivers and the sender transmits ciphertexts of correlated plaintexts, a receiver selective opening (RSO) attack for a public key encryption (PKE) scheme considers adversaries that can corrupt some of the receivers and get their secret keys and plaintexts. Security against RSO attacks for a PKE scheme ensures confidentiality of ciphertexts of uncorrupted receivers. Simulation-based RSO security against chosen ciphertext attacks (SIM-RSO-CCA) is the strongest security notion in all RSO attack scenarios. Jia, Lu, and Li (2016) [19] proposed the first SIM-RSO-CCA secure PKE scheme. However, their scheme used indistinguishability obfuscation, which is not known to be constructed from any standard computational assumption. In this paper, we give two contributions for constructing SIM-RSO-CCA secure PKE from standard computational assumptions. Firstly, we propose a generic construction of SIM-RSO-CCA secure PKE using an IND-CPA secure PKE scheme and a non-interactive zero-knowledge proof system satisfying one-time simulation soundness. Secondly, we propose an efficient and concrete construction of SIM-RSO-CCA secure PKE based on the decisional Diffie-Hellman (DDH) assumption. Moreover, we give a method for efficiently expanding the plaintext space of the DDH-based construction. By applying this method to the construction, we obtain the first DDH-based SIM-RSO-CCA secure PKE scheme supporting a super-polynomially large plaintext space with compact ciphertexts.

AAAI Conference 2013 Conference Paper

A Mediation Mechanism for Automated Negotiating Agents Whose Utility Changes over Time

• Keisuke Hara
• Takayuki Ito