A short introduction to ring signatures

Most of the time, a digital signature is meant to tell you exactly who is speaking. You sign a message with your private key, and anyone who holds the matching public key can confirm that the message came from you and from no one else. That certainty is the entire point of an ordinary signature, but sometimes it's not quite what you want.

(If public and private keys are unfamiliar, this short video will make the rest of this page easier to follow.)

There are situations where you want to prove that a message came from someone within a particular group, while making it impossible to tell which member it was. That’s what a ring signature enables. It lets you sign on behalf of multiple public keys — your own and any number of others — so that a verifier can confirm the signature was produced by one of those keys but learns nothing more than that.

Ring signatures were introduced in a 2001 paper by Rivest, Shamir, and Tauman, under the title How to Leak a Secret. Their motivating example is a government insider who wants to pass a credible tip to a journalist. If the insider digitally signs it with his real name then the journalist will find it credible, but the insider is now exposed to retaliation. If the tip is given anonymously then the source is safe, but the journalist has little reason to think it is genuine.

A ring signature can bridge that gap. The insider signs the message using their own key together with the public keys of several colleagues. The journalist can then verify that the message came from someone inside that circle — so the claim carries the credibility of the group — and yet no one, the journalist included, can prove who actually wrote it. In a sentence: a ring signature lets you trade incrementally between your anonymity and your credibility, instead of being forced to sacrifice all of one to keep the other.

The crucial feature is that assembling a ring requires no cooperation. You do not ask anyone's permission to include them, you simply collect their public keys and assemble the ring yourself. Only your own contribution to the signature is genuine, while every other member's is, in effect, forged. The other people named in your ring never agreed to be included, and may never even find out that they were. This feature is what makes ring signatures powerful for the person who needs cover. On the other hand, it means that the only sure way never to be named in someone's ring signature is to never share a public key at all.

The modern internet has come to rely on centralized custodians of identity like Google, Apple, and Meta. That is why a forgotten password is a minor nuisance rather than a disaster, but it's also why few people have ever even heard of the benefits of public key cryptography. That has started to change now that Nostr has been around for a few years. It is an open protocol whose users generate and hold their own key pairs, which means there is already a large and growing set of real identities ready for forging into a ring signature.

The OstrichSign console is a way to work with those keys directly, in your browser. A user can import Nostr keys, gather them into a ring, sign a message anonymously as an unknown member, and verify signatures that other people produce. It is a graphical front end for the nostringer scheme, with every step running locally on the user’s machine.

A few cautions before you try it

• This is experimental and has not been through a formal security audit. Treat it as something to learn with, not something to lean on when the stakes are real.
• Your Nostr keys are entirely your own responsibility. There is no recovery and no reset.
• Relays can see who reads and writes through them. Anyone using this for genuine cover should connect through Tor or a VPN and choose relays with care, and should remember that deleting a note is only a request to the relays that hold it, never a guarantee.
• Because rings are built without consent, anyone can be named in one — including alongside people they would rather not be grouped with.

When you are ready, open the console and build a ring.