A short introduction to ring signatures

Traditional digital signatures have been around since the 1970s, and are one of the standard uses of asymmetric key cryptography. If you don’t know what that means, try watching this short introductory video. The summary is that traditional digital signatures mathematically prove exactly who wrote something, which is useful if you want to prevent someone from impersonating you on the internet, but not so useful for other applications like credible leaks or whistleblowing.

Ring signatures build on traditional digital signatures. The algorithm enables mathematical proofs that a message was written by one of a list of people, without revealing which one. They were introduced in a 2001 paper by Rivest, Shamir, and Tauman, under the title How to Leak a Secret. Their motivating example is a government insider who wants to pass a credible tip to a journalist. If the insider digitally signs it with his real name then the journalist will find it credible, but the insider is now exposed to retaliation. If the tip is given anonymously then the source is safe, but then the journalist has little reason to think it is genuine.

Ring signatures solve this dilemma by allowing the insider to sign the message using their own key together with the public keys of several colleagues. The journalist can then verify that the message came from someone inside that circle so the claim carries the credibility of the group. But no one, not the journalist nor anyone named in the ring, can prove who actually wrote it. In short, a ring signature lets you make incremental trades between your anonymity and your credibility, instead of being forced to choose between all of one or all of the other.

Importantly, assembling a ring requires no cooperation. You don't ask anyone's permission to include them, you just collect their public keys and build the ring yourself. Only your own contribution to the signature is genuine--every other member's is, in effect, forged. The other people named in your ring never agreed to be included, and may never even find out. This is what makes ring signatures powerful for the person who needs cover. The flip side is that the only sure way to never appear in someone else's ring is to never publish a public key at all.

Cryptography and digital signatures are still esoteric, but this might start to change if the Nostr network gets more adoption. If you haven’t heard of Nostr, you can think of it as similar to Twitter, but decentralized and based on digital signatures. Nostr users generate and hold their own key pairs, which means there is already a large set of real identities available for forging into a ring signature.

The OstrichSign console is a way to directly work with those keys in your web browser. It is a graphical front end for the nostringer scheme. A user can import Nostr keys, gather them into a ring, sign a message anonymously as an unknown member, or verify signatures that other people produce.

Caution:

• This is experimental software. It has not been through a formal security audit. Please test it out and play around with it but don't use it for anything real.
• There is no resetting or recoverying a Nostr key. Keep your private key in a password manager and consider using an event signer like Amber to prevent it from leaking.
• Nostr relays can see your traffic. Standard practice is to always connect through Tor or a VPN. Remember that deleting a note is only a request to the relays that host it.