One-Shot Fiat-Shamir-Based NIZK Arguments of Composite Residuosity and Logarithmic-Size Ring Signatures in the Standard Model

The standard model security of the Fiat-Shamir transform has been an active research area for many years. In breakthrough results, Canetti et al. (STOC’19) and Peikert-Shiehian (Crypto’19) showed that, under the Learning-With-Errors ( 𝖫𝖶𝖤_ ) assumption, it provides soundness by applying correlation-intractable (CI) hash functions to so-called trapdoor -protocols. In order to be compatible with CI hash functions based on standard 𝖫𝖶𝖤_ assumptions with polynomial approximation factors, all known such protocols have been obtained via parallel repetitions of a basic protocol with binary challenges. In this paper, we consider languages related to Paillier’s composite residuosity assumption ( 𝖣𝖢𝖱 ) for which we give the first trapdoor -protocols providing soundness in one shot, via exponentially large challenge spaces. This improvement is analogous to the one enabled by Schnorr over the original Fiat-Shamir protocol in the random oracle model. Using the correlation-intractable hash function paradigm, we then obtain simulation-sound NIZK arguments showing that an element of ℤ_N^2^* is a composite residue, which opens the door to space-efficient applications in the standard model. As a concrete example, we build logarithmic-size ring signatures (assuming a common reference string) with the shortest signature length among schemes based on standard assumptions in the standard model. We prove security under the 𝖣𝖢𝖱 and 𝖫𝖶𝖤_ assumptions, while keeping the signature size comparable with that of random-oracle-based schemes.