@InProceedings{RST01,
  author = 	 { Ronald L. Rivest and Adi Shamir and Yael Tauman },
  title = 	 { How to Leak a Secret },
  pages = 	 { 552--565 },
  OPTurl =       { http://dx.doi.org/10.1007/3-540-45682-1_32 },
  doi =          { 10.1007/3-540-45682-1_32 },
  booktitle =    { Advances in Cryptology -- ASIACRYPT 2001 },
  date =         { 2001 },
  publisher =    { Springer },
  editor = 	 { Colin Boyd },
  isbn =         { 978-3-540-42987-6 },
  series = 	 { Lecture Notes in Computer Science },
  volume = 	 { 2248 },
  organization = { IACR },
  OPTyear =      { 2001 },
  OPTmonth =     { December 9--13, },                  
  eventdate =    { 2001-12-09/2001-12-13 },                  
  eventtitle =   { ASIACRYPT 2001 },                  
  venue =        { Gold Coast, Australia },                  
  keywords =     { signature scheme, ring signature scheme, signer-ambiguous signature scheme,
                   group signature scheme, designated verifier signature scheme },
  abstract =     { 
                  In this paper we formalize the notion of a \emph{ring
                  signature}, which makes it possible to specify a set
                  of possible signers without revealing which member
                  actually produced the signature.  Unlike group
                  signatures, ring signatures have no group managers,
                  no setup procedures, no revocation procedures, and
                  no coordination: any user can choose any set of
                  possible signers that includes himself, and sign any
                  message by using his secret key and the others'
                  public keys, without getting their approval or
                  assistance.  Ring signatures provide an elegant way
                  to leak authoritative secrets in an anonymous way, to
                  sign casual email in a way which can only be
                  verified by its intended recipient, and to solve
                  other problems in multiparty computations. The main
                  contribution of this paper is a new construction of
                  such signatures which is unconditionally
                  signer-ambiguous, provably secure in the random
                  oracle model, and exceptionally efficient: adding each
                  ring member increases the cost of signing or
                  verifying by a single modular multiplication and a
                  single symmetric encryption.  
                  },
}