Accountable Ring Signatures from Symmetric-Key Primitives*

We propose an accountable ring signature scheme (ARS) that is constructed from only symmetric-key primitives; pseudorandom functions, hash functions and commitments. Introducing interaction between a user and an opener in the key-issuing phase, our ARS is a composition of the previous two schemes of the ring and group signatures that were proposed by Katz et al. at ACM-CCS 2018. It attains two non-trivial features. One is effective use of the Merkle trees to keep the length of a signature logarithmic to the size of a ring. The other is post-quantum security due to the security properties of the building blocks.