Adding Linkability to Ring Signatures with One-Time Signatures

We propose a generic construction that adds linkability to any ring signature scheme with one-time signature scheme. Our construction has both theoretical and practical interest. In theory, the construction gives a formal and cleaner description for constructing linkable ring signature from ring signature directly. In practice, the transformation incurs a tiny overhead in size and running time. By instantiating our construction using the ring signature scheme (ACNS 2019) and the one-time signature scheme (TCHES 2018), we obtain a lattice-based linkable ring signature scheme whose signature size is logarithmic in the number of ring members. This scheme is practical, especially the signature size is very short: for $2^{30}$ ring members and 100 bit security, our signature size is only 4 MB. In addition, when proving the linkability we develop a new proof technique in the random oracle model, which might be of independent interes