Ring signature, introduced by Rivest et al. [Asiacrypt’01], allows a person to sign a document on behalf of an ad-hoc group (or ring) while hiding the identity of the actual signer. But the anonymity provided by the ring signature scheme can be used to conceal a malicious signer and put other ring members under suspicion. Fortunately, Park et al. [Crypto’19] proposed a repudiable ring signature scheme which can overcome this disadvantage. However, the construction of Park et al. [Crypto’19] is not compact, in other word, the size of signatures and repudiations in their scheme increases with the square of the ring size.

In this paper, we propose the first logarithmic-size repudiable ring signature scheme, which means the size of signatures and repudiations grows only logarithmically in the ring size. Moreover, in terms of security model, we present a new requirement (repudiation-unforgeability), which requires ‘no one can forge a valid repudiation’. Our scheme is the first repudiable ring signature scheme satisfies this new requirement.

环签名，由 Rivest 等人引入。[Asiacrypt'01]，允许一个人代表一个临时组（或环）签署文件，同时隐藏实际签署人的身份。但是环签名方案提供的匿名性可用于隐藏恶意签名者并使其他环成员受到怀疑。幸运的是，Park 等人。[Crypto'19] 提出了一种可否认的环签名方案，可以克服这个缺点。然而，Park 等人的建设。[Crypto'19] 并不紧凑，换句话说，他们方案中签名和否认的大小随着环大小的平方而增加。

在本文中，我们提出了第一个对数大小的可否认环签名方案，这意味着签名和否认的大小仅在环大小上呈对数增长。此外，在安全模型方面，我们提出了一个新的要求（repudiation-unforgeability），它要求“没有人可以伪造一个有效的拒绝”。我们的方案是第一个满足这一新要求的可否认环签名方案。