Timed Anonymous Ring Signature With Application to Bidding Systems

Ring signatures enable a user to sign a message on behalf of a group while preserving both anonymity and unforgeability. Despite these strong privacy guarantees, they present regulatory challenges. To address these issues, we introduce a novel cryptographic primitive: <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">timed anonymous ring signatures</i> (TARS). Unlike group signatures, which rely on a trusted third party, TARS maintains the decentralization and unforgeability of traditional ring signatures while incorporating <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">timed anonymity</i>, allowing the signer’s identity to be disclosed by any user after a predetermined time period, denoted as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>. To realize this, we propose a new CCA-secure <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">timed public key encryption</i> (TPKE) scheme that ensures correct decryption without the secret key after the time <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>. Building upon TPKE, we present two concrete TARS constructions that guarantee anonymity until time <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> and unforgeability at all times. To demonstrate its applicability, we apply TARS to a decentralized bidding system that is anticollusion between the auctioneer and the bidders. The system ensures anonymous bidding while disclosing the winner’s identity after the bid announcement, maintaining a transparent, fair, and decentralized bidding process. Finally, experimental evaluations confirm the practicality and efficiency of the proposed schemes. Crucially, the TARS scheme extends conventional ring signature schemes with timed anonymity by introducing only a moderate computational overhead (experimentally measured at ≈1.37 seconds under our configuration) while preserving their cryptographic robustness.