While reading the Off-the-Record-Messaging paper by Nikita Borisov, Ian Goldberg and Eric Brewer, I came across the idea for "ring signatures" which allow a member of a group to sign a message in the name of the whole group. A third party then has no way of knowing who signed it, except for the fact that someone of that group did.

I was wondering if there was already an implementation of this on the internet or if I can even use off-the-shelf tools like GPG to create a ring signature.

  • What about this Python script?
    – techraf
    Commented Jul 8, 2016 at 1:08
  • My understanding of that script is that it basically produces a signature by using everyone's key to sign the same data (so it's time complexity increases linearly with the more input keys) I would propose that you could achieve the objective similarly by creating a single key that all parties will sign upon receipt of the private component along with all those parties signing eachother's keys. Any message generated with the shared key could be the result of any of the above signatories with verification of said signatures only needing to happen once (or upon addition/removal of a key)
    – Olipro
    Commented Jul 8, 2016 at 1:29

1 Answer 1


Ring signatures would require modification of the OpenPGP standard and it's implementations, so you won't be able to use them while staying compatible. In fact, there was a propsal in 2014 on the OpenPGP IETF mailing list, but I couldn't find any further follow-ups towards an RFC.

To achieve a similar effect without ring signatures (and the effort of setting up a group), OpenPGP already knows the concept of "group keys", in the end it boils down to setting a key flag indicating the key is shared among a group. From RFC 4880:  Key Flags

   (N octets of flags)

   This subpacket contains a list of binary flags that hold information
   about a key.  It is a string of octets, and an implementation MUST
   NOT assume a fixed size.  This is so it can grow over time.  If a
   list is shorter than an implementation expects, the unstated flags
   are considered to be zero.  The defined flags are as follows:


       0x80 - The private component of this key may be in the
              possession of more than one person.

I'm not aware though whether this flag can be set without fiddling with GnuPG's source code and compiling GnuPG on your own.

By sharing the key, user's will not be able to determine who signed a message. By signing all group member's keys with the group key, you can publish the list of possible signers.

Do not share the primary key but subkeys if you want to be able to escrow keys more easily (so if somebody leaves the group, all certifications from and on the key stay the same, but you can revoke the old subkey and only have to distribute a new signing subkey to everybody). You can also prevent the rest of the group from issuing certifications or generating/revoking new subkeys on their behalf at the same time.

  • 1
    Thanks! This is a nice solution, except that someone of the group could hand on the private key without anyone else noticing, which should be far less likely, if their personal keys "signed the ring". But I guess since there is no other option with readily available tools, I will accept this answer.
    – comfreak
    Commented Jul 9, 2016 at 17:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .