How to create a ring signature?

Question

While reading the Off-the-Record-Messaging paper by Nikita Borisov, Ian Goldberg and Eric Brewer, I came across the idea for "ring signatures" which allow a member of a group to sign a message in the name of the whole group. A third party then has no way of knowing who signed it, except for the fact that someone of that group did.

I was wondering if there was already an implementation of this on the internet or if I can even use off-the-shelf tools like GPG to create a ring signature.

Answer 1

Ring signatures would require modification of the OpenPGP standard and it's implementations, so you won't be able to use them while staying compatible. In fact, there was a propsal in 2014 on the OpenPGP IETF mailing list, but I couldn't find any further follow-ups towards an RFC.

To achieve a similar effect without ring signatures (and the effort of setting up a group), OpenPGP already knows the concept of "group keys", in the end it boils down to setting a key flag indicating the key is shared among a group. From RFC 4880:

5.2.3.21.  Key Flags

   (N octets of flags)

   This subpacket contains a list of binary flags that hold information
   about a key.  It is a string of octets, and an implementation MUST
   NOT assume a fixed size.  This is so it can grow over time.  If a
   list is shorter than an implementation expects, the unstated flags
   are considered to be zero.  The defined flags are as follows:

[...]

       0x80 - The private component of this key may be in the
              possession of more than one person.

I'm not aware though whether this flag can be set without fiddling with GnuPG's source code and compiling GnuPG on your own.

By sharing the key, user's will not be able to determine who signed a message. By signing all group member's keys with the group key, you can publish the list of possible signers.

Do not share the primary key but subkeys if you want to be able to escrow keys more easily (so if somebody leaves the group, all certifications from and on the key stay the same, but you can revoke the old subkey and only have to distribute a new signing subkey to everybody). You can also prevent the rest of the group from issuing certifications or generating/revoking new subkeys on their behalf at the same time.