"this hpp implements the merge of (relation R1 and R2) in ESORICS 2015" is which article?

[XinwenXiang]

hello, I'm doing some scheme's implementation, i want to ask in your nizk folder "this hpp implements the merge of (relation R1 and R2) in ESORICS 2015" is which article?

[XinwenXiang]

it may be the [BCC+15]? ,if is [BCC+15],it may lack some part. like in your accountable ring sig, you only count it should alson include the

[yuchen1024]

Thanks for your interest. Yes, ESORICS 2015 refers to "Short Accountable Ring Signatures Based on DDH". The implementation replaced ElGamal with twisted ElGamal. I cannot remember the details. I am not sure if this is the reason that the code is slight different from the protocol specified in the paper.

[XinwenXiang]

yeah, in your implementation you use twisted EIGamml, what is twisted ElGamal? and I also want to ask: In R_sig proof to R2, R2 want prove that N ElGamal Ciphertexts has a ciphertext encrypt '1', but in your code, you find the signer index,but but in [BCC+15] it really confused me (excuse me that our server has down last days, i can't run it thanks for your answer.

[yuchen1024]

I did not implement the original ESORICS 2015 protocol, but implemented a new protocol case tailored for twisted ElGamal (perhaps with some tiny optimization trick, I cannot remember the details for the moment). You can find more details about Twisted ElGamal in https://eprint.iacr.org/2019/319

[XinwenXiang]

thanks a lot.