Attribute-based signatures, as introduced by Maji et al. [MPR11] allow to generate anonymously a signature for a message on behalf of a signing policy. To sign a message, a private attribute that satises the signing policy has to be used. It is furthermore not possible to identify the actual signer based on the signature. Attribute-based signatures have some important properties for electronic voting, e.g., it guarantees that a vote has been submitted by an eligible voter without revealing her identity. To be fully applicable in that setting, attribute-based signatures must allow not only to determine when some signatures have been emitted by the same person, but also it has to easily detect when the signatures have been issued by dierent persons. In this thesis, we solve the aforementioned problems by constructing a linkable attribute-based signature (LABS) scheme for unbounded circuits in the random oracle model. We start by providing a generic construction of LABS schemes, where we dene both the linkability and exculpability properties. We also provide a concrete instantiation of our generic LABS construction from protocols based on lattices. We do it by introducing a new zero-knowledge proof of knowledge for proving possession of a valid signature of the lattice-based signature scheme of Boschini et al. [Bos+20].
