We propose a generic construction of linkable ring signature from any compatible ring
signature scheme and one-time signature scheme. Our construction has both theoretical
and practical interest. In theory, our construction gives the first generic transformation
from ring signature to linkable ring signature, which brings at least two main benefits: first,
the transformation achieves the lowest bound of the complexity that constructing linkable
ring signature schemes. Second, ours preserves the anonymity of underlying ring signature
schemes. In practice, our transformation incurs a very small overhead in size and running
time. By instantiating our construction using the ring signature scheme (eprint 2018) and
the one-time signature scheme (TCHES 2018), we obtain a lattice-based linkable ring signature
scheme whose signature size is logarithmic in the number of ring members. This scheme is
practical, especially the signature size is very short: for $2^{30}$ ring members and security level
of 100-bit, our signature size is only 4MB.
In addition, we give a new proof approach in proving the linkability, which might be of
independent interest towards the proof in the random oracle model.