While studying ring signatures, I obviously stumbled on the Wikipedia article about ring signatures. It [includes a piece of Python code](https://en.wikipedia.org/w/index.php?title=Ring_signature&oldid=795547045) to demonstrate "How to leak a secret" ring signatures.

Remarkably, they do not use a symmetric encryption function ($E\_k$, as in "How to leak a secret"), but a hash function ($\mathcal{H}$). Indeed, the encryption function does not *need* to be invertible, if we close the ring of the signature at the very last (take $v^\prime$ random, $m$ is the hashed plaintext):

\begin{align\*}
\mathcal{H'}(x) &= \mathcal{H}(x\mathbin\Vert m)\\
v&=\mathcal{H'}(y\_{r} \oplus \mathcal{H'}(y\_{r-1} \oplus \mathcal{H'}(\ldots\oplus \mathcal{H'}(v'))))\quad r-s\enspace\text{times}\\
h&=\mathcal{H'}(y\_{s-1} \oplus \mathcal{H'}(y\_{s-2} \oplus \mathcal{H'}(\ldots\oplus \mathcal{H'}(y\_1 \oplus v))))
\end{align\*}

now notice that
$$
v'=y\_s \oplus h \quad\Leftrightarrow\quad y\_s=v'\oplus h\\
x\_s=g\_s^{-1}(y\_s)
$$

which "closes" the ring.

**What are the security implications here?** I can't seem to find literature describing this substitution.