Mathematics behind the paper "how to leak a secret" for ring signature
From the paper, $E$ is a cipher, i.e., $E_k$ is a permutation. That is, given a secret key $k$, one can compute both the encryption $y=E_k(x)$ (for any $x$) and the decryption $x=E^{-1}_k(y)$ (for any $y$). Therefore, if you know $z$ and all but one $y_i$, you can pick a $v$ (which equals $z$ in the context of ring signature) and get the missing $y_s$ by computing the XOR of $s-1$ $E_k$ encryptions starting from "inside" of the $E(E(...))$ expression and $r-s$ $E_k^{-1}$ decryptions starting from "outside". For instance, if $r=3$ and $s=2$, then $y_2=E_k(y_1\oplus v)\oplus E^{-1}_k(E^{-1}_k(z)\oplus y_3)$.