Linkable Ring Signatures on Pairing-Friendly curves I'm working on a pairing-friendly (Barreto-Naehrig) elliptic curve. If I understand correctly, one consequence of this is that the Decisional Diffie-Hellman assumption no longer holds, but the Computational Diffie-Hellman assumption still should.

I'd like to be able to construct linkable ring signatures, but all the linkable ring signature schemes I know of depend on DDH for their anonymity proofs, and none of the pairing-based ring signature schemes I know of are linkable.

Are there any linkable ring signature schemes that are usable on pairing-friendly curves?
As I know, the pairing on bn-curve is type 3, $G_1\times G_2\rightarrow G_T$.
In CryptoNote, the key image is $I=H(P)^x$ and it can't be attacked if $H(*)$ and $P$ belong to same group.

See my question related.