A Group Signature Scheme with Improved Efficiency (Extended Abstract)

Abstract

The concept of group signatures allows a group member to sign messages anonymously on behalf of the group. However, in the case of a dispute, the identity of a signature's originator can be revealed by a designated entity. In this paper we propose a new group signature scheme that is well suited for large groups, i.e., the length of the group's public key and of signatures do not depend on the size of the group. Our solution based on a variation of the RSA problem is more efficient than previous ones satisfying these requirements.

A Practical and Provably Secure Coalition-Resistant Group Signature Scheme

“…Extending the scheme to a blind group-signature scheme or to split the group manager into a membership manager and a revocation manager is straight-forward (cf. [CM98a,LR98]). …”

“…Moreover, our registration protocol is statistically zero-knowledge with respect to the group member's secrets. In contrast, in [CM98a] the group member is required to send the group manager the product of her secret, a prime of special form, and a random prime; such products are in principle susceptible to an attack due to Coppersmith [Cop96]. Moreover, our scheme is provably coalition-resistance against an adaptive adversary, whereas for the scheme by Camenisch and Michels [CM98a] this holds only for a static adversary.…”

“…Our new (group signature) scheme improves on the state-of-the-art exemplified by the scheme of Camenisch and Michels [CM98a] which is the only known scheme whose coalition-resistance is provable under a standard cryptographic assumption. In particular, our scheme's registration protocol (JOIN) for new members is an order of magnitude more efficient.…”

An Identity Escrow Scheme with Appointed Verifiers

“…For a user with secret key x, a group membership certificate for an appointed verifier V , will be a quin-tuple (s, Z, c, u, e) such that each of these values lies in the correct integer interval, u 2e = (a 0 a s 1 a x 2 Za c 4 ) 2 holds, and c is the encryption of the value log a3 Z mod n under V 's public key. We show that such a certificate is hard to forge under the strong RSA assumption [3,11,23,27,28] and the assumption that computing discrete logarithms modulo a modulus of this form is hard. On the other hand, if c is not an encryption of log a3 Z mod n, then this certificate is easy to forge (Lemma 3).…”

On the Security of Dynamic Group Signatures: Preventing Signature Hijacking

“…To address this, Bellare, Shi, and Zhang [3] extended the model of [2] to capture dynamic group signature schemes in which a user can dynamically join the group by engaging in a join protocol with the issuer. Furthermore, to reduce trust in the opener, the model adopts the approach by Camenisch and Michels [11], and requires that the opener produces a non-interactive and publicly verifiable proof that a given signature was produced by a given signer. The model introduces three formal security notions: anonymity, traceability, and non-frameability.…”