Foundations of Fully Dynamic Group Signatures

Bootle, Jonathan; Cerulli, Andrea; Chaidos, Pyrros; Ghadafi, Essam; Groth, Jens

doi:10.1007/978-3-319-39555-5_7

Cited by 75 publications

(33 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our main contribution is the first fully dynamic group signature from lattices. The scheme satisfies the strong security requirements put forward by Bootle et al [7], under the Short Integer Solution (SIS) and the Learning With Errors (LWE) assumptions. As in all previous lattice-based group signatures, our scheme is analyzed in the random oracle model.…”

Section: Introductionmentioning

confidence: 82%

“…We recall the definition and security notions of fully dynamic group signatures (FDGS) presented by Bootle et al [7]. An FDGS scheme involves the following entities: a group manager GM that determines who can join the group, a tracing manager TM who can open signatures, and a set of users who are potential group members.…”

Section: Fully Dynamic Group Signaturesmentioning

confidence: 99%

“…Several different approaches have been suggested [10,12,50,42,6] to address this problem, and notable pairing-based constructions supporting both dynamic joining and efficient revocation were given in [40,33,32]. Very recently, Bootle et al [7] pointed out a few shortcomings of previous models, and put forward stringent security notions for fully dynamic group signatures. They also demonstrated a construction satisfying these notions based on the decisional Diffie-Hellman (DDH) assumption, following a generic transformation from a secure accountable ring signature scheme [8].…”

Section: Introductionmentioning

confidence: 99%

“…It involves modular linear equations with bounded-norm secrets, and can be handled using Stern-like techniques from [35,28]. Now, to equip the obtained fully dynamic group signature scheme with the deniability functionality, we first incorporate Ishida et al's notion of deniability [22] into Bootle et al's model [7]. Then we describe how to make our scheme deniable, via a zero-knowledge argument of knowledge that a given Regev ciphertext [45] does not decrypt to a given message.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Lattice-based group signatures: Achieving full dynamicity (and deniability) with ease

Ling

Nguyen

Wang

et al. 2019

Theoretical Computer Science

View full text Add to dashboard Cite

Lattice-based group signature is an active research topic in recent years. Since the pioneering work by Gordon, Katz and Vaikuntanathan (Asiacrypt 2010), eight other schemes have been proposed, providing various improvements in terms of security, efficiency and functionality. However, most of the existing constructions work only in the static setting where the group population is fixed at the setup phase. The only two exceptions are the schemes by Langlois et al. (PKC 2014) that handles user revocations (but new users cannot join), and by Libert et al. (Asiacrypt 2016) which addresses the orthogonal problem of dynamic user enrollments (but users cannot be revoked).In this work, we provide the first lattice-based group signature that offers full dynamicity (i.e., users have the flexibility in joining and leaving the group), and thus, resolve a prominent open problem posed by previous works. Moreover, we achieve this non-trivial feat in a relatively simple manner. Starting with Libert et al.'s fully static construction (Eurocrypt 2016) -which is arguably the most efficient lattice-based group signature to date, we introduce simple-but-insightful tweaks that allow to upgrade it directly into the fully dynamic setting. More startlingly, our scheme even produces slightly shorter signatures than the former, thanks to an adaptation of a technique proposed by Ling et al. (PKC 2013), allowing to prove inequalities in zero-knowledge. The scheme satisfies the strong security requirements of Bootle et al.'s model (ACNS 2016), under the Short Integer Solution (SIS) and the Learning With Errors (LWE) assumptions.Furthermore, we demonstrate how to equip the obtained group signature scheme with the deniability functionality in a simple way. This attractive functionality, put forward by Ishida et al. (CANS 2016), enables the tracing authority to provide an evidence that a given user is not the owner of a signature in question. In the process, we design a zero-knowledge protocol for proving that a given LWE ciphertext does not decrypt to a particular message.

show abstract

Section: Introductionmentioning

confidence: 82%

Section: Fully Dynamic Group Signaturesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Lattice-based group signatures: Achieving full dynamicity (and deniability) with ease

Ling

Nguyen

Wang

et al. 2019

Theoretical Computer Science

View full text Add to dashboard Cite

show abstract

“…While such a tracing mechanism is necessary to ensure user accountability, it grants too much power to the opening authority. Indeed, in traditional models of group signatures, e.g., [2,23,7,3,24,54,8], the OA can break users' anonymity whenever he wants, and we do not have any method to verify whether this trust is well placed or not.…”

Section: Introductionmentioning

confidence: 99%

Accountable Tracing Signatures from Lattices

Ling

Nguyen

Wang

et al. 2019

Topics in Cryptology – CT-RSA 2019

View full text Add to dashboard Cite

Group signatures allow users of a group to sign messages anonymously in the name of the group, while incorporating a tracing mechanism to revoke anonymity and identify the signer of any message. Since its introduction by Chaum and van Heyst (EUROCRYPT 1991), numerous proposals have been put forward, yielding various improvements on security, efficiency and functionality. However, a drawback of traditional group signatures is that the opening authority is given too much power, i.e., he can indiscriminately revoke anonymity and there is no mechanism to keep him accountable. To overcome this problem, Kohlweiss and Miers (PoPET 2015) introduced the notion of accountable tracing signatures (ATS) -an enhanced group signature variant in which the opening authority is kept accountable for his actions. Kohlweiss and Miers demonstrated a generic construction of ATS and put forward a concrete instantiation based on number-theoretic assumptions. To the best of our knowledge, no other ATS scheme has been known, and the problem of instantiating ATS under post-quantum assumptions, e.g., lattices, remains open to date.In this work, we provide the first lattice-based accountable tracing signature scheme. The scheme satisfies the security requirements suggested by Kohlweiss and Miers, assuming the hardness of the Ring Short Integer Solution (RSIS) and the Ring Learning With Errors (RLWE) problems. At the heart of our construction are a lattice-based key-oblivious encryption scheme and a zero-knowledge argument system allowing to prove that a given ciphertext is a valid RLWE encryption under some hidden yet certified key. These technical building blocks may be of independent interest, e.g., they can be useful for the design of other lattice-based privacy-preserving protocols. Setup(λ):On input the security parameter λ, it outputs public parameter pp.pp is implicit for all algorithms below if not explicitly mentioned. KeyGen(pp): On input pp, it generates a key pair (pk, sk). KeyRand(pk): On input the public key pk, it outputs a new public key pk ′ for the same secret key. Enc(pk, m): On inputs pk and a message m, it outputs a ciphertext ct on this message. Dec(sk, ct): On inputs sk and ct, it outputs the decrypted message m ′ .Correctness. The above scheme must satisfy the following correctness requirement: For all λ, all pp ← Setup(λ), all (pk, sk) ← KeyGen(pp), all pk ′ ← KeyRand(pk), all m, Dec(sk, Enc(pk ′ , m)) = m.

show abstract

Efficient Group Signature Scheme Over NTRU Lattice

Yang

Yan

et al. 2018

Cloud Computing and Security

View full text Add to dashboard Cite

Foundations of Fully Dynamic Group Signatures

Cited by 75 publications

References 44 publications

Lattice-based group signatures: Achieving full dynamicity (and deniability) with ease

Lattice-based group signatures: Achieving full dynamicity (and deniability) with ease

Accountable Tracing Signatures from Lattices

Efficient Group Signature Scheme Over NTRU Lattice

Contact Info

Product

Resources

About