Group Signatures from Lattices: Simpler, Tighter, Shorter, Ring-Based

Abstract

Abstract. We introduce a lattice-based group signature scheme that provides several noticeable improvements over the contemporary ones: simpler construction, weaker hardness assumptions, and shorter sizes of keys and signatures. Moreover, our scheme can be transformed into the ring setting, resulting in a scheme based on ideal lattices, in which the public key and signature both have bitsize O(n·log N ), for security parameter n, and for group of N users. Towards our goal, we construct a new lattice-based cryptographic tool: a statistical zero-knowledge argument of knowledge of a valid message-signature pair for Boyen's signature scheme (Boyen, PKC'10), which potentially can be used as the building block to design various privacy-enhancing cryptographic constructions.

Zero-Knowledge Arguments for Lattice-Based PRFs and Applications to E-Cash

“…Stern-like systems are less efficient than those of the first family because each protocol execution admits a constant soundness error, requiring the protocols to be repeated ω(log λ) times in order to achieve a negligible soundness error. On the upside, Stern-like protocols do have perfect completeness and are capable of handling a wide range of lattice-based relations [69,74,72,71,70], especially when the witnesses are not only required to be small or binary, but should also have prescribed arrangements of coordinates. Moreover, unlike protocols of the first family, the extractor of Stern-like protocols are able to output witness vectors having exactly the same properties as those expected from valid witnesses.…”

“…Despite the scarcity of truly efficient zero-knowledge proofs in the latticesetting, a recent body of work successfully designed proof systems in privacypreserving protocols [67,58,68,13,84,74]. These results, however, only considered ring signatures [19,67], group signatures [58,68,69,13,84,74], group encryption [70] or building blocks [71] for anonymous credentials [36].…”

Zero-Knowledge Password Policy Check from Lattices

“…Stern's protocol was originally proposed for code-based cryptography, and adapted to lattices by Kawachi et al [29]. It was subsequently empowered by Ling et al [37] to handle the matrix-vector relations associated with the SIS and inhomogeneous SIS problems and extended to design several lattice-based schemes: group signatures [38,36,34,39], policy-based signatures [12] and group encryption [35]. The basic protocol has 3 moves.…”

“…These are less efficient than those of the first family because each protocol execution admits a constant soundness error, and require repeating protocols ω(log n) times, for a security parameter n, to achieve negligible soundness error. On the upside, Stern-like protocols have perfect completeness and can handle a wide range of lattice-based relations [38,36,12,34,35,39], especially when witnesses have to not only be small or binary, but also certain prescribed arrangement of coordinates. Furthermore, unlike protocols of the first family, the extractor of Stern-like protocols can output witness vectors with the same properties expected of valid witnesses.…”

Simpler Efficient Group Signatures from Lattices

“…A current and independent work of Ling, Nguyen and Wang [49] also try to design an efficient lattice-based group signature scheme. Specifically, by first constructing a nice Stern-type [59] NIZK protocol, they propose a scheme which excels previous ones in [44,45] by a constant factor in terms of efficiency, i.e., all the sizes are still proportional to log N .…”