Separability and Efficiency for Generic Group Signature Schemes

Abstract

A cryptographic protocol possesses separability if the participants can choose their keys independently of each other. This is advantageous from a key-management as well as from a security point of view. This paper focuses on separability in group signature schemes. Such schemes allow a group member to sign messages anonymously on the group's behalf. However, in case of this anonymity's misuse, a trustee can reveal the originator of a signature. We provide a generic fully separable group signature scheme and present an efficient instantiation thereof. The scheme is suited for large groups; the size of the group's public key and the length of signatures do not depend on the number of group member. Its efficiency is comparable to the most efficient schemes that do not offer separability and is an order of magnitude more efficient than a previous scheme that provides partial separability. As a side result, we provide efficient proofs of the equality of two discrete logarithms from different groups and, more general, of the validity of polynomial relations in Zamong discrete logarithms from different groups.

Efficient Proofs that a Committed Number Lies in an Interval

“…Such kind of proofs are intensively used in several schemes: electronic cash systems [7], group signatures [11], publicly verifiable secret sharing schemes [17,4], and other zero-knowledge protocols (e.g. [13,10]).…”

Controlling Access to an Oblivious Database Using Stateful Anonymous Credentials

“…We use several standard results for proving statements about discrete logarithms, such as (1) a proof of knowledge of a discrete logarithm modulo a prime [33] or a composite [26,24], (2) a proof of knowledge of equality of representation modulo two (possibly different) prime [19] or composite [14] moduli, (3) a proof that a commitment opens to the product of two other committed values [13,16,6], and (4) a proof of the disjunction or conjunction of any two of the previous [22]. These composite-based protocols are secure under Strong RSA and the prime-based ones under the discrete logarithm assumption.…”

Statistically Hiding Sets

“…Subsequently it has been studied extensively and used in a variety of cryptographic applications (for e.g. [17,12,8,2,7,3,28]). The second assumption we make is a Knowledge-of-Exponent Assumption (KEA).…”

“…Consider the following mapping: first map the given binary string unambiguously to a sufficiently large integer t (but not larger than 2 poly(k) ). 8 Then map it to the smallest prime number greater than t 2 .…”