A Group Signature Scheme from Lattice Assumptions

Gordon, Steven; Katz, Jonathan; Vaikuntanathan, Vinod

doi:10.1007/978-3-642-17373-8_23

Cited by 179 publications

(141 citation statements)

References 27 publications

(61 reference statements)

Supporting

Mentioning

139

Contrasting

Order By: Relevance

“…Efficiency: For a security parameter n and for a group of N members, the group public key and the signature have bit-sizes O(n 2 ) · log N and O(n) · log N , respectively. This result is comparable to that of [22], and is a noticeable improvement over those of [19] and [13]. 4.…”

Section: Introductionsupporting

confidence: 61%

“…In particular, we introduce the first group signature with verifier-local revocation from lattice assumptions, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with known lattice-based group signatures, while the schemes from [19], [13] and [22] follow the CPA-anonymity and CCA-anonymity notions from [8,5], our construction satisfies the (weaker) notion of selfless-anonymity for VLR group signatures from [9]. Nevertheless, our scheme has several remarkable advantages over the contemporary counterparts: 1.…”

Section: Introductionmentioning

confidence: 96%

“…To the best of our knowledge, three lattice-based group signature schemes have been proposed, but none of them supports membership revocation. The first one was introduced by Gordon et al [19] in 2010. While their scheme is of great theoretical interest, its signatures have size O(N ), where N is the number of group users.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A lattice-based group signature scheme with verifier-local revocation

Ling

Nguyen

Roux-Langlois

et al. 2018

Theoretical Computer Science

View full text Add to dashboard Cite

Abstract. Support of membership revocation is a desirable functionality for any group signature scheme. Among the known revocation approaches, verifier-local revocation (VLR) seems to be the most flexible one, because it only requires the verifiers to possess some up-to-date revocation information, but not the signers. All of the contemporary VLR group signatures operate in the bilinear map setting, and all of them will be insecure once quantum computers become a reality. In this work, we introduce the first lattice-based VLR group signature, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with existing lattice-based group signatures, our scheme has several noticeable advantages: support of membership revocation, logarithmic-size signatures, and weaker security assumption. In the random oracle model, our scheme is proved to be secure based on the hardness of the SIVP O(n 1.5 ) problem in general lattices -an assumption that is as weak as those of state-of-the-art lattice-based standard signatures. Moreover, our construction works without relying on encryption schemes, which is an intriguing feature for group signatures.

show abstract

Section: Introductionsupporting

confidence: 61%

Section: Introductionmentioning

confidence: 96%

See 1 more Smart Citation

A lattice-based group signature scheme with verifier-local revocation

Ling

Nguyen

Roux-Langlois

et al. 2018

Theoretical Computer Science

View full text Add to dashboard Cite

show abstract

“…In particular, the Groth scheme applies efficient zero-knowledge proofs for bilinear groups, which are known as Groth-Sahai proofs [26]. In addition to these schemes, lattice-based constructions were proposed [24,33,32,13].…”

Section: Related Workmentioning

confidence: 99%

Group Signature with Deniability: How to Disavow a Signature

Ishida

Emura

Hanaoka³

et al. 2016

Cryptology and Network Security

View full text Add to dashboard Cite

Group signatures are a class of digital signatures with enhanced privacy. By using this type of signature, a user can sign a message on behalf of a specific group without revealing his identity, but in the case of a dispute, an authority can expose the identity of the signer. However, in some situations it is only required to know whether a specific user is the signer of a given signature. In this case, the use of a standard group signature may be problematic since the specified user might not be the signer of the given signature, and hence, the identity of the actual signer will be exposed.Inspired by this problem, we propose the notion of a deniable group signature, where, with respect to a signature and a user, the authority can issue a proof showing that the specified user is NOT the signer of the signature, without revealing the actual signer. We also describe a fairly practical construction by extending the Groth group signature scheme (ASIACRYPT 2007). In particular, a denial proof in our scheme consists of 96 group elements, which is about twice the size of a signature in the Groth scheme. The proposed scheme is provably secure under the same assumptions as those of the Groth scheme.

show abstract

“…To handle this, we prove that, given (x j ) j≤i and all the keys (h j ) j≤N , the adversary cannot distinguish P i,π i (k) from the original signals. For this purpose, we exploit a technique from [28] to simulate (h j ) i<j≤N from the public information. Theorem 28.…”

Section: Public Traceability From Projective Samplingmentioning

confidence: 99%

Hardness of k-LWE and Applications in Traitor Tracing

Ling

Phan

Stehlé

et al. 2014

Advances in Cryptology – CRYPTO 2014

View full text Add to dashboard Cite

Abstract. We introduce the k-LWE problem, a Learning With Errors variant of the k-SIS problem. The Boneh-Freeman reduction from SIS to k-SIS su ers from an exponential loss in k. We improve and extend it to an LWE to k-LWE reduction with a polynomial loss in k, by relying on a new technique involving trapdoors for random integer kernel lattices. Based on this hardness result, we present the rst algebraic construction of a traitor tracing scheme whose security relies on the worst-case hardness of standard lattice problems. The proposed LWE traitor tracing is almost as e cient as the LWE encryption. Further, it achieves public traceability, i.e., allows the authority to delegate the tracing capability to untrusted parties. To this aim, we introduce the notion of projective sampling family in which each sampling function is keyed and, with a projection of the key on a well chosen space, one can simulate the sampling function in a computationally indistinguishable way. The construction of a projective sampling family from k-LWE allows us to achieve public traceability, by publishing the projected keys of the users. We believe that the new lattice tools and the projective sampling family are quite general that they may have applications in other areas. so that a master can generate a large number of secret keys for the same public key. As a result, the latter encryption scheme, called dual-Regev, can be naturally extended into a multi-receiver encryption scheme. In the present work, we build traitor tracing schemes from this dual-Regev LWE-based encryption scheme.Traitor tracing. A traitor tracing scheme is a multi-receiver encryption scheme where malicious receiver coalitions aiming at building pirate decryption devices are deterred by the existence of a tracing algorithm: Using the pirate decryption device, the tracing algorithm can recover at least one member of the malicious coalition. Such schemes are particularly well suited for ghting copyright infringement in the context of

show abstract

A Group Signature Scheme from Lattice Assumptions

Cited by 179 publications

References 27 publications

A lattice-based group signature scheme with verifier-local revocation

A lattice-based group signature scheme with verifier-local revocation

Group Signature with Deniability: How to Disavow a Signature

Hardness of k-LWE and Applications in Traitor Tracing

Contact Info

Product

Resources

About