A lattice-based group signature scheme with verifier-local revocation

Abstract

Abstract. Support of membership revocation is a desirable functionality for any group signature scheme. Among the known revocation approaches, verifier-local revocation (VLR) seems to be the most flexible one, because it only requires the verifiers to possess some up-to-date revocation information, but not the signers. All of the contemporary VLR group signatures operate in the bilinear map setting, and all of them will be insecure once quantum computers become a reality. In this work, we introduce the first lattice-based VLR group signature, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with existing lattice-based group signatures, our scheme has several noticeable advantages: support of membership revocation, logarithmic-size signatures, and weaker security assumption. In the random oracle model, our scheme is proved to be secure based on the hardness of the SIVP O(n 1.5 ) problem in general lattices -an assumption that is as weak as those of state-of-the-art lattice-based standard signatures. Moreover, our construction works without relying on encryption schemes, which is an intriguing feature for group signatures.

A Challenge-Response Assisted Authorisation Scheme for Data Access in Permissioned Blockchains

“…Meanwhile, this trading system can only ensure data integrity (signature) of messages but cannot provide confidentiality protection because messages between two edge nodes are plain to all permissioned nodes without any encryption. Furthermore, the issue of key revocation [ 22 , 23 ] is quite complicated and is not considered in such a large-scale decentralised system [ 24 ].…”

An Improved Group Signature Scheme with VLR over Lattices

“…At PKC 2014, Langiois et al [10] introduced the first GS over lattices to support membership revocation with verifier-local revocation (VLR) mechanism. Because of an improper design, there is a flaw of [10], this mistake is completely fixed, and a secure scheme [11] was provided. As an orthogonal problem of membership revocation, enrollment is also noteworthy, and this problem was first resolved by Libert et al [12].…”

“…Membership revocation is also noteworthy for GS, and the VLR mechanism is the most flexible choice in the mobile network that allows anonymous authentication. After the first GS-VLR over lattices was given by Langlois et al [10], some new constructions are proposed [11,16,17]. However, all schemes are within Bonsai trees [18] and featuring bitsizes of group public-key and member secret signing key proportional to log N; therefore, these schemes are not suitable for certain large group, the only two exceptions [19,20].…”

“…0 mod q. For (b), we first sample a uniformly random B ∈ Z n×m q (a matrix in an oracle), and a short random e ∈ Z m (a vector in a learning with errors (LWE) distribution), and let b � B T • grt i + emod grt as in [11]. For (a), because e i is an affirmative answer to…”

Accountable Tracing Signatures from Lattices

“…Nevertheless, regarding the supports of advanced functionalities, lattice-based group signatures are still way behind their number-theoretic-based counterparts. Indeed, there have been known only a few lattice-based schemes [32,31,28,35,36] that depart from the BMW model [2] -which deals solely with static groups and which may be too inflexible to be considered for a wide range of real-life applications. In particular, although there was an attempt [31] to restrict the power of the OA in the MDO sense, the problem of making the OA accountable in the context of lattice-based group signatures is still open.…”