Group Signature with Constant Revocation Costs for Signers and Verifiers

Abstract

Abstract. Membership revocation, being an important property for applications of group signatures, represents a bottleneck in today's schemes. Most revocation methods require linear amount of work to be performed by unrevoked signers or verifiers, who usually have to obtain fresh update information (sometimes of linear size) published by the group manager. We overcome these disadvantages by proposing a novel group signature scheme, where computation costs for unrevoked signers and potential verifiers remain constant, and so is the length of the update information that must be fetched by these parties from the data published by the group manager. We achieve this complexity by increasing the amount of work at the group manager's side, which growths quadratic with the total number of members. This increase is acceptable since algorithms of the group manager are typically executed on resourceful devices. Our scheme uses a slightly modified version of the pairing-based dynamic accumulator, introduced by Camenisch, Kohlweiss, and Soriente (PKC 2009), which we implicitly combine with the short (non-revocable) group signature scheme by Boneh, Boyen, and Shacham (CRYPTO 2004). We prove that our revocable scheme satisfies the desired security properties of anonymity, traceability, and non-frameability in the random oracle model, although for better efficiency we resort to a somewhat stronger hardness assumption.

Secure and Anonymous Communication Technique: Formal Model and Its Prototype Implementation

“…3) Though signing/verification costs are constant, the size of gpk is O( √ N ) [22] or the size of RL is O(N ) [23]. 4) All costs are asymptotically quite efficient (less than O(log N )), but the real costs are inefficient [24], [19], [25].…”

Scalable Group Signatures with Revocation

“…The reason is that, in known pairing-based accumulators [53,27], public keys have linear size in the maximal number of accumulated values (unless one sacrifices the constant size of proofs of non-membership as in [5]), which would result in linear-size group public keys in straightforward implementations. Recently [35], Fan et al suggested a different way to use the accumulator of [27] and announced constant-size group public keys but their scheme still requires the group manager to publicize O(N ) values at each revocation. In a revocation mechanism along the lines of [29], Boneh, Boyen and Shacham [16] managed to avoid linear dependencies.…”

Privacy and security protection in cloud integrated sensor networks

“…Since Chaum and Van Heyst introduced the group signature concept in [98], researchers have proposed a large number of group signature schemes [99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118].…”

“…The security of the design relies on the strong Diffie-Hellman and the Decision Linear assumptions. Since then, various other group signatures built on bilinear maps have been proposed in [106,115,109,119,116,117,118,110,113,114]. Particularly, schemes [109,119] are designed to provide backward unlinkability for revoked users, i.e., even a member is revoked, signatures generated by this member before the revocation remain anonymous.…”

“…An improved revocation mechanism was to broadcast a message to all signers and verifiers such that non-revoked users can update their secret keys while revoked users cannot [102,104,107]. Recently, schemes [113,114], in which the revocation overhead is constant independently of the number of revoked members, have been proposed. However, the feature of constant revocation overhead in scheme [113] is achieved in the cost of large storage overhead, as the size of its public key is O(…”