Lattice-Based Group Signatures with Logarithmic Signature Size

Laguillaumie, Fabien; Langlois, Adeline; Libert, Benôıt; Stehlé, Damien

doi:10.1007/978-3-642-42045-0_3

Cited by 113 publications

(101 citation statements)

References 40 publications

(111 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Efficiency: For a security parameter n and for a group of N members, the group public key and the signature have bit-sizes O(n 2 ) · log N and O(n) · log N , respectively. This result is comparable to that of [22], and is a noticeable improvement over those of [19] and [13]. 4.…”

Section: Introductionsupporting

confidence: 64%

“…In particular, we introduce the first group signature with verifier-local revocation from lattice assumptions, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with known lattice-based group signatures, while the schemes from [19], [13] and [22] follow the CPA-anonymity and CCA-anonymity notions from [8,5], our construction satisfies the (weaker) notion of selfless-anonymity for VLR group signatures from [9]. Nevertheless, our scheme has several remarkable advantages over the contemporary counterparts: 1.…”

Section: Introductionmentioning

confidence: 95%

“…However, in their construction, the signatures size is still linear in N . Recently, Laguillaumie et al [22] designed a scheme featuring signature size O(log N ), which is the first lattice-based group signature that overcomes the linear-size barrier. We remark that all the above mentioned schemes follow the traditional sign-and-encrypt-and-prove paradigm: to enable the tracing mechanism, these schemes require the signer to encrypt some private information via certain type of encryption based on the Learning With Errors (LWE) problem, and then generate a sophisticated proof to prove particularly that the ciphertext is well-formed.…”

Section: Introductionmentioning

confidence: 99%

“…Relying on encryption to construct group signatures may imply two troublesome issues: firstly, it makes the construction less efficient; secondly, since the whole system is secure only if the underlying encryption scheme is secure, it usually leads to a relatively strong security assumption. In particular, the recent scheme by Laguillaumie et al [22] is only provably secure if there is no quantum algorithm to approximate the Shortest Independent Vectors Problem (SIVP γ ) on lattices of dimension n to within certain γ = O(n 8.5 ). This yields several interesting open questions in this direction: Is it possible to construct a scheme that supports membership revocation?…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

A lattice-based group signature scheme with verifier-local revocation

Ling

Nguyen

Roux-Langlois

et al. 2018

Theoretical Computer Science

View full text Add to dashboard Cite

Abstract. Support of membership revocation is a desirable functionality for any group signature scheme. Among the known revocation approaches, verifier-local revocation (VLR) seems to be the most flexible one, because it only requires the verifiers to possess some up-to-date revocation information, but not the signers. All of the contemporary VLR group signatures operate in the bilinear map setting, and all of them will be insecure once quantum computers become a reality. In this work, we introduce the first lattice-based VLR group signature, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with existing lattice-based group signatures, our scheme has several noticeable advantages: support of membership revocation, logarithmic-size signatures, and weaker security assumption. In the random oracle model, our scheme is proved to be secure based on the hardness of the SIVP O(n 1.5 ) problem in general lattices -an assumption that is as weak as those of state-of-the-art lattice-based standard signatures. Moreover, our construction works without relying on encryption schemes, which is an intriguing feature for group signatures.

show abstract

Section: Introductionsupporting

confidence: 64%

Section: Introductionmentioning

confidence: 95%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A lattice-based group signature scheme with verifier-local revocation

Ling

Nguyen

Roux-Langlois

et al. 2018

Theoretical Computer Science

View full text Add to dashboard Cite

show abstract

“…In particular, the Groth scheme applies efficient zero-knowledge proofs for bilinear groups, which are known as Groth-Sahai proofs [26]. In addition to these schemes, lattice-based constructions were proposed [24,33,32,13].…”

Section: Related Workmentioning

confidence: 99%

Group Signature with Deniability: How to Disavow a Signature

Ishida

Emura

Hanaoka³

et al. 2016

Cryptology and Network Security

View full text Add to dashboard Cite

Group signatures are a class of digital signatures with enhanced privacy. By using this type of signature, a user can sign a message on behalf of a specific group without revealing his identity, but in the case of a dispute, an authority can expose the identity of the signer. However, in some situations it is only required to know whether a specific user is the signer of a given signature. In this case, the use of a standard group signature may be problematic since the specified user might not be the signer of the given signature, and hence, the identity of the actual signer will be exposed.Inspired by this problem, we propose the notion of a deniable group signature, where, with respect to a signature and a user, the authority can issue a proof showing that the specified user is NOT the signer of the signature, without revealing the actual signer. We also describe a fairly practical construction by extending the Groth group signature scheme (ASIACRYPT 2007). In particular, a denial proof in our scheme consists of 96 group elements, which is about twice the size of a signature in the Groth scheme. The proposed scheme is provably secure under the same assumptions as those of the Groth scheme.

show abstract

Short and provable secure lattice-based signature scheme in the standard model

Wang

Liu

2016

Security Comm. Networks

View full text Add to dashboard Cite

This paper proposes a short lattice‐based signature scheme in the standard model. The proposed scheme is designed without using the lattice‐based delegation tools whose the verification key size and the signature length are both short. To achieve the provable security and shorten the verification key and the signature length, given a message with bit length l, we firstly encode the message into an m‐dimensional vector with the help of l + 1m‐dimensional public vectors, and then we use the Gaussian sample algorithm to sign the encoded result on the same lattice by the trapdoor basis. Hence, all the messages are signed on the same lattice in this paper. Moreover, the verification key of the proposed scheme only consists of one shared matrix and l + 1 public vectors. Simultaneously, the signature length of the proposed scheme is the same as that of the signature scheme in the random oracle model. Under the hardness of the shortest integer solution problem, the presented scheme is provable strong unforgeable under adaptive chosen‐message attack in the standard model. Copyright © 2016 John Wiley & Sons, Ltd.

show abstract

Lattice-Based Group Signatures with Logarithmic Signature Size

Cited by 113 publications

References 40 publications

A lattice-based group signature scheme with verifier-local revocation

A lattice-based group signature scheme with verifier-local revocation

Group Signature with Deniability: How to Disavow a Signature

Short and provable secure lattice-based signature scheme in the standard model

Contact Info

Product

Resources

About