Revocable Group Signature Schemes with Constant Costs for Signing and Verifying

Abstract

Lots of revocable group signature schemes have been proposed so far. In one type of revocable schemes, signing and/or verifying algorithms have O(N) or O(R) complexity, where N is the group size and R is the number of revoked members. On the other hand, in Camenisch-Lysyanskaya scheme and the followers, signing and verifying algorithms have O(1) complexity. However, before signing, updates of the secret key are required. The complexity is O(R) in the worst case. In this paper, we propose a revocable scheme with signing and verifying of O(1) complexity, where no updates of secret key are required. The compensation is the long public key of O(N). In addition, we extend it to the scheme with O(√ N)-size public key, where signing and verifying have constant extra costs.

Foundations of Fully Dynamic Group Signatures

“…We show that some state of the art constructions, as [NFHF09,LPY12b,LPY12a], are susceptible to this attack. Specifically, their membership certificates are not bound to the epochs of their issuance.…”

“…[NFHF09,LPY12b,LPY12a] are also specific to those approaches and have their own shortcomings. For instance, as discussed earlier, the models used by the state-of-the-art constructions by Libert et al [LPY12b,LPY12a] and Nakanishi et al [NFHF09] do not prevent a group member from being able to sign w.r.t. time intervals before she joined the group.…”

“…This is an attack that can be problematic in some applications of the primitive. In the traceability game used in [NFHF09] as well as the misidentification game used in [LPY12b,LPY12a], the adversary is required to output a signature that is valid w.r.t. the current interval (epoch) and therefore the definitions do not capture the attack we highlight.…”

“…In addition [NFHF09,LPY12b,LPY12a] only consider a partially but not fully corrupt tracing manager in the non-frameability game. Moreover, they do not capture the requirement that a signature should only trace to one member (i.e.…”

“…We show that the state-of-the-art certificate-based schemes in [LPY12b,LPY12a] and [NFHF09] are all susceptible to an attack against traceability which allows any user to sign w.r.t. an epoch predating her joining.…”