An identity-based dynamic group signature scheme for reputation evaluation systems

A lattice-based group signature scheme (LGSS) is an active cryptographic primitive, where each group member can sign messages anonymously in the name of the entire group and each valid signature should be traced to some group member on the lattice. In each LGSS, the size of the group signature usually depends on the number of group members and the security parameter. Thus, designing a constant-size LGSS is an interesting problem. At PKC 2018, Ling, Nguyen, Wang and Xu presented the first constant-size group signature scheme under lattice assumptions. Its design is based on a zero-knowledge argument of the knowledge of a valid message-signature pair for the Ducas-Micciancio signature scheme, which follows the sign-then-encrypt-then-prove protocol. In contrast to this work, we construct a new constant-size LGSS. The scheme adopts the sign-hybrid-encrypt approach and makes use of the Lyubashevsky signature scheme. Our work is efficient in the signing algorithm, more precise on the open algorithm and shorter in public key, secret key and signature size than previous studies. Furthermore, we prove that the scheme has full anonymity and full traceability under the Ring Learning With Errors and Ring Short Integer Solution assumptions in the random oracle model.

One important property of group signatures is forward-security, which prevents an attacker in possession of a group signing key to forge signatures produced in the past. In case of exposure of one group member’s signing key, group signatures lacking forward-security need to invalidate all group public and secret keys (by re-initializing the whole system) but also invalidate all previously issued group signatures. Most of the existing forward-secure group signatures (FS-GS) are built from number-theoretic security assumptions which are vulnerable to quantum computers. The only post-quantum secure FS-GS scheme is built from lattices by Ling et al. (PQCrypto 19) in the random oracle model, following the classical framework of encrypt-then-prove, thus using non-interactive zero-knowledge (NIZK) proofs. In this work, we achieve the first FS-GS from lattices in the standard model. Our starting point is the group signature of Katsumada and Yamada (Eurocrypt 19) which replaces NIZK by attribute-based signatures (ABS), thus removing the need for random oracles. We first modify the underlying ABS of Tsabary (TCC 17) to equip it with forward-security property. We then prove that by plugging it back in the group signature framework of Katsumada and Yamada (Eurocrypt 19), we can design a FS-GS scheme secure in the standard model with public key and signature size constant in the number of users. Our constant size is achieved by relying on complexity leveraging, which further implies relying on the subexponential hardness of the Short Integers Solution (SIS) assumption.

A new group signature with one time secret key is proposed. The main merits are that it only needs the trusted center issuing the partial secret key one time for each group member; and that the group member can generate his different secret key each time when he wants to sign a message. The group public key is constant and the size of the signature is independent of the number of group members. The total computation cost of signature and verification requires only 8 modular exponentiations.

Ring signatures and group signatures are prominent cryptographic primitives offering a combination of privacy and authentication. They enable individual users to anonymously sign messages on behalf of a group of users. In ring signatures, the group, i.e. the ring, is chosen in an ad hoc manner by the signer. In group signatures, group membership is controlled by a group manager. Group signatures additionally enforce accountability by providing the group manager with a secret tracing key that can be used to identify the otherwise anonymous signer when needed. Accountable ring signatures, introduced by Xu and Yung (CARDIS 2004), bridge the gap between the two notions. They provide maximal flexibility in choosing the ring, and at the same time maintain accountability by supporting a designated opener that can identify signers when needed. We revisit accountable ring signatures and offer a formal security model for the primitive. Our model offers strong security definitions incorporating protection against maliciously chosen keys and at the same time flexibility both in the choice of the ring and the opener. We give a generic construction using standard tools. We give a highly efficient instantiation of our generic construction in the random oracle model by meticulously combining Camenisch’s group signature scheme (CRYPTO 1997) with a generalization of the one-out-of-many proofs of knowledge by Groth and Kohlweiss (EUROCRYPT 2015). Our instantiation yields signatures of logarithmic size (in the size of the ring) while relying solely on the well-studied decisional Diffie-Hellman assumption. In the process, we offer a number of optimizations for the recent Groth and Kohlweiss one-out-of-many proofs, which may be useful for other applications. Accountable ring signatures imply traditional ring and group signatures. We therefore also obtain highly efficient instantiations of those primitives with signatures shorter than all existing ring signatures as well as existing group signatures relying on standard assumptions.

In this paper, a new dynamic group signature scheme is proposed. It allows the group manager to increase or delete group members flexibly. Furthermore, the length of group signatures, as well as the computational effort for signing, verifying and opening are very small and independent of the number of group members and deleted group members. So it is efficient.

A group signature scheme allows a user to sign a message anonymously on behalf of a group and provides accountability by using an opening authority who can “open” a signature and reveal the signer’s identity. Group signature schemes have been widely used in privacy-preserving applications, including anonymous attestation and anonymous authentication. Fully dynamic group signature schemes allow new members to join the group and existing members to be revoked if needed. Symmetric-key based group signature schemes are post-quantum group signatures whose security rely on the security of symmetric-key primitives, and cryptographic hash functions. In this paper, we design a symmetric-key based fully dynamic group signature scheme, called DGMT, that redesigns DGM (Buser et al. ESORICS 2019) and removes its two important shortcomings that limit its application in practice: (i) interaction with the group manager for signature verification, and (ii) the need for storing and managing an unacceptably large amount of data by the group manager. We prove security of DGMT (unforgeability, anonymity, and traceability) and give a full implementation of the system. Compared to all known post-quantum group signature schemes with the same security level, DGMT has the shortest signature size. We also analyze DGM signature revocation approach and show that despite its conceptual novelty, it has significant hidden costs that makes it much more costly than using the traditional revocation list approach.

Support of membership revocation is a desirable functionality for any group signature scheme. Among the known revocation approaches, verifier-local revocation (VLR) seems to be the most flexible one, because it only requires the verifiers to possess some up-to-date revocation information, but not the signers. All of the contemporary VLR group signatures operate in the bilinear map setting, and all of them will be insecure once quantum computers become a reality. In this work, we introduce the first lattice-based VLR group signature, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with existing lattice-based group signatures, our scheme has several noticeable advantages: support of membership revocation, logarithmic-size signatures, and weaker security assumption. In the random oracle model, our scheme is proved to be secure based on the hardness of the $\mathsf{SIVP}_{\widetilde{\mathcal{O}}(n^{1.5})}$ problem in general lattices - an assumption that is as weak as those of state-of-the-art lattice-based standard signatures. Moreover, our construction works without relying on encryption schemes, which is an intriguing feature for group signatures.

Group signatures are a central cryptographic primitive where users can anonymously and accountably sign messages in the name of a group they belong to. Several efficient constructions with security proofs in the standard model (i.e., without the random oracle idealization) appeared in the recent years. However, like standard PKIs, group signatures need an efficient revocation system to be practical. Despite years of research, membership revocation remains a non-trivial problem: many existing solutions do not scale well due to either high overhead or constraining operational requirements (like the need for all users to update their keys after each revocation). Only recently, Libert, Peters and Yung (Eurocrypt’12) suggested a new scalable revocation method, based on the Naor-Naor-Lotspiech (NNL) broadcast encryption framework, that interacts nicely with techniques for building group signatures in the standard model. While promising, their mechanism introduces important storage requirements at group members. Namely, membership certificates, which used to have constant size in existing standard model constructions, now have polylog size in the maximal cardinality of the group (NNL, after all, is a tree-based technique and such dependency is naturally expected). In this paper we show how to obtain private keys of constant size. To this end, we introduce a new technique to leverage the NNL subset cover framework in the context of group signatures but, perhaps surprisingly, without logarithmic relationship between the size of private keys and the group cardinality. Namely, we provide a way for users to efficiently prove their membership of one of the generic subsets in the NNL subset cover framework. This technique makes our revocable group signatures competitive with ordinary group signatures (i.e., without revocation) in the standard model. Moreover, unrevoked members (as in PKIs) still do not need to update their keys at each revocation.KeywordsGroup SignatureGroup ElementRandom OracleBroadcast EncryptionCryptology ePrint ArchiveThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The paper presents group-oriented (t,n) threshold digital signature schemes based on the difficulty of solving the discrete logarithm problem. By employing these schemes, any t out of n users in a group can represent this group to sign the group signature. The size of the group signature and the verification time of the group signature are equivalent to that of an individual digital signature. In other words, the (t, n) threshold signature scheme has the following five properties: (i) any group signature is mutually generated by at least t group members; (ii) the size of the group signature is equivalent to the size of an individual signature; (iii) the signature verification process is simplified because there is only one group public key required; (iv) the group signature can be verified by any outsider; and (v) the group holds the responsibility to the signed message. In addition to the above properties, two of the schemes proposed do not require the assistance of a mutually trusted party. Each member selects its own secret key and the group public key is determined by all group members. Each group member signs a message separately and sends the individual signature to a designated clerk. The clerk validates each individual signature and then combines all individual signatures into a group signature. The (n, n) threshold signature scheme can be easily extended to become a digital multisignature scheme.< >

Both member registration and member revocation are essential features in group signature schemes. In ASIACRYPT 2016 Libert, Ling, Mouhartem, Nguyen, and Wang suggested a simple joining mechanism with their lattice-based group signature scheme with member registration. However, their scheme does not support member revocation. Verifier-local revocation is a member revocation approach in group signature schemes, which only requires the verifiers to keep the revocation messages while existing members have no burden. Since there is no workload for existing members related to revocation messages, verifier-local revocation method became the most suitable revocation approach for any environment. However, original group signature schemes with verifier-local revocability satisfy weaker security. This paper adds verifier-local revocation mechanism to the Libert’s (ASIACRYPT 2016) scheme to produce a fully dynamic lattice-based group signature scheme with member registration and member revocation using verifier-local revocation mechanism. Moreover, the resulted scheme achieves stronger security than the security in the original group signature schemes with verifier-local revocation.

Cloud data privacy-preserving and integrity verification have become major research areas. Many existing schemes use group signatures to make sure that the data stored in cloud is unbroken for the purpose of privacy and anonymity. However, group signatures do not consider user equality and the framing caused by manager. Therefore, we propose data sharing scheme for non-manager groups, which reconstructs democratic group signature with threshold traceability to homomorphic authentication. We further present a public auditing scheme for non-manager shared data. In our scheme, group manager's rights are distributed to all members equally and some of them can work together to trace the signer if it is necessary. Besides identity privacy, data privacy, traceability and non-frameability, our scheme also ensures the efficiency and the feasibility. The experimental results show the overhead of the auditing is independent of the group user numbers and effectiveness of our approach. And thanks to the low overhead, our scheme can be further used in mobile cloud storage.

Recently, with the rapid development of blockchain technology, the information interaction and value transfer problems between different blockchains have become the focus of research. The cross-chain technology is to solve the cross-chain operation problems of assets and data between different chains. However, the existing cross-chain technology has the problem of identity privacy leakage. Therefore, this article proposes a cross-chain privacy protection scheme for consortium blockchains based on group signature, certificate authority and relay chain. The scheme is divided into three cross-chain service layers, called the management layer, the transaction layer, and the group layer. The management layer is responsible for the forwarding of cross-chain transactions, the transaction layer includes the blockchains that actually participate in cross-chain transactions, and the group layer is responsible for group signature related work. Through this scheme, the identity privacy of both parties to the transaction can be protected during the cross-chain transaction process.

Group signature is an important anonymous technique. Two primitive properties of group signature is anonymity and unforgeability. It allows a group member to sign messages anonymously on behalf of the group such that any one can verify the signature but no one (except group manager) can find out which group member produce it. However, group manager can reveal the identity of the originator of a signature in case of a dispute. Recently Elaalim et.al proposed a short ID-based group signature, and claimed that the scheme is secure against forgeability attack and linkability attack. Unfortunately, in the paper, we show that the scheme is insecure, it exists universal forgeability, namely, anyone can forge a group signature on arbitrary message; and the scheme is linkable, namely, given two different group signatures, anyone can distinguish whether they are produced by the signer. Finally, the corresponding attacks are mounted, and the reason to such attacks are analyzed.

Group signatures are a central cryptographic primitive which allows users to sign messages while hiding their identity within a crowd of group members. In the standard model (without the random oracle idealization), the most efficient constructions rely on the Groth-Sahai proof systems (Eurocrypt’08). The structure-preserving signatures of Abe et al. (Asiacrypt’12) make it possible to design group signatures based on well-established, constant-size number theoretic assumptions (a.k.a. “simple assumptions”) like the Symmetric eXternal Diffie-Hellman or Decision Linear assumptions. While much more efficient than group signatures built on general assumptions, these constructions incur a significant overhead w.r.t. constructions secure in the idealized random oracle model. Indeed, the best known solution based on simple assumptions requires 2.8 kB per signature for currently recommended parameters. Reducing this size and presenting techniques for shorter signatures are thus natural questions. In this paper, our first contribution is to significantly reduce this overhead. Namely, we obtain the first fully anonymous group signatures based on simple assumptions with signatures shorter than 2 kB at the 128-bit security level. In dynamic (resp. static) groups, our signature length drops to 1.8 kB (resp. 1 kB). This improvement is enabled by two technical tools. As a result of independent interest, we first construct a new structure-preserving signature based on simple assumptions which shortens the best previous scheme by $$25\,\%$$ . Our second tool is a method for attaining anonymity in the strongest sense using a new CCA2-secure encryption scheme which is also a Groth-Sahai commitment.

With the rise of digital images in our daily lives, there is a growing need to provide an image trading market where people can monetize their images and get desired images at prices that fit their budget. Those images are usually uploaded and stored onto centralized image trading service providers’ servers and the transactions for image trading are processed by these providers. Unfortunately, transaction unfairness and users’ privacy breaches have become major concerns since the service providers might be untrusted and able to manipulate image trading prices and infer users’ private information. Recently, several approaches have been proposed to address the unfairness issue by using the decentralized ledger technique and smart contract, but users’ privacy protection is not considered. In this paper, we propose a fair and privacy-preserving protocol that supports image fair exchange and protect user privacy. In particular, we exploit blockchain and Merkle tree to construct a fair image trading protocol with low communication overhead based on smart contract, which serves as an external judge that resolves disputes between buyers and sellers in image transactions. Moreover, we extend a popular short group signature scheme to protect users’ identity privacy, prevent linkability of transactions from being inferred, and ensure traceability of malicious users who may sell fake images and/or refuse to pay. Finally, we design and build a practical and open-source image trading system to evaluate the performance of our proposed protocol. Experimental results demonstrate its effectiveness and efficiency in real-world applications.