An Improved Group Signature Scheme

Recently, Lee et al. used their new group signature with the function of authenticated encryption to design a sealed-bid auction scheme, and they claimed that their schemes are secure. In this paper, we show that if the group manager has a valid group signature of a member, without the member's secret key, he can forge a group signature on arbitrary message on behalf of the member; then, if the registration manager (RM) and the auction manager (AM) conspired (with each other) in their auction scheme, they can forge a new bid on any goods on behalf of the bidder who has sent his/her bid to AM. Therefore, their group signature and auction scheme are insecure. Finally, we improve Lee et al.'s group signature scheme to overcome the modification attack and achieve the security requirements.

A group signature scheme introduced by Chaum and Van Heyst allows a group member to sign messages anonymously on behalf of the group. However, in the case of a dispute, the identity of a signer of a group signature can be revealed only by a privileged entity, called a group manager. The group signature scheme has mainly been studied from the viewpoint of computational security setting so far. The main contribution of this paper is to study group signature schemes in unconditional security. More specifically, we newly introduce strong security notions of unconditionally secure group signatures (USGS for short) based on the idea of those of computationally secure group signatures proposed by Bellare, Micciancio and Warinschi. We also provide a generic method to construct USGS that is provably secure in our security definition. More precisely, we construct USGS by combining an encryption scheme with a signature, and show that the constructed scheme is unconditionally secure if the encryption and the signature used in the construction are unconditionally secure. Finally, we provide an instantiation of the one-time secure group signature scheme based on the generic construction.

A group signature scheme allows a user to sign a message anonymously on behalf of a group and provides accountability by using an opening authority who can “open” a signature and reveal the signer’s identity. Group signature schemes have been widely used in privacy-preserving applications, including anonymous attestation and anonymous authentication. Fully dynamic group signature schemes allow new members to join the group and existing members to be revoked if needed. Symmetric-key based group signature schemes are post-quantum group signatures whose security rely on the security of symmetric-key primitives, and cryptographic hash functions. In this paper, we design a symmetric-key based fully dynamic group signature scheme, called DGMT, that redesigns DGM (Buser et al. ESORICS 2019) and removes its two important shortcomings that limit its application in practice: (i) interaction with the group manager for signature verification, and (ii) the need for storing and managing an unacceptably large amount of data by the group manager. We prove security of DGMT (unforgeability, anonymity, and traceability) and give a full implementation of the system. Compared to all known post-quantum group signature schemes with the same security level, DGMT has the shortest signature size. We also analyze DGM signature revocation approach and show that despite its conceptual novelty, it has significant hidden costs that makes it much more costly than using the traditional revocation list approach.

Ring signatures and group signatures are prominent cryptographic primitives offering a combination of privacy and authentication. They enable individual users to anonymously sign messages on behalf of a group of users. In ring signatures, the group, i.e. the ring, is chosen in an ad hoc manner by the signer. In group signatures, group membership is controlled by a group manager. Group signatures additionally enforce accountability by providing the group manager with a secret tracing key that can be used to identify the otherwise anonymous signer when needed. Accountable ring signatures, introduced by Xu and Yung (CARDIS 2004), bridge the gap between the two notions. They provide maximal flexibility in choosing the ring, and at the same time maintain accountability by supporting a designated opener that can identify signers when needed. We revisit accountable ring signatures and offer a formal security model for the primitive. Our model offers strong security definitions incorporating protection against maliciously chosen keys and at the same time flexibility both in the choice of the ring and the opener. We give a generic construction using standard tools. We give a highly efficient instantiation of our generic construction in the random oracle model by meticulously combining Camenisch’s group signature scheme (CRYPTO 1997) with a generalization of the one-out-of-many proofs of knowledge by Groth and Kohlweiss (EUROCRYPT 2015). Our instantiation yields signatures of logarithmic size (in the size of the ring) while relying solely on the well-studied decisional Diffie-Hellman assumption. In the process, we offer a number of optimizations for the recent Groth and Kohlweiss one-out-of-many proofs, which may be useful for other applications. Accountable ring signatures imply traditional ring and group signatures. We therefore also obtain highly efficient instantiations of those primitives with signatures shorter than all existing ring signatures as well as existing group signatures relying on standard assumptions.

Group signatures are generalised credential/member authentication schemes with wide applications. Membership revocation problem is a major issue of group signatures, and is often resolved through an additional protocol which would encumber the whole group signature both in computation and storage, as Camenisch et al. did to ACJT's group signature scheme (the first ever practical group signature based on RSA problem put forward by Ateniese et al. at Crypto'00) by dynamic accumulator. Boneh et al. applied Camenisch et al.'s dynamic accumulator based revocation reversely, resulted in short group signature. We formally define the method used by Boneh et al., named reversed dynamic accumulator in this paper, and apply it on some previous group signatures to obtain improved ones with revocation capability, reduced bandwidth (signature size) and less signature generation computations. We also address the problems unsolved in Boneh et al.'s work, e.g. how to open a group signature since the current certificate may no longer be the one stored when it is firstly generated.

Group signatures allow a group member to sign messages anonymously on behalf of the group and, if needed, a group authority is able to identify the signer. In most applications, groups are dynamic and the number of arrivals and departures is non-negligible. Group signature schemes must take into account this situation and deal with member revocation. Even if group signature schemes have been intensively investigated during the last decade, few are applicable in low resource context. Among them, the simplest and most efficient has been proposed by Canard and Girault at Cardis 2002 and involves the smart card as security proxy. This solution has many advantages; however, there is a need to be connected to a group authority in order to sign or to verify the signature. Clearly, this is a drawback in embedded security for mobile applications. Based on a re-assessment of the notion of group signature, we propose an improvement of the Canard-Girault scheme allowing to perform signature and verification both off-line. In particular, we introduce the notion of risk-management for group signature schemes, which leads us to a novel approach of the member revocation problem.

Leakage-resilient group signature: Definitions and constructions

Both member registration and member revocation are essential features in group signature schemes. In ASIACRYPT 2016 Libert, Ling, Mouhartem, Nguyen, and Wang suggested a simple joining mechanism with their lattice-based group signature scheme with member registration. However, their scheme does not support member revocation. Verifier-local revocation is a member revocation approach in group signature schemes, which only requires the verifiers to keep the revocation messages while existing members have no burden. Since there is no workload for existing members related to revocation messages, verifier-local revocation method became the most suitable revocation approach for any environment. However, original group signature schemes with verifier-local revocability satisfy weaker security. This paper adds verifier-local revocation mechanism to the Libert’s (ASIACRYPT 2016) scheme to produce a fully dynamic lattice-based group signature scheme with member registration and member revocation using verifier-local revocation mechanism. Moreover, the resulted scheme achieves stronger security than the security in the original group signature schemes with verifier-local revocation.

A group signature scheme allows a group member to sign a message anonymously on behalf of the group. In case of a dispute, the group manager can reveal the actual identity of signer. In this paper, we propose an efficient group signature scheme, which divide the document M into m blocks and add some redundant bits to each message block, to avoid the conspiracy attack. The security of the proposed scheme is based on the difficulty of computing the discrete logarithm modulo for a composite number. The size of the group signature and the verification time of the group signature are equivalent to that of an individual signature.

Over the past two decades, group signature schemes have been developed and used to enable authenticated and anonymous peer-to-peer communications. Initial protocols rely on two main authorities, Issuer and Opener, which are given substantial capabilities compared to (regular) participants, such as the ability to arbitrarily identify users. Building efficient, fast, and short group signature schemes has been the focus of a large number of research contributions. However, only a few dealt with the major privacy-preservation challenge of group signatures; this consists in providing user anonymity and action traceability while not necessarily relying on a central and fully trusted authority. In this paper, we present \(\mathcal {DOGS}\), a privacy-preserving Blockchain-supported group signature scheme with a distributed Opening functionality. In \(\mathcal {DOGS}\), participants no longer depend on the Opener entity to identify the signer of a potentially fraudulent message; they instead collaborate and perform this auditing process themselves. We provide a high-level description of the \(\mathcal {DOGS}\) scheme and show that it provides both user anonymity and action traceability. Additionally, we prove how \(\mathcal {DOGS}\) is secure against message forgery and anonymity attacks.

Support of membership revocation is a desirable functionality for any group signature scheme. Among the known revocation approaches, verifier-local revocation (VLR) seems to be the most flexible one, because it only requires the verifiers to possess some up-to-date revocation information, but not the signers. All of the contemporary VLR group signatures operate in the bilinear map setting, and all of them will be insecure once quantum computers become a reality. In this work, we introduce the first lattice-based VLR group signature, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with existing lattice-based group signatures, our scheme has several noticeable advantages: support of membership revocation, logarithmic-size signatures, and weaker security assumption. In the random oracle model, our scheme is proved to be secure based on the hardness of the $\mathsf{SIVP}_{\widetilde{\mathcal{O}}(n^{1.5})}$ problem in general lattices - an assumption that is as weak as those of state-of-the-art lattice-based standard signatures. Moreover, our construction works without relying on encryption schemes, which is an intriguing feature for group signatures.

The concept of group signature allows a group member to sign message anonymously on behalf of the group. In the event of a dispute, a designated entity can reveal the identity of a signer. Previous group signature schemes use an RSA signature based membership certificate and a signature based on a proof of knowledge (SPK) in order to prove the possession of a valid membership certificate. In these schemes, all of SPKs are generated over an unknown-order group, which requires more work and memory compared with a publicly-known-order group.In this paper, we present an efficient group signature scheme with a membership revocation function. Our membership certificate is based on a Nyberg-Rueppel signature (NR-signature) over a known-order group. We also reconstruct all SPKs that prove to have “valid” (non-revoked) membership certificate. As a result, our scheme is more efficient than another group signature based on NR-signature.

We propose an order-specified aggregate authority-transfer signature based on the gap Diffie-Hellman group. In various organizations, to reduce the number of approvals required by someone who has relevant authority, the authority for a task can be transferred to a subordinate or another person who executes the task. Currently, authority is commonly transferred via a document, such as an authority-transfer agreement. However, to speed up the process and maintain the integrity of the evidence, we believe that it is better to transfer such authority via a computer network. In this paper, we propose an authority-transfer signature scheme using an order-specified aggregate signature and a group signature, and we propose a new authority-transfer system. In the signature method, a group signature scheme is used to express authority. Moreover, it transfers the authority owned by the manager to another member of the group. The difference from the group manager of the group signature is that this manager not only manages the group but also delegates authority. With the order-specified aggregate signature, it is possible to handle multiple signatures efficiently while verifying the order. We show that a safe and efficient authority-transfer system can be constructed using this new digital signature.

A lattice-based group signature scheme (LGSS) is an active cryptographic primitive, where each group member can sign messages anonymously in the name of the entire group and each valid signature should be traced to some group member on the lattice. In each LGSS, the size of the group signature usually depends on the number of group members and the security parameter. Thus, designing a constant-size LGSS is an interesting problem. At PKC 2018, Ling, Nguyen, Wang and Xu presented the first constant-size group signature scheme under lattice assumptions. Its design is based on a zero-knowledge argument of the knowledge of a valid message-signature pair for the Ducas-Micciancio signature scheme, which follows the sign-then-encrypt-then-prove protocol. In contrast to this work, we construct a new constant-size LGSS. The scheme adopts the sign-hybrid-encrypt approach and makes use of the Lyubashevsky signature scheme. Our work is efficient in the signing algorithm, more precise on the open algorithm and shorter in public key, secret key and signature size than previous studies. Furthermore, we prove that the scheme has full anonymity and full traceability under the Ring Learning With Errors and Ring Short Integer Solution assumptions in the random oracle model.

A group signature scheme allows a group member to sign a message anonymously on behalf of the group. In case of a dispute, the group manager can reveal the actual identity of signer. To enhance the efficiency of group signature schemes, in this paper, we propose an efficient group signature scheme which adds some redundant bits to each divided message block, to avoid the conspiracy attack. In our scheme, the size of a signature is the same as that of an individual signature and the signature verification process is simplified by a group public key. The security of the proposed scheme is based on the difficulty of computing the discrete logarithm modulo for a composite number.