Group Signatures with Message-Dependent Opening: Formal Definitions and Constructions

Box 6

Shacham’s variant of the Cramer-Shoup encryption scheme, where is the message length (in group elements) of the scheme.

TKg:

 , ,

 , , , , ,

 For :

 , ,

 ,

 ,

 For :

 ,

TEnc:

 ,

 Output

TDec:

 If then

Output