Group Signatures with Message-Dependent Opening: Formal Definitions and Constructions

Table 1

The number of group elements of GS-MDO in the standard model.

	Cost
verification key		3
TB-KEM CT		4
IB-KEM CT		3
DEM CT		29
NIZK proof
commitments for
,	2 vars. per var.	6
,	2 vars. per var.	6
	1 var. per var.	3
	14 vars. per var.	42
	7 vars. per var.	21
	7 vars. per var.	21
equations for
well-formedness of	4 -var. lin. eqs. per eq.	8
well-formedness of	3 -var. lin. eqs. × per eq.	6
well-formedness of	29 multi-scalar mult. eqs. per eq.	261
validity of	2 pair. prod. eqs. per eq.	18
validity of	2 pair. prod. eqs. per eq.	18
one-time signature			2
Total		449	2