Group Signatures with Message-Dependent Opening: Formal Definitions and Constructions

Table 2

Performance comparison among pairing-based GS-MDO and GS schemes.

	Signature size
	# of [,,]-elements	bits	MDO	Assumptions	Without RO
Ours (Section 6)		79364	-bounded	DLIN, SFP	Yes
Ours (Section 7)		3636	unbounded	DLIN, DBDH, -SDH	No
Libert-Joye [7]	[		unbounded	DLIN, D3DH	Yes
BBS [10]		1548	-	DLIN, -SDH	No
Groth [32]		8800	-	DLIN, -SDH, -U	Yes

Signature Size. The signature size in terms of the number of group elements and the bit sizes for 80-bit security. We adopt the estimates of the bit sizes of group elements used in [9] (the sizes of the elements of , , and are 176 bits, 170 bits, and 1056 bits, respectively.) is the number of group members. We assume that the Wee one-time signature scheme [48] is used for the instantiation of the one-time signature scheme.
MDO. The security level of the message-dependent functionality, where “-bounded” denotes that one needs, at the setup, to fix the number of tokens that will be issued, and “unbounded” denotes that one needs not fix the upper bound.
Assumptions. The hardness assumption on which the scheme is based. D3DH stands for the decision 3-party Diffie-Hellman assumption [11]. The -U assumption is defined in [32].
Without RO. Whether or not the scheme requires the random oracle model.