An 𝑟-Hiding Revocable Group Signature Scheme: Group Signatures with the Property of Hiding the Number of Revoked Users

Abstract

If there are many displaced workers in a company, then a person who goes for job hunting might not select this company. That is, the number of members who quit is quite negative information. Similarly, in revocable group signature schemes, if one knows (or guesses) the number of revoked users (say 𝑟), then one may guess the reason behind such circumstances, and it may lead to harmful rumors. However, no previous revocation procedure can achieve hiding 𝑟. In this paper, we propose the first revocable group signature scheme, where 𝑟 is kept hidden, which we call 𝑟-hiding revocable group signature. To handle this property, we newly define the security notion called anonymity with respect to the revocation which guarantees the unlinkability of revoked users.

1. Introduction

Imagine that there are many users who have stopped using a service. If this fact is published, then how would the newcomers feel about this? One may guess the reason behind such circumstances and may judge that those users did not find the service attractive or the service fee is expensive. The same thing may occur in other cases; for example, if there are many displaced workers in a company, then a person who goes for job hunting might not select this company. For example, the person might imagine there are many problematic employees in this company or might imagine the labor environment may not be good. That is, the number of members who quit is quite negative information.

Group Signature. Many cryptographic attempts for the revocation of rights of users have been considered so far. In this paper, we mainly focus on group signature. The concept of group signature was investigated by Chaum and van Heyst [1]. A typical usage of group signature is described as follows. The group manager (GM) issues a membership certificate to a signer. A signer makes a group signature by using their own membership certificate and sends it (with a signed message) to a verifier. The verifier anonymously verifies whether a signer is a member of a group or not. That is, the verifier checks the possession of a membership certificate without revealing themself. In order to handle some special cases (e.g., an anonymous signer behaves maliciously), GM can identify the actual signer through the open procedure. Since verifiers do not have to identify individual signers, group signature is a useful and powerful tool for protecting signers’ privacy.

As additional functionality of group signature, anonymity revocation has been introduced [2–11], where no revoked users can make a valid group signature or revoked users can be publicly detected even if they try to make a group signature. (Since a long RSA modulus might lead to certain inefficiency aspects (e.g., long signatures, heavy complexity costs, and so on), we exclude RSA-based revocable group signatures (e.g., [12, 13]) in this paper.) However, the number of revoked users (say 𝑟) is revealed in all previous revocable group signature schemes. As mentioned previously, the number of revoked users 𝑟 is quite negative information. Next, we introduce applications of revocable group signature for outsourcing businesses [14] and biometric authentication [15] as concrete examples, where revealing 𝑟 may lead to harmful rumors.

Concrete Example 1 (identity management). In this application, presented in [14], there are four entities: a user, outsourcee, opening manager (OM), and revocation manager (RM). Let outsourcee be in charge of providing the service to legitimate users. When a user requests the service, the user makes a group signature and sends it to outsourcee. Due to anonymity of the underlying group signature scheme, outsourcee does not have to identify individual users (protect users’ privacy). One important thing is that outsourcee does not have to manage a list of identities of users. That is, the risk of leaking user information (i.e., the user list) can be minimized, and this is the merit of using group signature in identity management. After a certain interval, for charging a service fee, OM detects a user by using the opening procedure of group signature. If a user does not pay a fee (or when a user wants to leave the service), then OM announces the identity of this user to RM, and RM revokes this user from the system. In this system, if 𝑟 is revealed, then one may think that there might be many dropout users who have stopped using the service; that is, this service may not be interesting, or he/she have not paid the service fee; namely, the service fee may be expensive and so on. That is, “revealing 𝑟” may lead to harmful rumors.

Concrete Example 2 (biometric authentication). In this application presented in [15], there are four entities: a human user, a sensor client, a card issuer, and a service provider. A human user authenticates himself/herself to the service provider by using his/her biometric data preserved on a plastic card. A card issuer (with a group master secret key) issues a card to a human user which contains a signing key and his/her biometric data. Moreover, the card issuer can revoke users if malicious behavior occurs or a user loses his/her card. A sensor client extracts human user’s biometric trait (e.g., iris is used in [15]) and communicates with the service provider, so that the user will be authenticated by the service provider. The service provider verifies a group signature and provides a service (e.g., open a door) if the signature is valid. Due to anonymity, the service provider does not identify who the user is; even sensitive biometric information is treated. In this system, if someone knows 𝑟 in this application, they may think that there might be many malicious behaviors, or there might be many lost cards; that is, good management may deteriorate, and so on. That is, “revealing 𝑟” may lead to harmful rumors.

Our Target. So, our main target is to propose a revocable group signature scheme with the property of hiding the number of revoked users 𝑟, which we call 𝑟-hiding revocable group signature. Then, we need to investigate the methodology for achieving the following.(1)The size of any value does not depend on 𝑟.(2)The costs of any algorithm do not depend on 𝑟, except the revocation algorithm executed by GM.(3)Revoked users are unlinkable. In particular, if revoked users are linkable, then anyone can guess (i.e., not exactly obtain) 𝑟 by linking and counting revoked users. Although we assume that an adversary can obtain the polynomial (of the security parameter) number of group signatures, this assumption is not unreasonable (actually, the adversary can be allowed to access the signing oracle in polynomial times). In addition, 𝑟 is also a polynomial-size value. That is, this guessing attack works given that revoked users are linkable.

However, no previous revocable signature scheme satisfying all requirements above has been proposed. For example, in revocable group signatures [2, 4, 11] (which are based on updating the group public values, e.g., using accumulators), either the size of public value or the costs of updating membership certificate depend on 𝑟. Nakanishi et al. [6] proposed a novel technique of group signature, where no costs of the GSign algorithm (or the Verify algorithm also) depend on 𝑟. However, their methodology requires that 𝑟 signatures are published to make a group signature, and therefore 𝑟 is revealed. Recently, Libert-Peters-Yung proposed two scalable group signature schemes [7, 8] by applying the Naor-Naor-Lotspeich (NNL) broadcast encryption framework [16]. However, at least one cost depends on 𝑟 (e.g., 𝑂(𝑟)-size revocation list is required for signing in [7, 8] (of subset difference variant) and 𝑂(𝑟log(𝑁/𝑟))-size revocation list is required for signing in [8] (of complete subtree variant) and 𝑁 (the number of users) are publicly available). Therefore, 𝑟 is revealed. In [3, 5, 10, 17, 18] (which are verifier-local revocation (VLR) type group signature schemes), revoked users are linkable. In this case, anyone can guess 𝑟 by executing the verification procedure. For the sake of clarity, we introduce the Nakanishi-Funabiki methodology [10] as follows: let RL={ℎ^𝑥1,ℎ^𝑥2,…,ℎ^𝑥𝑟} be the revocation list, where 𝑥_𝑖 is the secret value of revoked user 𝑈_𝑖. Note that, by adding dummy values, we can easily expand the size of revocation list |RL|. So, we can assume that 𝑟 is not revealed from the size of RL, but 𝑟 is revealed (or rather, guessed) as follows. Each group signature 𝜎 (made by 𝑈_𝑗) contains 𝑓^{𝑥𝑗+𝛽} and ℎ^𝛽 for some random 𝛽 and some group elements 𝑓 and ℎ. If 𝑈_𝑗 has been revoked, then there exists ℎ^𝑥𝑖 such that 𝑒(𝑓^{𝑥𝑗+𝛽},ℎ)=𝑒(ℎ^𝑥𝑖ℎ^𝛽,𝑓) holds. By counting such 𝑖, one can easily guess 𝑟 even if RL is expanded by dummy values. Since each value in RL is linked to a user (i.e., ℎ^𝑥𝑖 is linked to 𝑈_𝑖), even if values in RL are randomized (e.g., (ℎ^𝑥𝑖)^𝑟𝑖 for some random 𝑟_𝑖), this connection between a user and a value in RL is still effective. So, one can easily guess 𝑟 even if RL is randomized.

From the above considerations, no previous revocation procedure can be applied for hiding 𝑟. One solution has been proposed in [19], where only the designated verifier can verify the signature. By preventing the verification of signature from the third party, 𝑟 is not revealed from the viewpoint of the third party. However, this scheme (called anonymous designated verifier signature) is not publicly verifiable and is not group signature any longer. Next, as another methodology, we may consider multigroup signatures [20, 21] with two groups (valid user group and revoked user group). However, this attempt does not work, since each user is given his/her membership certificate (corresponding to the group he/she belongs to) in the initial setup phase, and the revocation procedure is executed after the setup phase.

Our Contribution. In this paper, we propose the first 𝑟-hiding revocable group signature scheme in the random oracle model by applying attribute-based group signature (ABGS) [22–25]. By considering two attributes: (1) valid group user and (2) the user’s identity, we can realize the property of hiding 𝑟. To handle this property, we newly define the security notion called anonymity with respect to the revocation. As the main difference among our anonymity definition and previous ones, to guarantee the unlinkability of revoked users, 𝒜 can issue the revocation queries against the challenge users. Our scheme is secure under the computational Diffie-Hellman (CDH) assumption, the decision Diffie-Hellman (DDH) assumption over a bilinear group (i.e., the external Diffie-Hellman (XDH) assumption), the decision linear (DLIN) assumption, the hidden strong Diffie-Hellman (HSDH) assumption, and the 𝑞-strong Diffie-Hellman (SDH) assumption, in the random oracle model. We apply the Boldyreva multisignature scheme [26] to revoke each user.

Related Work. There were several security definitions of group signatures until the Bellare-Micciancio-Warinschi work [27], which we call the BMW model. They showed that full-anonymity and full-traceability are enough to capture all security requirements that appeared before their work. Bellare et al. [28] extended the BMW model, which we call the BSZ model, to handle the dynamic group setting, where a user can join the system even after the system setup phase. Later, Sakai et al. [29] further extended the BSZ model for preventing signature hijacking. Independently, Kiayias and Yung also give a formal definition with dynamic join [30, 31], and Libert et al. [7, 8] extended to the KY model for revocable group signature.

Efficient group signature schemes in the random oracle model have been proposed in [2, 4, 32] and in the standard model [5, 33, 34]. Technically, (honest verifier) zero knowledge proofs of knowledge and the Fiat-Shamir heuristic [35] are mainly applied for constructing group signatures in the random oracle model, and Groth-Sahai proofs [36] and structure-preserving signatures [37] are mainly applied for constructing group signatures in the standard model. Though the above schemes are constructed over bilinear groups, lattice-based group signature schemes also have been proposed [38–40]. Usually, encryption schemes are applied for implementing the open algorithm; however, encryption-free group signatures schemes have been proposed in [41, 42].

As group signatures with an additional functionality, a new open functionality, which we call message-dependent opening, has been proposed in [43–45], where a signed message-dependent token is generated by an authority called admitter and an opener who has the opening key can open the group signatures using the corresponding token. Forward secure group signature schemes have been proposed [46–49], where users can update their secret signing key periodically, and group signatures made by the secret keys of previous periods remain secure even if a secret key is exposed. Revocable group signature schemes with backward unlinkability have been proposed [5, 9, 10, 18], where even after a user is revoked, group signatures made by this user before the revocation remain anonymous. Identity-based analogue of group signature also has been proposed in [50, 51].

As feasibility results, a group signature secure in the BMW model implies CCA-secure public key encryption (PKE) [52, 53], and a group signature secure in the Sakai et al. model implies PKENO [54], where PKENO stands for public key encryption with noninteractive opening [55]. Moreover, a group signature with message-dependent opening implies identity-based encryption [44].

2. Preliminaries

In this section, we give definitions of bilinear groups and complexity assumptions and introduce cryptographic tools which are applied in our construction. Let PPT mean probabilistic polynomial time, and 𝑥←^$𝑋 means that an element 𝑥 is chosen at uniform random from a set 𝑋.

2.1. Bilinear Groups and Complexity Assumptions

Definition 1 (bilinear groups). Let 𝔾₁, 𝔾₂, and 𝔾_𝑇 be cyclic groups with prime order 𝑝, and 𝔾₁=⟨𝑔⟩ and 𝔾₂=⟨ℎ⟩. Let 𝑒∶𝔾₁×𝔾₂→𝔾_𝑇 be an (efficient computable) bilinear map with the following properties: (1) bilinearity: for all (𝑔,𝑔^′)∈𝔾²₁ and (ℎ,ℎ^′)∈𝔾²₂, 𝑒(𝑔𝑔^′,ℎ)=𝑒(𝑔,ℎ)𝑒(𝑔^′,ℎ) and 𝑒(𝑔,ℎℎ^′)=𝑒(𝑔,ℎ)𝑒(𝑔,ℎ^′) hold, and (2) nondegeneracy: 𝑒(𝑔,ℎ)≠1_𝑇, where 1_𝑇 is the unit element over 𝔾_𝑇.

Definition 2 (the computational Diffie-Hellman (CDH) assumption). We say that the CDH assumption holds if, for all PPT adversary 𝒜, Pr[𝒜(𝑔₁,𝑔^𝑎₁,𝑔^𝑏₁)=𝑔₁^𝑎𝑏] is negligible, where 𝑔←₁^$𝔾₁ and (𝑎,𝑏)←^$ℤ²_𝑝.

Definition 3 (the decision Diffie-Hellman (DDH) assumption). We say that the DDH assumption holds if, for all PPT adversary 𝒜, |Pr[𝒜(𝑔₁,𝑔^′₁,𝑔^𝑥₁,𝑔^′₁^𝑥)=0]−Pr[𝒜(𝑔₁,𝑔^′₁,𝑔^𝑥₁,𝑔^′₁^𝑟)=0]| is negligible, where (𝑔₁,𝑔^′₁)←^$𝔾²₁ and (𝑥,𝑟)←^$ℤ²_𝑝 with 𝑥≠𝑟.

Definition 4 (the decision linear (DLIN) assumption [2]). We say that the DLIN assumption holds if, for all PPT adversary 𝒜, |Pr[𝒜(𝑢,𝑣,ℎ,𝑢^𝑎,𝑣^𝑏,ℎ^𝑎+𝑏)=0]−Pr[𝒜(𝑢,𝑣,ℎ,𝑢^𝑎,𝑣^𝑏,𝜂)=0]| is negligible, where (𝑢,𝑣,ℎ,𝜂)←^$𝔾⁴₂ and (𝑎,𝑏)←^$ℤ²_𝑝.

Definition 5 (the hidden strong Diffie-Hellman (HSDH) assumption [34]). We say that ℓ-HSDH assumption holds if, for all PPT adversary 𝒜, Pr[𝒜(𝑔₁,ℎ,ℎ^𝜔,(𝑔^{1/(𝜔+𝑐𝑖)}₁,ℎ^𝑥𝑖)_{𝑖=1,…,ℓ})=(𝑔₁^{1/(𝜔+𝑥)},ℎ^𝑥)∧∀𝑥_𝑖≠𝑥] is  negligible, where (𝑔₁,ℎ)←^$𝔾₁×𝔾₂, (𝜔,𝑥₁,…,𝑥_ℓ)←^$ℤ_𝑝^ℓ+1 and 𝑥∈ℤ_𝑝.

Definition 6 (the strong Diffie-Hellman (SDH) assumption [56]). We say that 𝑞-SDH assumption holds if, for all PPT adversary 𝒜, Pr[𝒜(𝑔₁,ℎ,ℎ^𝜔,ℎ^𝜔2,…,ℎ^𝜔𝑞)=(𝑔₁^{1/(𝜔+𝑥)},𝑥)] is negligible, where (𝑔₁,ℎ)←^$𝔾₁×𝔾₂,  𝜔←^$∈ℤ_𝑝, and 𝑥∈ℤ_𝑝.

Definition 7 (the external Diffie-Hellman (XDH) assumption [4]). Let (𝔾₁,𝔾₂,𝔾_𝑇) be a bilinear group. We say that the XDH assumption holds if for all PPT adversary 𝒜, the DDH assumption over 𝔾₁ holds.

2.2. Other Cryptographic Tools

In this section, we introduce cryptographic tools applied for our construction.

BBS+ Signature [2, 6, 32, 57]. Let 𝐿 be the number of signed messages and let (𝔾₁,𝔾₂,𝔾_𝑇) be a bilinear group. Select 𝑔,𝑔₁,…,𝑔←_𝐿^$𝔾₁, ℎ←^$𝔾₂, and 𝜔←ℤ_𝑝, and compute Ω=𝑔^𝜔. The signing key is 𝜔 and the verification key is (𝑝,𝔾₁,𝔾₂,𝔾_𝑇,𝑒,𝑔,𝑔₁,…,𝑔_𝐿+1,ℎ,Ω). For a set of signed messages (𝑚₁,…,𝑚_𝐿)∈ℤ^𝐿_𝑝, choose 𝑟,𝑦←^$ℤ_𝑝, and compute 𝐴=(𝑔^𝑚1₁⋯𝑔^𝑚𝐿_𝐿𝑔^𝑟_𝐿+1𝑔)^{1/(𝜔+𝑦)}. For a signature (𝐴,𝑟,𝑦), the verification algorithm output 1 if 𝑒(𝐴,Ωℎ^𝑦)=𝑒(𝑔^𝑚1₁⋯𝑔^𝑚𝐿_𝐿𝑔^𝑟_𝐿+1,ℎ) holds. The BBS+ signature scheme satisfies existential unforgeability against chosen message attack (EUF-CMA) under the 𝑞-SDH assumption. (First an adversary 𝒜 is given vk from the challenger 𝒞. Then 𝒜 sends messages to 𝒞 and obtains the corresponding signatures. Finally, 𝒜 outputs a message/signature pair (𝑀^∗,𝜎^∗). We say that 𝒜 wins if (𝑀^∗,𝜎^∗) is valid and 𝒜 has not sent 𝑀^∗ as a signing query. The EUF-CMA security guarantees that the probability Pr[𝒜wins] is negligible.)

Linear Encryption [2]. A public key is pk=(𝑢,𝑣,ℎ)∈𝔾₂ such that 𝑢^𝑋1=𝑣^𝑋2=ℎ for 𝑋₁,𝑋₂∈ℤ_𝑝. The corresponding secret key is (𝑋₁,𝑋₂). For a plaintext 𝑀∈𝔾₂, choose 𝛿₁,𝛿←₂^$ℤ_𝑝 and compute a ciphertext 𝐶=(𝐹₁,𝐹₂,𝐹₃), where 𝐹₁=𝑀⋅ℎ^𝛿1,𝛿2, 𝐹₂=𝑢^𝛿1, and 𝐹₃=𝑣^𝛿2. 𝐶 can be decrypted as 𝑀=𝐹₁/𝐹^𝑋1₂𝐹^𝑋2₃. The linear encryption is IND-CPA secure under the DLIN assumption. (First an adversary 𝒜 is given pkfrom the challenger 𝒞. Then 𝒜 sends the challenge message (𝑀^∗₀,𝑀^∗₁) to 𝒞, and 𝒞 chooses 𝜇←^${0,1} and computes the challenge ciphertext 𝐶^∗ which is a ciphertext of 𝑀^∗_𝜇. 𝒜 is given 𝐶^∗ and outputs a bit 𝜇^′. The IND-CPA security guarantees that |Pr[𝜇=𝜇^′]−1/2| is negligible.)

Signature Based on Proof of Knowledge. In our group signature, we apply the conversion of the underlying interactive zero knowledge (ZK) proof into noninteractive ZK (NIZK) proof by applying the Fiat-Shamir heuristic [35]. We describe such converted signature based on proof of knowledge (SPK) as SPK{𝑥∶(𝑦,𝑥)∈𝑅}(𝑀), where 𝑥 is the knowledge to be proved, 𝑅 is a relation (e.g., 𝑦=𝑔^𝑥 in the case of the knowledge of the discrete logarithm), and 𝑀 is a signed message. The SPK has an extractor of the proved knowledge from two accepting protocol views whose commitments are the same but challenges are different.

3. Definitions of Group Signature with the Property of Hiding the Number of Revoked Users

Here, we define the syntax of revocable group signature and security requirements (anonymity with respect to the revocation and traceability) by adapting [6]. Note that our definition follows the static group settings as in the BMW model [27], but we can easily handle the dynamic group settings as in the BSZ model [28] (and nonframeability) by adding an interactive join algorithm.

Definition 8 (syntax of 𝑟-hiding revocable group signature).  
Setup. This probabilistic setup algorithm takes as input the security parameter 1^𝜅 and returns public parameters params.
KeyGen. This probabilistic key generation algorithm (for GM) takes as input the maximum number of users 𝑁 and params and returns the group public key gpk, GM’s secret key msk, all user’s secret key {usk_𝑖}_{𝑖∈[1,𝑁]}, and the initial revocation-dependent value 𝒯₀.
GSign. This probabilistic signing algorithm (for a user 𝑈_𝑖) takes as input gpk, usk_𝑖, a signed message 𝑀, and a revocation-dependent value (in the period 𝑡) 𝒯_𝑡 and returns a group signature 𝜎.
Verify. This deterministic verification algorithm takes as input gpk,𝑀, 𝜎, and 𝒯_𝑡 and returns 1 if 𝜎 is a valid group signature and 0 otherwise.
Revoke. This (potentially) probabilistic revocation algorithm takes as input gpk, msk, a set of revoked users RL_𝑡+1={𝑈_𝑖}, and 𝒯_𝑡 and returns 𝒯_𝑡+1.
Open. This deterministic algorithm takes as input msk and a valid pair(𝑀,𝜎) and returns the identity of the signer of 𝜎 ID. If ID is not a group member, then the algorithm returns 0.

In the Revoke algorithm, we setRL₀=0/ and assume that the nonrevoked users in 𝑡 are {𝑈₁,…,𝑈_𝑁}⧵RL_𝑡. Under this setting, boomerang users (who rejoin the group) are available (i.e., 𝑈_𝑖 such that 𝑈_𝑖∈RL_𝑡−1 and 𝑈_𝑖∉RL_𝑡). In addition, if an invalid pair (𝑀,𝜎) is input to the Open algorithm, then the Open algorithm easily detects this fact by using the Verify algorithm. So, we exclude this case from the definition of the Open algorithm.

Next, we define anonymity with respect to the revocation and traceability. As the main difference among our anonymity definition and previous ones, 𝒜 can issue the revocation queries against the challenge users in order to guarantee the unlinkability of revoked users. Note that we do not consider the CCA-anonymity, where an adversary 𝒜 can issue the open queries. So, we just handle the CPA-anonymity [2] only in this paper. However, as mentioned by Boneh et al. [2], the CCA-anonymity can be handled by applying a CCA secure public key encryption for implementing the open algorithm.

Definition 9 (anonymity with respect to the revocation).  
Setup. The challenger 𝒞 runs the Setup algorithm and the KeyGen algorithm and obtains params, gpk, msk, and all {usk_𝑖}^𝑁_𝑖=1. 𝒞 gives params and gpkto 𝒜 and sets 𝑡=0, RU₀=0/, and CU=0/, where RU₀ denotes the (initial) set of IDs of revoked users and CU denotes the set of IDs of corrupted users.
Queries.𝒜 can issue the following queries. Revocation. 𝒜 can request the revocation of users ID_𝑖1,…,ID_{𝑖𝑘𝑡+1} for some constant 𝑘_𝑡+1∈[1,𝑁]. 𝒞 runs 𝒯_𝑡+1← Revoke(msk,{ID_𝑖1,…,ID_{𝑖𝑘𝑡+1}},𝒯_𝑡) and adds ID_𝑖1,…,ID_{𝑖𝑘𝑡+1} to RU_𝑡+1. Signing.  𝒜 can request a group signature on a message 𝑀 for a user 𝑈_𝑖 where ID_𝑖∉CU. 𝒞 runs 𝜎←  GSign(gpk,usk_𝑖,𝑀,𝒯_𝑡), where 𝒯_𝑡 is the current revocation-dependent value and gives 𝜎 to 𝒜.  Corruption. 𝒜 can request the secret key of a user 𝑈_𝑖. 𝒞 adds ID_𝑖 to CU and gives usk_𝑖 to 𝒜.
Challenge. 𝒜 sends a message 𝑀^∗ and two users 𝑈_𝑖0 and 𝑈_𝑖1, where ID_𝑖0,ID_𝑖1∉CU. 𝒞 chooses a bit 𝑏←{0,1} and runs 𝜎^∗←𝖦𝖲𝗂𝗀𝗇(gpk,usk_𝑖𝑏,𝑀^∗,𝒯_𝑡∗), where 𝒯_𝑡∗ is the current revocation-dependent value and gives 𝜎^∗ to 𝒜.
Queries. It is the same as the previous one (note that no corruption query for the challenge users is allowed).
Output. 𝒜 outputs a guessing bit 𝑏^′∈{0,1}.
We say that anonymity holds if, for all PPT adversaries 𝒜, the advantage 𝖠𝖽𝗏^anon_𝒜(𝜅)∶=Pr𝑏=𝑏^′−12 (1) is negligible.

There are two types of revocable group signature such that (1) any users can make a valid group signature, but anyone can check whether a signer has been revoked or not [3, 5, 10, 17], or (2) no revoked user can make a valid group signature without breaking traceability [2, 4, 6, 11]. We implicitly require the second type of revocable group signature, since clearly anonymity is broken if one of the challenge users is revoked in a first type scheme. We also require that the challenger 𝒞 (that has msk) can break traceability to compute the challenge group signature 𝜎^∗ for the case that a challenger user is revoked. Note that since msk is used for generating user’s secret keys, obviously any entity with msk makes an “untraceable” group signature, and this fact does not detract the security of our group signature.

One may think that the above anonymity definition can be extended that 𝒜 can issue the corruption query against the challenge users as in the full-anonymity [27]. It might be desired that 𝑟 is not revealed even if revoked users reveal their secret signing keys, since their signing keys are already meaningless (i.e., the rights of signing have expired). For example, if users are not intentionally revoked (e.g., a user has not paid in the outsourcing businesses example [14]), then users might reveal their secret signing keys to compromise the systems. Or, even if users are intentionally revoked (e.g., they feel that this service is not interesting in the outsourcing businesses example), they might reveal their secret signing keys as a crime for pleasure. However, even if 𝑟 is kept hidden when revoked users reveal their secret signing keys, one can easily guess 𝑟 by counting the number of revealed secret keys. So, in our opinion such secret key leakage resilient property is too strong, and therefore, our proposed group signature does not follow this leakage property.

Next, we define traceability.

Definition 10 (traceability).  
Setup. The challenger 𝒞 runs the Setup algorithm and the KeyGen algorithm and obtains params, gpk, msk, and all {usk_𝑖}^𝑁_𝑖=1. 𝒞 gives params and gpk to 𝒜 and sets 𝑡=0, RU₀=0/, and CU=0/, where RU₀ denotes the (initial) set of IDs of revoked users and CU denotes the set of IDs of corrupted users.
Queries.𝒜 can issue the following queries.
 Revocation.𝒜 can request the revocation of users ID_𝑖1,…,ID_{𝑖𝑘𝑡+1} for some constant 𝑘_𝑡+1∈[1,𝑁]. 𝒞 runs 𝒯_𝑡+1←𝖱𝖾𝗏𝗈𝗄𝖾(msk,{ID_𝑖1,…,ID_{𝑖𝑘𝑡+1}},𝒯_𝑡) and adds ID_𝑖1,…,ID_{𝑖𝑘𝑡+1} to RU_𝑡+1. GSigning.𝒜 can request a group signature on a message 𝑀 for a user 𝑈_𝑖 where ID_𝑖∉CU. 𝒞 runs 𝜎←  GSign(gpk,usk_𝑖,𝑀,𝒯_𝑡), where 𝒯_𝑡 is the current revocation-dependent value and gives 𝜎 to 𝒜. Corruption.𝒜 can request the secret key of a user 𝑈_𝑖. 𝒞 adds ID_𝑖 to CU and gives usk_𝑖 to 𝒜. Opening.𝒜 can request to a group signature 𝜎 on a message 𝑀. 𝒞 returns the result of Open(msk,𝑀,𝜎) to 𝒜.
Output.𝒜 outputs a past interval 𝑡^∗≤𝑡 for the current interval 𝑡, and (𝑀^∗,𝜎^∗).
We say that 𝒜 wins if (1)∧(2)∧((3)∨(4)) holds, where(1)Verify(gpk,𝑀^∗,𝜎^∗,𝒯_𝑡∗)=1,(2)𝒜 did not obtain 𝜎^∗ by making a signing query at 𝑀^∗,(3)for  ID_𝑖^∗← Open(msk,𝑀^∗,𝜎^∗), ID_𝑖^∗∉CU,(4)for  ID_𝑖^∗←Open(msk,𝑀^∗,𝜎^∗), ID_𝑖^∗∈RU_𝑡∗.
We say that traceability holds if, for all PPT adversaries 𝒜, the advantage 𝖠𝖽𝗏^trace_𝒜(𝜅)∶=Pr[𝒜wins] (2) is negligible.

4. Proposed Group Signature Scheme with Hiding of the Number of Revoked Users

In this section, we propose an 𝑟-hiding revocable group signature scheme by applying ABGS. Before explaining our scheme, we introduce ABGS as follows.

Attribute-Based Group Signature (ABGS). ABGS [22–25, 58] is a kind of group signature, where a user with a set of attributes can prove anonymously whether he/she has these attributes or not. Anonymity means a verifier cannot identify who the actual signer is among group members. As a difference from attribute-based signature (ABS) [59–68], there is an opening manager (as in group signatures) who can identify the actual signer (anonymity revocation), and a verifier can “explicitly” verify whether a user has these attributes or not [22, 24, 25]. By applying this explicit attribute verification, anonymous survey for the collection of attribute statistics is proposed [22]. As one exception, the Fujii et al. ABGS scheme [23] achieves signer-attribute privacy (as in ABS), where a group signature does not leak which attributes were used to generate it, except that assigned attributes satisfy a predicate. As another property (applied in our construction), the dynamic property has been proposed in [22], where the attribute predicate can be updated without reissuing the user’s secret keys.

Our Methodology. We consider two attributes: (1) valid group user and (2) the user’s identity (say 𝑈_𝑖), and apply the dynamic property of ABGS [22] and the signer-attribute privacy of ABGS [23]. Here we explain our methodology. Let the initial access tree be represented as in Figure 1.

Figure 1 

Initial access tree.

Due to the signer-attribute privacy, a user 𝑈_𝑖 can anonymously prove that he/she has attributes “valid group user” and “𝑈_𝑖.” Namely, anyone can verify whether the signer’s attributes satisfy the access tree, without detecting the actual attribute (i.e., the user’s identity).

When a user (say 𝑈₁) is revoked, the tree structure is changed as in Figure 2.

Figure 2 

Modified access tree.

Due to the dynamic property of ABGS, this modification can be done without reissuing the user’s secret keys. By removing the attribute “valid group user” from the subtree of 𝑈₁, we can express the revocation of 𝑈₁, since 𝑈₁ cannot prove that his/her attributes satisfy the current access tree.

In addition, we propose randomization and dummy attribute techniques to implement the revocation procedure (Figure 3). We apply the Boldyreva multisignature scheme [26], since it is applied for the computation of the membership certificate in the Fujii et al. ABGS. Let 𝑡 be the time interval and let 𝑣 denote the attribute “valid group user.”

Figure 3 

Our randomization and dummy attribute technique.

For a nonrevoked user 𝑈_𝑖, GM publishes the dummy value 𝑔^{𝑠𝑣,𝑡,𝑖𝑥𝑖}₁. Then 𝑈_𝑖 can compute 𝑔^{(𝑠𝑣,𝑡,𝑖+𝑠𝑖)𝑥𝑖}₁(=𝐻_𝑖) from 𝑑_{𝑇,𝑡,𝑖}=𝑔^{𝑠𝑣,𝑡,𝑖𝑥𝑖}₁ and 𝑈_𝑖’s secret key 𝐵_𝑖=𝑔^{𝑠𝑖𝑥𝑖}₁. Let 𝑈_𝑖 be revoked in the time interval 𝑡+1. Then, GM publishes a randomized dummy value 𝑔^{𝑠′𝑣,𝑡+1,𝑖}₁ (instead of 𝑔^{𝑠𝑣,𝑡+1,𝑖𝑥𝑖}₁), and therefore, 𝑈_𝑖 cannot compute 𝑔^{(𝑠𝑣,𝑡+1,𝑖+𝑠𝑖)𝑥𝑖} due to the CDH assumption. Note that (𝑔^{𝑠𝑣,𝑡+1,𝑖+𝑠𝑖}₁,𝑔^{𝑠𝑣,𝑡+1,𝑖𝑥𝑖}₁) and (𝑔^{𝑠𝑣,𝑡+1,𝑖+𝑠𝑖}₁,𝑔^{𝑠′𝑣,𝑡+1,𝑖}₁) are indistinguishable under the XDH assumption, where the DDH assumption holds in 𝔾₁. So, no one can decide whether 𝑈_𝑖 is a revoked user or not by observing either (𝑔^{𝑠𝑣,𝑡+1,𝑖+𝑠𝑖}₁,𝑔^{𝑠𝑣,𝑡+1,𝑖𝑥𝑖}₁) or (𝑔^{𝑠𝑣,𝑡+1,𝑖+𝑠𝑖}₁,𝑔^{𝑠′𝑣,𝑡+1,𝑖}₁). This is our main idea for preventing revealing the number of revoked users 𝑟.

Next, we give our group signature scheme.

Construction 1 (proposed 𝑟-hiding revocable group signature scheme).  
Setup(1^𝜅). Select a bilinear group (𝔾₁,𝔾₂,𝔾_𝑇) with prime order 𝑝 and a bilinear map 𝑒∶𝔾₁×𝔾₂→𝔾_𝑇, 𝑔,𝑔₁,…,𝑔₄,𝑔←^$𝔾₁, ℎ←^$𝔾₂. Output params=(𝑝,𝔾₁,𝔾₂,𝔾_𝑇,𝑒,𝑔,𝑔₁,𝑔₂,𝑔₃,𝑔₄,𝑔,ℎ,ℋ), where ℋ∶{0,1}^∗→ℤ_𝑝 is a hash function modeled as a random oracle.
KeyGen(𝑝𝑎𝑟𝑎𝑚𝑠,𝑁). Let (𝑈₁,…,𝑈_𝑁) be all users. Set 𝑡=0. Select 𝜔₁,𝜔₂,𝑋₁,𝑋₂,𝑥₁,…,𝑥_𝑁,𝑠₁,…,𝑠←_𝑁^$ℤ^∗_𝑝. Compute(i)𝑢,𝑣,ℎ∈𝔾₂ with the condition 𝑢^𝑋1=𝑣^𝑋2=ℎ(note that (𝑢,𝑣,ℎ) is a public key of the linear encryption and (𝑋₁,𝑋₂) is the corresponding secret key),(ii)𝐾_𝑖,1=𝑔^{1/(𝜔1+𝑥𝑖)}₁, 𝐾_𝑖,2=ℎ^𝑥𝑖, and 𝐵_𝑖=𝑔^{𝑠𝑖𝑥𝑖}₁ for all 𝑖∈[1,𝑁],(iii)Ω₁=ℎ^𝜔1 and Ω₂=ℎ^𝜔2.For all 𝑖∈[1,𝑁], choose 𝑠_𝑣,0,𝑖,𝑦_0,𝑖,𝑟←_0,𝑖^$ℤ^∗_𝑝. If 𝑠_𝑣,0,𝑖+𝑠_𝑖=0mod𝑝, then choose 𝑠_𝑣,0,𝑖 again until 𝑠_𝑣,0,𝑖+𝑠_𝑖≠0mod𝑝 holds. Set 𝑠_𝑇,0,𝑖∶=𝑠_𝑣,0,𝑖+𝑠_𝑖 and compute(i)ℎ_𝑇,0,𝑖=𝑔^{𝑠𝑇,0,𝑖}₁,(ii)𝐴_0,𝑖=(𝑔^{𝑠𝑇,0,𝑖}₁𝑔^𝑡₂𝑔^𝑟0,𝑖₃𝑔₄)^{1/(𝜔2+𝑦0,𝑖)} (which is a BBS+ signature for signed messages (𝑠_𝑇,0,𝑖,𝑡)),(iii)𝑑_𝑇,0,𝑖∶=𝑔^{𝑠𝑣,0,𝑖𝑥𝑖}₁.Set Sign(𝑠_𝑇,0,𝑖,𝑖)∶=(𝐴_0,𝑖,𝑦_0,𝑖,𝑟_0,𝑖). Output(i)gpk=(params,Ω₁,Ω₂,𝑢,𝑣,ℋ), where ℋ∶{0,1}^∗→ℤ^∗_𝑝 is a hash function which is modeled as a random oracle,(ii)msk=(𝑋₁,𝑋₂,𝑠₁,…,𝑠_𝑁,𝑠_𝑣,0,1,…,𝑠_𝑣,0,𝑁,𝑥₁,…,𝑥_𝑁,reg∶={(𝐾_𝑖,2,𝑖)}^𝑁_𝑖=1),(iii)usk_𝑖=(𝐾_𝑖,1,𝐾_𝑖,2,𝐵_𝑖) for all 𝑖∈[1,𝑁], and 0,(iv)𝒯₀={(Sign(𝑠_𝑇,0,𝑖,𝑖),ℎ_𝑇,0,𝑖,𝑑_𝑇,0,𝑖)}^𝑁_𝑖=1.

GSign(𝑔𝑝𝑘,𝑢𝑠𝑘_𝑖,𝑀,𝒯_𝑡). Let 𝑈_𝑖 be a nonrevoked user in the current time interval 𝑡. That is, for (Sign(𝑠_{𝑇,𝑡,𝑖},𝑖),ℎ_{𝑇,𝑡,𝑖},𝑑_{𝑇,𝑡,𝑖})∈𝒯_𝑡, ℎ_{𝑇,𝑡,𝑖}=𝑔^{𝑠𝑣,𝑡,𝑖+𝑠𝑖}₁∶=𝑔^{𝑠𝑇,𝑡,𝑖}₁ and 𝑑_{𝑇,𝑡,𝑖}=𝑔^{𝑠𝑣,𝑡,𝑖𝑥𝑖}₁ hold for some unknown exponent 𝑠_{𝑣,𝑡,𝑖}∈ℤ^∗_𝑝. 𝑈_𝑖 chooses 𝑟₁,𝑟₂,…,𝑟₁₀,𝛿₁,𝛿←₂^$ℤ^∗_𝑝, sets 𝛼=−𝑟₁𝑟₂, 𝛽=−𝑟₂𝑟₄, 𝛽^′=𝑟₅𝑦_𝑡,𝑖−𝑟₄, 𝛾=𝑟₂𝑟₆+𝑟₇, 𝛾^′=𝑟₄𝑟₈+𝑟₉, and 𝛾^′′=𝑟₁₀𝑦_𝑡,𝑖, and computes 𝐻_𝑖=𝐵_𝑖⋅𝑑_{𝑇,𝑡,𝑖}=𝑔^{𝑠𝑖𝑥𝑖+𝑠𝑣,𝑡,𝑖𝑥𝑖}₁=ℎ^𝑥𝑖_{𝑇,𝑡,𝑖},𝑇₁=𝐾_𝑖,1𝑔^𝑟1,𝑇₂=𝐾_𝑖,2ℎ^𝑟2,𝑇₃=𝐻_𝑖𝑔^𝑟3,𝑇₄=ℎ_{𝑇,𝑡,𝑖}𝑔^𝑟4,𝑇₅=𝐴_𝑡,𝑖𝑔^𝑟5,𝐶₁=𝑔^𝑟1𝑔^𝑟6,𝐶₂=𝑔^𝛼𝑔^𝑟7,𝐶₃=𝑔^𝑟2𝑔^𝑟8,𝐶₄=𝑔^𝛽𝑔^𝑟9,𝐶₅=𝑔^𝑟10𝑔^−𝑟5,𝐶₆=𝑔^𝛾′′𝑔^−𝑟4,𝐹₁=𝐾_𝑖,2ℎ^𝛿1+𝛿2,𝐹₂=𝑢^𝛿1,𝐹₃=𝑣^𝛿2. (3) Next, we explain the relations proved in SPK 𝑉 which proves the following three things.(1)A signer has a valid (𝐾_𝑖,1,𝐾_𝑖,2) generated by the KeyGen algorithm.(i) (𝐾_𝑖,1,𝐾_𝑖,2) can be verified by using the public value Ω₁ such that 𝑒𝐾_𝑖,1,Ω₁𝐾_𝑖,2=𝑒𝑔₁,ℎ. (4)(ii)Since 𝐾_𝑖,1 (resp., 𝐾_𝑖,2) is hidden such that 𝑇₁=𝐾_𝑖,1𝑔^𝑟1, (resp., 𝑇₂=𝐾_𝑖,2ℎ^𝑟2), this relation is represented as 𝑒𝑇₁,Ω₁𝑇₂𝑒𝑔₁,ℎ=𝑒(𝑔,Ω₁𝑇₂)^𝑟1𝑒(𝑇₁,ℎ)^𝑟2𝑒(𝑔,ℎ)^𝛼. (5)(iii)We need to guarantee the relation 𝛼=−𝑟₁𝑟₂ in the relation above. To prove this, introduce an intermediate value 𝛾=𝑟₂𝑟₆+𝑟₇ and prove that 𝐶₁=𝑔^𝑟1𝑔^𝑟6∧𝐶₂=𝑔^𝛼𝑔^𝑟7∧𝐶₂=𝐶^−𝑟2₁𝑔^𝛾. (6) Note that 𝐶₂=𝐶^−𝑟2₁𝑔^𝛾=(𝑔^𝑟1𝑔^𝑟6)^−𝑟2𝑔^𝛾=𝑔^{−𝑟1𝑟2}𝑔^{−𝑟2𝑟6+𝛾}=𝑔^𝛼𝑔^𝑟7 yields 𝛼=−𝑟₁𝑟₂ and 𝛾=𝑟₂𝑟₆+𝑟₇.(2)A signer has not been revoked.(i)A nonrevoked signer can compute 𝐻_𝑖=ℎ^{logℎ𝐾𝑖,2}_{𝑇,𝑡,𝑖}=(𝑔^{𝑠𝑇,𝑡,𝑖}₁)^𝑥𝑖 from 𝐵_𝑖 and 𝑑_{𝑇,𝑡,𝑖}, where 𝑠_{𝑇,𝑡,𝑖} is a signed message of 𝐴_𝑡,𝑖. These satisfy the following relations: 𝑒ℎ_{𝑇,𝑡,𝑖},𝐾_𝑖,2=𝑒𝐻_𝑖,𝑒𝐴,ℎ_𝑡,𝑖,Ω₂ℎ^{𝑦𝑡,𝑖}=𝑒𝑔^{𝑠𝑇,𝑡,𝑖}₁𝑔^𝑡₂𝑔^{𝑟𝑡,𝑖}₃𝑔₄,ℎ. (7)(ii)Since 𝐻_𝑖, ℎ_{𝑇,𝑡,𝑖}, and 𝐴_𝑖 are hidden such that 𝑇₃=𝐻_𝑖𝑔^𝑟3, 𝑇₄=ℎ_{𝑇,𝑡,𝑖}𝑔^𝑟4, and 𝑇₅=𝐴_𝑡,𝑖𝑔^𝑟5, these relations are represented as 𝑒𝑇₄,𝑇₂𝑒𝑇₃=,ℎ𝑒(𝑔,𝑇₂)^𝑟4𝑒(𝑇₄,ℎ)^𝑟2𝑒(𝑔,ℎ)^𝛽𝑒(𝑔,ℎ)^𝑟3,𝑒𝑇₅,Ω₂𝑒𝑔₄,ℎ𝑒𝑇₄,ℎ𝑒(𝑔₂,ℎ)^𝑡=𝑒(𝑔,Ω₂)^𝑟5𝑒(𝑔₃,ℎ)^{𝑟𝑡,𝑖}𝑒(𝑔,ℎ)^𝛽′𝑒(𝑇₅,ℎ)^{𝑦𝑡,𝑖}. (8)(iii)We need to guarantee the relations 𝛽=−𝑟₂𝑟₄ and 𝛽^′=𝑟₅𝑦_𝑡,𝑖−𝑟₄ in the relations above. To prove these, introduce intermediate values 𝛾^′=𝑟₄𝑟₈+𝑟₉ and 𝛾^′′=𝑟₁₀𝑦_𝑡,𝑖 and prove that 𝐶₃=𝑔^𝑟2𝑔^𝑟8∧𝐶₄=𝑔^𝛽𝑔^𝑟9∧𝐶₄=𝐶^−𝑟4₃𝑔^𝛾′,𝐶₅=𝑔^𝑟10𝑔^−𝑟5∧𝐶₆=𝑔^𝛾′′𝑔^−𝑟4∧𝐶₆=𝐶^{𝑦𝑡,𝑖}₅𝑔^𝛽′. (9)(iv)As in 𝛼 and 𝛾 explained before, relations 𝛽=−𝑟₂𝑟₄, 𝛽^′=𝑟₅𝑦_𝑡,𝑖−𝑟₄, 𝛾^′=𝑟₄𝑟₈+𝑟₉, and 𝛾^′′=𝑟₁₀𝑦_𝑡,𝑖 are obtained from the relations above.(v)Note that (𝐴_𝑡,𝑖,𝑟_𝑡,𝑖,𝑦_𝑡,𝑖) is a BBS+ signature for signed messages (𝑠_{𝑇,𝑡,𝑖},𝑡), and therefore 𝑉 depends on the current time interval 𝑡.(3)A value for the Open algorithm is included in 𝜎.(i)(𝐹₁,𝐹₂,𝐹₃) is a ciphertext (of the linear encryption scheme) of the plaintext 𝐾_𝑖,2, which can be computed by decrypting (𝐹₁,𝐹₂,𝐹₃) using msk.According to the above explanations, compute the SPK 𝑉 proving the following relations (we give the detailed SPK 𝑉 in the Appendix): 𝑉=SPK𝑟₁,𝑟₂,𝑟₃,𝑟₄,𝑟₅,𝑟₆,𝑟₇,𝑟₈,𝑟₉,𝑟₁₀,𝑦_𝑡,𝑖,𝑟_𝑡,𝑖,𝛼,𝛽,𝛽^′,𝛾,𝛾^′,𝛾^′′,𝛿₁,𝛿₂∶𝑒𝑇₁,Ω₁𝑇₂𝑒𝑔₁,ℎ=𝑒𝑔,Ω₁𝑇₂^𝑟1𝑒𝑇₁,ℎ^𝑟2𝑒𝑔,ℎ^𝛼∧𝑒𝑇₄,𝑇₂𝑒𝑇₃=𝑒,ℎ𝑔,𝑇₂^𝑟4𝑒𝑇₄,ℎ^𝑟2𝑒𝑔,ℎ^𝛽𝑒𝑔,ℎ^𝑟3∧𝑒𝑇₅,Ω₂𝑒𝑔₄,ℎ𝑒𝑇₄,ℎ𝑒𝑔₂,ℎ^𝑡=𝑒(𝑔,Ω₂)^𝑟5𝑒(𝑔₃,ℎ)^{𝑟𝑡,𝑖}𝑒(𝑔,ℎ)^𝛽′𝑒(𝑇₅,ℎ)^{𝑦𝑡,𝑖}∧𝐶₁=𝑔^𝑟1𝑔^𝑟6∧𝐶₂=𝑔^𝛼𝑔^𝑟7∧𝐶₂=𝐶^−𝑟2₁𝑔^𝛾∧𝐶₃=𝑔^𝑟2𝑔^𝑟8∧𝐶₄=𝑔^𝛽𝑔^𝑟9∧𝐶₄=𝐶^−𝑟4₃𝑔^𝛾′∧𝐶₅=𝑔^𝑟10𝑔^−𝑟5∧𝐶₆=𝑔^𝛾′′𝑔^−𝑟4∧𝐶₆=𝐶^{𝑦𝑡,𝑖}₅𝑔^𝛽′∧𝑇₂𝐹₁=ℎ^𝑟2ℎ^𝛿1+𝛿2∧𝐹₂=𝑢^𝛿1∧𝐹₃=𝑣^𝛿2(𝑀). (10) Output 𝜎=(𝐶₁,𝐶₂,𝐶₃,𝐶₄,𝐶₅,𝐶₆,𝐹₁,𝐹₂,𝐹₃,𝑇₁,𝑇₂,𝑇₃,𝑇₄,𝑇₅,𝑉).

Verify(𝑔𝑝𝑘,𝑀,𝜎,𝒯_𝑡). Return 1 if 𝜎 is a valid group signature and 0 otherwise. We give the procedure of the verification algorithm in the Appendix.

Revoke(𝑔𝑝𝑘,𝑚𝑠𝑘,{𝑈_𝑖},𝒯_𝑡). Let RL_𝑡+1∶={𝑈_𝑖} be a set of revoked users. Set 𝑡→𝑡+1. For all 𝑖∈{𝑖∣𝑈_𝑖∈RL_𝑡+1}, choose 𝑠←^′_{𝑣,𝑡+1,𝑖}^$ℤ^∗_𝑝. For all 𝑖∈[1,𝑁], choose 𝑠_{𝑣,𝑡+1,𝑖},𝑦_𝑡+1,𝑖,𝑟←_𝑡+1,𝑖^$ℤ^∗_𝑝 (until 𝑠_{𝑣,𝑡+1,𝑖}+𝑠_𝑖≠0mod𝑝 holds), set 𝑠_{𝑇,𝑡+1,𝑖}∶=𝑠_{𝑣,𝑡+1,𝑖}+𝑠_𝑖, and compute ℎ_{𝑇,𝑡+1,𝑖}=𝑔^{𝑠𝑇,𝑡+1,𝑖},𝐴_𝑡+1,𝑖=𝑔^{𝑠𝑇,𝑡+1,𝑖}₁𝑔₂^𝑡+1𝑔^{𝑟𝑡+1,𝑖}₃𝑔₄^{1/(𝜔2+𝑦𝑡+1,𝑖)}, (11) and compute 𝑑_{𝑇,𝑡+1,𝑖} such that 𝑑_{𝑇,𝑡+1,𝑖}=𝑔^{𝑠𝑣,𝑡+1,𝑖𝑥𝑖}₁𝑈_𝑖∉RL_𝑡+1𝑔^{𝑠′𝑣,𝑡+1,𝑖}₁𝑈_𝑖∈RL_𝑡+1, (12) and set Sign(𝑠_{𝑇,𝑡+1,𝑖},𝑖)=(𝐴_𝑡+1,𝑖,𝑦_𝑡+1,𝑖,𝑟_𝑡+1,𝑖). Output 𝒯_𝑡+1={(Sign(𝑠_{𝑇,𝑡+1,𝑖},𝑖),ℎ_{𝑇,𝑡+1,𝑖},𝑑_{𝑇,𝑡+1,𝑖})}^𝑁_𝑖=1.

Open(𝑔𝑝𝑘,𝑚𝑠𝑘,𝑀,𝜎). Compute 𝐹₁/𝐹^𝑋1₂𝐹^𝑋2₃=𝐾 and search 𝑖 such that (𝐾_𝑖,2,𝑖)∈reg and 𝐾=𝐾_𝑖,2. If there is no such 𝑖, output 0. Otherwise, output 𝑖.

In our scheme, no public values have size dependent on 𝑟 and no costs of the GSign algorithm (or the Verify algorithm) depend on 𝑟 or 𝑁. In addition, our scheme satisfies anonymity with respect to the revocation which guarantees the unlinkability of revoked users. So, in our scheme, no 𝑟 is revealed.

5. Security Analysis

Theorem 11. The proposed group signature scheme satisfies anonymity with respect to the revocation under the DLIN assumption and the XDH assumption in the random oracle model.

Proof. This proof contains three games, Games 0, 1, and 2. Game 0 is the same as anonymity game. In Game 1, all 𝑑_{𝑇,𝑡,𝑖} where 𝑖∈[1,𝑁] is randomly chosen. Let 𝒜₁ be the adversary who breaks anonymity with respect to the revocation of our scheme and let ℬ₁ be the simulator. First, ℬ₁ chooses all values and sets up the scheme as in Game 0, except all 𝑑_{𝑇,𝑡,𝑖}, where 𝑖∈[1,𝑁] are randomly chosen. Note that still ℬ₁ can answer all queries issued from 𝒜₁ since ℬ₁ knows all secret values and can compute ℎ^𝑥𝑖_{𝑇,𝑡,𝑖} for all 𝑖∈[1,𝑁]. Under the XDH assumption, Game 0 and Game 1 are identical.
Game 2 is the same as Game 1, except that the challenge group signature contains the challenge ciphertext of the linear encryption. In Game 2, let 𝒞₂ be the challenger of the linear encryption and let 𝒜₂ be the adversary who breaks anonymity with respect to the revocation of our scheme. We construct algorithm ℬ₂ that breaks the IND-CPA security of the linear encryption. First, 𝒞₂ gives the public key of the linear encryption (𝑢,𝑣,ℎ). ℬ₂ chooses all values, except for (𝑢,𝑣,ℎ), and therefore ℬ₂ can answer all queries issued from 𝒜₂. In the challenge phase, 𝒜₂ sends (𝑀^∗,𝑈_𝑖0,𝑈_𝑖1). Let ℎ^𝑥𝑖0 and ℎ^𝑥𝑖1 be (a part of) secret key of 𝑈_𝑖0 and 𝑈_𝑖1, respectively. ℬ₂ sets 𝑀^∗₀∶=ℎ^𝑥𝑖0 and 𝑀^∗₁∶=ℎ^𝑥𝑖1 and sends (𝑀^∗₀,𝑀^∗₁) to 𝒞₂ as the challenge messages of the linear encryption. 𝒞₂ sends the challenge ciphertext 𝐶^∗. ℬ₂ sets 𝐶^∗=(𝐹₁,𝐹₂,𝐹₃) and computes the challenge group signature 𝜎^∗. Note that ℬ₂ does not know the random number (𝛿^∗₁,𝛿^∗₂) and 𝜇∈{0,1} such that 𝐶^∗=(ℎ^𝑥𝑖𝜇ℎ^{𝛿∗1+𝛿∗2},𝑢^𝛿∗1,𝑣^𝛿∗2), since (𝛿^∗₁,𝛿^∗₂,𝜇) are chosen by 𝒞. So, ℬ₂ uses the backpatch of the random oracle ℋ for computing 𝜎^∗ and includes 𝐶^∗ in 𝜎^∗. Then, all values (except for 𝐶^∗) are independent of 𝜇. Note that even if 𝑈_𝑖𝜇 is revoked in the challenge interval, ℬ₂ can compute 𝜎^∗, since ℬ₂ knows msk. Finally, 𝒜₂ outputs the guessing bit 𝜇^′∈{0,1}. ℬ₂ outputs 𝜇^′ as the guessing bit of the IND-CPA game of the linear encryption.

Theorem 12. The proposed group signature scheme satisfies traceability under the 𝑁-HSDH assumption, the CDH assumption, and the 𝑁𝑡-SDH assumption, where 𝑡 is the final time interval that 𝒜 outputs (𝑀^∗,𝜎^∗).

Proof. From the winning conditions of traceability, that is, either ID_𝑖^∗∉CU or ID_𝑖^∗∈RU_𝑡∗, an adversary is divided into the following three types: 𝒜₁, 𝒜₂, and 𝒜₃, as follows: let 𝒜₁ be an adversary who outputs (𝑀^∗,𝜎^∗), where for ID_𝑖^∗← Open(msk,𝑀^∗,𝜎^∗), ID_𝑖^∗∉CU and 𝑈_𝑖^∗∈{𝑈₁,…,𝑈_𝑁} hold. Let 𝒜₂ be an adversary who outputs (𝑀^∗,𝜎^∗), where for ID_𝑖^∗← Open(msk,𝑀^∗,𝜎^∗), ID_𝑖^∗∉CU and 𝑈_𝑖^∗∉{𝑈₁,…,𝑈_𝑁} hold. In addition, let 𝒜₃ be an adversary who outputs (𝑀^∗,𝜎^∗), where for ID_𝑖^∗← Open(msk,𝑀^∗,𝜎^∗), ID_𝑖^∗∈RU_𝑡∗ holds (note that since ID_𝑖^∗∈RU_𝑡∗, 𝑈_𝑖^∗∈{𝑈₁,…,𝑈_𝑁} holds).
We construct an algorithm ℬ₁ (resp., ℬ₂ and ℬ₃) that breaks the 𝑁-HSDH assumption (resp., 𝑞-SDH assumption, where 𝑞 is the number of signing queries, and the CDH assumption) by using 𝒜₁ (resp., 𝒜₂ and 𝒜₃).
First, we describe ℬ₁. Let 𝑔₁,ℎ,ℎ^𝜔1,{(𝑔^{1/(𝜔1+𝑥𝑖)}₁,ℎ^𝑥𝑖)}_{𝑖=1,…,𝑁} be an 𝑁-HSDH instance. ℬ₁ selects 𝑈_𝑖^∗∈{𝑈₁,…,𝑈_𝑁}, and choose all values, except for 𝑔₁, ℎ, and Ω₁∶=ℎ^𝜔1. ℬ₁ answers queries issued by 𝒜₁ as follows.
Revocation. 𝒜₁ requests the revocation of users ID_𝑖1,…,ID_𝑖𝑘𝑡 for some constant 𝑘_𝑡∈[1,𝑁]. Since ℬ₁ knows 𝜔₂, ℬ₁ adds ID_𝑖1,…,ID_𝑖𝑘𝑡 to RU_𝑡 and simply returns the result of the Revoke algorithm.
GSigning. 𝒜₁ requests a group signature on a message 𝑀 for a user 𝑈_𝑖 where ID_𝑖∉CU. Since ℬ₁ does not know 𝑔^𝑥𝑖₁, ℬ₁ computes 𝜎 by using the backpatch of the random oracle ℋ and gives 𝜎 to 𝒜.
Corruption. 𝒜₁ requests the secret key of a user 𝑈_𝑖. If 𝑈_𝑖=𝑈_𝑖^∗, then ℬ₁ aborts. Otherwise, ℬ₁ sets (𝑔^{1/(𝜔1+𝑥𝑖)}₁,ℎ^𝑥𝑖)=(𝐾_𝑖,1,𝐾_𝑖,2), chooses 𝑠←^′_𝑖^$ℤ^∗_𝑝, sets 𝑠^′_𝑖=𝑠_𝑖𝑥_𝑖, and computes 𝐵_𝑖=𝑔^𝑠′𝑖. ℬ₁ adds ID_𝑖 to CU and gives (𝐾_𝑖,1,𝐾_𝑖,2,𝐵_𝑖) to 𝒜₁.
Opening. Since ℬ₁ has (𝑋₁,𝑋₂), ℬ₁ simply returns the result of the Open algorithm.
Finally, 𝒜₁ outputs a past interval 𝑡^∗≤𝑡 for the current interval 𝑡 and a pair (𝑀^∗,𝜎^∗). By using the extractor of SPK, ℬ₁ gets (𝐾^∗_𝑖,1,𝐾^∗_𝑖,2,𝐻^∗_𝑖), where 𝑒(𝐾^∗_𝑖,1,Ω₁𝐾^∗_𝑖,2)=𝑒(𝑔₁,ℎ), 𝑒(ℎ_{𝑇,𝑡,𝑖},𝐾^∗_𝑖,2)=𝑒(𝐻^∗_𝑖,ℎ), 𝐹₁=𝐾^∗_𝑖,2ℎ^𝛿1+𝛿2, 𝐹₂=𝑢^𝛿1, and 𝐹₃=𝑣^𝛿2 hold. From (𝐹₁,𝐹₂,𝐹₃), ℬ₁ obtains 𝑖 by using the Open algorithm. If 𝑖≠𝑖^∗, then ℬ₁ aborts. Otherwise, ℬ₁ outputs (𝐾^∗_𝑖,1,𝐾^∗_𝑖,2) as a solution of the 𝑁-HSDH problem.
Next, we describe ℬ₂ that outputs a forged BBS+ signature. Let 𝒞 be the challenger of the BBS+ signature. ℬ₂ is given (𝑔,𝑔₁,𝑔₂,𝑔₃,𝑔₄,ℎ,Ω₂) from 𝒞. ℬ₂ chooses all values, except for (𝑔,𝑔₁,𝑔₂,𝑔₃,𝑔₄,ℎ,Ω₂). For each revocation query, ℬ₂ issues 𝑁 signing queries to 𝒞 for obtaining 𝐴_⋅,𝑖. So, ℬ₂ needs to issue the signing query in 𝑁𝑡 times. For other queries, ℬ₂ can answer since ℬ₂ knows all other secret values. Finally, 𝒜₃ outputs a past interval 𝑡^∗≤𝑡 for the current interval 𝑡 and a pair (𝑀^∗,𝜎^∗). By using the extractor of SPK, ℬ₂ gets (𝐴_𝑡∗,𝑖^∗,𝑦_{𝑡∗,𝑖∗},𝑟_𝑡∗,𝑖^∗), where 𝑒(𝐴_𝑡∗,𝑖^∗,Ω₂ℎ^{𝑦𝑡∗∗,𝑖})=𝑒(𝑔^{𝑠∗∗𝑇,𝑡,𝑖}₁𝑔^𝑡∗₂𝑔^{𝑟𝑡∗∗,𝑖}₃𝑔₄,ℎ). Note that since 𝑈_𝑖^∗∉{𝑈₁,…,𝑈_𝑁}, ℬ₂ does not obtain (𝐴_𝑡∗,𝑖^∗,𝑦_{𝑡∗,𝑖∗},𝑟_𝑡∗,𝑖^∗) from 𝒞. So, ℬ₂ outputs a forged BBS+ signature (𝐴_𝑡∗,𝑖^∗,𝑦_{𝑡∗,𝑖∗},𝑟_𝑡∗,𝑖^∗).
Finally, we describe ℬ₃ that breaks the CDH assumption. Let (𝑔₁,𝑔^𝑎₁,𝑔^𝑏₁) be an CDH instance. ℬ₃ selects 𝑈_𝑖^∗∈{𝑈₁,…,𝑈_𝑁}, sets 𝑥_𝑖^∗∶=𝑎 and 𝑠_𝑖^∗∶=𝑏, and chooses all values, except for 𝑔₁ and usk_𝑖^∗. ℬ₃ answers queries issued by 𝒜₃ as follows.
Revocation. 𝒜₃ requests the revocation of users ID_𝑖1,…,ID_𝑖𝑘𝑡 for some constant 𝑘_𝑡. Since ℬ₃ knows 𝜔₂, ℬ₃ adds ID_𝑖1,…,ID_𝑖𝑘𝑡 to RU_𝑡 and simply returns the result of the Revoke algorithm.
GSigning. 𝒜₃ requests a group signature on a message 𝑀 for a user 𝑈_𝑖 where ID_𝑖∉CU. ℬ₃ computes 𝜎 by using the backpatch of the random oracle ℋ and gives 𝜎 to 𝒜.
Corruption. 𝒜₃ requests the secret key of a user 𝑈_𝑖. If 𝑈_𝑖=𝑈_𝑖^∗, then ℬ₃ aborts. Otherwise, ℬ₃ adds ID_𝑖 to CU and gives (𝐾_𝑖,1,𝐾_𝑖,2,𝐵_𝑖) to 𝒜₃.
Opening. Since ℬ₃ has (𝑋₁,𝑋₂), ℬ₃ simply returns the result of the Open algorithm.
Finally, 𝒜₃ outputs a past interval 𝑡^∗≤𝑡 for the current interval 𝑡 and a pair (𝑀^∗,𝜎^∗). By using the extractor of SPK, ℬ₃ gets 𝐻^∗_𝑖, where 𝑒(𝐾^∗_𝑖,1,Ω₁𝐾^∗_𝑖,2)=𝑒(𝑔₁,ℎ), 𝑒(ℎ_{𝑇,𝑡,𝑖},𝐾^∗_𝑖,2)=𝑒(𝐻^∗_𝑖,ℎ), 𝐹₁=𝐾^∗_𝑖,2ℎ^𝛿1+𝛿2, 𝐹₂=𝑢^𝛿1, and 𝐹₃=𝑣^𝛿2 hold. From (𝐹₁,𝐹₂,𝐹₃), ℬ₃ obtains 𝑖 by using the Open algorithm. If 𝑖≠𝑖^∗, then ℬ₃ aborts. Otherwise, ℬ₃ solves the CDH problem as follows. Since 𝑈_𝑖∈RL_𝑡, ℬ₃ has computed 𝑔^{𝑠∗𝑣,𝑡,𝑖}₁⋅𝑔^𝑏₁=𝑔^{𝑠∗𝑣,𝑡,𝑖+𝑠𝑖∗}₁ and 𝑔^{𝑠′∗𝑣,𝑡,𝑖}₁. That is, 𝐻^∗_𝑖=𝐵_𝑖^∗⋅𝑔^{𝑠∗𝑣,𝑡,𝑖𝑥𝑖}₁=𝑔^{𝑎𝑏+𝑎𝑠∗𝑣,𝑡,𝑖𝑥𝑖}₁ holds. So, ℬ₃ outputs 𝐻^∗_𝑖/(𝑔^𝑎₁)^{𝑠∗𝑣,𝑡,𝑖}=𝑔₁^𝑎𝑏 as the solution of the CDH problem.

6. Discussion: Toward Efficient and Standard Model Construction

One drawback of our scheme is that the number of public values depends on 𝑁, since no common attribute can be applied for implementing the revocation procedure of “each” user. So, one may think that there might be a more trivial construction (without applying ABGS) if such a big-size public value is allowed. For example, as one of the most simple group signature constructions, let 𝑔^𝑥1,…,𝑔^𝑥𝑁 be users’ public keys, and GM randomizes these values such that 𝑦₁∶=(𝑔^𝑥1)^𝑟GM,…,𝑦_𝑁∶=(𝑔^𝑥𝑁)^𝑟GM and publishes 𝑦∶=𝑔^𝑟GM. Each user (say 𝑈_𝑖) proves the knowledge of 𝑥_𝑖 for the relation (𝑔^𝑟GM)^𝑥𝑖 using the OR relation such that SPK{𝑥∶𝑦^𝑥=𝑦₁∨⋯∨𝑦^𝑥=𝑦_𝑁}(𝑀) to hide the identity 𝑖∈[1,𝑁]. If a user (say 𝑈_𝑗) is revoked, then GM publishes a random value 𝑅_𝑗 (instead of (𝑔^𝑥𝑗)^𝑟GM). In this case, the number of revoked users is not revealed under the DDH assumption, since (𝑔,𝑔^𝑥𝑗,𝑔^𝑟GM,(𝑔^𝑥𝑗)^𝑟GM) is a DDH tuple. However, this trivial approach requires 𝑁-dependent signing/verification cost, whereas our scheme achieves constant proving costs.

As another candidate, Sudarsono et al. [69] proposed an attribute-based anonymous credential system by applying an efficient pairing-based accumulator proposed by Camenisch et al. [70]. Since the Sudarsono et al. construction follows AND/OR relations of attributes, a revocable group signature scheme with the property of hiding 𝑟 might be constructed. However, it is not obvious whether 2-DNF (disjunctive normal form) formulae ∨^𝑁_𝑖=1(validgroupuser∧𝑈_𝑖) can be implemented or not in the Sudarsono et al. attribute-based proof system. Later, Begum et al. [71] proposed an attribute-based anonymous credential system for CNF (conjunctive normal form) formulae which can be converted to DNF formulae. However, these constructions require the 𝑁-dependent-size (𝑁 is the number of attributes in this context) public values to update the witness of users as in our group signature scheme. So, we insist that proposing a revocable group signature scheme with both the property of hiding 𝑟 and constant proving costs is not trivial even if such a large-size public key is allowed.

Libert et al. [72] proposed anonymous broadcast encryption, where information of a set of authorized users 𝑆 (indicated by a user who encrypts a plaintext 𝑀) is not revealed from a ciphertext, except for the size of 𝑆. More precisely, they first considered a scheme, where there are 𝑁 public keys (𝑁 is the total number of users in this context) and the user encrypts 𝑀 (resp., 0) by using the corresponding user’s public key if a user belongs to 𝑆 (resp., does not belong to 𝑆), using key-private public key encryption [73]. Though the size of ciphertext is 𝑂(𝑁), no information of 𝑆, including its size, is revealed. In order to improve the size of ciphertext of their first scheme, Abdalla et al. applied robust encryption [74] and constructed an anonymous broadcast encryption scheme whose ciphertext size is 𝑂(|𝑆|). In other words, they can reduce the ciphertext size at the expense of information of the size of 𝑆. In 𝑟-hiding group signature, the size of the set of revoked user needs to be hidden. To do so, we essentially use the same methodology of the Libert et al.’s first scheme, that is, adding dummies. Though an anonymous broadcast encryption scheme with sublinear size ciphertext has been proposed [75], this scheme only achieves outsider anonymity, where the receiver’s identities are hidden from outsiders; this security notion seems not enough for our purpose. Therefore, if an efficient anonymous broadcast encryption scheme which hides the size of 𝑆 can be constructed, then we might construct more efficient 𝑟-hiding group signature scheme by using the methodology of recent group signature schemes [7, 8], where nonrevocable users prove the decryption ability of a ciphertext of a broadcast encryption scheme.

Another (theoretical) drawback of our construction is using random oracles. Actually, a typical group signature construction methodology for standard model construction has been appearing in several papers after the Groth construction [33], that is, using Groth-Sahai proofs [36] and structure-preserving signatures [37]. By applying this methodology, we can expect that an 𝑟-hiding revocable group signature scheme in the standard model can be constructed. However, big-size public values problem still remains. So, we need to propose a novel methodology for proposing an 𝑟-hiding revocable group signature scheme with small-size public key, even in the random oracle model.

Under a XDH-hard elliptic curve with 170-bit 𝑝 (as in [4, 10]), the size of signature is 7242 bits, where the size of an element of 𝔾₁ is 171 bits, the size of an element of 𝔾₂ is 513 bits, and the size of the challenge 𝑐 is 80 bits. Since the size of signature in [4] (resp., in [10]) is 1444 (resp., 1533) bits, there might be space for improvement of the signature size.

7. Conclusion

In this paper, for the first time we pointed out that the number of revoked users 𝑟 is quite negative information in group signature, and we propose a revocable group signature scheme with the property of hiding 𝑟, by applying ABGS. As a matter of first priority, proposing such a group signature scheme with small-size public parameter is an interesting future work. Then, we may be able to apply the standard model construction methodology for constructing an efficient scheme in the standard model.

Appendix

Here, we describe the detailed SPK 𝑉 as follows.(1)Choose 𝑟_𝑟1,𝑟_𝑟2,𝑟_𝑟3,𝑟_𝑟4,𝑟_𝑟5,𝑟_𝑟6,𝑟_𝑟7,𝑟_𝑟8,𝑟_𝑟9,𝑟_𝑟10,𝑟_{𝑦𝑡,𝑖},𝑟_{𝑟𝑡,𝑖},𝑟_𝛼,𝑟_𝛽,𝑟_𝛽′,𝑟_𝛾,𝑟_𝛾′,𝑟_𝛾′′,𝑟_𝛿1,𝑟←_𝛿2^$ℤ^∗_𝑝.(2)Compute 𝑅₁=𝑒𝑔,Ω₁𝑇₂^𝑟𝑟1𝑒𝑇₁,ℎ^𝑟𝑟2𝑒𝑔,ℎ^𝑟𝛼,𝑅₂=𝑒𝑔,𝑇₂^𝑟𝑟4𝑒𝑇₄,ℎ^𝑟𝑟2𝑒𝑔,ℎ^𝑟𝛽𝑒𝑔,ℎ^𝑟𝑟3,𝑅₃=𝑒𝑔,Ω₂^𝑟𝑟5𝑒𝑔₃,ℎ^{𝑟𝑟𝑡,𝑖}𝑒𝑔,ℎ^𝑟𝛽′𝑒𝑇₅,ℎ^{𝑟𝑦𝑡,𝑖},𝑅₄=𝑔^𝑟𝑟1𝑔^𝑟𝑟6,𝑅₅=𝑔^𝑟𝛼𝑔^𝑟𝑟7,𝑅₆=𝐶^−𝑟𝑟2₁𝑔^𝑟𝛾,𝑅₇=𝑔^𝑟𝑟2𝑔^𝑟𝑟8,𝑅₈=𝑔^𝑟𝛽𝑔^𝑟𝑟9,𝑅₉=𝐶^−𝑟𝑟4₃𝑔^𝑟𝛾′,𝑅₁₀=𝑔^𝑟𝑟10𝑔^−𝑟𝑟5,𝑅₁₁=𝑔^{𝑟𝛾′′}𝑔^−𝑟𝑟4,𝑅₁₂=𝐶^{𝑟𝑦𝑡,𝑖}₅𝑔^𝑟𝛽′,𝑅₁₃=ℎ^𝑟𝑟2ℎ^{𝑟𝛿1+𝑟𝛿2},𝑅₁₄=𝑢^𝑟𝛿1,𝑅₁₅=𝑣^𝑟𝛿2,𝑐=ℋgpk,𝑀,𝐶_𝑖⁶_𝑖=1,𝐹_𝑖³₌₁,𝑇_𝑖⁵_𝑖=1,𝑅_𝑖¹⁵_𝑖=1,𝑠_𝑟𝑖=𝑟_𝑟𝑖+𝑐𝑟_𝑖(𝑖∈[1,10]),𝑠_{𝑦𝑡,𝑖}=𝑟_{𝑦𝑡,𝑖}+𝑐𝑦_𝑡,𝑖,𝑠_{𝑟𝑡,𝑖}=𝑟_{𝑟𝑡,𝑖}+𝑐𝑟_𝑡,𝑖,𝑠_𝛼=𝑟_𝛼+𝑐𝛼,𝑠_𝛽=𝑟_𝛽𝑠+𝑐𝛽,_𝛽′=𝑟_𝛽′+𝑐𝛽^′,𝑠_𝛾=𝑟_𝛾+𝑐𝛾,𝑠_𝛾′=𝑟_𝛾′+𝑐𝛾^′,𝑠_𝛾′′=𝑟_𝛾′′+𝑐𝛾^′′,𝑠_𝛿1=𝑟_𝛿1+𝑐𝛿₁,𝑠_𝛿2=𝑟_𝛿2+𝑐𝛿₂. (A.1)(3)𝑉=(𝑐,{𝑠_𝑟𝑖}¹⁰_𝑖=1,𝑠_{𝑦𝑡,𝑖},𝑠_{𝑟𝑡,𝑖},𝑠_𝛼,𝑠_𝛽,𝑠_𝛽′,𝑠_𝛾,𝑠_𝛾′,𝑠_𝛾′′,𝑠_𝛿1,𝑠_𝛿2).

So, the final form of a group signature is described as 𝜎=(𝐶₁,𝐶₂,𝐶₃,𝐶₄,𝐶₅,𝐶₆,𝐹₁,𝐹₂,𝐹₃,𝑇₁,𝑇₂,𝑇₃,𝑇₄,𝑇₅,𝑐,{𝑠_𝑟𝑖}¹⁰_𝑖=1,𝑠_{𝑦𝑡,𝑖},𝑠_{𝑟𝑡,𝑖},𝑠_𝛼,𝑠_𝛽,𝑠_𝛽′,𝑠_𝛾,𝑠_𝛾′,𝑠_𝛾′′,𝑠_𝛿1,𝑠_𝛿2).

Next, we give the detailed verification procedure. Let 𝜎=(𝐶₁,𝐶₂,𝐶₃,𝐶₄,𝐶₅,𝐶₆,𝐹₁,𝐹₂,𝐹₃,𝑇₁,𝑇₂,𝑇₃,𝑇₄,𝑇₅,𝑐,{𝑠_𝑟𝑖}¹⁰_𝑖=1,𝑠_{𝑦𝑡,𝑖},𝑠_{𝑟𝑡,𝑖},𝑠_𝛼,𝑠_𝛽,𝑠_𝛽′,𝑠_𝛾,𝑠_𝛾′,𝑠_𝛾′′,𝑠_𝛿1,𝑠_𝛿2).(1)Compute 𝑅₁=𝑒𝑔,Ω₁𝑇₂^𝑠𝑟1𝑒𝑇₁,ℎ^𝑠𝑟2𝑒𝑔,ℎ^𝑠𝛼𝑒𝑇₁,Ω₁𝑇₂𝑒𝑔₁,ℎ^−𝑐,𝑅₂=𝑒𝑔,𝑇₂^𝑠𝑟4𝑒𝑇₄,ℎ^𝑠𝑟2𝑒𝑔,ℎ^𝑠𝛽𝑒𝑔,ℎ^𝑠𝑟3𝑒𝑇₄,𝑇₂𝑒𝑇₃,ℎ^−𝑐,𝑅₃=𝑒𝑔,Ω₂^𝑠𝑟5𝑒𝑔₃,ℎ^{𝑠𝑟𝑡,𝑖}𝑒𝑔,ℎ^𝑠𝛽′𝑒𝑇₅,ℎ^{𝑠𝑦𝑡,𝑖}×𝑒𝑇₅,Ω₂𝑒(𝑔₄,ℎ)𝑒(𝑇₄,ℎ)𝑒𝑔₂,ℎ^𝑡−𝑐,𝑅₄=𝑔^𝑠𝑟1𝑔^𝑠𝑟6𝐶₁^−𝑐,𝑅₅=𝑔^𝑟𝛼𝑔^𝑠𝑟7𝐶₂^−𝑐,𝑅₆=𝐶^−𝑠𝑟2₁𝑔^𝑟𝛾𝐶₂^−𝑐,𝑅₇=𝑔^𝑠𝑟2𝑔^𝑠𝑟8𝐶₃^−𝑐,𝑅₈=𝑔^𝑠𝛽𝑔^𝑠𝑟9𝐶₄^−𝑐,𝑅₉=𝐶^−𝑠𝑟4₃𝑔^𝑠𝛾′𝐶₄^−𝑐,𝑅₁₀=𝑔^𝑠𝑟10𝑔^−𝑠𝑟5𝐶₅^−𝑐,𝑅₁₁=𝑔^{𝑠𝛾′′}𝑔^−𝑠𝑟4𝐶₆^−𝑐,𝑅₁₂=𝐶^{𝑠𝑦𝑡,𝑖}₅𝑔^𝑠𝛽′𝐶₆^−𝑐,𝑅₁₃=ℎ^𝑠𝑟2ℎ^{𝑠𝛿1+𝑠𝛿2}𝑇₂𝐹₁^−𝑐,𝑅₁₄=𝑢^𝑠𝛿1𝐹₂^−𝑐,𝑅₁₅=𝑣^𝑟𝛿2𝐹₃^−𝑐. (A.2)Note that a verifier computes 𝑒(𝑔₂,ℎ)^𝑡 to check whether 𝜎 is made in the time interval 𝑡 or not.(2)Check 𝑐=ℋ(gpk,𝑀,𝐶₁,𝐶₂,𝐶₃,𝐶₄,𝐶₅,𝐶₆,𝐹₁,𝐹₂,𝐹₃,𝑇₁,𝑇₂,𝑇₃,𝑇₄,𝑇₅,𝑅₁,…,𝑅₁₅). If it holds, then output 1, and 0 otherwise.

Disclosure

A preliminary version of this paper appears in the 14th International Conference on Information Security and Cryptology, ICISC 2011 [76]. This is the full version. We add estimations of recent revocable group signature schemes [7, 8] that appeared after publishing our conference version and have added content presented in the 4th International Conference on Provable Security, ProvSec 2010 [19].

Conflict of Interests

The authors declare that there is no conflict of interests regarding the publication of this paper.