[PDF] Top 20 Simpler Efficient Group Signatures from Lattices

... [32], group signatures have at- tracted much attention from the research ...of group signatures for static groups (where the group members are fixed in the system setup phase) in ... See full document

... (iii) The schemes [14], [20], [23], [28] are all static where signing keys of the members are fixed during setup. Although the scheme [25] is dynamic and has the flexibility to issue secret key at the joining time of a ... See full document

... practical group signatures schemes ([7], [17]) that have been proposed are proven secure in the random oracle model ...an efficient group signature scheme in the standard model but proved its ... See full document

... comes from its complicated implementation, as its efficiency relies on several technical routines and the deep exploitation of the structures of the underlying mathematical ...NTRU lattices can be seen as ... See full document

... get efficient verification in an amortized sense, when verifying a computation f over many different ...homomorphic signatures (or even homomorphic MACs), where we require a static certificate which ... See full document

... only efficient if k = poly(λ) is polynomial in the security parameter ...the efficient homomorphic evaluation of circuits whose depth d = O(log λ) is logarithmic in the security ... See full document

... Remark 3. The BSZ model [6] defines strong security properties that are sufficient in most contexts. However, it may be possible in some situations to relax some of them, usually leading to more efficient ... See full document

... using lattices with algebraic structure [HPS98, Mic07], and to the enormous versatility afforded by the Learning with Errors (LWE) problem ...based signatures [LM08a, GPV08, Lyu09, Boy10, R¨ uc10, GLP12, ... See full document

... practical signatures from isogeny ...state signatures of over 100 KiB and signing/verification that take a few seconds on a ...get signatures smaller than a kilobyte, which is better even than ... See full document

... of Group signature was introduced by Chaum and Van Heyst ...well-known group signature problem is that it is difficult for the group manager to identify a malicious user since all signatures ... See full document

... only group elements from the source groups were recently given by [10, 36, ...anonymous signatures, including group signatures [21], attribute-based signatures [42], proxy ... See full document

... homomorphic signatures. The strongest, EUF-FH-CMA, differs from the weakest, EUF-FH-CDA, in that the strict model (EUF-FH-CMA) allows fully adaptive queries at the message level, while the relaxed model ... See full document

... Sanitizable signatures have numerous applications, such as the anonymization of medical data, replacing commercials in authenticated media streams, or updates of reliable routing information ...sanitizable ... See full document

... Abstract. Group signatures are a central cryptographic primitive which allows users to sign messages while hiding their identity within a crowd of group ...most efficient constructions rely on ... See full document

... dynamic group signatures with distributed traceability, where the capability to trace signatures is distributed among n managers without requiring any ...easily from our definitions and ... See full document

... generic group model. In the (Type III) generic bilinear group model the adversary may compute new group elements in either source group by taking arbitrary linear combinations of previously ... See full document

... Our group signature scheme satisfies anonymity and traceability as defined by Bellare et ...most efficient parameters for our scheme, resulting in signatures of 910 kB for a group of 2 25 ... See full document

... message from the verifier, which we overcome by a non-trivial technique described in Section ...apart from group signatures, such protocols are essential for designing various ... See full document

... tracing signatures (ATS), which is an enhanced variant of group signatures that has an additional mechanism to make the OA ...the group manager (GM), and there are two kinds of group ... See full document

... certified group member once receiving a Ducas-Micciancio sig- nature on his public key ...generating group signatures, the user first encrypts his public key p to ciphertext c via a CCA-secure ... See full document