Lattice-based Group Signature Research Articles

Post-quantum secure group signature with verifier local revocation and backward unlinkability

Group signature supports users to generate signatures on behalf of the group. Verifier local revocation (VLR) is an important method to revoke a misbehaving user in group signature, which has attracted many researchers’ attention. However, the existing lattice-based group signature schemes with VLR either achieve only selfless anonymity, have revocation list of size linear with the number of revoked users, or suffer from the issue that signatures generated by revoked users could easily be linked by an adversary. Additionally, the development of quantum computing technology threatens the security of traditional cryptosystems. Therefore, in this paper we propose a new lattice-based group signature scheme, which makes use of the complete tree technique to combine the timestamp with VLR. It enjoys post-quantum security and satisfies almost full anonymity and traceability if the LWE and SIS problems are hard. Compared with previous schemes, our scheme achieves backward unlinkability additionally. Thanks to the revocation token update mechanism, a revocation token for time period t could not be connected with signatures generated in period t+1. Furthermore, the revocation list in our scheme only stores the tokens of users who have been revoked before the expiry, reducing the revocation list size effectively.

Lattice-Based Group Signature with Message Recovery for Federal Learning

Federal learning and privacy protection are inseparable. The participants in federated learning need to be the targets of privacy protection. On the other hand, federated learning can also be used as a tool for privacy attacks. Group signature is regarded as an effective tool for preserving user privacy. Additionally, message recovery is a useful cryptographic primitive that ensures message recovery during the verification phase. In federated learning, message recovery can reduce the transmission of parameters and help protect parameter privacy. In this paper, we propose a lattice-based group signature with message recovery (GS-MR). We then prove that the GS-MR scheme has full anonymity and traceability under the random oracle model, and we reduce anonymity and traceability to the hardness assumptions of ring learning with errors (RLWE) and ring short integer solution (RSIS), respectively. Furthermore, we conduct some experiments to evaluate the sizes of key and signature, and make a performance comparison between three lattice-based group signature schemes and the GS-MR scheme. The results show that the message–signature size of GS-MR is reduced by an average of 39.17% for less than 2000 members.

Zero-Knowledge Arguments for Lattice-Based Accumulators: Logarithmic-Size Ring Signatures and Group Signatures Without Trapdoors

An accumulator is a function that hashes a set of inputs into a short, constant-size string while preserving the ability to efficiently prove the inclusion of a specific input element in the hashed set. It has proved useful in the design of numerous privacy-enhancing protocols, in order to handle revocation or simply prove set membership. In the lattice setting, currently known instantiations of the primitive are based on Merkle trees, which do not interact well with zero-knowledge proofs. In order to efficiently prove the membership of some element in a zero-knowledge manner, the prover has to demonstrate knowledge of a hash chain without revealing it, which is not known to be efficiently possible under well-studied hardness assumptions. In this paper, we provide an efficient method of proving such statements using involved extensions of Stern’s protocol. Under the Small Integer Solution assumption, we provide zero-knowledge arguments showing possession of a hash chain. As an application, we describe new lattice-based group and ring signatures in the random oracle model. In particular, we obtain: (i) the first lattice-based ring signatures with logarithmic size in the cardinality of the ring and (ii) the first lattice-based group signature that does not require any GPV trapdoor and thus allows for a much more efficient choice of parameters.

Lattice-based group signatures with forward security for anonymous authentication

Group signatures allow users to sign messages on behalf of a group without revealing authority is capable of identifying the user who generated it. However, the exposure of the user's signing key will severely damage the group signature scheme. In order to reduce the loss caused by signing key leakage, Song proposed the first forward-secure group signature. If a group signing key is revealed at the current time period, the previous signing key will not be affected. This means that the attacker cannot forge group signatures regarding messages signed in the past. To resist quantum attacks, many lattice-based forward-secure group signatures have been proposed. However, their key-update algorithm is expensive since they require some costly computations such as the Hermite normal form (HNF) operations and conversion from a full-rank set of lattice vectors into a basis.In this paper, we propose the group signature with forward security from lattice. In comparison with previous works, we have several advantages: Firstly, our scheme is more effective since we only need to sample some vectors independently from a discrete Gaussian during the key-update algorithm. Secondly, the derived secret key size is linear instead of quadratic with the lattice dimensions, which is more friendly towards lightweight applications. Anonymous authentication plays an increasingly critical role in protecting privacy and security in the environment where private information could be collected for intelligent analysis. Our work contributes to the anonymous authentication in the post-quantum setting, which has wide potential applications in the IoT environment.

A survey of quantum secure group signature schemes: Lattice-based approach

The group signatures allow any member to sign the message on behalf of the group. While anyone who does not need to be a group member can verify the signature, they do not know who the signer is. The first examples are constructed using classical techniques such as the discrete logarithm and the integer factorization problem. The fact that the cryptosystems using classical techniques will be broken in polynomial time with quantum computing power increases the interest in post-quantum cryptography. Lattice-based cryptography is a good alternative for the post-quantum world due to its simple structures, efficient implementations, and worst-case hardness. Therefore, the lattice-based group signature schemes have been proposed for quantum era. In this paper, our aim is to review group signature schemes over lattices. We classify the schemes into four groups according to the fact that they allow adding and revoking members: static, group signature schemes with revocation mechanism, partially dynamic and fully dynamic. Firstly, we define the algorithms needed to construct the schemes. We give the development process and requirements for constructing group signatures before we review all group signature schemes over lattices. In addition, we compare all proposed lattice-based group signature schemes in view of underlying lattice problems, security requirements, the sizes of group public and secret signing key, signature size and security model. The main contribution of this study is that it is the first study examining lattice-based group signature schemes in detail.

Lattice-Based Group Signatures With Time-Bound Keys via Redactable Signatures

Group signatures are active cryptographic topics where group members are granted right to sign messages anonymously on behalf of their group. However, in practical applications, such rights are not permanent in most cases and are usually limited to some time periods. This means that the signing right of each group member needs to be associated with time periods such that it can be automatically changed with the latter. Among the known approaches, verifier local revocation (VLR) seems to be the feasible one to implement the above functionality, but it will cause an inefficient verification process when the group size is large. In this paper, we describe a group signature scheme with time-bound keys, based on the hardness of lattice assumption, which implements the limitation of the signing right to any time period by constructing a lattice-based redactable signature scheme. Our scheme still adds VLR mechanism for some members who need to revoke prematurely, but the time-bound keys function ensures such members are only a small fraction that do not incur excessive cost for revocation check. We give implementation for our scheme under 93-bit and 207-bit security respectively to demonstrate the practicability – all costs are independent of the group size and achieve a relatively efficient level.

A forward-secure and efficient authentication protocol through lattice-based group signature in VANETs scenarios

Message authentication has been a research hotspot in current vehicular ad hoc networks (VANETs). Many researchers adopt group signatures based on number-theoretic assumptions to authenticate the vehicular users’ identities. Nevertheless, the classical group signature is vulnerable to quantum computing attacks and without considering the negative consequences of secret key disclosure. In this paper, to address these problems, we propose a novel group signature protocol for authentication in VANETs, which is based on lattice cryptography to achieve quantum-resistance and Bonsai-tree signature architecture to achieve forward security. Our scheme is proven secure in terms of traceability, anonymity, and forward-security under the Short Integer Solution (SIS) and Learning With Errors (LWE) hardness. Through comprehensive performance evaluation, we demonstrate that the storage overhead of our scheme is relatively diminutive and the computation cost of the sign and verify algorithms are efficient and practical compared with other existing schemes.

Lattice-Based Group Signature with Forward Security for Anonymous Authentication

Lattice-Based Group Signature with Forward Security for Anonymous Authentication

Policy-Based Group Signature Scheme from Lattice

Although the existing group signature schemes from lattice have been optimized for efficiency, the signing abilities of each member in the group are relatively single. It may not be suitable for complex applications. Inspired by the pioneering work of Bellare and Fuchsbauer, we present a primitive called policy-based group signature. In policy-based group signatures, group members can on behalf of the group to sign documents that meet their own policies, and the generated signatures will not leak the identity and policies of the signer. Moreover, the group administrator is allowed to reveal the identity of signer when a controversy occurs. Through the analysis of application scenarios, we concluded that the policy-based group signature needs to meet two essential security properties: simulatability and traceability. And we construct a scheme of policy-based group signature from lattice through techniques such as commitment, zero-knowledge proof, rejection sampling. The security of our scheme is proved to be reduced to the module short integer solution (MSIS) and module learning with errors (MLWE) hard assumptions. Furthermore, we make a performance comparison between our scheme and three lattice-based group signature schemes. The result shows that our scheme has more advantages in storage overhead and the sizes of key and signature are decreased roughly by 83.13%, 46.01%, respectively, compared with other schemes.

Almost Fully Secured Lattice-Based Group Signatures with Verifier-Local Revocation

An efficient member revocation mechanism is a desirable feature when group signature schemes are applied in practical scenarios. Revocation methods, such as verifier-local revocation (VLR), provide an efficient member revocation in applications of group signatures. However, VLR-group signatures rely on a weaker security notion. On the other hand, group signature schemes for static groups gain stronger security with the full-anonymity security notion. Even though an outsider sees the secret signing keys of all group members in the full-anonymity, the signer is still anonymous. Achieving the full-anonymity for VLR group signature schemes is challenging due to the structure of secret signing keys. The secret signing keys of those schemes consist of tokens, which are used to manage revocation. The reveal of tokens may destroy the anonymity of the signers. We obtain stronger security for the lattice-based VLR group signature schemes by providing a new key generation method, which outputs revocation tokens without deriving from the members’ secret signing keys. We propose a new group signature scheme from lattices with VLR, which achieves stronger security than the previous related works. To avoid signature forgeries, we suggest a new zero-knowledge proof system that requires signers to validate themselves. Moreover, we output an efficient tracing mechanism.

Lattice-based group signature scheme without random oracle

ABSTRACT Group signature is a cryptographic primitive where any member can anonymously sign a message on behalf of the population they belong to. Several group signatures were proposed based on number-theoretic assumptions. All these schemes are insecure in the presence of quantum computers. Group signatures based on lattice assumptions are believed to be quantum-resistant. In the past few years, group signatures based on lattice assumptions have been proposed and most of them are proved to be secure in random-oracle model. This paper presents a lattice-based group signature scheme without using random-oracle. Our scheme is based on correlation-intractable function ensembles for all evasive relations which are constructed recently based on well-defined assumptions. Security of our scheme is proved based on correlation-intractable function ensembles and hardness of Short Integer Solution and Learning With Errors problem.

Combined interactive protocol for lattice-based group signature schemes with verifier-local revocation

Combined interactive protocol for lattice-based group signature schemes with verifier-local revocation

Combined interactive protocol for lattice-based group signature schemes with verifier-local revocation

In group signature schemes, signers are required to prove their validity of representing the group while being anonymous to the verifiers and traceable to the authority. On the other hand, group signature schemes with verifier-local revocation require signers to prove their revocation token is not in the revocation list. This paper presents a combined interactive protocol that supports group signature schemes with explicit tracing mechanism and verifier-local revocation, where keys and revocation tokens are generated separately to achieve stronger security. This new protocol enables signers to prove that their signing is valid, their revocation tokens are not in the revocation list, and their index is correctly encrypted.

A New Constant-Size Group Signature Scheme From Lattices

A lattice-based group signature scheme (LGSS) is an active cryptographic primitive, where each group member can sign messages anonymously in the name of the entire group and each valid signature should be traced to some group member on the lattice. In each LGSS, the size of the group signature usually depends on the number of group members and the security parameter. Thus, designing a constant-size LGSS is an interesting problem. At PKC 2018, Ling, Nguyen, Wang and Xu presented the first constant-size group signature scheme under lattice assumptions. Its design is based on a zero-knowledge argument of the knowledge of a valid message-signature pair for the Ducas-Micciancio signature scheme, which follows the sign-then-encrypt-then-prove protocol. In contrast to this work, we construct a new constant-size LGSS. The scheme adopts the sign-hybrid-encrypt approach and makes use of the Lyubashevsky signature scheme. Our work is efficient in the signing algorithm, more precise on the open algorithm and shorter in public key, secret key and signature size than previous studies. Furthermore, we prove that the scheme has full anonymity and full traceability under the Ring Learning With Errors and Ring Short Integer Solution assumptions in the random oracle model.

An efficient full dynamic group signature scheme over ring

The group signature scheme is an important primitive in cryptography, it allows members in a group to generate signatures anonymously on behalf of the whole group. In view of the practical application of such schemes, it is necessary to allow users’ registration and revocation when necessary, which makes the construction of dynamic group signature schemes become a significant direction. On the basis of (Ling et al., Lattice-based group signatures: achieving full dynamicity with ease, 2017), we present the first full dynamic group signature scheme over ring, and under the premise of ensuring security, the efficiency of the scheme is improved mainly from the following three aspects: the size of keys, the dynamic construction of a Merkle hash tree that used to record the information of registered users, and the reuse of the leaves in this tree. In addition, the public and secret keys of both group manager and trace manager are generated by a trusted third party, which prevents the situation that the two managers generate their respective public key and secret key maliciously. Compared with the counterpart of the scheme in (Ling et al., Lattice-based group signatures: achieving full dynamicity with ease, 2017) over ring, the expected space complexity of the Merkle tree used in our work down almost by half, and the computational complexity of its update has been reduced by a notch because of the dynamic construction of the hash tree.

Lattice-based group signatures: Achieving full dynamicity (and deniability) with ease

Lattice-based group signature is an active research topic in recent years. Since the pioneering work by Gordon et al. (2010) [20], eight other schemes have been proposed, providing various improvements in terms of security, efficiency and functionality. However, most of the existing constructions work only in the static setting where the group population is fixed at the setup phase. The only two exceptions are the schemes by Langlois et al. (2014) [27] that handles user revocations (but new users cannot join), and by Libert et al. (2016) [28,29] which addresses the orthogonal problem of dynamic user enrollments (but users cannot be revoked).In this work, we provide the first lattice-based group signature that offers full dynamicity (i.e., users have the flexibility in joining and leaving the group), and thus, resolve a prominent open problem posed by previous works. Moreover, we achieve this non-trivial feat in a relatively simple manner. Starting with Libert et al.'s fully static construction (2016) [30] - which is arguably the most efficient lattice-based group signature to date, we introduce simple-but-insightful tweaks that allow to upgrade it directly into the fully dynamic setting. More startlingly, our scheme even produces slightly shorter signatures than the former, thanks to an adaptation of a technique proposed by Ling et al. (2013) [35], allowing to prove inequalities in zero-knowledge. The scheme satisfies the strong security requirements of Bootle et al.'s model (2016) [7], under the Short Integer Solution (SIS) and the Learning With Errors (LWE) assumptions.Furthermore, we demonstrate how to equip the obtained group signature scheme with the deniability functionality in a simple way. This attractive functionality, put forward by Ishida et al. (2016) [22], enables the tracing authority to provide an evidence that a given user is not the owner of a signature in question. In the process, we design a zero-knowledge protocol for proving that a given LWE ciphertext does not decrypt to a particular message.

A lattice-based group signature scheme with verifier-local revocation

Support of membership revocation is a desirable functionality for any group signature scheme. Among the known revocation approaches, verifier-local revocation (VLR) seems to be the most flexible one, because it only requires the verifiers to possess some up-to-date revocation information, but not the signers. All of the contemporary VLR group signatures operate in the bilinear map setting, and all of them will be insecure once quantum computers become a reality. In this work, we introduce the first lattice-based VLR group signature, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with existing lattice-based group signatures, our scheme has several noticeable advantages: support of membership revocation, logarithmic-size signatures, and milder hardness assumptions. Moreover, our construction works without relying on public-key encryption schemes, which is an intriguing feature for group signatures.

Lattice-based group signature with verifier-local revocation

Among several post quantum primitives proposed in the past few decades, lattice-based cryptography is considered as the most promising one, due to its underlying rich combinatorial structure, and the worst-case to average-case reductions. The first lattice-based group signature scheme with verifier-local revocation (VLR) is treated as the first quantum-resistant scheme supported member revocation, and was put forward by Langlois et al. This VLR group signature (VLR-GS) has group public key size of O(nm log N log q), and a signature size of O(tm logN log q log β). Nguyen et al. constructed a simple efficient group signature from lattice, with significant advantages in bit-size of both the group public key and the signature. Based on their work, we present a VLR-GS scheme with group public key size of O(nm log q) and signature size of O(tm log q). Our group signature has notable advantages: support of membership revocation, and short in both the public key size and the signature size.

Organization of revocation for lattice-based group signature scheme

An approach to solving the problem of revocation of the signature authority of some group member in lattice-based group signature schemes has been suggested. The security of VLR schemes is based on delegating additional rights to opening manager, i.e., on checking the presence of user certificate in revocation list.