Group signature with local revocation verification with capacity for lifting anonymity

摘要

The cryptographic scheme subdivides time into periods with an index j=0, 1, 2, etc. A public key indicates elements u and v of a first cyclic group G₁ of prime order p and, for each period j, an integer s_j between 0 and p−1 and elements g_1,j of the group G₁ and g_2,j, w_j and h_j of another cyclic group G₂ of order p. The private key of a member of the group indicates an integer x_i between 0 and p−1 and, for each period j, an element A_i,j of the group G₁ such that A_i,n=[A_i,n-1/g_1,n-1]^{1/(x_i−s_n)} for 1≦n≦j. To sign a message during a period j≧0, the member selects two integers α and β between 0 and p−1, calculates T₁=u^α, T₂=A_i,j·v^α, S₁=g_2,j^β and S₂=e(A_i,j, h_j)^β where e(., .) is a bilinear map of G₁×G₂ onto G_T, and determines according to the message the data that justify the fact that the elements T₁, T₂, S₁ and S₂ are correctly formed with knowledge of the private key of the member for the period with index j.