Verifier-local revocation group signatures with backward unlinkability from lattices  

作　　者：Yanhua ZHANG Ximeng LIU Yupu HU Yong GAN Huiwen JIA 

机构地区：[1]College of Computer and Communication Engineering,Zhengzhou University of Light Industry,Zhengzhou 450001,China [2]College of Mathematics and Computer Science,Fuzhou University,Fuzhou 350108,China [3]Stale Key Laboratory of Integrated Service Networks,Xidian University,Xi’an 710071,China [4]College of Information Engineering,Zhengzhou University of Technology,Zhengzhou 450044,China [5]School of Mathematics and Information Science,Guangzhou University,Guangzhou 510006,China

出　　处：《Frontiers of Information Technology & Electronic Engineering》2022年第6期876-892,共17页信息与电子工程前沿（英文版）

基　　金：the National Natural Science Foundation of China(Nos.61802075 and 61772477);the Natural Science Foundation of Henan Province,China(Nos.222300420371 and202300410508)。

摘　　要：For group signature(GS)supporting membership revocation,verifier-local revocation(VLR)mechanism seems to be a more flexible choice,because it requires only that verifiers download up-to-date revocation information for signature verification,and the signers are not involved.As a post-quantum secure cryptographic counterpart of classical number-theoretic cryptographic constructions,the first lattice-based VLR group signature(VLR-GS)was introduced by Langlois et al.(2014).However,none of the contemporary lattice-based VLR-GS schemes provide backward unlinkability(BU),which is an important property to ensure that previously issued signatures remain anonymous and unlinkable even after the corresponding signer(i.e.,member)is revoked.In this study,we introduce the first lattice-based VLR-GS scheme with BU security(VLR-GS-BU),and thus resolve a prominent open problem posed by previous works.Our new scheme enjoys an O(log N)factor saving for bit-sizes of the group public-key(GPK)and the member’s signing secret-key,and it is free of any public-key encryption.In the random oracle model,our scheme is proven secure under two well-known hardness assumptions of the short integer solution(SIS)problem and learning with errors(LWE)problem.

关 键 词：Group signature Lattice-based cryptography Verifier-local revocation Backward unlikability Short integer solution 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]