Group signatures á la carte
Giuseppe Ateniese, Gene Tsudik · 1999
A group signature scheme allows any member of a potentially large group to sign on behalf of the group. Group signatures are anonymous and unlinkable. Only a designated group manager can co-relate signatures and/or reveal the identity of the actual signer. At the same time, no one (including a group manager) can misattribute a valid signature. In this paper we construct a very efficient and provably secure group signature scheme. 1 Introduction A group signature allows any group member to sign on behalf of the group. Group signatures are publicly verifiable but anonymous in that, no one, with the exception of a designated group manager, can establish the identity of the signer. Furthermore, group signatures are unlinkable which makes it computationally hard to establish whether or not multiple signatures are produced by the same group member. In exceptional cases (such as a legal dispute) any group signature can be "opened" by a group manager to reveal unambiguously the identity of t...