For group signature(GS)supporting membership revocation,verifier-local revocation(VLR)mechanism seems to be a more flexible choice,because it requires only that verifiers download up-to-date revocation information for signature verification,and the signers are not involved.As a post-quantum secure cryptographic counterpart of classical number-theoretic cryptographic constructions,the first lattice-based VLR group signature(VLR-GS)was introduced by Langlois et al.(2014).However,none of the contemporary lattice-based VLR-GS schemes provide backward unlinkability(BU),which is an important property to ensure that previously issued signatures remain anonymous and unlinkable even after the corresponding signer(i.e.,member)is revoked.In this study,we introduce the first lattice-based VLR-GS scheme with BU security(VLR-GS-BU),and thus resolve a prominent open problem posed by previous works.Our new scheme enjoys an(O)(log N)factor saving for bit-sizes of the group public-key(GPK)and the member's signing secret-key,and it is free of any public-key encryption.In the random oracle model,our scheme is proven secure under two well-known hardness assumptions of the short integer solution(SIS)problem and learning with errors(LWE)problem.

Yanhua ZHANG;Ximeng LIU;Yupu HU;Yong GAN;Huiwen JIA

College of Computer and Communication Engineering,Zhengzhou University of Light Industry,Zhengzhou 450001,China;College of Mathematics and Computer Science,Fuzhou University,Fuzhou 350108,China;State Key Laboratory of Integrated Service Networks,Xidian University,Xi'an 710071,China;College of Information Engineering,Zhengzhou University of Technology,Zhengzhou 450044,China;School of Mathematics and Information Science,Guangzhou University,Guangzhou 510006,China

信息与电子工程前沿（英文）

[1]Yanhua ZHANG;Ximeng LIU;Yupu HU;Yong GAN;Huiwen JIA-.Verifier-local revocation group signatures with backward unlinkability from lattices)[J].信息与电子工程前沿（英文）,2022(06):876-892

Verifier,revocation,unlinkability,verifier,VLR,verifiers,unlinkable,revoked,GPK

local,group,signatures,backward,from,lattices,For,GS,supporting,membership,mechanism,seems,more,flexible,choice,because,requires,only,that,download,date,information,verification,signers,are,not,involved,post,quantum,secure,cryptographic,counterpart,classical,number,theoretic,constructions,first,was,introduced,by,Langlois,However,none,contemporary,schemes,provide,BU,which,important,property,ensure,previously,issued,remain,anonymous,even,after,corresponding,In,this,study,security,thus,resolve,prominent,open,problem,posed,works,Our,new,enjoys,log,saving,bit,sizes,public,key,signing,secret,free,any,encryption,random,oracle,model,our,proven,under,two,well,known,hardness,assumptions,short,integer,solution,SIS,learning,errors,LWE

0.511965