Verifier-local revocation group signatures with backward unlinkability from lattices

作     者：Yanhua ZHANG Ximeng LIU Yupu HU Yong GAN Huiwen JIA Yanhua ZHANG;Ximeng LIU;Yupu HU;Yong GAN;Huiwen JIA

作者机构：College of Computer and Communication EngineeringZhengzhou University of Light IndustryZhengzhou 450001China College of Mathematics and Computer ScienceFuzhou UniversityFuzhou 350108China Stale Key Laboratory of Integrated Service NetworksXidian UniversityXi’an 710071China College of Information EngineeringZhengzhou University of TechnologyZhengzhou 450044China School of Mathematics and Information ScienceGuangzhou UniversityGuangzhou 510006China 

出 版 物：《Frontiers of Information Technology & Electronic Engineering》 (信息与电子工程前沿（英文版）)

年 卷 期：2022年第23卷第6期

页      面：876-892页

核心收录：

学科分类：0839[工学-网络空间安全] 08[工学] 081201[工学-计算机系统结构] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

基　　金：the National Natural Science Foundation of China(Nos.61802075 and 61772477) the Natural Science Foundation of Henan Province,China(Nos.222300420371 and202300410508) 

主　　题：Group signature Lattice-based cryptography Verifier-local revocation Backward unlikability Short integer solution 

摘      要：For group signature(GS)supporting membership revocation,verifier-local revocation(VLR)mechanism seems to be a more flexible choice,because it requires only that verifiers download up-to-date revocation information for signature verification,and the signers are not *** a post-quantum secure cryptographic counterpart of classical number-theoretic cryptographic constructions,the first lattice-based VLR group signature(VLR-GS)was introduced by Langlois et al.(2014).However,none of the contemporary lattice-based VLR-GS schemes provide backward unlinkability(BU),which is an important property to ensure that previously issued signatures remain anonymous and unlinkable even after the corresponding signer(i.e.,member)is *** this study,we introduce the first lattice-based VLR-GS scheme with BU security(VLR-GS-BU),and thus resolve a prominent open problem posed by previous *** new scheme enjoys an O(log N)factor saving for bit-sizes of the group public-key(GPK)and the member’s signing secret-key,and it is free of any public-key *** the random oracle model,our scheme is proven secure under two well-known hardness assumptions of the short integer solution(SIS)problem and learning with errors(LWE)problem.