For group signatures (GS) supporting membership revocation, verifier-local revocation (VLR) mechanism is the most flexible choice. As a post-quantum secure cryptographic counterpart of classical schemes, the first dynamic GS-VLR scheme over lattices was put forward by Langlois et al. at PKC 2014; furthermore, a corrected version was shown at TCS 2018. However, both designs are within Bonsai trees and featuring bit-sizes of group public-key and member secret signing key proportional to log N where N is the group size; therefore, both schemes are not suitable for a large group. In this paper, we provide an improved dynamic GS-VLR over lattices, which is efficient by eliminating a O log N factor for both sizes. To realize the goal, we adopt a more efficient and compact identity-encoding technique. At the heart of our new construction is a new Stern-type statistical zero-knowledge argument of knowledge protocol which may be of some independent cryptographic interest.
For group signatures (GS) supporting membership revocation, verifier-local revocation (VLR) mechanism is the most flexible choice. As a post-quantum secure cryptographic counterpart of classical schemes, the first dynamic GS-VLR scheme over lattices was put forward by Langlois et al. at PKC 2014; furthermore, a corrected version was shown at TCS 2018. However, both designs are within Bonsai trees and featuring bit-sizes of group public-key and member secret signing key proportional to log N where N is the group size; therefore, both schemes are not suitable for a large group. In this paper, we provide an improved dynamic GS-VLR over lattices, which is efficient by eliminating a O log N factor for both sizes. To realize the goal, we adopt a more efficient and compact identity-encoding technique. At the heart of our new construction is a new Stern-type statistical zero-knowledge argument of knowledge protocol which may be of some independent cryptographic interest.
For group signature (GS) supporting membership revocation, verifier-local revocation (VLR) mechanism seems to be a more flexible choice, because it requires only that verifiers download up-to-date revocation information for signature verification, and the signers are not involved. As a post-quantum secure cryptographic counterpart of classical number-theoretic cryptographic constructions, the first lattice-based VLR group signature (VLR-GS) was introduced by Langlois et al. (2014). However, none of the contemporary lattice-based VLR-GS schemes provide backward unlinkability (BU), which is an important property to ensure that previously issued signatures remain anonymous and unlinkable even after the corresponding signer (i.e., member) is revoked. In this study, we introduce the first lattice-based VLR-GS scheme with BU security (VLR-GS-BU), and thus resolve a prominent open problem posed by previous works. Our new scheme enjoys an O(logN) factor saving for bit-sizes of the group public-key (GPK) and the member’s signing secret-key, and it is free of any public-key encryption. In the random oracle model, our scheme is proven secure under two well-known hardness assumptions of the short integer solution (SIS) problem and learning with errors (LWE) problem.
Abstract. Support of membership revocation is a desirable functionality for any group signature scheme. Among the known revocation approaches, verifier-local revocation (VLR) seems to be the most flexible one, because it only requires the verifiers to possess some up-to-date revocation information, but not the signers. All of the contemporary VLR group signatures operate in the bilinear map setting, and all of them will be insecure once quantum computers become a reality. In this work, we introduce the first lattice-based VLR group signature, and thus, the first such scheme that is believed to be quantum-resistant. In comparison with existing lattice-based group signatures, our scheme has several noticeable advantages: support of membership revocation, logarithmic-size signatures, and weaker security assumption. In the random oracle model, our scheme is proved to be secure based on the hardness of the SIVPÕ(n1.5) problem in general lattices- an assumption that is as weak as those of state-of-the-art lattice-based standard signatures. Moreover, our construction works without relying on encryption schemes, which is an intriguing feature for group signatures.
Abstract A forward-secure group signature (FSGS) ensures the unforgeability of signatures in the past time period despite signing secret key is leaked in the current time period. As we know, traditional FSGS schemes are mostly relying on number-theoretic assumptions unable to resist quantum attacks. Therefore, we present an efficient lattice-based fully dynamic (i.e. users can flexibly join or quit the group) forward-secure group signature (DFSGS) by combining an improved version of FSGS scheme proposed by Ling. Based on an efficient zero-knowledge argument, we construct argument of knowledge of the committed value and the plaintext that help with privacy protection. Our DFSGS scheme is proved to be anonymous and forward-secure traceable relying on short integer solution and learning with errors assumptions in random oracle model. Moreover, the lengths of group public key and signature of our DFSGS scheme have been improved, and the length of user secret key has no connection with the quantity of group members.
A group signature allows a group member who signs the message on behalf of the other group members. Any recipient also verifies the signature without knowing the signer. However, it is possible to reveal the signer’s identity since the group signatures have the tracing mechanism. In general, the group signature size increases the number of group members. However, the schemes are also proposed with the constant signature size. On the other hand, the security of some schemes are based on the discrete logarithm and factorization problems while some schemes which are secure against quantum attacks are proposed. To the best of our knowledge, the signature scheme in the group concept has not been proposed on lattices in quantum oracles. In this paper, we propose a new constant-size and partially-dynamic group signature scheme on lattice assumptions. We combine the Dilithium signature scheme, a Stern-like zero-knowledge scheme and Regev’s encryption scheme. We give a zero-knowledge argument system for our proposed scheme and security analysis in the quantum random oracle model. According to the comparison results, the proposed scheme has better size complexity in asymptotic concept.
Abstract With the rapid growth of online users, protecting user privacy in access control scenarios has become a critical challenge in the field of information security. Group signatures serve as a fundamental cryptographic primitive that enables users to sign on behalf of a group, providing anonymity while supporting traceability of signers. However, traditional group signature schemes, which rely on number-theoretic assumptions vulnerable to quantum algorithms, face significant security threats in the advent of quantum computing. In this paper, we propose a module lattice-based group signature scheme (ML-GS). ML-GS leverages FIPS 204 standard, a recently standardized signature scheme by the National Institute of Standards Technology (NIST), and integrates a dualrejection-sampling signature mechanism with the K-PKE encryption scheme from FIPS 203 standard, forming a “sign-hybrid-encrypt” hybrid structure to ensure both efficiency and traceability. In the key generation phase, we introduce a module Gaussian preimage sampling algorithm that reduces public key size and supports dynamic user enrollment. The security of ML-GS is formally proven in the random oracle model under the Module Learning with Error (MLWE) and Module Short Integer Solution (MSIS) assumptions. Experimental results demonstrate that, compared to existing scheme with equivalent security level, the ML-GS scheme achieves significant improvements in both time and storage overhead.
Abstract The lattice-based cryptographic accumulators, which enable short zero-knowledge arguments of membership, have numerous applications in post-quantum privacy-preserving protocols. However, most efficient quantum-safe zero-knowledge arguments are PCP-based systems and rely on non-falsifiable assumptions. For non-PCP-based constructions using the state-of-the-art techniques on compressing lattice-based zero-knowledge proofs, the concrete size of the resulting proof for accumulators with 232 members is at least 500 KB. In this paper, we propose a compact non-PCP zero-knowledge proof for the lattice-based Merkle-tree, which leads to an efficient post-quantum cryptographic accumulator. The complexity of our construction is logarithmic in l⋅ns, where l and ns denote the depth of the underlying Merkle-tree and the size of a node, respectively, and the concrete size is only $143.7\ $KB when l=32. In particular, we provide an improved lattice-based Bulletproof with efficient knowledge extraction, which allows large challenge space but small soundness slack. Furthermore, the amortized technique can be applied to the Bulletproof without breaking the knowledge soundness due to our improved knowledge extraction. As a direct application, we present a practical lattice-based ring signature, which can achieve logarithmical signing/verifying computational complexity with the number of the ring, while the state-of-the-art constructions (CRYPTO 21) have linear computational complexity.