0
$\begingroup$

I've reviewed the BBS signature scheme and the constant size k-TAA, known as BBS+. However, I couldn't find any specific mechanism for opening in BBS+. In the constant size k-TAA, if a user attempts to authenticate more than k times, they can be traced. Is there a general opening mechanism for BBS+?

In the BBS group signature scheme the issuer can trace back to the original signer of the message. By "opening" I mean that a trusted party would have the ability to trace back to the original signer.

BBS: https://crypto.stanford.edu/~dabo/pubs/papers/groupsigs.pdf

BBS+: https://eprint.iacr.org/2008/136

$\endgroup$
1
  • $\begingroup$ In BBS signature scheme, issuer(group manager) can trace the original signer, but is there a mechanism for tracing the original signer in BBS+ as well? By opening I mean tracing the original signer. $\endgroup$
    – Reisha Ali
    Commented May 11 at 18:10

2 Answers 2

1
$\begingroup$

Are you referring to opening like you would open or use the committed values/attributes in a BBS+ signature for expressive signature verification/proofs?

If so, this paper is an update to the original BSS+ and explains in more detail how they use generalized Schnorr proofs to prove knowledge of a signature. During verification, the prover could extend their proofs to include relations about the commitment or perhaps selective disclosure by opening a position of the message vector commitment.

$\endgroup$
1
  • $\begingroup$ By opening I mean tracing the original signer. $\endgroup$
    – Reisha Ali
    Commented May 15 at 12:56
0
$\begingroup$

Your understanding of group signatures appears to be incorrect. The trace/opening mechanism in group signatures relies on the decryption capability of the group manager, rather than the signature scheme.

In group signatures, members are required to validate their membership through ZPK systems. In other words, they must prove at least one statement in zero knowledge, such as owning a valid signature (membership credential/certificate) issued by the group manager.

$\endgroup$
1
  • $\begingroup$ As far as I understand in BBS group signature scheme, issuer(group manager) can trace the original signer, but is there a mechanism for tracing the original signer in BBS+(constant size k-TAA) as well? $\endgroup$
    – Reisha Ali
    Commented May 15 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.