I am trying to sign the multiple (millions of) different readings but the receiver should not be able to link multiple signed readings together (unlinkability) or with the identity of the signer (anonymity).
As a potential solution, the sender sends the reading $m$ along with non-interactive witness indistinguishable (NIWI) proof of knowledge (PoK) of signature on $m$. I am looking at certified signature scheme where CA certifies the public keys of legitimate signers. The signer signs the reading $m$, generate NIWI proof of knowledge of his/her signature on the reading $m$ and sends ($m$ and the NIWI proof) to the receiver. I want to use BLS signatures as the signature is one element in $G_1$ (and the signature size can be as short as 161 bits). BLS signature scheme uses gap Diffie-Hellman (co-GDH) groups $(G_1,G_2)$ of prime order $p$, where co-DDH is easy but co-CDH is hard.
Now, in order to construct proof of knowledge of BLS signature, I want to use the Groth and Sahai's NIWI proof in Efficient Noninteractive Proof Systems for Bilinear Groups which can be constructed based on one of the three assumptions:
- sub-group assumption
- SXDH assumption
- DLIN assumption.
I am confused, which assumption can I make for generating NIWI PoK of BLS signature?
Q1. Can I use SXDH assumption based NIWI PoK i.e. is it valid to simultaneously make co-GDH and SXDH assumptions on the group pair $(G_1,G_2)$?
Q2. DLIN based NIWI proof will require me use symmetric pairings for BLS signatures. Is symmetric setting suitable for secure and short BLS signatures?
Q3. Can I use subgroup assumption for NIWI PoK of BLS signature? as $|G_1|=|G_2|= p$.