I read the following in a paper about group signatures called "A Practical and Provably Secure Coalition-Resistant Group Signature Scheme".

In the sign part of paper the following expressions can be found:

$$d_2 = T_2^{r_1}/g^{r_3} \bmod N$$ $$s_1 = r_1-c(e_i-2^{\gamma_1})$$ $$s_3 = r_3-c*e_i*w$$

and in the verify part

$$d_2 = T_2^{s_1-c*2^{\gamma_1}}/g^{s_3} \bmod N$$

this is not producing correct result as $d_2$ doesn't verify.

I am confused about the result of these expressions, can you explain if and why the expressions are correct?


The $\text{ mod } N$ is implied in all equations below.

In the signing process we have:

$$d_2 = T_2^{r_1} / g^{r_3}$$

In the verification process we have:

$$d_2 = T_2^{s_1 - c2^{\gamma_1}} / g^{s_3}$$

So we know that we must have the following equivalence:

$$T_2^{r_1} / g^{r_3} = T_2^{s_1 - c2^{\gamma_1}} / g^{s_3}$$

Substituting in the values for $s_1$ and $s_3$ we have:

$$T_2^{r_1} / g^{r_3} = T_2^{r_1 - ce_i + c2^{\gamma_1} - c2^{\gamma_1}} / g^{r_3 - ce_iw}$$ $$T_2^{r_1} / g^{r_3} = T_2^{r_1 - ce_i} / g^{r_3 - ce_iw}$$

From the paper we know that $T_2 = g^w$ and we can also use some exponent laws to simplify:

$$(g^w)^{r_1} / g^{r_3} = (g^w)^{r_1}(g^w)^{-ce_i} / g^{r_3}g^{-ce_iw}$$ $$g^{wr_1} / g^{r_3} = g^{wr_1}g^{-ce_iw} / g^{r_3}g^{-ce_iw}$$ $$g^{wr_1} / g^{r_3} = g^{wr_1} / g^{r_3}$$

Hence the equation provided are correct, and the verify procedure does indeed produce the same $d_2$ as the sign procedure. If you are producing incorrect results one thing to remember is that division $\text{ mod } N$ is equivalent to multiplication by the multiplicative inverse of the denominator.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.