# Result of expressions using modular arithmatic for group signatures

I read the following in a paper about group signatures called "A Practical and Provably Secure Coalition-Resistant Group Signature Scheme".

In the sign part of paper the following expressions can be found:

$$d_2 = T_2^{r_1}/g^{r_3} \bmod N$$ $$s_1 = r_1-c(e_i-2^{\gamma_1})$$ $$s_3 = r_3-c*e_i*w$$

and in the verify part

$$d_2 = T_2^{s_1-c*2^{\gamma_1}}/g^{s_3} \bmod N$$

this is not producing correct result as $d_2$ doesn't verify.

I am confused about the result of these expressions, can you explain if and why the expressions are correct?

The $\text{ mod } N$ is implied in all equations below.

In the signing process we have:

$$d_2 = T_2^{r_1} / g^{r_3}$$

In the verification process we have:

$$d_2 = T_2^{s_1 - c2^{\gamma_1}} / g^{s_3}$$

So we know that we must have the following equivalence:

$$T_2^{r_1} / g^{r_3} = T_2^{s_1 - c2^{\gamma_1}} / g^{s_3}$$

Substituting in the values for $s_1$ and $s_3$ we have:

$$T_2^{r_1} / g^{r_3} = T_2^{r_1 - ce_i + c2^{\gamma_1} - c2^{\gamma_1}} / g^{r_3 - ce_iw}$$ $$T_2^{r_1} / g^{r_3} = T_2^{r_1 - ce_i} / g^{r_3 - ce_iw}$$

From the paper we know that $T_2 = g^w$ and we can also use some exponent laws to simplify:

$$(g^w)^{r_1} / g^{r_3} = (g^w)^{r_1}(g^w)^{-ce_i} / g^{r_3}g^{-ce_iw}$$ $$g^{wr_1} / g^{r_3} = g^{wr_1}g^{-ce_iw} / g^{r_3}g^{-ce_iw}$$ $$g^{wr_1} / g^{r_3} = g^{wr_1} / g^{r_3}$$

Hence the equation provided are correct, and the verify procedure does indeed produce the same $d_2$ as the sign procedure. If you are producing incorrect results one thing to remember is that division $\text{ mod } N$ is equivalent to multiplication by the multiplicative inverse of the denominator.