Many group signature schemes follow sign-encrypt then prove paradigm, where a membership certificate, is encrypted using some public-key encryption scheme. There are some encryption free group signature schemes.

What is the advantage of group signature scheme without encryption over the group signature scheme with encryption?


1 Answer 1


Usually the schemes without encryption are more efficient in terms of computational and size complexity. This owes to the fact that encrypting a membership certificate and proving the consistency is typically more expensive than simply randomising some signature and proving a simpler statement.

It should be noted, however, that some schemes following the without encryption paradigm are secure in a weaker model than the schemes which use sign-encrypt-proof. For example, in the scheme in this paper, the anonymity guarantees are lost upon leakage of a user key. It was only recently shown that one can actually construct highly efficient schemes following the without encryption paradigm which achieve security in the strongest model for dynamic group signatures.

Also see the introduction of this paper for an in depth discussion of the pros and cons (the term sign-randomize-proof is used there to describe the paradigm used by without encryption schemes, as this captures the essence of the without encryption paradigm more appropriately).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.