Does the signatures generated by a revoked member before revocation remains valid in VLR group signatures

Question

Group signatures allow any member of the group sign the message on behalf of the group anonymously using his own secret-key. Only group manager can reveal the identity of the signer. Verifier Local Revocation (VLR) is an efficient approach of membership revocation.

In VLR group signatures, revocation-token is generated for each user and is placed in Revocation List (RL) whenever the user is revoked. VLR group signature schemes consist of three algorithms: KeyGen, Sign and Verify

KeyGen algorithm outputs public-key, secret-key for each user and revocation-token for each user

Sign algorithm generates the signature on a message using the secret-key of a group member.

Verify algorithm returns 1 if it is a valid signature that is signer is valid group member and he is not revoked. Otherwise, returns 0.

If a group member "i" is revoked then its revocation token in placed RL. Therefore, he cannot generate a valid signature. But, the verify algorithm returns invalid for all the signatures generated by user "i" before revocation if we verify the signatures using the RL where revocation-token of user "i" is placed. Is my understanding correct?

Answer 1

I think it depends on the implementation of the scheme. A naive implementation might do what you've described and invalidate every previous signature of the revoked member.

However, the scheme proposed here: http://www.scitepress.org/Papers/2012/40175/40175.pdf takes a respective time $period$ into account.

Here the verification algorithm is defined as:

$Verify(gpk, j, RL_{j}, m , \sigma)$:

This algorithm, run by a verifier takes as input a message $m$, its signature $\sigma$, a period $j$, the corresponding Revocation List $RL_{j}$ and the public parameters $gpk$. It checks if the message has been signed by an unrevoked group member, without revealing the signer’s identity. The possible outputs are valid and invalid.

As you can see, the verification check depends on a certain time period here. In this case, all signatures in previous periods would remain valid. This is especially useful because it enables to unrevoke members in a later period without having to generate a new key for that user.

So to answer your question: I think it depends on the implementation.