# How to sign commited group elements?

I'm actually searching some particular primitive compatible with Groth-Sahai commitment.

I would like to know a signature scheme (on group elements), such that there exists an algorithm $$\mathtt{SigCom}$$ such that it takes as input the commitment key $$\mathtt{ck}$$ , the signing key $$\mathtt{sk}$$ and a commitment $$\mathtt{c}$$ and outputs a committed signature $$\mathtt{c}_\sigma$$ with a (Groth-Sahai) proof $$\pi$$ that certifies the signature committed is the signature of the value (in the commitment of the input).

I've found this article. It does exactly what I want except that the value are on a precise type $$\left(G^m, H^m\right)$$, and it's too restrictive for me.

If you know a more general result (or something that fit with two group elements without any relation between them), it would be good for me.

• see this paper aswell: link.springer.com/chapter/10.1007/978-3-642-14623-7_12 It has the same message space so it might still be too restrictive though. Maybe you could clarify your restrictions? Jun 19, 2021 at 7:51
• I would like to have something very general which can consider each vector of group elements as message. Jun 29, 2021 at 9:23
• Without having studied the details of the paper I linked, it does not seem that any party actually has to know neither $m$ nor $H^m$, which should then satisfy your requirements. Also, the authors state that the scheme can be instantiated for $G_1 = G_2$, which seems in line with your general setting. Jun 30, 2021 at 9:05
• $H$ is fixed, then only few vectors can be signed. For example $(G, H^2)$ can't be signed. Jun 30, 2021 at 9:07
• you are not actually signing $H^m$ in section 4 of the linked paper, the value only exists. But instead, have a look at section 5 of the linked paper. It proposes a scheme for signing vectors of group elements, which seems to be what you need Jun 30, 2021 at 9:15