In this paper, it referred that there are two paradigms used in constructing group signatures: the "sign-encrypt-prove"(SEP) paradigm and "sign-randomize-proof"(SRP) paradigm.
As said in this paper, SEP paradigm is
Here, a signature is an encrypted membership certificate together with a signature of knowledge, where the signer demonstrates knowledge of some signed value in the ciphertext
SRP paradigm is
Essentially,they use a signature scheme which supports (1) randomization ofsignatures so that multiple randomized versions of the same sig-nature are unlinkable, and (2) efficiently proving knowledge of asigned value. In their construction, on joining the group, the issuer uses such a signature scheme to sign a commitment to the user’ssecret key. The user can then produce a group signature for a mes-sage by randomizing the signature and computing a signature ofknowledge on the message, which demonstrates knowledge of thesigned secret key.
In my understanding, if using the non-randomized signature scheme to construct group signature scheme, maybe I should follow "SEP", otherwise(using the randomized signature scheme), I should follow "SRP", because in this way I just need to prove the knowledge of signed secret key in the signature, which is easier to prove than that in "SEP".
However, when I read the group signature proposed by Camenisch, J., and Lysyanskaya, it said that it followed "sign-encrypt-prove" paradigm. The CL signature has re-randomize property, why it doesn't seem to follow the "sign-randomize-proof" paradigm ? In other paper proposed by David Pointcheval and Olivier Sanders, it first proposed the similar randomized signature like CL and followed "SRG" paradigm to construct group signature(concrete construction in Appendix A).
And if CL-group signature indeed follows the SEP, why does it only encrypt the group member public key but not the certificate? That seems to contradict with the SEP as well.
