In this paper, it referred that there are two paradigms used in constructing group signatures: the "sign-encrypt-prove"(SEP) paradigm and "sign-randomize-proof"(SRP) paradigm.

As said in this paper, SEP paradigm is

Here, a signature is an encrypted membership certificate together with a signature of knowledge, where the signer demonstrates knowledge of some signed value in the ciphertext

SRP paradigm is

Essentially,they use a signature scheme which supports (1) randomization ofsignatures so that multiple randomized versions of the same sig-nature are unlinkable, and (2) efficiently proving knowledge of asigned value. In their construction, on joining the group, the issuer uses such a signature scheme to sign a commitment to the user’ssecret key. The user can then produce a group signature for a mes-sage by randomizing the signature and computing a signature ofknowledge on the message, which demonstrates knowledge of thesigned secret key.

In my understanding, if using the non-randomized signature scheme to construct group signature scheme, maybe I should follow "SEP", otherwise(using the randomized signature scheme), I should follow "SRP", because in this way I just need to prove the knowledge of signed secret key in the signature, which is easier to prove than that in "SEP".

However, when I read the group signature proposed by Camenisch, J., and Lysyanskaya, it said that it followed "sign-encrypt-prove" paradigm. The CL signature has re-randomize property, why it doesn't seem to follow the "sign-randomize-proof" paradigm ? In other paper proposed by David Pointcheval and Olivier Sanders, it first proposed the similar randomized signature like CL and followed "SRG" paradigm to construct group signature(concrete construction in Appendix A).

And if CL-group signature indeed follows the SEP, why does it only encrypt the group member public key but not the certificate? That seems to contradict with the SEP as well.

  • $\begingroup$ The CL scheme is simply a SEP scheme. Its exactly like BBS04, but using a different signature scheme. Also SEP is just a rough template and it might not perfectly describe every scheme. $\endgroup$
    – DrLecter
    Nov 7, 2019 at 15:48


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.