# Is BBS+ 1. a multi-messages signing protocol or 2. a group signature signed by a member of a group anonymously?

There's no doubt that the BBS Signature was born from this classic Short Group Signature paper in 2004. It's capable of Zero-knowledge. In the paper, section 5, it describes how a member of a group, can sign a message, without revealing which member signed it. But, this group signature can be verified that it was signed by a member of a group (anonymously) through a group public key $$gpk$$.

However, later, there are some works improving BBS into BBS+. It was first modified and named in Constant-Size Dynamic k-TAA by Au et al. BBS+ was touched again in Anonymous Attestation Using the Strong Diffie Hellman Assumption Revisited. Nevertheless, in those two papers mentioned above, it seems the BBS+ scheme is a multi-messages signing protocol. It takes messages $$m_1, m_2, m_3,..., m_L$$ and produces a single signature $$\sigma$$. It can create a proof of knowledge $$SPK$$ on top of signature $$\sigma$$, with some messages $$m_i$$ revealed.

Yet, in work on Enhanced Privacy ID from Bilinear Pairing by intel, it seems their BBS+ scheme becomes as a member of a group signing the message anonymously, same as Short Group Signature paper in 2004.

Therefore, I'm confused about BBS+ protocol. Whether it is

1. a multi-message $$m_1, m_2, m_3,..., m_L$$ signing protocol producing a single signature $$\sigma$$ with signature proof of knowledge $$SPK$$

or

1. a group signature signed by a member of a group anonymously using a group public key $$gpk$$?