There's no doubt that the BBS Signature was born from this classic Short Group Signature paper in 2004. It's capable of Zero-knowledge. In the paper, section 5, it describes how a member of a group, can sign a message, without revealing which member signed it. But, this group signature can be verified that it was signed by a member of a group (anonymously) through a group public key $gpk$.

However, later, there are some works improving BBS into BBS+. It was first modified and named in Constant-Size Dynamic k-TAA by Au et al. BBS+ was touched again in Anonymous Attestation Using the Strong Diffie Hellman Assumption Revisited. Nevertheless, in those two papers mentioned above, it seems the BBS+ scheme is a multi-messages signing protocol. It takes messages $m_1, m_2, m_3,..., m_L$ and produces a single signature $\sigma$. It can create a proof of knowledge $SPK$ on top of signature $\sigma$, with some messages $m_i$ revealed.

Yet, in work on Enhanced Privacy ID from Bilinear Pairing by intel, it seems their BBS+ scheme becomes as a member of a group signing the message anonymously, same as Short Group Signature paper in 2004.

Therefore, I'm confused about BBS+ protocol. Whether it is

  1. a multi-message $m_1, m_2, m_3,..., m_L$ signing protocol producing a single signature $\sigma$ with signature proof of knowledge $SPK$


  1. a group signature signed by a member of a group anonymously using a group public key $gpk$?

1 Answer 1


I've always used it as #1. Hyperledger Ursa has an implementation in Rust (see https://github.com/hyperledger/ursa/tree/master/libzmix/bbs).

However, it is a type of group signature which allows the type of signing of multiple messages.

When someone says to me group signature I immediately think your #2. If we look at a paper written by David Chaum (https://chaum.com/publications/Group_Signatures.pdf), He mentions

group signatures are a "generalization" of the credential/ membership authentication schemes, in which one person proves that he belongs to a certain group.

So in effect, the proof being made is proving the messages belong to the signature and the signature allows for a proof of knowledge to be made. It's a different use of a crypto primitive.

Hope this helps


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.