Page 8, Paper: "Efficient Group Signature Schemes for Large Groups" by Camenisch and Stadler

(1) I was trying to understand membership certificate part. I am have only basic knowledge of math, but there seems to be quite some math behind it. Can somebody help me understand this part? "e" and "y" are not secret. Why is it infeasible to construct a triple (x, y, v) without the help of Group manager?

enter image description here

(2) During verification, what convinces the verifier that Alice is a valid group member? Is it - whoever can prove knowledge of eth root of (their) (y+1) is a group member? Can somebody help in understanding this part also?

enter image description here

  • $\begingroup$ I do not see any $x$... $\endgroup$
    – Ievgeni
    Oct 20, 2021 at 7:40


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.