Page 8, Paper: "Efficient Group Signature Schemes for Large Groups" by Camenisch and Stadler
(1) I was trying to understand membership certificate part. I am have only basic knowledge of math, but there seems to be quite some math behind it. Can somebody help me understand this part? "e" and "y" are not secret. Why is it infeasible to construct a triple (x, y, v) without the help of Group manager?
(2) During verification, what convinces the verifier that Alice is a valid group member? Is it - whoever can prove knowledge of eth root of (their) (y+1) is a group member? Can somebody help in understanding this part also?