Group signature with local revocation verification with capacity for lifting anonymity

Abstract

The cryptographic scheme subdivides time into periods with an index j=0, 1, 2, etc. A public key indicates elements u and v of a first cyclic group Gof prime order p and, for each period j, an integer sbetween 0 and p−1 and elements gof the group Gand g, wand hof another cyclic group Gof order p. The private key of a member of the group indicates an integer xbetween 0 and p−1 and, for each period j, an element Aof the group Gsuch that A=[A/g]for 1≦n≦j. To sign a message during a period j≧0, the member selects two integers α and β between 0 and p−1, calculates T=u, T=A·v, S=gand S=e(A, h)where e(., .) is a bilinear map of G×Gonto G, and determines according to the message the data that justify the fact that the elements T, T, Sand Sare correctly formed with knowledge of the private key of the member for the period with index j.