![](bg2.png)
lution for signers. In (Nakanishi and Funabiki, 2007),
the authors extend a group signature scheme (Boneh
and Shacham, 2004) and add Backward Unlinkability
(BU). They employ the revocation tokens of revoked
members for certain time intervals to ensure that for-
mer signatures cannot be linkable if the member is
revoked. Since the proposal (Nakanishi and Funabiki,
2007) is proved in the random oracle model, the work
(Libert and Vergnaud, 2009) presents the VLR group
signature scheme with BU that is proved in the stan-
dard model. Nevertheless, the revocation check also
costs 1 pairing operation per one revocation token as
in (Nakanishi and Funabiki, 2007). To improve com-
putational overhead, one revocation check is reduced
from one pairing to one exponentiation in (Chen and
Li, 2012). In (Bringer and Patey, 2011), the scheme
proposed in (Chen and Li, 2012) is patched to satisfy
backward unlinkability, traceability and exculpability
in the random oracle model. The work (Camenisch
et al., 2010) presents revocation with efficient up-
dates. The validity time of a credentials is encoded
into an attribute. Nevertheless, the solution does not
support an immediate revocation. In time-critic ser-
vices, the solution has to be combined with an accu-
mulator solution. The work (Chu et al., 2012) pro-
poses a pairing-based group signature scheme with
VLR employing time-bound secret keys and without
BU. Each group secret key has an expiration date so
the verifier checks the revocation list that excludes ex-
pired members. Only one exponentiation is needed
to check whether the key is revoked. Nevertheless,
the scheme performs seven pairing operations per one
message in the verification phase.
1.2 Our Contribution
Our scheme provides standard group signature prop-
erties like authenticity, anonymity, data integrity, non-
reputation, correctness and one public key. The
scheme does not need the reinitialization of param-
eters and keys of members when a new user is
added, revoked or epoch is ended. In contrary to
schemes (Nakanishi and Funabiki, 2007), (Libert and
Vergnaud, 2009), (Chen and Li, 2012) and (Bringer
and Patey, 2011) where time intervals are employed,
in our proposal, a Revocation List (RL) is reduced
by the natural expiration of secret keys which is con-
venient for applications where the individual time of
group membership expiration is needed. To our best
knowledge, only the scheme proposed by Chu et al.
2012 (Chu et al., 2012) uses time-bound secret keys
to the natural expiration of these keys. Neverthe-
less, we propose a scheme which is more efficient in
computational overhead than Chu et al. scheme (Chu
et al., 2012) by using a different design and employ-
ing optimization techniques such as the batch verifi-
cation used in (Ferrara et al., 2009) and (Malina et al.,
2013). Our scheme needs only 8 elements per a re-
vocation token in contrary to 14 elements needed in
(Chu et al., 2012). Moreover, to ensure the shorter
revocation tokens, we use time offsets in comparing
with using date formats in (Chu et al., 2012). Accord-
ing to the initial results, see section 4.2, our scheme
has better performance in the verification phase than
the current VLR group signatures.
2 BACKGROUND
In this section, the cryptography background and sys-
tem model are outlined.
2.1 Cryptography Used
Our scheme is based on a group signature scheme
proposed by Boneh and Shacham (the BS04 scheme)
(Boneh and Shacham, 2004) with verifier-local revo-
cation that ensures anonymity, authenticity, message
integrity, non-repudiation, unlinkability and traceabil-
ity. The scheme uses bilinear maps and is based on
the q-SDH problem and Decision Linear problem,
which have been described in (Boneh and Shacham,
2004). We modify this scheme to ensure more effi-
cient verification algorithm by a verifier-local revoca-
tion with time-bound group member secret keys and
batch verification. To make time-bound group se-
cret member keys, we employ the methods called 0-
encoding/1-encoding presented in (Chu et al., 2012).
The 0-encoding and 1-encoding reduce the greater
than predicate to set intersection predicate by convert-
ing a date format in binary string to a value in Z
p
.
2.2 System Model
Our system model consists of three parties:
• Group manager (GM). We assume that GM is a
trusted party. GM initializes all group signature
parameters, one group public key, one group man-
ager secret key and group member secret keys.
GM also manages a revocation list which includes
revoked users.
• Verifier (V). V checks only signed messages by a
group public key and if user is on the revocation
list or not.
• User (U). U, who correctly joins into a group, can
sign any message by his/her group member secret
key and send it to V.
SECRYPT2013-InternationalConferenceonSecurityandCryptography
556