1

I'm looking to use group signature that is scalable in terms of the size of the signature is independent of the number of the group members.

Two question-

1- Is [1] considered an up to date, efficient and secure scheme?

2- In case of new joining member, does the signature needs to be changed? (to also to reflect the new member's membership).

[1] - https://link.springer.com/content/pdf/10.1007/BFb0052252.pdf

Shak
  • 229
  • 1
  • 6

1 Answers1

2

My answer to a multi-sig question may shed some more light if you're interested in more flexible groups.

I don't see the date of the paper you've linked, but it does not reference anything after 2k. The following is from 2001.

As far as I know there isn't anything that would compete directly without being a distinct protocol. If you want n-of-n, you may look at MuSig, which is a recent advancement in the n-of-n signing of a common message. If you want a subset, you can select the signers directly. This isn't anonymous between cosigners as in t-of-n; but it is directly traceable.

Joining a new member to the group does not change old signatures, but it does change the identity of the group. Evolving t-of-n produces opaque new identities; while n-of-n MuSig evolves transparently. In either case you'll need to have some method and protocol to manage which identities are valid and when. I.e. Git code signing could be relative to the state of the commit.

What properties are you interested in?

If you want t-of-n anonymous groups. AFAIK you'll need to do a re-key and establish a new identity for any group changes. This would certainly be annoying to maintain, especially if this is frequent.

If you want a traceable subset of a larger known, and trivially dynamic group; then you may prefer a direct n-of-n through identity-aggregation.

cypherfox
  • 1,422
  • 7
  • 16