Group signatures with separate and distributed authorities

Abstract

We propose a new group signature scheme that simultaneously provides the following two properties: (1) the membership authority is able to add a user but not to identify an actual signer, while the tracing authority is able to identify the actual signer but not to add a user, (2) for further decentralization, these two authorities are respectively distributed among multiple entities in a manner efficient enough for practical applications. Previous group signature schemes have only offered one or the other of these two properties. Further, we formalize the security properties © Springer-Verlag Berlin Heidelberg 2005.