Extracting group signatures from traitor tracing schemes

Abstract

Digital Signatures emerge naturally from Public-Key Encryption based on trapdoor permutations, and the "duality" of the two primitives was noted as early as Diffie-Hellman's seminal work. The present work is centered around the crucial observation that two well known cryptographic primitives whose connection has not been noticed so far in the literature enjoy an analogous "duality." The primitives are Group Signature Schemes and Public-Key Traitor Tracing. Based on the observed "duality," we introduce new design methodologies for group signatures that convert a traitor tracing scheme into its "dual" group signature scheme. Our first methodology applies to generic public-key traitor tracing schemes. We demonstrate its power by applying it to the Boneh-Franklin scheme, and obtaining its "dual" group signature. This scheme is the first provably secure group signature scheme whose signature size is not proportional to the size of the group and is based only on DDH and a random oracle. The existence of such schemes was open. Our second methodology introduces a generic way of turning any group signature scheme with signature size linear in the group size into a group signature scheme with only logarithmic dependency on the group size. To this end it employs the notion of traceability codes (a central component of combinatorial traitor tracing schemes already used in the first such scheme by Chor, Fiat and Naor). We note that our signatures, obtained by generic transformations, are proportional to a bound on the anticipated maximum malicious coalition size. Without the random oracle assumption our schemes give rise to provably secure and efficient Identity Escrow schemes. © International Association for Cryptologic Research 2003.