An Identity-Based Group Signature with Membership Revocation in the Standard Model

Group signatures allow group members to sign an arbitrary number of messages on behalf of the group without revealing their identity. Under certain circumstances the group manager holding a tracing key can reveal the identity of the signer from the signature. Practical group signature schemes should support membership revocation where the revoked member loses the capability to sign a message on behalf of the group without influencing the other non-revoked members. A model known as verifier-local revocation supports membership revocation. In this model the trusted revocation authority sends revocation messages to the verifiers and there is no need for the trusted revocation authority to contact non-revoked members to update their secret keys. Previous constructions of verifier-local revocation group signature schemes either have a security proof in the random oracle model or are non-identity based. A security proof in the random oracle model is only a heuristic proof and non-identity-based group signature suffer from standard Public Key Infrastructure (PKI) problems, i.e. the group public key is not derived from the group identity and therefore has to be certified. In this work we construct the first verifier-local revocation group signature scheme which is identity-based and which has a security proof in the standard model. In particular, we give a formal security model for the proposed scheme and prove that the scheme has the property of anonymity under the decision Linear (DLIN) assumption and it is fully-traceable under the Computation Diffie-Hellman (CDH) assumption. The proposed scheme is based on prime order bilinear groups.