Advances in Cryptology - ASIACRYPT 2013

Volume 8270 of the series Lecture Notes in Computer Science pp 41-61

Lattice-Based Group Signatures with Logarithmic Signature Size

  • Fabien LaguillaumieAffiliated withUniversité Claude Bernard Lyon 1LIP (U. Lyon, CNRS, ENS Lyon, INRIA, UCBL)
  • , Adeline LangloisAffiliated withÉcole Normale Supérieure de LyonLIP (U. Lyon, CNRS, ENS Lyon, INRIA, UCBL)
  • , Benoît LibertAffiliated withTechnicolor
  • , Damien StehléAffiliated withÉcole Normale Supérieure de LyonLIP (U. Lyon, CNRS, ENS Lyon, INRIA, UCBL)

* Final gross prices may vary according to local VAT.

Get Access


Group signatures are cryptographic primitives where users can anonymously sign messages in the name of a population they belong to. Gordon et al. (Asiacrypt 2010) suggested the first realization of group signatures based on lattice assumptions in the random oracle model. A significant drawback of their scheme is its linear signature size in the cardinality N of the group. A recent extension proposed by Camenisch et al. (SCN 2012) suffers from the same overhead. In this paper, we describe the first lattice-based group signature schemes where the signature and public key sizes are essentially logarithmic in N (for any fixed security level). Our basic construction only satisfies a relaxed definition of anonymity (just like the Gordon et al. system) but readily extends into a fully anonymous group signature (i.e., that resists adversaries equipped with a signature opening oracle). We prove the security of our schemes in the random oracle model under the SIS and LWE assumptions.


Lattice-based cryptography group signatures anonymity