Tracing-by-Linking Group Signatures

In a group signature [19], any group member can sign on behalf of the group while remaining anonymous, but its identity can be traced in an future dispute investigation. Essentially all state-of-theart group signatures implement the tracing mechnism by requiring the signer to escrow its identity to an Open Authority (OA) [2, 14, 4, 25, 5, 7, 24]. We call them Tracing-by-Escrowing (TbE) group signatures. One drawback is that the OA also has the unnecessary power to trace without proper cause. In this paper we introduce Tracing-by-Linking (TbL) group signatures. The signer’s anonymity is irrevocable by any authority if the group member signs only once (per event). But if a member signs twice, its identity can be traced by a public algorithm without needing any trapdoor. We initiate the formal study of TbL group signatures by introducing its security model, constructing the first examples, and give several applications. Our core construction technique is the successful transplant of the TbL technique from single-term offline e-cash from the blind signature framework [10, 22, 21] to the group signature framework. Our signatures have size O(1).