Practical dynamic group signatures without knowledge extractors

dynamic group signature ( 𝒟𝒢𝒮 ) allows a user to generate a signature on behalf of a group, while preserving anonymity. Although many existing 𝒟𝒢𝒮 schemes have been proposed in the random oracle model for achieving efficiency, their security proofs require knowledge extractors that cause loose security reductions. In this paper, we first propose a new practical 𝒟𝒢𝒮 scheme whose security can be proven without knowledge extractors in the random oracle model. Moreover, our scheme can also be proven in the strong security model where an adversary is allowed to generate the group managers’ keys maliciously. The efficiency of our scheme is comparable to existing secure 𝒟𝒢𝒮 schemes in the random oracle model using knowledge extractors. The security of our scheme is based on a new complexity assumption that is obtained by generalizing the Pointcheval–Sanders (PS) assumption. Although our generalized PS (GPS) assumption is interactive, we prove that, under the (2,1)-discrete logarithm assumption, the new GPS assumption holds in the algebraic group model.