Paper 2016/101

Signature Schemes with Efficient Protocols and Dynamic Group Signatures from Lattice Assumptions

Benoit Libert, San Ling, Fabrice Mouhartem, Khoa Nguyen, and Huaxiong Wang


A recent line of works - initiated by Gordon, Katz and Vaikuntanathan (Asiacrypt 2010) - gave lattice-based constructions allowing users to authenticate while remaining hidden in a crowd. Despite five years of efforts, known constructions are still limited to static sets of users, which cannot be dynamically updated. This work provides new tools enabling the design of anonymous authentication systems whereby new users can join the system at any time. Our first contribution is a signature scheme with efficient protocols, which allows users to obtain a signature on a committed value and subsequently prove knowledge of a signature on a committed message. This construction is well-suited to the design of anonymous credentials and group signatures. It indeed provides the first lattice-based group signature supporting dynamically growing populations of users. As a critical component of our group signature, we provide a simple joining mechanism of introducing new group members using our signature scheme. This technique is combined with zero-knowledge arguments allowing registered group members to prove knowledge of a secret short vector of which the corresponding public syndrome was certified by the group manager. These tools provide similar advantages to those of structure-preserving signatures in the realm of bilinear groups. Namely, they allow group members to generate their own public key without having to prove knowledge of the underlying secret key. This results in a two-message joining protocol supporting concurrent enrollments, which can be used in other settings such as group encryption. Our zero-knowledge arguments are presented in a unified framework where: (i) The involved statements reduce to arguing possession of a $\{-1,0,1\}$-vector $\mathbf{x}$ with a particular structure and satisfying $\mathbf{P}\cdot \mathbf{x} = \mathbf{v} \bmod q$ for some public matrix $\mathbf{P}$ and vector $\mathbf{v}$; (ii) The reduced statements can be handled using permuting techniques for Stern-like protocols. Our framework can serve as a blueprint for proving many other relations in lattice-based cryptography.

Available format(s)
Public-key cryptography
Publication info
A major revision of an IACR publication in ASIACRYPT 2016
Lattice-based cryptographyanonymitysignatures with efficient protocolsdynamic group signaturesanonymous credentials
Contact author(s)
benoit libert @ ens-lyon fr
2016-09-07: last of 2 revisions
2016-02-08: received
See all versions
Short URL
Creative Commons Attribution


      author = {Benoit Libert and San Ling and Fabrice Mouhartem and Khoa Nguyen and Huaxiong Wang},
      title = {Signature Schemes with Efficient Protocols and Dynamic Group Signatures from Lattice Assumptions},
      howpublished = {Cryptology ePrint Archive, Paper 2016/101},
      year = {2016},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.