On the Efficiency of Group Signatures Providing Information-Theoretic Anonymity

Group signatures, introduced by Chaum and van Heijst at Eurocrypt'91, allow members of a group to make signatures on behalf of the group while remaining anonymous. Furthermore, in case of disputes a designated group authority, who is given some auxiliary information, can identify the signer. Chaum and van Heijst presented four schemes, one of which protects the anonymity of the signer information-theoretically. However, this scheme as well as subsequent schemes with this property requires that the signer basically needs a new secret key for each signature and that the group authority secretly stores a very long string. This paper analyses such group signature schemes and obtains lower bounds on the length of both the secret keys of the group members and the auxiliary information of the authority depending on the number of signatures each is allowed to make and the number of group members. These bounds are optimal as they are met by the scheme suggested by Chaum and van Heijst.