GMMT: A Revocable Group Merkle Multi-Tree Signature Scheme

G-Merkle (GM) (PQCrypto 2018) is the first hash-based group signature scheme where it was stated that multi-tree approaches are not applicable, thus limiting the maximum number of supported signatures to 2. DGM (ESORICS 2019) is a dynamic and revocable GM-based group signature scheme that utilizes a computationally expensive puncturable encryption for revocation and requires interaction between verifiers and the group manager for signature verification. In this paper, we propose GM, a hash-based group signature scheme that provides solutions to the aforementioned challenges of the two schemes. GM builds on GM and adopts a multi-tree construction that constructs new GM trees for new signing leaves assignment while keeping the group public key unchanged, Compared to a single GM instance which enables 2 signature, GM allows growing the multi-tree structure adaptively to support 2 signatures under the same public key. Moreover, GM has a revocation mechanism that attains linkable anonymity of revoked signatures and has a logarithmic verification computational complexity compared to the linear complexity of DGM. The group manager in GM requires storage that is linear in the number of members while the corresponding storage in DGM is linear in the number of signatures supported by the system. Concretely, for a system that supports 2 signatures with 2 members and provides 256-bit security, the required storage of the group manager is 1 MB (resp. 10 TB) in GM(resp. DGM).