Implementation of a Revocable Group Signature Scheme with Compact Revocation List Using Accumulator

A group signature scheme allows a user to anonymously sign a message on behalf of a group. One of important issues in group signature schemes is the user revocation. Previously, Libert et al. proposed an elegant revocable group signature scheme with O(1) signing/verification costs, O(1) signature size, O(1) membership certificate size, and O(log N) public key size, where N is the number of group members. However, the revocation list (RL) size is O(R), where R is the number of revoked members. Due to O(R) signatures in the RL, the RL size amounts to 8 MB in case of R=10,000. Then, a revocable group signature scheme with O(R/T) RL size was previously proposed for an integer parameter T, by accumulating T entries in the RL. Thus, we can expect that the delay time for a signer to fetch the RL is reduced in mobile environment. As the trade-off, the signing cost is increased by O(T). However, this scheme with the compact RL has not been implemented yet, and the practicality on the computation times for concrete T is unknown. In this paper, we implemented the scheme with the compact RL, and explore the practicality, where the signing time is greatly reduced by the technique to reduce the witness computation for the accumulator shown in the previous paper. From the experimental results, the signing and verification times are less than 500 ms and 900 ms even for T=100, and thus we can confirm that the implemented scheme is practical, and the accumulating technique in the implemented scheme is sufficiently effective.