Linkable and Anonymous Signature for Ad Hoc Groups

We present a 1-out-of-n group signature scheme that satisfies three major properties. (1) Anonymity, or signer-indistinguishability. (2) Linkability: That two signatures by the same signer can be linked. (3) Spontaneity: No group manager or TTP, no setup stage such as in secret sharing. The scheme has many applications where maximum privacy is protected, copycatting is prevented, and impromptu linkup is prerogative. For example: whistle blowing, e-voting, anonymous membership authentication, and digital rights management. We show under the random oracle model that our scheme satisfies all the three properties. Additionally, we present an e-voting system based on our scheme. In the system, there is no involvement of voters in the registration phase and the voting phase is only one-round. We also present a new proof of the core lemma in rewind simulation. This is the literature’s third such proofs, after the forking lemma [30] and the heavy-row lemma [28]. Our proof is the most accessible of the three, relying on only the moment inequality from elementary probability theory. And our proof has the best simulation efficiency of the three. Threshold extensions of our scheme are also proposed.