As an extension of digital signature, designated confirmer signature (DCS) efficiently realizes the privacy protection of the signer. In a DCS scheme, the validity of the signature must be confirmed by the signer or a semi-trusted third party, called confirmer. Since the DCS signature is generated by encrypting a standard signature with the designated confirmer’s public key, only the confirmer ...