Group signatures and their relevance to privacy-protecting off-line electronic cash systems

A group signature scheme allows members of a possibly large group to sign messages anonymously on behalf of the group. Only a designated entity can determine the identity of the group member who issued a given signature. Group signatures, and particularly group blind signatures [28, 35] (which incorporate the properties of bath blind signatures and group signatures), have many applications such as e-commerce. In this paper, we first propose a new group signature scheme, suitable for large groups (i.e., the group's public key and the signatures are fixed-size regardless of the number of memberships). Furthermore, we show how to use our group signature scheme to construct a practical privacy-protecting off-line electronic cash system Our group signature scheme is more efficient than previous ones and the resulting electronic cash system is characterized by a high computational efficiency in the withdrawal protocol(1). Then, we show some weaknesses in the design of an electronic cash system based on a group signature scheme [28, 35](2). Finally, we describe some weaknesses of recently proposed group signature schemes [1, 2, 10, 28].