Abstract: A verifier-local revocation group signature scheme with backward unlinkability is proposed based on the scheme presented by Boneh and Shacham. In our scheme, the private key to a group member is a triple consisting of the key obtained from the key issuer and that generated by the member, thus realizing strong exculpability. Also, we solve the problem that the running time of signature verification is linearly dependent on the length of revocation list using zero knowledge under Decision Linear Diffie-Hellman assumption, so the verification of our scheme requires only three multi-exponentiations and one paring computation. Further, our scheme realizes the backward unlinkability based on the concept of time intervals and is only 1553bits in size.

Key words: group signature, verifier-local, backward unlinkability, strong exculpability