[Paper Review] Group Signature Schemes Using Braid Groups

Tony Thomas, A. K. Lal|ArXiv.org|Feb 17, 2006

Geometric and Algebraic Topology21 references3 citations

TL;DR

This paper presents the first group signature schemes based on braid groups, leveraging the hardness of the root problem, conjugacy problem, and decomposition problem. It proposes three schemes: one relying solely on the root problem for security, another combining undeniable signatures with group signatures, and a third using conjugacy-related assumptions, all achieving anonymity, unforgeability, exculpability, and traceability in the braid group setting.

ABSTRACT

Artin's braid groups have been recently suggested as a new source for public-key cryptography. In this paper we propose the first group signature schemes based on the conjugacy problem, decomposition problem and root problem in the braid groups which are believed to be hard problems.

Motivation & Objective

• To design the first group signature schemes using braid groups as a foundation for public-key cryptography.
• To leverage the hardness of braid group problems—root, conjugacy, and decomposition—for constructing secure group signatures.
• To ensure core group signature properties: anonymity, unforgeability, exculpability, and traceability.
• To establish formal security assumptions based on braid group algebraic problems, particularly the factor equality problem in 3-factor decompositions.
• To explore the feasibility of extending braid-based cryptography to other non-abelian groups and signature variants like ring signatures.

Proposed method

• The scheme uses braid groups $B_n$ with Artin generators $\sigma_i$, relying on the algebraic structure of positive and non-repeating braids.
• A group signature is formed as a pair $S_m = (S_1, S_2)$, where $S_1 = s^{-1} \beta_1^{-1} y \beta_2 s$ and $S_2 = s^{-1} \beta_1^{-1} y \beta_2 s$, with $y$ derived from the signer's secret key.
• Security relies on the infeasibility of determining factor equality in 3-factor braid decompositions, formalized in Assumption 3.1.
• Anonymity is ensured by hiding the signer’s identity through conjugacy operations and secret key obfuscation.
• Traceability is achieved via a trusted group manager who uses the signature and public parameters to compute a conjugate that reveals the signer’s identity.
• The scheme employs confirmation and denial protocols to enable dispute resolution, allowing the group manager to open signatures when needed.

Experimental results

Research questions

• RQ1 Can group signature schemes be constructed using braid groups as the underlying algebraic structure?
• RQ2 Is the root problem in braid groups sufficiently hard to serve as the sole security foundation for a group signature scheme?
• RQ3 Can the conjugacy and decomposition problems in braid groups be used to achieve unforgeability and anonymity?
• RQ4 How can the unlinkability and exculpability of the scheme be formally established under braid group assumptions?
• RQ5 What are the implications of using braid group problems for designing other cryptographic protocols beyond group signatures?

Key findings

• The first group signature scheme whose security is based exclusively on the root problem in braid groups is proposed, and this scheme is considered the most secure due to the presumed hardness of the root problem.
• The scheme achieves unlinkability because determining whether two signatures share the same factor structure is computationally infeasible under Assumption 3.1.
• Anonymity is preserved as no group member or verifier can identify the signer without solving the conjugacy search problem, which is assumed to be hard.
• Exculpability holds because the group manager cannot learn any signer’s private keys or signing keys due to the secure key derivation protocol during member enrollment.
• Traceability is formally proven: the group manager can open any valid signature to reveal the actual signer by computing a conjugate involving the signature and public parameters.
• The security of the schemes relies on unproven assumptions such as the difficulty of factor equality in 3-factor braid decompositions, which require further numerical and theoretical investigation.