
Figure 1.
Group Signature in Electronic Contract Signing
Table 1.
Notation Definition
| Notations | Description |
|---|---|
| n-dimensional vector over modulo q | |
| n × m matrix over modulo q | |
| R | polynomial Z[[x] / (xd + 1) |
| Rq | quotient ring Z[q[x] / (xd + 1) |
| x ← D | x is sampled from the distribution D |
| ∥a∥ | |
| ∥a∥∞ | |
| ∥w∥ | , where w = (w0, …., w)∈ Rk |
| ∥w∥∞ | , where w = (w0, …., wk) ∈ Rk |
| ⊥ | the algorithm outputs fail |
| negl(λ) | a non-negligible function about λ |
| B | the set of integers representable by a single byte, i.e., {0,1,…,255} |

Figure 2.
Algorithm for Rejection Sampling

Figure 3.
The Definitions for Anonymity Game

Figure 4.
The Definitions for Traceability Game
Table 2.
The Parameters for ML-GS Scheme
| Parameter | Recommended Parameters | |
|---|---|---|
| PARM I | PARM II | |
| q | 1073738753 | 1073738753 |
| Q | 3329 | 3329 |
| n | 256 | 256 |
| (k, l) | (4,4) | (6,5) |
| η | 83832 | 83290 |
| η1 | 3 | 3 |
| τ | 39 | 49 |
| ≈ 231 | ≈ 231 | |
| BKZ blocksize b to break SIS | 364 | 583 |
| Classical security | 106 | 170 |
| Quantum security | 96 | 154 |
Table 3.
Algorithm Notations and Execution Time (ms)
| Notation | Description | Execution time |
|---|---|---|
| TM–TrapGen | Trapdoor generation algorithm on module lattices | 248.09 |
| TM–Sample | Trapdoor sampling algorithm on module lattices | 31.10 |
Table 4.
The Time Cost for ML-GS Scheme
| Setup | KeyGen | Sign | Verify | |
|---|---|---|---|---|
| PARM I | 248.09 | 56.54 | 89.04 | 57.24 |
| PARM II | 426.40 | 96.12 | 179.67 | 114.48 |

Figure 5.
Time Cost Comparison of GS Schemes (ms).

Figure 6.
The Store Cost of ML-GS Scheme.