Method comprising pairing-based accountable subgroup multi- signature schemes

Abstract

The invention relates to a method or methods comprising pairing-based accountable subgroup multi- signature schemes.

Description

[0001] METHOD COMPRISING PAIRING-BASED ACCOUNTABLE SUBGROUP MULTI¬

[0002] SIGNATURE SCHEMES

[0003] TECHNICAL FIELD

[0004] The invention relates to a method or methods comprising pairing-based accountable subgroup multi- signature schemes.

[0005] KNOWN STATE OF THE ART (BACKGROUND)

[0006] In the literature, there is a pairing-based accountable subgroup multi-signature (ASM) scheme offered by Boneh-Drijvers-Neven*. In the group setup of said ASM scheme, group members authenticate jointly. For this purpose, a multi-signature is also used with the participation of n members.

[0007] BRIEF DESCRIPTION AND OBJECTS OF THE INVENTION

[0008] The present invention relates to a method comprising pairing-based accountable subgroup multi- signature schemes for eliminating the disadvantages mentioned above and bringing new advantages to the related technical field.

[0009] With the invention, 3 new schemes have been developed, different from the existing ASM schemes in the literature.

[0010] The authentication mechanisms presented in the invention are innovative. While an additional multi- signature is used with the participation of all group members for authentication in the group setup of the schemes in the literature, the number of group operations required by the signing and verification phases has been reduced by using the Verifiable Secret Sharing (VSS) in the group setup of the inventive vASM. This means faster signing and verification under equivalent assumptions and on equivalent systems. The number of group operations required by the verification phase has been reduced by authenticating only with the participation of subgroup members in the group setup of the inventive ASMwSA.

[0011] In the group setup of the inventive ASMwCA, the number of group operations required for the verification phase was reduced by having all group members send their verification components (except their own) to the combiner, which was then authenticated by the combiner.

[0012] Digital signatures are not only used in document signing, but in many fields such as financial transactions, authentication, electronic voting, blockchain technologies, etc. For example, the digital signatures of the following person(s) need to be verified;

[0013] The person(s) authorized to make the transfer if money is to be transferred from an account,

[0014] The person(s) authorized to initiate firing if a remote-controlled weapon system is to be fired,

[0015] The person(s) authorized to vote if a vote is to take place, etc.

[0016] In this context, features such as accountability and flexible signer number offered by vASM, ASMwSA and ASMwCA of the invention can be used to meet the needs that may arise in many fields from military technologies to space and aviation technologies, from banking / financial technologies to medical technologies, and in short, in all sectors where digital signatures are used.

[0017] Description of the Figures Describing the Invention

[0018] The figures used to better explain the stand developed with this invention are as follows: Figure -1: vASM group setup

[0019] Figure -2: ASMwCA group setup DETAILED DESCRIPTION OF THE INVENTION

[0020] In this detailed description, the innovation of the invention is explained only with examples that will not have any limiting effect for a better understanding of the subject matter.

[0021] Said invention relates to methods and to 3 pairing-based accountable subgroup multi-signature schemes (vASM, ASMwSA and ASMwCA). a. vASM:

[0022] (i) In the created vASM scheme, implicit authentication is performed by using VSS instead of multi- signature in the group setup. Due to this group setup, the verification phase of the signature scheme can be performed with less operations compared to present systems. In addition, the signing phase requires less group operations compared to present systems.

[0023] (ii) In the vASM scheme, if the number of signers is fixed beforehand, it becomes an accountable threshold signature.

[0024] (iii) In vASM scheme, group members use membership keys (mk) instead of secret keys (sk) to multi- signature. This definitively separates the signature jurisdictions of the users. Let's take user A as an example. User A uses their own secret key (skA) to sign on behalf of themselves, while they use the membership key (mkA) that they produce jointly with other group members to sign on behalf of a group they belong to. b. ASMwSA:

[0025] (i) In the ASMwSA scheme, authentication is only performed jointly by the members of the subgroup. Due to this group setup, the verification phase of the signature scheme can be performed with less operations than the present pairing-based ASM scheme.

[0026] (ii) In the ASMwSA scheme, if the number of signers is fixed beforehand, it becomes an accountable threshold signature. c. ASMwCA:

[0027] (i) In the group setup of the ASMwCA scheme, users assign n multi-signatures and send these signatures to the combiner as membership key components (except for the one signed for themselves). The combiner performs the authentication process by adding the relevant membership key components to the individual signatures it receives. In this way, the verification phase of the signature scheme can be performed with less processing compared to the present pairing-based ASM scheme.

[0028] (ii) In the ASMwCA scheme, if the number of signers is fixed beforehand, it becomes an accountable threshold signature.

[0029] Multi-signature and other related definitions;

[0030] 1. A multi- signature is a type of digital signature in which a group of signers sign the same message together. There are some concepts in the literature regarding multi-signatures for different scenarios, such as group signatures, threshold signatures, aggregate signatures, and accountable subgroup multi-signatures. a. A group signature includes a group of potential signers, where any group member can anonymously sign a message on behalf of the entire group. In fact, this signature is not exactly an anonymous signature. That is because in group Q there is a group manager who knows the identities of all signers. Also, in group signatures, more than one signer cannot sign at the same time. A threshold signature is a type of multi-signature that requires any t signers from group to create a legitimate signature on behalf of a group Q of n potential signers. It provides anonymity, so signers' identities cannot be known by the verifier party. Therefore, there is no accountability feature. There is also a more general concept called aggregate signature, which enables different signatures created on different messages to be collected in a single signature. As can be seen from the definitions given above, neither group signatures, threshold signatures nor aggregate signatures provide sufficient flexibility and accountability at the same time. b. Accountable subgroup multi- signature (ASM) is a variant of multi-signature that ensures that any subgroup 5 of a group Q of n potential signers together sign an m message, making each 5 member responsible for the resulting signature. There are two types of ASM schemes based on DLP (discrete logarithm problem) and DHP (Diffie-Hellman problem) in the literature. The inventors have created a new ASM scheme (vASM) using the BLS scheme, a pairing-based multi- signature scheme based on DHP. Before describing the created vASM scheme, the tools used in the phases of the scheme and BLS and MSP signature schemes are explained.

[0031] Below are the definitions of bilinear pairing, verifiable secret sharing scheme, and BLS (Boneh-Lynn-Shacham) and MSP (Multi Signature Protocol) signature schemes used in the stages of the invention. 1. Bilinear Pairing: Let and G2be cyclic additive groups with a prime number of elements, and GTbe a cyclic multiplicative group with the same number of elements.

[0032] Definition 2.1. A pairing is an e: map which has bilinearity and non-degeneracy features.

[0033] 2. Verifiable Secret Sharing Scheme (VSS):

[0034] (a) Definitions:

[0035] (i) Suppose we have a dealer and a group with n users.

[0036] (ii) Let t be threshold value,

[0037] (iii) q a prime integer, Fqa finite field and g its primitive element.

[0038] (b) The dealer distributes a secret value as follows.

[0039] (i) Selects a polynomial with a degree (t-1):

[0040] With and a0shared secret values that are different from each other and from zero

[0041] (ii) Calculates a commitment set from the coefficients of the f(x) polynomial:

[0042] (iii) Sends f(i) and COM binary to the

[0043] (b) After receiving their shares, the users confirm with the g equation whether the shares they receive are consistent with the secret value distributed and their own identities. If equality is achieved, the correct share has been sent to the correct user.

[0044] (c) If any t or more users add their user shares, they can correctly construct the polynomial f(x) by Lagrange interpolation. So f(0) gives the shared secret. In the vASM scheme, only the sharing and commitment phases of the VSS are used, and the secret reconstruction phase is not used. 3. BLS Signing Scheme:

[0045] Definitions:

[0046] (i) Gxand G2are cyclic additive groups with a prime number of elements (q), and GTis a cyclic multiplicative group with the same number of elements,

[0047] (ii) (gi, g2) pair is the generators of the group pair of (G1;G2)

[0048] (iii) e: GxX G2-> GT, is an active, indestructible, and binary linear reference defined in groups (G1;G2, GT),

[0049] (iv) H:{0,l }*-> a function that sends Gxbinary strings of arbitrary length to group Gx

[0050] The BLS signature scheme consists of three phases.

[0051] (a) Key generation phase:

[0052] (i) A secret key (sk) is randomly selected from the set of integers.

[0053] (ii) The public key (pk) is calculated as: pk = g2sk

[0054] (b) Signature generation phase: Let m be the message to be signed. Signature is calculated as a = H(m)sk.

[0055] (c) Verification phase: If and only if the equation e(H(m), pk) = e(CT, g2) is satisfied, a signature is considered as valid.

[0056] 4. MSP Multi-Signature Scheme:

[0057] Definitions: group, (vi) function that sends the Z arbitrary length binary strings to the integer set,

[0058] (vii) Group is the user group of n potential signers,

[0059] (viii) The public key set of the users in the

[0060] (ix) The party called "combiner" can be any user from group Q, or it can also be a party specially assigned to combine signatures.

[0061] The MSP signature scheme consists of five phases.

[0062] (a) Key generation phase: user i calculates their secret and public keys as follows:

[0063] (i) A secret key (ski) is randomly selected from the set of integers.

[0064] (ii) The public key (pki) is calculated as:

[0065] (b) Key collection phase: user i calculates their aggregated public key as follows:

[0066] (c) Signature generation phase: m is the message to be signed. Signature is calculated as s, =

[0067] (d) Signature collection phase: After the combiner receives the individual signatures it receives; it calculates the multi- signature of group Q-.

[0068] (e) Verification phase: If and only if the equation e(H0(apk, m), apk) = e(o, g2) is satisfied, a signature is considered as valid.

[0069] A. Accountable Subgroup Multi-Signature Scheme with Verifiable Group Setup: vASM

[0070] Definitions:

[0071] (a) G1and G2are cyclic additive groups with a prime number of elements (q), and GTis a cyclic multiplicative group with the same number of elements, (b) (gi, g2) pair are the generators of the group pair of (G1;G2)

[0072] (c) e: . active, indestructible, and binary linear reference defined in groups

[0073] (d) par: = {G1(G2, GT, g1(g2, e, q] is a public parameter set,

[0074] (e) Ho:{O,l }*-> a function that sends Gxarbitrary length binary strings to group G15

[0075] (f) Group £ is a user group of n potential signers,

[0076] (g) 5 is a subgroup of group Q composed of signers.

[0077] (h) The party called "Combiner" can be any user from group Q, or it can also be a party specially assigned to combine signatures.

[0078] 1. Key generation phase: Each user i generates their own secret and public key as follows.

[0079] (A) Randomly chooses a secret key (ski) from a set of integers.

[0080] (B) Calculates the public key (pki):

[0081] 2. Group setup phase: Each user i creates their group commitment set and their own membership key by following the steps below. (See Figure -1)

[0082] (a) With degree (n-1), and coefficients different from each other and from zero, q bchoses a polynomial as such:

[0083] (b) f®(x) calculates a commitment set from the coefficients of the polynomial:

[0084] (c) Sends the f ® (j) and COM® binary to

[0085] (d) After taking the binaries f®(i) and COM® for j = 1, calculates its own membership key (mkj) and the commitment set (COM) of the group:

[0086] (e) Checks the following equations:

[0087] (f) If at least one of the above equations is not satisfied, the group finishes the setup, if both are satisfied, the group's commitment set COM is published.

[0088] 3. Signature generation phase: Let m be the message to be signed. The individual signature of the user i is calculated and sent to the combiner:

[0089] 4. Signature combining phase: After receiving the individual signatures, combiner first creates the signers subgroup Then calculates the aggregated subgroup multi-signature:

[0090] 5. Verification phase: Any verifier given {par, COM, S, m, o} can verify the signature by checking:

[0091] B. Accountable Subgroup Multi-Signature Scheme with Subgroup Authentication: ASMwSA

[0092] Definitions: (i) The public key set of the users in the Q group is

[0093] (j) 5 is a subgroup of the Q group composed of signers.

[0094] (k) The party called "combiner" can be any user from group Q, or it can also be a party specially assigned to combine signatures.

[0095] (l) Subgroup 5 of signers is known to the signers before the signing process begins.

[0096] 1. Key generation phase: Each user i generates their own secret and public key as follows.

[0097] (a) Randomly chooses a secret key (ski) from a set of integers.

[0098] (b) Calculates the public key

[0099] 2. Group setup phase: Each user i calculates and saves;

[0100] 3. Signature generation phase: Let m be the message to be signed, user i calculates;

[0101] (a) the subgroup membership key

[0102] (b) individual signatures and sends them to the combiner.

[0103] 4. Signature combining phase: After receiving the individual signatures combiner calculates the accountable subgroup multi-signature and the subgroup public key spk =

[0104] 5. Verification phase: Any verifier given {par, apk, spk, S, m, o} can verify the signature by checking: C. Accountable Subgroup Multi-Signature Scheme with Combiner Authentication:

[0105] ASMwCA

[0106] Definitions:

[0107] 1. Key generation phase: Each user i generates their own secret and public key as follows.

[0108] (A) Randomly chooses a secret key (ski) from a set of integers.

[0109] (B) Calculates the public key

[0110] 2. Group setup phase: Each user i;

[0111] 1, ••• , n and j and sends them to the combiner. (See Figure -2)

[0112] 3. Signature generation phase: m is the message to be signed. User i calculates their individual signature and sends it to the combiner. 4. Signature combining phase: After receiving the individual signatures combiner first creates a signers subgroup Then, calculates the combined accountable subgroup multisignatures and subgroup public key

[0113] 5. Verification phase: Any verifier given {par, apk, spk, S, m, o'} can verify the signature by checking:

[0114] As explained above, with vASM, ASMwSA and ASMwCA, the signing and verification phases that require less group operation are introduced. In computer technologies, depending on the architecture of the processor, the calculation of some mathematical operations requires more time and energy than the simple four operations. For example, 1 in the additive group of points on an elliptic curve is equivalent to addition, 2 is equivalent to modular multiplication, 2 is equivalent to modular addition and one is equivalent to modular inversion. Therefore, this process savings, which the inventors realize during the signature scheme phases, saves users time and energy.

[0115] Based on the detailed explanation above, said invention is a method characterized in that it comprises the following steps;

[0116] • In the key generation phase, a secret and public key pair is generated based on DLP (discrete logarithm problem).

[0117] • During the group setup phase, with the participation of all users in group Q, membership keys or membership key components are calculated to be used in signature generation (unlike ASM schemes in the literature) in a way that will keep the pairing process to a minimum in the verification phase. When these membership keys are used during the signature generation phase, they indicate to the verifiers that said message is signed on behalf of group Q and that non- signing users have authorized the signers to do so through group setup. During the signature production phase, individual signatures are computed by users in subgroup 5 and sent to the combiner.

[0118] • In the signature combining phase, the accountable subgroup multi-signature of subgroup 5 is calculated by combining the individual signatures received at the combiner and the membership key components that need to be added, if any.

[0119] • In the validation phase, it is verified whether the message is jointly signed by the members of the given subgroup by any verifier who is given public parameters, message, signature, and subgroup information.

[0120] The schemes mentioned in the method are Accountable Subgroup Multi-Signature Scheme with Verifiable Group Setup (vASM), Accountable Subgroup Multi-signature Scheme with Subgroup Authentication (ASMwSA), Accountable Subgroup Multi-signature Scheme (ASMwCA) with Combiner Authentication.

[0121] The working method of the vASM scheme, characterized in that;

[0122] 1. Key generation phase: A secret and public key pair is generated based on DLP (discrete logarithm problem).

[0123] 2. Group setup phase: The secret keys produced during the key generation phase from each user party in group Q are shared with other users (including themselves) in group Q through the verifiable secret sharing scheme. The commitment set of group Q is created by combining the individual commitment sets from each user party and the consistency checks of the secret shares are made. If the zero number element of the commitment set of group Q is equal to the multiplication of the public keys of all users in the group and the consistency control of the secret sharing scheme is ensured, a membership key is generated for group Q by summing the shares and published as the commitment set public parameter of group Q. If both of the mentioned controls are not provided, the protocol is canceled, and the group setup is terminated. (See Figure -1) 3. Signature generation phase: The summary of the m message is signed with the membership key generated during the group setup phase, individual signatures are generated and sent to the combiner.

[0124] 4. Signature combining phase: Based on the individual signatures received at the combiner, signers subgroup 5 £ g is first created. Then, the individual signatures are combined to calculate the accountable subgroup multi-signature of subgroup 5.

[0125] 5. Verification phase: By any verifier who is given public parameters, message, accountable subgroup multi-signature, group commitment set, and subgroup information, it is verified whether the message is jointly signed by the given subgroup members.

[0126] The working method of the ASMwSA scheme, characterized in that;

[0127] 1. Key generation phase: A secret and public key pair is generated based on DLP (discrete logarithm problem).

[0128] 2. Group setup phase: First, unique user-specific identifier value is computed for each user in group g by adding the set of public keys generated during the key generation phase to the set of public keys of all users in the group and summarizing them. Then, with the help of these identifier values, the public keys of all users are combined, and the combined public key of the group is created. Then, for each user in group g, the combined public key and the user index to be authorized are combined and summarized. The summary obtained by using the secret key produced in the key generation phase with the user-specific and unique identifier value calculated in advance is signed with the MSP scheme. Membership key components calculated in this way are saved separately for each user.

[0129] 3. Signature generation phase: First, a subgroup membership key is generated for the users in subgroup 5 who will join the subgroup multi-signature by summing the membership key components computed and stored during the group setup phase. Then, the summary of the m message is signed with the secret key generated during the key generation phase and the unique user-specific identifier value, and the individual signatures generates by combining the subgroup membership key are sent to the combiner. 4. Signature combining phase: By combining the individual signatures received by the combiner and accountable subgroup multi-signature and the combination of the public keys of users in subgroup 5 via unique identifier values unique to the respective users, the combined key of subgroup 5 is generated.

[0130] 5. Verification phase: Any verifier who is given public parameters, the combined public key of the group, the combined public key of the subgroup, the message, the accountable subgroup multi-signature, and the subgroup information, verifies whether the message is jointly signed by the members of the given subgroup.

[0131] The working method of the ASMwCA scheme, characterized in that;

[0132] 1. Key generation phase: A secret and public key pair is generated based on DLP (discrete logarithm problem).

[0133] 2. Group setup phase: First, a specific and unique identifier is computed by each user in group g by summarizing the public keys generated during the key generation phase by adding the set of public keys of all users in the group. Then, with the help of these identifier values, the public keys of all users are combined to form the combined public key of the group. Then, for each user in group Q, the combined public key and the user index to be authorized are combined and summarized. The summary obtained by using the pre-calculated user-specific and unique identifier value and the secret key generated during the key generation phase is signed with the MSP scheme. Of the membership key components calculated in this way, the components calculated by the users for themselves are saved. The components calculated for other users are sent to the combiner. (See Figure -2)

[0134] 3. Signature generation phase: The summary of the m message is signed by each user with the secret key generated during the key generation phase and the unique user- specific identifier value, and the individual signatures are combined with the membership key component calculated and stored for themselves and sent to the combiner.

[0135] 4. Signature combining phase: Based on the individual signatures received from the associative party, the signers subgroup 5 £ g is first created. Then, by combining the individual signatures of the users in subgroup 5 with the relevant ones from the membership key components sent to the combiner during the group setup phase, and by combining the accountable subgroup multi-signature of subgroup 5 and the public keys of the users in subgroup 5 via unique user-specific identifier values, the combined public key of subgroup 5 is generated.

[0136] 5. Verification phase: Any verifier who given public parameters, the combined public key of the group, the combined public key of the subgroup, the message, the accountable subgroup multi-signature, and the subgroup information, verifies whether the message is jointly signed by the members of the given subgroup.

[0137] REFERENCES

[0138] *Dan Boneh, Manu Drijvers, and Gregory Neven. Compact multi-signatures for smaller blockchains. In Thomas Peyrin and Steven Galbraith, editors, Advances in Cryptology - ASIACRYPT 2018, pages 435-464, Cham, 2018. Springer International Publishing

Claims

CLAIMS 1. A method comprising pairing-based accountable subgroup multi-signature schemes, characterized in that it comprises the following steps;• In the key generation phase, generating a secret and public key pair based on the discrete logarithm problem (DLP),• During the group setup phase, with the participation of all users in group Q, the calculation of membership keys or membership key components that, when used in the signature generation phase, indicate to the verifiers that said message is signed on behalf of the group Q and that the non- signing users have authorized the signers to do so through group setup in a way that minimizes the number of pairing processes to be performed during the verification phase,• Calculation of individual signatures by users in subgroup Q and sending them to the combiner in the signature production phase,• Calculation of the accountable subgroup multi-signature of subgroup 5 by combining the individual signatures received at the combiner and the membership key components, if any, that need to be added in the signature pairing phase,• Verification of whether the message is jointly signed by the members of the given subgroup by any verifier who is given the public parameters, message, signature and subgroup information in the verification phase.

2. A method according to Claim 1, characterized in that said schemes are Accountable Subgroup Multi-Signature Scheme with Verifiable Group Setup (vASM), Accountable Subgroup Multi-Signature Scheme with Subgroup Authentication (ASMwSA), Accountable Subgroup Multi-Signature Scheme (ASMwCA) with Combiner Authentication.

3. A method according to Claim 2, characterized in that the working method of said Accountable Subgroup Multi-Signature Scheme (vASM) with Verifiable Group Setup comprises the steps of;• In the key generation phase: Generation of a secret and public key pair based on the discrete logarithm problem (DLP),• In the group setup phase; Sharing the secret keys produced during the key generation phase by each user in group g through the verifiable secret sharing scheme to other users in group Q, including themselves, creating the commitment set of group Q by combining the individual commitment sets received by each user party and checking the consistency of the secret shares, if the zero numbered element of the commitment set of group Q is equal to the multiplication of the public keys of all users in the group and the consistency control of the secret sharing scheme is ensured, creating a membership key for the Q group by adding the shares and publishing the commitment set of group Q as a public parameter, if both of the mentioned controls are not provided, cancelling the group and terminating the group setup,• In the signature generation phase: Creating individual signatures by signing the summary of the m message with the membership key generated during the group setup phase and sending it the same to the combiner,• In the signature combining phase; Creating first a subgroup 5 £ gof signers based on individual signatures received by the combiner, then, calculating the accountable subgroup multi-signature of subgroup 5 by combining the individual signatures,• Verification phase: Verifying whether the message has been jointly signed by the given subgroup members by any verifier who has been given the public parameters, message, accountable subgroup multi-signature, group commitment set and subgroup information.

4. A method according to Claim 2, characterized in that the working method of said Accountable Subgroup Multi-Signature Scheme (ASMwSA) with Subgroup Authentication comprises the steps of;• In the key generation stage: Generating a secret and public key pair based on the discrete logarithm problem (DLP) in the key generation phase,,• In the group setup phase: Calculating a user-specific and unique identifier value by first adding the set of public keys generated by each user in g group, during the key generation phase to the set of public keys of all users in the group and summarizing them, then, with the help of these identifier values, combining the public keys of all users to create the combined public key of the group, thensummarizing the combined public key for each user in group Q and the user index to be authorized, signing the digest obtained by using the pre-calculated user-specific and unique identifier value and the secret key generated during the key generation phase with the MSP (Multi-Signature Protocol) scheme, recording the membership key components calculated in this way separately for each user,• In the signature generation phase: Generating first a subgroup membership key by collecting the membership key components calculated and saved during the group setup phase for the users in subgroup 5 who will join the subgroup multi-signature, then signing the summary of message m with the secret key and unique user-specific identifier value created during the key generation phase, and sending individual signatures generated by combining the subgroup membership key to the combiner,• In the signature combining phase: Creating the combined public key of subgroup 5 by combining the individual signatures received by the combiner to form an accountable subgroup multi- signature and by combining the public keys of the users in subgroup 5 via the unique identifier values unique to the relevant users,• In the verification phase: Verifying whether the message is jointly signed by the members of the given subgroup from any verifier who is given the public parameters, the combined public key of the group, the combined public key of the subgroup, the message, the accountable subgroup multi-signature, and the subgroup information.

5. A method according to Claim 2, characterized in that; the working method of said Accountable Subgroup Multi- signature Scheme (ASMwCA) with Combiner Authentication comprises the steps of;• In the key generation stage: Generating a secret and public key pair based on the discrete logarithm problem (DLP),• In the group setup phase: Calculating a user-specific and unique identifier value by first adding the set of public keys generated by each user in group Q during the key generation phase to the set of public keys of all users in the group and summarizing them, then with the help of these identifier values, combining thepublic keys of all users to form the combined public key of the group, then summarizing by combining the combined public key for each user in group g with the user index to be authorized, signing the summary obtained by using the precalculated user-specific and unique identifier value and the secret key generated during the key generation phase with the MSP scheme, saving the membership key components calculated in this way for the users themselves, and sending the components calculated for other users to the combiner,• In the signature generation phase: Signing the summary of message m by each user with the secret key generated during the key generation phase and the unique user-specific identifier value, and sending the individual signatures generated by combining them with the membership key component that it calculates and saves for itself to the combiner,• In the signature combining phase: First, creating the signers subgroup 5 £ g based on the individual signatures received by the combiner, then generating the combined public key of subgroup 5 by combining the individual signatures of users in subgroup 5 with the relevant membership key components sent to the combiner during the group setup phase, also by combining the accountable subgroup multisignature of subgroup 5 and the public keys of users in subgroup 5 subgroup via unique identifier values unique to the respective users.• In the verification phase: Verifying whether the message is jointly signed by the members of the given subgroup by any verifier who is given the public parameters, the combined public key of the group, the combined public key of the subgroup, the message, the accountable subgroup multi-signature, and the subgroup information.

Images