On Efficiency and Usability of Group Signatures on Smartphone and Single-board Platforms

On Efficiency and Usability of Group Signatures on Smartphone and Single-board Platforms Patrik Dobias [email protected] Brno University of Technology Czech Republic Lukas Malina [email protected] Brno University of Technology Czech Republic Petr Ilgner [email protected] Brno University of Technology Czech Republic Petr Dzurenda [email protected] Brno University of Technology Czech Republic ABSTRACT With increasing digitalization and omnipresent data sensing, security and users’ privacy become essential requirements in new digital services. Group Signatures (GS) or also known as Anonymous Digital Signatures (ADS) are often used as a core Privacy-Enhancing Technology (PET) in order to keep users’ privacy during their access and/or authentication phases within ensuring the security of provided services. In this work, we provide a comprehensive assessment of group signatures on various small computing platforms typically used in modern digital services. Based on our analysis of well-established GS schemes and their libraries, we implement and evaluate chosen schemes on both well-known smartphone platforms (i.e., Android, iOS) and on a single-board computer. Our results indicate that current handheld devices can already effectively perform main group signatures’ phases and make these schemes practical for deployment in various privacy-requiring scenarios. CCS CONCEPTS •Security and privacy → Authentication;Privacy-preserving protocols;Access control;Pseudonymity, anonymity and untraceability. KEYWORDS Access control, Anonymous Digital Signature, Applied Cryptography, Authentication, Benchmarks, Group Signature, Privacy, Security ACM Reference Format: Patrik Dobias, Lukas Malina, Petr Ilgner, and Petr Dzurenda. 2023. On Efficiency and Usability of Group Signatures on Smartphone and Single-board Platforms. In The 18th International Conference on Availability, Reliability and Security (ARES 2023), August 29–September 01, 2023, Benevento, Italy. ACM, New York, NY, USA, 9 pages. https://doi.org/10.1145/3600160.3605015 This work is licensed under a Creative Commons Attribution International 4.0 License. ARES 2023, August 29–September 01, 2023, Benevento, Italy ©2023 Copyright held by the owner/author(s). ACM ISBN 979-8-4007-0772-8/23/08. https://doi.org/10.1145/3600160.3605015 1 INTRODUCTION Emerging smart technologies and omnipresent connectivity expand and improve many digital services that serve in smart cities, e-healthcare, smart grid, or smart transport. Nowadays, the Internet of Things (IoT) paradigm is slowly being absorbed by the Internet of Everything (IoE) and transformed into Intelligent Infrastructures (II). II systems are quite complex and contain a network of end devices with applications that usually forward and aggregate data into central servers and/or clouds with advanced data processing functionalities. On the one hand, these smart services could significantly help society and end users simplify their daily lives. On the other hand, invasive central authentication approaches, monitoring, and sensing data from users may open significant privacy risks. Nowadays, smartphones with applications often represent a smart service on the user side. Therefore, smartphones are the main interface between digital services and humans. Several regulations such as General Data Protection Regulation (GDPR) improve security and privacy and indirectly require that applications should ensure a certain level of privacy protection. Privacy can be protected by common cryptography, security, and system approaches. Sometimes these approaches are called as Privacy-Enhancing Technologies (PETs). Group Signatures (GS) are important and popular PETs that can be deployed in various scenarios where users require anonymity and a system requires data authenticity, integrity, and non-repudiation. The user can anonymously sign on behalf of a group. Such an anonymous user signs a message and can broadcast it to other users or just send the message to a system. Other users or the system then need only one public key (a group key) for the verification of the group signature. For the first time, group signatures were proposed by Chaum [ 9 ] in 1991. Since then, group signatures have been studied in many research works, from wellestablished GS schemes, e.g., [ 4 , 6 , 12 , 21 , 24 , 28 , 30 ] to optimized GS schemes suitable for resource-constrained devices used in IoT, e.g., [ 13 , 16 – 18 , 42 ]. Several GS schemes have been also standardized as Anonymous Digital Signature (ADS) by the standard ISO/IEC 20008-2:2013 [1]. In this work, we investigate how group signatures could be practical for applications deploying users’ handheld/small devices (i.e., smartphones, embedded devices, and single-board computers) and assess their performance on these devices. ARES 2023, August 29–September 01, 2023, Benevento, Italy Dobias et al. 1.1 Related work There are several works that deal with practical implementations and the performance assessment of group signatures on mobile devices and smartphones. The first implementation experiences during implementing and evaluating group signatures schemes on Android-based mobiles were published by Manolopoulos et al. [ 35 ] in 2011 and later by Potzmader et al. [ 39 ] in 2013. Manolopoulos et al. [ 35 ] implemented the group signature scheme proposed by Boneh, Boyen, and Shacham from 2004 (BBS04) [4] by using the Java Pairing-Based Cryptography Library (jPBC) [ 11 ] on smartphones. The performance results of the BBS04 sign and verification phases take from 4 to 15 seconds on phones with 1 GHz and 600 MHz CPUs. Potzmader et al. [ 39 ] examined three anonymous digital signature schemes included in ISO/IEC 20008-2:2013 [1] on mobile devices. In 2014, Liu et al. [ 32 ] wrapped a C-based Pairing-Based Cryptography (PBC) library (developed by Ben Lynn 1 ) into Java for the Android platform version 2.3 and higher. This Android PBC library enables researchers and developers to simply deploy pairing-based cryptography schemes on Android devices. Based on that work, the usability of pairing-based cryptography on smartphones and wearable devices was further studied in several works [ 3 , 27 , 34 , 36 , 41 ]. For example, Isern-Deya et al. [ 27 ] presented their implementation of the pairing-based BBS group signature scheme with various types of pairing-friendly elliptic curves. They measured elapsed times of sign/verify phases with different pairing types from 4 to 146 seconds on the HTC Desire smartphone with a 1 GHz CPU. In 2015, Diaz et al. [ 14 ] released an open-source library for group signatures, called libgroupsig 2 . The library implemented three different GS schemes within the ISO/IEC 20008 standard but was designed to be simply deployed by new GS schemes. Currently, the library offers 8 GS schemes 3 . In 2018, Malina et al. [ 33 ] studied the usability of group signature schemes on smartphones. They implemented seven GS schemes on smartphones and PCs, provided the performance results, and evaluated some optimization tricks. The results indicate that pairing-based GS schemes required units to tens of seconds on smartphones (using Nexus 4x 2.26 GHz) with Android versions 4.2 and 5.1. Recently, group signatures have been used in various privacypreserving solutions with smartphone devices. For instance, Groza et al. [ 22 ] preserved the anonymity of users by GS in access to vehicle on-board units. They implemented the group signature scheme BBS04 [ 4 ] and measured this on mobile platforms. Their implementation of BBS04 takes 24 ms for signing and 33 ms for verification on Samsung S7. Other tested devices had slower times (hundreds ms). In this work, we provide an updated overview and practical evaluation of GS on current smartphones and on a small singleboard computer. In our work, we focus on both main platforms, i.e., Android and iOS. We present the performance assessment of selected well-known GS on these platforms in order to show their current efficiency and how these schemes could be efficiently used in privacy-enhancing services. 1https://crypto.stanford.edu/pbc/ 2https://github.com/IBM/libgroupsig 3https://github.com/IBM/libgroupsig/wiki/Supported-schemes 1.2 Contributions and Paper Organization This work focuses on a practical deployment of group signatures on small and handheld computing platforms. We deal with three basic research questions in this work. Question 1: What is the current state of libraries providing group signature schemes on various computing platforms? Question 2: What is their performance on these platforms? Question 3: Are these implementations practical for privacy-preserving use cases requiring real-time processing (up to 300 ms)? Question 1) is studied in Section 2 where we map existing GS implementations and libraries that can be also run on smartphones. Then, we introduce the setup of our experimental implementation in Section 3. Section 4 presents results of GS that are related to Q2. Section 5 discusses how GS could be used in practical use cases where smartphones and single boards are deployed (Q3). Then, we conclude this work with a future research discussion in Section 6. 2 PRELIMINARIES This section introduces the main features of group signatures and presents a basic overview of existing group signatures with their practical implementations and libraries. 2.1 Group Signatures In this subsection, we introduce a general model, basic phases, and properties of group signatures. Further, we present a basic comparison of well-known group signatures. A typical model of a GS scheme employs usually the following entities: • Group Manager (GM) - a semi-trusted party that adds users to a group. GM also generates initial secret parameters, and public scheme parameters including a group public key 𝑔𝑝𝑘 , and often issues the secret keys of group members (users). • Revocation Manager (RM) - a trusted party that can disclose or revoke the identity of a dishonest member/user. If someone breaks the rules, RM (often in cooperation with GM) can trace the identity of the signer by a revocation phase. GM or RM can use the group manager’s secret key to reveal the user identity that is mapped in the signature and in the manager database of members. • User - a group member with the group member secret key 𝑔𝑚𝑠𝑘 can sign a message on behalf of the group. Users can also verify incoming signatures by the group public key 𝑔𝑝𝑘 . In this study, we assume that the users use their own handheld devices such as smartphones or wearables. • Verifier - a party that verifies signatures using the group public key 𝑔𝑝𝑘 . In this study, we assume that the verifier can use a handheld device, embedded PC, constrained platform, or be a server in a service backend. The GS entities usually engage in the following phases: • Setup - setting the security level, cryptographic parameters, and their distribution in the system. • Join - new members (users) are added to the existing system. Users get parameters, group secret member keys, and one group public key from GM. On Efficiency and Usability of Group Signatures on Smartphone and Single-board Platforms ARES 2023, August 29–September 01, 2023, Benevento, Italy Group of users Anonymous signer Verifier with group public key Group manager User device Signing + Verification Join Setup / Revocation Revocation manager Figure 1: Principle of group signatures. • Signing - a group member signs the message by using his/her group secret member key, and sends the message and signature to a verifier. • Verification - a verifier receives the message with the signature and verifies it by one group public key. • Revocation - users can be revoked after leaving the group (e.g., via blacklist) or by breaking system rules (which leads to the revocation of the user’s anonymity and thus his/her identification). The principle of group signatures is depicted in Figure 1. GS schemes usually offer the following basic security and privacy properties: • Anonymity - a verifier is not able to determine the identity of a user from a signed message. • Data authenticity and integrity - signed data cannot be modified without recomputing the signature by an adversary. • Correctness (soundness and completeness) - every correct signature produced by a valid user has to be always accepted, and every incorrect signature has to be always rejected during the verification phase. • Unforgeability - only a valid user is able to create a valid signature on behalf of the group. • Traceability - the group manager should be able to trace which group member issued signed messages. • Unlinkability - a verifier and other users are not able to link two signatures that are signed by a single member of the group. • Revocation - a revoked user is not able to create valid signatures on behalf of the group. Some properties can be adapted to certain services and use cases. For example, the user revocation can be enhanced by opening the signature and tracing the ID of a signer who breaks the rules. Further, some newer GS schemes such as [ 15 ] improve privacy by adding a user-centric control of linkage of their signatures. Nevertheless, it is out of the scope of this work to describe all possible GS properties. Advanced properties and trends in GS constructions have been described by some recent studies, e.g., [37, 40]. Table 1 summarizes the basic parameters of selected group signature schemes. Note that schemes usually provide different properties and revocation strategies. Therefore, the comparison only demonstrates certain evolution in group signature schemes and gives an overview of schemes’ computational and memory aspects. Pairing-based schemes indicate by G1 , G2 , G𝑇 , Z𝑝 different groups with the following bit lengths |G1| = 175 b, |G2| = 175 b, and |G𝑇| = 1050 b which is computed by 𝑘· |G1| ( 𝑘 is an embedded degree, e.g., 𝑘 = 6). |Z𝑝| = 170 b denotes the size of the field for used pairingfriendly elliptic curves. In GS without pairing operations, |G∗ 𝑛| = 1024 b denotes a multiplicative group (RSA) with an exponent size |Z𝑞| = 160 b. The revocation mechanism based on a secret key is denoted as 𝑠𝑘 , based on credential as 𝑐𝑟𝑒𝑑 , and based on a revocation list (black/white list) as 𝑟𝑙. 2.2 Group Signature Implementations and Libraries Group signatures have been usually implemented and published by original authors or by developers that were interested in using group signatures in more complex systems requiring their privacy properties. Table 2 lists well-known implementations and libraries of group signature schemes. The most updated library is the libgroupsig library [ 14 ] which provides 8 GS schemes and several wrappers. Other libraries do not provide a wide range of schemes and focus usually on one or two schemes. The most popular scheme is the well-known BBS04 scheme [ 5 ]. Most libraries target to classic PC platforms. Nevertheless, a few libraries with group signatures can be also wrapped and extended for smartphone platforms, e.g., libgroupsig. More details about our modifications of libraries on smartphone platforms can be found in Sections 3 and 4. 2.3 Group Signature Optimization Techniques As Table 1 and related work analysis show, group signatures can often require many computationally heavy operations (e.g., bilinear pairings and exponentiation) during the signing and verify phases that run on users’ or verifier’s devices. As these devices are usually more constrained in memory and performance than more powerful servers, some optimization tricks which are reducing the number of operations have been proposed in the literature, e.g. [ 19 , 34 ]. Especially, pairing-based schemes were often optimized by using a pairing collapsing trick or precomputing heavy operations in advance. Note that precomputing works only with operations with static input values. The pairing collapsing usually reduces more pairing operations into one by multiplication of inputs inside the pairing operation, see an example in the following Equation 1: 𝑒(𝑇3,𝐺2)𝑠𝑥·𝑒(𝑇3,𝑊 )𝑐=𝑒(𝑇3,𝑠𝑥𝐺2+𝑐𝑊 ),(1) where 𝑇3,𝐺2,𝑊 are elliptic curve points, 𝑠𝑥,𝑐 are scalars, and 𝑒(·,·) defines function of bilinear pairing. The third optimization technique called batch verification is deployed only in the verify phase when a verifier checks more ARES 2023, August 29–September 01, 2023, Benevento, Italy Dobias et al. Table 1: Comparison of selected group signature schemes. Scheme Signing Verify Signature size PK Size Pairing Assumption Rev. BBS04 [4] 9𝐸G1+3𝐸G𝑇 1 /𝑒 +8 𝐸G1 + 2𝐸G2+3𝐸G𝑇 3 G1 +6 Z𝑝 (1545 b) 4 G1 +2 G2 (1050 b) ✓ q-SDH, DLIN, ECDL 𝑠𝑘 DP06 [12] 8𝐸G1+3𝐸G𝑇 1 /𝑒 +7 𝐸G1 + 2𝐸G2+3𝐸G𝑇 4 G1 +5 Z𝑝 (1559 b) 4 G1 +2 G2 (1050 b) ✓ q-SDH, XDH, DLIN, ECDL 𝑠𝑘 HLCCN11 [24] 7𝐸G1+5𝐸G𝑇 1 /𝑒 +5 𝐸G1 + 2𝐸G2+4𝐸G𝑇 3 G1 +5 Z𝑝 (5600 b) 6 G1 +2 G2 (1400 b) ✓ q-SDH, XDH, DLIN, ECDL 𝑠𝑘 ACJT00 [2] 12𝐸G∗ 𝑛10𝐸G∗ 𝑛 7 G∗ 𝑛 +1 Z𝑞 (7328 b) 6G∗ 𝑛(6144 b) ✗ SRSA, DDH, DL 𝑐𝑟𝑒𝑑,𝑟𝑙 CG05 [7] 10𝐸G∗ 𝑛10𝐸G∗ 𝑛 8 G∗ 𝑛 +1 Z𝑞 (8352 b) 7 G∗ 𝑛 +1 Z𝑞 (7328 b) ✗ SRSA, DDH, DL 𝑐𝑟𝑒𝑑,𝑟𝑙 IMSTY06 [28] 7𝐸G∗ 𝑛+8𝐸G17𝐸G∗ 𝑛+8𝐸G1 5 G∗ 𝑛 +5 Z𝑝 +1 Z𝑞 (6155 b) 7 G∗ 𝑛 +4 Z𝑝 (7848 b) ✗ SRSA, DH, ECDL 𝑐𝑟𝑒𝑑 HMGS13 [23] 9𝐸G∗ 𝑛10𝐸G∗ 𝑛 7 G∗ 𝑛 +1 Z𝑞 (7328 b) 5G∗ 𝑛(5120 b) ✗DL, IF 𝑟𝑙 PS16 [38] 2𝐸G1+ 1𝐸G𝑇3/𝑒+1𝐸G1+ 1𝐸G𝑇 2 G1 +2 Z𝑝 (690 b) 3G2(525 b) ✓DDH, LRSW 𝑠𝑘 GL19 [20] 16𝐸G1+ 15𝐸Z𝑛2 2 /𝑒 + 12 𝐸G1 + 11𝐸Z𝑛2 3 G1 +6 Z𝑝 +1H + 6Z∗ 𝑛2(7945 b) 1 G1 +1 G2 + parameters ✓ DL, DDH, qSDH 𝑠𝑘 KLAP20 [29] 4𝐸G13/𝑒+ 2𝐸G1 3 G1 +2 Z𝑝 + (1280 b) 3 G1 +1 Z𝑝 (695 b) ✓ SDL, XDH, GPS 𝑠𝑘 DL21 [15] 14𝐸G12/𝑒+9𝐸G1 4 G1 +5 Z𝑝 +1H (1806 b) 1G1(175 b) ✓ DL, DDH, qSDH 𝑠𝑘 Note: 𝐸G1– EC scalar multiplication in G1, or 𝐸G2and 𝐸G𝑇,/𝑒– bilinear pairing, 𝑠𝑘 – private key of group member, 𝑐𝑟𝑒𝑑 – credential, 𝑟𝑙 – revocation list. Table 2: Selected libraries of group signature schemes. Name GS supported Platforms/languages Website libgroupsig DL21, DL21SEQ, KLAP20, GL19, PS16, BBS04,CPY06, KTY04 C library with wrappers for Java, Node.js, Python https://github.com/IBM/libgroupsig The Groupsig library DAR15[14], CPY06[10] JAVA https://cryptimeleon.org/docs/groupsig.html Group-Signature-CL-Scheme CL04[8] C++/C https://github.com/Bohdat/Group-Signature-CL-Scheme FISCO BCOS group sig. lib BBS04[5], LSAG ring sig.[31] C++ https://github.com/FISCO-BCOS/group-signature-lib PBC sig Library BBS04[5] C https://crypto.stanford.edu/pbc/sig/ signatures at once. The verifier does not need to perform pairing operations per signature but can multiply all partial inputs and then finally apply only one pairing operation. See an example in the equitation 2: 𝑛 Ö 𝑖=1 𝑒(𝑎𝐺𝑖, 𝐻) → 𝑒( 𝑛 ∑︁ 𝑖=1 𝑎𝐺𝑖, 𝐻),(2) where 𝐺𝑖, 𝐻 are elliptic curve points, 𝑎 is a scalar, and 𝑒(·,·) defines function of bilinear pairing. By deploying batch verification, the verifier can usually reduce computation costs. Nevertheless, in case of invalid signatures appearing in the batch, the verification process must then sort and indicate all valid and invalid signatures. 3 EXPERIMENTAL SETUP AND IMPLEMENTATION The section briefly discusses our setup on Android, iOS, and singleboard platforms and how the libraries were run on these tested platforms. 3.1 Android Setup As an Android target device for our experiments, we used Samsung A53 (CPU Samsung Exynos 1280, 8 cores, 2 - 2.4 GHz, 6 GB RAM, Android 12) and Huawei P20 Lite (CPU Huawei Kirin 959, 4 cores at 2.36 GHz + 4 cores at 1.7 GHz, 4 GB RAM, Android 9). The second phone mentioned is an older, lower-end phone that is used to test performance and compatibility with older phones. To test the schemes, an application was created using the libgroupsig library [ 14 ], which is implemented in C. The Android Native Development Kit (NDK) v23b toolset was used to provide support on the Android platform. The Android application itself was created in Kotlin. The handing of the cryptographic layer and the forwarding of the performance measurement results is performed by a wrapper using the Java Native Interface (JNI). The experimental application was compiled using Android SDK 32 (Android 12), minimum required SDK version 28 (Android 9). 3.2 iOS Setup As an iOS target device for our experiments, we used iPhone 12 mini (CPU Apple A14 Bionic, 6 cores, max 3.1 GHz, 4 GB RAM, iOS 16.1). To test the schemes, an application was created using the Swift programming language and development environment Xcode version 14.2 and to benchmark the schemes, we used the XCTest framework. We integrated the libgroupsig [ 14 ] and group-signaturelib 4 libraries into the Xcode project using CMake with toolchains for iOS and linked them to the application. Since Swift supports integration with C, adding the bridging header was sufficient to 4https://github.com/FISCO-BCOS/group-signature-lib On Efficiency and Usability of Group Signatures on Smartphone and Single-board Platforms ARES 2023, August 29–September 01, 2023, Benevento, Italy Table 3: Parameter sizes of schemes in libgroupsig library. Scheme Signature [B] Group Key [B] Manager Key [B] Member Key [B] BBS04 373 2150 670 670 DL21 461 358 74 26 DL21SEQ 549 358 156 28 GL19 697 618 234 42 KLAP20 229 554 98 18 PS16 177 354 146 18 Table 4: Performance in CPU usage of phases of schemes in libgroupsig library on Android, iOS and ARM Cortex-A53 platforms. Device Phase/Scheme Time [ms] BBS04 DL21 DL21SEQ GL19 KLAP20 PS16 Samsung A53 5G Setup 26.31 6.42 6.44 10.46 8.91 6.18 Join 8.59 29.56 29.69 31.24 81.42 24.57 Sign 15.32 11.73 11.80 20.11 3.39 9.96 Verify 21.70 21.52 21.65 28.11 20.73 21.78 Huawei P20 Lite Setup 72.51 18.18 18.20 30.19 24.90 17.24 Join 23.61 82.35 82.41 87.29 226.18 68.83 Sign 44.14 34.08 34.14 58.87 10.01 27.54 Verify 61.32 60.68 60.65 80.31 56.83 59.65 iPhone 12 mini Setup 3.51 1.01 0.98 1.10 1.43 1.36 Join 1.21 4.34 3.55 3.61 7.78 3.07 Sign 2.54 1.65 1.71 2.53 0.74 2.24 Verify 3.09 2.90 2.90 3.40 2.16 2.76 ARM Cortex-A53 Setup 292.86 63.35 63.51 111.80 95.58 61.16 Join 98.47 342.82 343.02 362.24 962.24 285.17 Sign 178.70 136.38 136.36 235.79 40.31 115.38 Verify 254.98 251.91 251.85 331.20 240.21 252.39 make C functions visible for Swift code, which made the process straightforward. 3.3 Single-board Device Setup As a constrained device target for our experiments, we used the ARM Cortex-A53 architecture represented by Raspberry Pi Zero (1 core, 1 GHz) with the raspberrypi 6.1.24+ operating system. These devices are often used in developing IoT projects. Integrating the libgroupsig [ 14 ] and group-signature-lib libraries into this platform was straightforward, as both libraries support Linux OS, and we only had to make minor modifications to the profiling sources. Although we wanted to extend our experiments to even more constrained devices, such as ESP32 and Arduino boards, however we found that evaluating the libgroupsig [ 14 ] and group-signaturelib libraries on these devices cannot be done without performance degradation. These libraries rely on complex math operations that are specifically implemented in assembly for specific CPU architectures. Consequently, compiling them for ESP32 and Arduino platforms without rewriting these libraries was not possible. Wrapping and optimization of libraries for these platforms could be one of the future tasks. 4 EXPERIMENTAL RESULTS In this section, we describe our experimental results of two selected libraries, libgroupsig [ 14 ] and group-signature-lib, on Android, iOS, and single-board platforms. 4.1 Evaluation of libgroupsig We thoroughly tested and benchmarked all group signature schemes supported by the libgroupsig library version 1.1.0. Specifically, we evaluated the BBS04, DL21/D21SEQ, GL19, KLAP20, and PS16 schemes. These schemes use the same 384/256-bit optimal matching parameters over BN curves. We focused on measuring the duration of the Setup, Join, Sign, and Verify phases. The results of these measurements are presented in Table 4 and Figure 2. All the values are average values for 100 runs on Android and 10 runs on iOS and ARM Cortex-A53. We can see that the BBS04 scheme exhibited the longest setup phase, which was 2.5-5 times slower than the other schemes. However, it outperformed the remaining schemes in the join phase, with times 3-10 times faster. The KLAP20 scheme displayed a significant spike during the join phase compared to the other schemes but showcased the lowest times for the sign and verify phases. Comparing the computation time on the iPhone 12 mini (a higher-priced phone) to the Samsung A53 device (for KLAP20), the sign phase was more than 5 times faster, and the verify phase was more than 10 ARES 2023, August 29–September 01, 2023, Benevento, Italy Dobias et al. BBS04 DL21 DL21SEQ GL19 KLAP20 PS16 0 20 40 60 80 Scheme CPU Time [ms] Samsung A53 5G Setup Join Sign Verify BBS04 DL21 DL21SEQ GL19 KLAP20 PS16 0 50 100 150 200 Scheme CPU Time [ms] Huawei P20 Lite BBS04 DL21 DL21SEQ GL19 KLAP20 PS16 0 2 4 6 8 Scheme CPU Time [ms] iPhone 12 mini BBS04 DL21 DL21SEQ GL19 KLAP20 PS16 0 200 400 600 800 1,000 Scheme CPU Time [ms] ARM Cortex-A53 Figure 2: Comparison of processor usage for individual phases of schemes in libgroupsig library on Android, iOS and ARM Cortex-A53 platforms. times faster. Independent measurements [ 25 , 26 ] indicate that the iPhone 12 mini has a more than 2 times higher single-core CPU performance than the Samsung A53 5G. Based on these experiments, it is evident that the iOS platform exhibits better computational efficiency. However, the computing time for the different phases of the protocol is sufficient for all considered applications on both platforms. Another important aspect to consider is the size of the signatures generated and the keys used by these schemes. The corresponding values are presented in Table 3. The PS16 scheme demonstrates the lowest overall memory usage, with a signature size of 177 B, group key size of 354 B, manager key size of 146 B, and member key size of 18 B. On the other hand, the BBS04 scheme has the highest key requirements, with a group key size of 2150 B and manager/member key size of 670 B each. 4.2 Evaluation of group-signature-lib We thoroughly tested and benchmarked all parameter sets of the BBS04 scheme supported by the group-signature-lib library version 1.2.0. Each of the parameter sets represents a linear pairing described by the capital letter (e.g. A, E, ...). We focused on measuring the duration of the Setup, Join, Sign, Verify, and Open phases. The results of these measurements are presented in Table 6 and Figure 3. All the values are average values for 10 runs. We can see that the A parameter set significantly outperforms the remaining parameter sets in terms of computation time with times up to 11 ms for all phases on iOS and times ranging from On Efficiency and Usability of Group Signatures on Smartphone and Single-board Platforms ARES 2023, August 29–September 01, 2023, Benevento, Italy Table 5: BBS04 scheme signature and key sizes in the group-signature-lib library. Parameter Signature [B] Public Key [B] Private Key [B] Manager Key [B] Member Key [B] A1236 1980 88 216 504 A1 4292 7100 340 724 1780 E3284 5724 172 388 1268 F1220 5680 88 216 1344 Table 6: Performance in CPU usage of phases of BBS04 scheme in group-signature-lib library for various parameters on iOS and ARM Cortex-A53 platforms. Device Phase/Parameter Time [ms] A A1 E F iPhone 12 mini Setup 11.01 223.15 240.88 263.06 Join 2.41 57.50 27.23 45.92 Sign 8.41 153.04 77.21 42.71 Verify 7.98 174.68 84.11 62.27 Open 9.98 209.50 102.05 62.81 ARM Cortex-A53 Setup 439.17 5 443.11 6 091.51 6 729.20 Join 45.47 1 172.37 543.40 1 463.10 Sign 178.78 2 695.76 1 366.97 1 272.28 Verify 169.81 3 200.52 1 540.71 1 894.08 Open 208.06 3 816.75 1 855.77 1 918.79 A A1 E F 0 50 100 150 200 250 Parameter CPU Time [ms] iPhone 12 mini Setup Join Sign Verify Open A A1 E F 0 2,000 4,000 6,000 Parameter CPU Time [ms] ARM Cortex-A53 Figure 3: Comparison of processor usage for individual phases of BBS04 scheme in group-signature-lib library on iOS and ARM Cortex-A53 platforms. tens to hundreds of milliseconds on ARM Cortex-A53. From the remaining parameter sets the E set offers the lowest computation times during the Join phase, while the F set offers the lowest times during Sing, Verify, and Open phases. Additionally, we can see, that all the measured values are significantly higher than those presented of libgroupsig [ 14 ] presented in the previous subsection. The size of the signatures generated and the keys used by these schemes are again presented in Table 3. The A parameter set offers the overall lowest memory usage with the signature size of 1236 B, public key 1980 B, private key 1980 B, manager key 88 B, and member key 216 B. The BBS04 scheme has the highest requirements for keys, with 2150 B for group key, 670 B for both manager and member keys. 5 PRACTICAL USE CASES Group signatures can be deployed as a basic privacy-enhancing technology in various smart, IoT, and Internet of Vehicles (IoV) applications to protect the privacy and security of users while ARES 2023, August 29–September 01, 2023, Benevento, Italy Dobias et al. still ensuring the integrity of the system. Users usually use their handheld devices (smartphones, smartwatches) that compute sign phases and interact with verification devices (often realized by small single-board platforms) via standard contactless interfaces such as Bluetooth, Near field communication (NFC), or showing/scanning Quick Response (QR) codes. Note that real-time applications usually require less than 300 ms for all processing (signing + verification + communication). Examples of applications, where users use their smartphones/wearables to compute or verify GS, are as follows: • Privacy-preserving access control to shared vehicles - GS can be used to allow only authorized users to anonymously access shared vehicles (e.g., car or bike). Users usually use their smartphones for the access control process based on GS. The vehicle usually contains a simple device (such as single-board computer) that can verify the user’s possession of valid access (i.e., a group signature created by the user’s secret key). Sometimes, the verification can be processed in a back-end server but this scenario would have its own limitations during an offline state. • Privacy-preserving access control to public shared devices/items - users could anonymously access shared devices such as printers, tools in the boxes, and other machines that can be activated or opened from a storing box after a valid user authorization via GS. The communication model and deployed devices are often similar to the previous scenario with shared vehicles. • Privacy-preserving access to tolls, low-emission city zones, and parking lots - GS can be used for proving the anonymous access to toll services, city low-emission zones, or parking services while ensuring that their access tokens are valid and secure after payment operations. Users may use their hand-held devices such as smartphones with running GS scheme. The service provider usually deploys embedded devices (into road-side units, gates) that verify users’ GS. • Building and office access - a user has access to his/her building/office or lab since he/she is in a group of valid employees or guests. Verifiers’ devices are usually connected to several doors’ locks that open doors after the successful verification of GS. The verifier’s device can be realized by a simple single-board device. • Private vehicle-to-x communication - in IoV applications, GS can be used to enable secure vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication. GS can be used to allow anonymous communication between vehicles on the road or during uploading data to infrastructure while still ensuring the integrity and authenticity of the messages. Currently, users mainly use their smartphones with special IoV applications that are connected to servers that centrally verify user notifications and send back to users notifications related to traffic and events on the road. In the future, we can expect that on-board units will take care of security, privacy, and V2X communication in the cars. • Secure messaging in smart city services - GS can be used to allow anonymous communication between citizens and city services for various data reporting and notifications in smart city applications (e.g., reporting damages or endorsing public services). Users can simply use their hand-held devices (smartphones, wearables) in this environment. In the city, single-board devices can establish connections with users. • Public transport - if a user has a valid pre-payed transport ticket inside his/her device then he/she can prove it by signing a challenge from a verifier. There are several smartphone applications used in urban transport. Deploying GS-based authentication can improve user privacy. • Privacy-preserving auctions/tenders - users as buyers submit bids/tenders (i.e., signed messages by a GS scheme), and if the preferred tender or highest bid is selected then a winner can be securely traced by the authority. Users can use their phones to make bids and sign them by GS. • Privacy-preserving digital voting - users should be able to cast votes anonymously. Votes are signed by GS. Smartphones can be used for signing votes. In the case of using QR/NFC communication with a verifier who verifies and collects votes, the users do not leak their identities and also other information such as their IP addresses. GS should be only set to prevent double voting. Privacy protection by using GS mainly depends on group size. If a group is relatively small, then users’ private information (e.g., position or votes) can leak to observers. On the other hand, a large group of users may have a significant impact on required performance during the verification and revocation phases. In Section 4, we show that modern smartphones are able to process GS schemes in several milliseconds. Deploying GS on such devices can be realistic also in real-time applications requiring fast reactions and less computational overhead (up to 300 ms). Deploying low-cost single board computers where the verification can take from 240 ms (KLAP20) to 331 ms (GL19). Such devices could be less suitable for real-time applications but can be solid for various access control use cases where processing time is not critical. 6 CONCLUSION In this paper, we analyzed currently existing implementations of group signatures and their potential use on main smartphone platforms (i.e., Android and iOS) and simple single-board devices. We modified well-known group signature libraries and implemented them on current smartphones and single-board devices. Our assessment indicates that most of the well-known group signatures take around units of milliseconds on current smartphones and up to several hundred milliseconds on the single board computer with the ARM Cortex-A53 processor. Our results indicate that nowadays smartphone platforms with multiple cores in their CPUs have no performance issues with pairing-based group signature schemes. The group signatures run on smartphones can be feasible in various privacy-requiring scenarios such as access control in public environments and in modern smart services that even require real-time processing. In future work, we will focus on upcoming GS schemes based on quantum-resistant assumptions and their usability on handheld devices and constrained devices. ACKNOWLEDGMENTS This work is supported by the DOPRAVA 2020+ programme under the Technology Agency of the Czech Republic grant agreement No. On Efficiency and Usability of Group Signatures on Smartphone and Single-board Platforms ARES 2023, August 29–September 01, 2023, Benevento, Italy CK03000040 (Protection of data flows in shared means of transport) and by the European Union under Grant Agreement No. 101087529 CHESS. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Research Executive Agency. Neither the European Union nor the granting authority can be held responsible for them. REFERENCES [1] ISO/IEC 20008-2:2013. 2013. Information technology - security techniques - anonymous digital signatures - part 2: Mechanisms using a group public key. (2013). International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). [2] Giuseppe Ateniese, Jan Camenisch, Marc Joye, and Gene Tsudik. 2000. A practical and provably secure coalition-resistant group signature scheme. In Annual International Cryptology Conference. Springer, 255–270. [3] Reza Azarderakhsh, Dieter Fishbein, Gurleen Grewal, Shi Hu, David Jao, Patrick Longa, and Rajeev Verma. 2015. Fast software implementations of bilinear pairings. IEEE Transactions on Dependable and Secure Computing 14, 6 (2015), 605–619. [4] Dan Boneh, Xavier Boyen, and Hovav Shacham. 2004. Short group signatures. In Crypto, Vol. 3152. Springer, 41–55. [5] Dan Boneh and Hovav Shacham. 2004. Group signatures with verifier-local revocation. In Proceedings of the 11th ACM conference on Computer and communications security. ACM, 168–177. [6] Jan Camenisch and Jens Groth. 2004. Group signatures: Better efficiency and new theoretical aspects. In International Conference on Security in Communication Networks. Springer, 120–133. [7] Jan Camenisch and Jens Groth. 2005. Group signatures: Better efficiency and new theoretical aspects. In Security in Communication Networks. Springer, 120–133. [8] Jan Camenisch and Anna Lysyanskaya. 2004. Signature schemes and anonymous credentials from bilinear maps. In Advances in Cryptology–CRYPTO 2004: 24th Annual International Cryptology Conference, Santa Barbara, California, USA, August 15-19, 2004. Proceedings 24. Springer, 56–72. [9] David Chaum and Eugene Van Heyst. 1991. Group signatures. In Proceedings of the 10th annual international conference on Theory and application of cryptographic techniques (Brighton, UK) (EUROCRYPT’91). Springer-Verlag, Berlin, Heidelberg, 257–265. [10] Seung Geol Choi, Kunsoo Park, and Moti Yung. 2006. Short traceable signatures based on bilinear pairings. In Advances in Information and Computer Security: First International Workshop on Security, IWSEC 2006, Kyoto, Japan, October 23-24, 2006. Proceedings 1. Springer, 88–103. [11] Angelo De Caro and Vincenzo Iovino. 2011. jPBC: Java pairing based cryptography. In Proceedings of the 16th IEEE Symposium on Computers and Communications, ISCC 2011. Kerkyra, Corfu, Greece, June 28 - July 1, 850–855. [12] Cécile Delerablée and David Pointcheval. 2006. Dynamic fully anonymous short group signatures. In Progress in Cryptology-VIETCRYPT 2006. Springer, 193–210. [13] David Derler and Daniel Slamanig. 2018. Highly-efficient fully-anonymous dynamic group signatures. In Proceedings of the 2018 on Asia Conference on Computer and Communications Security. ACM, 551–565. [14] Jesus Diaz, David Arroyo, and Francisco B. Rodriguez. 2015. libgroupsig: An extensible C library for group signatures. Cryptology ePrint Archive, Paper 2015/1146. https://eprint.iacr.org/2015/1146 https://eprint.iacr.org/2015/1146. [15] Jesus Diaz and Anja Lehmann. 2021. Group Signatures with User-Controlled and Sequential Linkability. Cryptology ePrint Archive, Paper 2021/181. https: //eprint.iacr.org/2021/181 https://eprint.iacr.org/2021/181. [16] Keita Emura and Takuya Hayashi. 2015. A light-weight group signature scheme with time-token dependent linking. In Lightweight Cryptography for Security and Privacy. Springer, 37–57. [17] Sungwook Eom and Jun-Ho Huh. 2018. Group signature with restrictive linkability: minimizing privacy exposure in ubiquitous environment. Journal of Ambient Intelligence and Humanized Computing (2018), 1–11. [18] Christian Esposito, Aniello Castiglione, Francesco Palmieri, and Alfredo De Santis. 2018. Integrity for an event notification within the industrial internet of things by using group signatures. IEEE Transactions on Industrial Informatics 14, 8 (2018), 3669–3678. [19] Anna Lisa Ferrara, Matthew Green, Susan Hohenberger, and Michael Østergaard Pedersen. 2009. Practical short signature batch verification. In Cryptographers’ Track at the RSA Conference. Springer, 309–324. [20] Lydia Garms and Anja Lehmann. 2019. Group Signatures with Selective Linkability. Cryptology ePrint Archive, Paper 2019/027. https://eprint.iacr.org/2019/027 https://eprint.iacr.org/2019/027. [21] Jens Groth. 2007. Fully anonymous group signatures without random oracles. In International Conference on the Theory and Application of Cryptology and Information Security. Springer, 164–180. [22] Bogdan Groza, Tudor Andreica, Adriana Berdich, Pal-Stefan Murvay, and Eugen Horatiu Gurban. 2020. Prestvo: Privacy enabled smartphone based access to vehicle on-board units. IEEE Access 8 (2020), 119105–119122. [23] Jan Hajny, Lukas Malina, Zdenek Martinasek, and Vaclav Zeman. 2013. Privacypreserving SVANETs-Privacy-preserving Simple Vehicular Ad-hoc Networks.. In SECRYPT. 267–274. [24] Jung Yeon Hwang, Sokjoon Lee, Byung-Ho Chung, Hyun Sook Cho, and DaeHun Nyang. 2011. Short group signatures with controllable linkability. In Lightweight Security & Privacy: Devices, Protocols and Applications (LightSec), 2011 Workshop on. IEEE, 44–52. [25] Primate Labs Inc. 2023. Geekbench Benchmarks: iPhone 12 Mini Benchmarks. https://browser.geekbench.com/ios_devices/iphone-12-mini [26] Primate Labs Inc. 2023. Geekbench Benchmarks: Samsung Galaxy A53 5G Benchmarks. https://browser.geekbench.com/android_devices/samsung-galaxy-a535g [27] Andreu Pere Isern-Deyà, Llorenç Huguet-Rotger, M Magdalena Payeras-Capellà, and Macià Mut-Puigserver. 2015. On the practicability of using group signatures on mobile devices: implementation and performance analysis on the android platform. International Journal of Information Security 14 (2015), 335–345. [28] Toshiyuki Isshiki, Kengo Mori, Kazue Sako, Isamu Teranishi, and Shoko Yonezawa. 2006. Using group signatures for identity management and its implementation. In Proceedings of the second ACM workshop on Digital identity management. ACM, 73–78. [29] Hyoseung Kim, Youngkyung Lee, Michel Abdalla, and Jong Hwan Park. 2020. Practical Dynamic Group Signature with Efficient Concurrent Joins and Batch Verifications. Cryptology ePrint Archive, Paper 2020/921. https://eprint.iacr.org/ 2020/921 https://eprint.iacr.org/2020/921. [30] Benoît Libert, Thomas Peters, and Moti Yung. 2012. Scalable group signatures with revocation. In Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, 609–627. [31] Joseph K. Liu, Victor K.-W. Wei, and Duncan S. Wong. 2004. Linkable Spontaneous Anonymous Group Signature for Ad Hoc Groups (Extended Abstract). IACR Cryptol. ePrint Arch. 2004 (2004), 27. [32] Weiran Liu, Jianwei Liu, Qianhong Wu, and Bo Qin. 2014. Android PBC: A pairing based cryptography toolkit for android platform. (2014). [33] Lukas Malina, Petr Dzurenda, and Jan Hajny. 2018. Evaluation of anonymous digital signatures for privacy-enhancing mobile applications. International Journal of Security and Networks 13, 1 (2018), 27–41. [34] Lukas Malina, Jan Hajny, and Vaclav Zeman. 2015. Usability of pairing-based cryptography on smartphones. In 2015 38th International Conference on Telecommunications and Signal Processing (TSP). IEEE, 617–621. [35] Vasileios Manolopoulos, Panos Papadimitratos, Sha Tao, and Ana Rusu. 2011. Securing smartphone based ITS. In 2011 11th International Conference on ITS Telecommunications. IEEE, 201–206. [36] Aleksandr Ometov, Pavel Masek, Lukas Malina, Roman Florea, Jiri Hosek, Sergey Andreev, Jan Hajny, Jussi Niutanen, and Yevgeni Koucheryavy. 2016. Feasibility characterization of cryptographic primitives for constrained (wearable) IoT devices. In 2016 IEEE International Conference on Pervasive Computing and Communication Workshops (PerCom Workshops). IEEE, 1–6. [37] Maharage Nisansala Sevwandi Perera, Toru Nakamura, Masayuki Hashimoto, Hiroyuki Yokoyama, Chen-Mou Cheng, and Kouichi Sakurai. 2022. A survey on group signatures and ring signatures: traceability vs. anonymity. Cryptography 6, 1 (2022), 3. [38] David Pointcheval and Olivier Sanders. 2015. Short Randomizable Signatures. Cryptology ePrint Archive, Paper 2015/525. https://eprint.iacr.org/2015/525 https://eprint.iacr.org/2015/525. [39] Klaus Potzmader, Johannes Winter, Daniel Hein, Christian Hanser, Peter Teufl, and Liqun Chen. 2013. Group signatures on mobile devices: Practical experiences. In Trust and Trustworthy Computing: 6th International Conference, TRUST 2013, London, UK, June 17-19, 2013. Proceedings 6. Springer, 47–64. [40] Meryem Soysaldı Şahin and Sedat Akleylek. 2023. A survey of quantum secure group signature schemes: Lattice-based approach. Journal of Information Security and Applications 73 (2023), 103432. [41] Ahmad Salman, William Diehl, and Jens-Peter Kaps. 2017. A light-weight hardware/software co-design for pairing-based cryptography with low power and energy consumption. In 2017 International Conference on Field Programmable Technology (ICFPT). IEEE, 235–238. [42] Run Xie, Chanlian He, Chunxiang Xu, and Chongzhi Gao. 2019. Lattice-based dynamic group signature for anonymous authentication in IoT. Annals of Telecommunications (2019), 1–12.