On the security of a constant-size group signature scheme

As a special digital signature, a group signature scheme allows a group member to sign message on behalf of the group in an anonymous and unlinkability way. In case of a dispute, the group manager can reveal the actual identity of signer. Anonymity and unlinkability are basic properties of group signature, which is distinguished from other signature schemes. Recently, based on identity cryptology, Zhang et.al propose an efficient group signature scheme with constant size at AINA 2008. Unfortunately, in this work we show that the scheme has linkability, namely, any one can distinguish whether two different group signatures are produced by the same signer, and existential forgery, namely, given a group signature, any one can forge a new group signature. Finally, we give the corresponding attack on the scheme.