A group signature scheme with signature claiming and variable linkability

In this paper, we present a new system for anonymous authentication, which allows a user to prove possession of an authenticated credential while not revealing his or her identity. Our system is an extension of an existing group signature scheme, providing additional features drawn from work on traceable signatures and direct anonymous attestation. Our first extension, a property taken from traceable signatures, allows a signer to later "claim" a signature, proving that they are indeed the individual who created this signature. Our second extension, taken from the work on direct anonymous attestation, allows a prover and verifier to agree on the degree of linkability of transactions, ranging from completely unlinkable transactions, to being able to link transactions made within a fixed time period (like a day), to completely linkable transactions. Our scheme is efficient enough to be practical, and is proved to be secure under the strong RSA assumption and the decisional Diffie-Hellman assumption