Accountable-subgroup multisignatures

Formal models and security proofs are especially important for multisignatures: in contrast to threshold signatures, no precise denitions were ever provided for such schemes, and some proposals were subsequently broken. In this paper, we formalize and implement a variant of multi-signature schemes, Accountable-Subgroup Multisignatures (ASM). In essence, ASM schemes enable any subgroup,S, of a given group,G, of potential signers, to sign eciently...