Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS ISO IEC 20008 — Anonymous Digital Signatures Standard Series
Information technology — Security techniques — Anonymous digital signatures — Part 1 & Part 2
🕵️ BS ISO/IEC 20008 is the British Standards Institution (BSI) adoption of the ISO/IEC 20008 series, covering anonymous digital signatures as an information-security technique. An anonymous digital signature lets a signer produce a signature verifiable with a public key without revealing the signer’s identity; typical implementations include group signatures. It was prepared by UK technical committee IST/33 (IT — Security techniques) and carries ICS classification 35.040. The series currently comprises two parts: Part 1 specifies the general requirements and Part 2 specifies mechanisms using a group public key.
💡 The core of an anonymous digital signature is “verifiable but unidentifiable”: any verifier holding the group public key can confirm that a signature comes from the group, but cannot tell which member produced it, unless an authorised entity performs a “reveal” operation.
1. Series Overview and Positioning 📌
Anonymous digital signatures are critical in scenarios requiring proof of “membership or origin” while protecting the signer’s identity, such as anonymous reporting, electronic voting, anonymous vehicle credentials, and privacy-preserving data aggregation. The ISO/IEC 20008 series provides a unified model, options, and security requirements for such mechanisms.
The two parts currently in the BS ISO/IEC 20008 series are shown below. Part 1 gives the general model and options, and Part 2 gives concrete mechanisms based on a group public key.
| Standard | Subject | Key Content | Edition |
|---|---|---|---|
| BS ISO/IEC 20008-1:2013 | General | Concepts, options (group public key / multiple public keys), general requirements, and general model of anonymous digital signatures | First edition 2013-12-15 |
| BS ISO/IEC 20008-2:2013 | Mechanisms using a group public key | Anonymous digital signature mechanisms using a group public key, general model, and requirements | First edition 2013-11-15 |
⚠️ Anonymous signatures differ from blind signatures: a blind signature hides the message from the signer; an anonymous signature hides the signer’s identity from the verifier. The two can be combined, but their purposes and mechanisms differ.
2. General Requirements and Options 🏗️
BS ISO/IEC 20008-1 specifies the general requirements of anonymous digital signatures and gives two basic design options:
- Group public key: the whole group shares one public key, so a verifier needs only one key to verify any member’s signature.
- Multiple public keys: each member has an independent public key, and the verifier must hold the full set of public keys.
The Standard also defines the entities involved, the security properties (such as anonymity, unforgeability, and traceability), and conformance requirements, laying the foundation for subsequent mechanism implementations.
3. Mechanisms Using a Group Public Key 🔧
BS ISO/IEC 20008-2 specifies anonymous digital signature mechanisms using a group public key. Such mechanisms are usually based on group signatures or similar “anonymous credential” schemes; the Standard specifies:
- General model and requirements: definitions of elements such as the group public key, member keys, and the revocation mechanism.
- Mechanism implementation: the algorithm steps for signing, verification, and (optional) revocation/tracing.
- Security properties: anonymity, traceability (an authorised entity can de-anonymise), unforgeability, etc.
💡 The “revocation” capability of group-signature mechanisms is a double-edged sword: it lets an authorised entity trace the anonymous signer when necessary (e.g., for law enforcement), but it also means anonymity is not absolute — the revocation authority and process must be clearly designed.
4. Engineering Practice and Applications 🔍
Anonymous digital signatures are widely used in anonymous-credential and privacy-preserving systems. Engineering practice points include:
- Anonymous credentials: anonymous identity credentials for vehicles or devices, letting a service provider verify a legitimate identity without tracking the individual.
- Electronic voting and reporting: let voters/reporters anonymously submit verifiable content while supporting anti-replay and, when necessary, revocation.
- Revocation design: clearly define “who may revoke anonymity and under what conditions” to avoid abuse of power.
- Parameters and implementation: choose sufficiently secure group parameters and use audited cryptographic implementations to avoid randomness flaws.
5. Frequently Asked Questions ❓
❓ Q: How does an anonymous digital signature achieve “verifiable yet anonymous”?
A: The signer generates the signature with a member key, and the verifier uses the group public key to confirm it comes from the group; because the signature does not reveal member identity, the verifier cannot determine the specific signer.
A: The signer generates the signature with a member key, and the verifier uses the group public key to confirm it comes from the group; because the signature does not reveal member identity, the verifier cannot determine the specific signer.
❓ Q: What is the difference between the group-public-key and multiple-public-keys options?
A: In the group-public-key scheme all members share one public key, so verification is simple; in the multiple-public-keys scheme each member has an independent key and the verifier must hold the full key set. The two trade off efficiency and degree of anonymity.
A: In the group-public-key scheme all members share one public key, so verification is simple; in the multiple-public-keys scheme each member has an independent key and the verifier must hold the full key set. The two trade off efficiency and degree of anonymity.
❓ Q: Is anonymity absolute?
A: Not necessarily. Many group-signature mechanisms support “revocation”, allowing an authorised entity to trace the signer under specific conditions. Whether revocation is enabled depends on the scheme and the business need.
A: Not necessarily. Many group-signature mechanisms support “revocation”, allowing an authorised entity to trace the signer under specific conditions. Whether revocation is enabled depends on the scheme and the business need.
🔍 Q: What is the difference between anonymous and blind signatures?
A: Blind signatures solve “the signer does not know the message”; anonymous signatures solve “the verifier does not know the signer”. The former is common in e-cash, the latter in anonymous credentials and voting.
A: Blind signatures solve “the signer does not know the message”; anonymous signatures solve “the verifier does not know the signer”. The former is common in e-cash, the latter in anonymous credentials and voting.