A membership key is a node-local elliptic-curve point used when producing an accountable subgroup signature. It is derived during setup from one row of a distributed membership matrix, then added to the node’s private-key-based message-signing term. section 18.4 section 18.8
For node i, the membership key is M_i = Σ(j=1..n) μ_i,j. Each node j computes a matrix column using its private key ψ_j, its public-key hash a_j, and H_2(A, i): μ_i,j = a_jψ_jH_2(A, i). It sends off-diagonal entries to other nodes while retaining its own diagonal entry. section 18.4 section 18.5
Equation 18.15
\[M_i=\sum_{j=1}^{n} \mu_{i, j} \label{ka15}\]This row-sum equation is the complete membership-key calculation: initialize an accumulator, add every received or locally retained row component, and store the resulting point as M_i. section 18.4 section 18.5
Setup and signing proceed in this order:
- Compute the ordered-public-key-derived value A and each node’s a_j value. section 18.4
- Have every node compute its μ column; distribute the column entries needed by other nodes. section 18.4 section 18.5
- Sum each node’s available row to obtain its own M_i; membership keys themselves need not be distributed. section 18.6.4
- Sign with s_i = M_i + ψ_iH_0(A, m), then aggregate signatures and participating public keys for the selected subgroup. section 18.4 section 18.5
Simulated subgroup setup
A simulation allocates a k×k μ matrix, calls mu_column for every node, and sums each row with membership_key. A selected list of ten node indices then signs a message using its corresponding membership key; the signature and public-key sums are combined and verified. In an actual deployment, no node can calculate another node’s full membership key because only that node has its diagonal matrix component. section 18.6.4 section 18.6.4
