A subset signature is the combined signature produced when a known subset S of participants signs message m in an accountable subgroup multi-signature scheme. The combiner aggregates both the signers’ public keys and their signature shares, while the signer list remains part of the result. section 18.4
The construction follows this flow:
- Complete setup by distributing matrix elements and computing each participant’s membership key M_i. section 18.4
- Create each share as s_i = M_i + ψ_i H_0(A, m). section 18.4
- Combine shares and public keys with σ_S = Σs_j and P_S = ΣP_j for j in S. section 18.4
- Verify the result through two pairings involving H_0(A, m), P_S, the indexed H_2 terms, and σ_S. section 18.4
Verification sensitivity
Anyone can compute the public-key sum when S is known. Changing the message or any listed signer’s public key causes the pairing check to fail. section 18.4
Equation 18.12
\[S \subseteq \mathfrak{P} \label{ka12}\]Use the subset relation S ⊆ 𝔓 to track which participants contribute to the aggregate and its verification inputs. section 18.4
