## 4 Scheme Construction
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Parameters** & \(PP_{1}\) & \(PP_{2}\) & \(PP_{3}\) \\ \hline Public key (Theo.) & 171 & 335 & 414 \\ Public key (Exp.) & 196 & 367 & 443 \\ Signing key (Theo.) & 3.00 & 4.00 & 6.00 \\ Signing key (Exp.) & 3.13 & 4.17 & 6.29 \\ Tracking key (Theo.) & 1.50 & 1.70 & 1.80 \\ Tracking key (Exp.) & 1.55 & 1.75 & 1.87 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Public key, signing key and tracking key sizes (in KB). Figure 3: Comparison of size in both the theoretical estimation (Theo.) and experiments (Exp.). (**a**) Comparison of public key size. (**b**) Comparison of signing key and tracking key size. in [19; 24; 27] are all related to the maximum number of group members \(N\), whereas the public and private keys in our scheme and [19] are fixed values. However, in this paper, we needed to use the lattice-based delegation algorithm to generate member signing keys, causing the signature length to be linearly related to \(N\). However, none of the above compared schemes have message recovery in the verification phase. For a more intuitive comparison, we chose fixed values for these schemes to compare the size of the verification parameter for different schemes under the same number of group members. We selected some fixed parameters while ensuring the security of the above comparison schemes. Let \(n=2^{9},m=4,q=2^{27}\), \(\sigma_{1}\approx 7602.8121\), and \(\sigma_{2}=1504.2467\). Finally, all schemes select a fixed message \(\text{M}=\{0,1\}^{l_{2}}\) in the signature generation stage, where \(l_{2}=2^{19}\). The comparison of the size of the verification parameters is shown in Table 5 and Figure 5. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Scheme** & **Public Key Size** & **Private Key Size** & **Signature Size** & **Message Recovery** \\ \hline Katsumata [24] & \(O(\lambda\cdot N)\) & \(O(\lambda)\) & \(O(\lambda\cdot N)\) & No \\ Canard [27] & \(O(\lambda\cdot\log N)\) & \(O(\lambda)\) & \(O(\lambda)\) & No \\ Huang [19] & \(O(\lambda^{2})\) & \(O(\lambda)\) & \(O(\lambda\cdot\log N)\) & No \\ Ours & \(O(\lambda)\) & \(O(\lambda)\) & \(O(\lambda\cdot N)\) & Yes \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of the progressive efficiency of group signatures. Figure 4: Comparison of the size of signature and message–signature pairs. From Figure 5, it can be seen that compared to the other three schemes, the size of the verification parameters in the GS-MR scheme is the shortest when the number of group members \(N\leq 1024\) is considered, with an average reduction of 53.02%. However, the signature size of GS-MR increases linearly with \(N\), and at \(N\geq 2048\), the verification parameter size is no longer advantageous compared to the Canard scheme [27] and the Huang scheme [27]. Overall, the proposed GS-MR scheme reduces the verification parameter size by an average of 39.17% compared to the schemes of [19; 24; 27]. ## 7 Conclusions

In this paper, we proposed a lattice-based group signature with message recovery. The scheme achieves message recoverability in the validation phase, thus eliminating the need for group members to send additional messages as validation. And the GS-MR scheme ensures privacy and integrity in collaborative settings, benefiting applications where data security is crucial. It has potential applications in secure data sharing, blockchain systems, and federal learning. Then, we prove that the GS-MR scheme achieves full anonymity and traceability properties based on the difficulty of RSIS and RLWE problems. We also performed some experiments to evaluate the sizes of key and signature. Finally, we compare the GS-MR scheme with three group signature schemes and the result shows that the verification parameter of the GS-MR scheme was reduced by an average of 39.17% for less than 2000 members. Constructing a group signature scheme with controlled linkability under the quantum oracle model will be an attractive research topic for the future. Conceptualization, Y.T. and D.P. ; methodology, D.P.