## 4 Scheme Construction
* For the choice of \(M\) in rejection sampling, according to Definition 4, if \(\sigma=12||\mathbf{c}||\), then the probability of \(e^{1+1/288}/M\geq D_{\sigma}^{m}(x)/M\cdot D_{c,\sigma(x)}^{m}\) and \(e^{1+1/288}/M\geq 3/M\) is greater than \(1-2^{-100}\). Then, we can fix \(M=3\). Specifically, we will use the following specific parameters for our experiments: \(pp_{1}:q=2^{24},n=512,m=3,t=14,\overline{m}=1536,M=3,\sigma_{1}\approx 6641.8455\), \(\sigma_{2}=1165.2235\). \(pp_{2}:q=2^{27},n=512,m=4,t=14,\overline{m}=2048,M=3,\sigma_{1}\approx 7602.8121\), \(\sigma_{2}=1504.2467\). \(pp_{3}:q=2^{29},n=1024,m=3,t=14,\overline{m}=3072,M=3,\sigma_{1}\approx 9311.5051\), \(\sigma_{2}=1822.4527\). \begin{table}
\begin{tabular}{c c c} \hline \hline  & **Form** & **Size** \\ \hline Public Key & \((\text{a},\text{a}_{0},...,\text{a}_{l},u_{f},f,g)\) & \((nm+lnm^{2}+3n)\log_{2}q\) \\ Signing Key & \(\mathbf{e}_{i}\) & \(nm\cdot D_{\sigma_{3}}\) \\ Tracking Key & \(gtk=s\) & \(n\log_{2}q\) \\ Message–Signature & \((\Pi,(c_{1},c_{2}),r)+M\) & \(Nm\cdot D_{\sigma_{1}}+2n\log_{2}q+l_{2}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Theoretical estimation of key size and message–signature size. In Table 2, we summarize the real output key values of the GS-MR scheme (i.e., public key, signing key, and tracking key) for three specific parameters compared to their theoretical estimates. For a more intuitive display, we plotted Figure 3 to visualize the variations in key sizes under different parameter settings. Based on Table 2 and Figure 3, it can be observed that the storage cost of our GS-MR scheme mainly lies in the group public key. In Figure 3, it can be seen that the signing key and tracking key of the GS-MR scheme are only the size of single-digit KB under the three sets of parameters. Although the signed message is not to be used as an input parameter in the verification phase, we also performed a comparative experiment with the signature and message-signature pairs. Subsequently, we conducted 10 experiments for each of the specific group orders 128, 256, 512, and 1024 to compare the signature size and the total length of message-signature under different scenarios (for Section 4, we fixed the value of \(l_{2}=2^{19}\)). Based on the experimental results, we evaluated the average signature size, as shown in Table 3 and Figure 4, which indicates that the signature size of GS-MR increases linearly with the number of group members. With a fixed message, the proportion of the message size decreases as the group size increases. However, we believe that our GS-MR scheme is still feasible. Particularly in small group environments with a low channel bandwidth and poor communication quality, the proposed GS-MR scheme can ensure a smaller total parameter transmission and alleviate concerns regarding the impact of channel noise on message transmission. To further demonstrate the advantages of the GS-MR scheme, we performed a progressive efficiency analysis and verification parameter size comparison between three lattice-based group signature schemes and the GS-MR scheme. They were, respectively, the group signature scheme with indexed attribute-based signature (ABS) proposed by [PERSON] et al. [24], the group signature scheme with forward security and constant size proposed by [PERSON] et al. [27], and the lattice-based dynamic group signature scheme proposed by [PERSON] et al. [19]. In Table 4, we compare these three group signature schemes [19; 24; 27] with the GS-MR scheme, where \(\lambda\) is the security parameter and \(N=2^{l}=poly(n)\) is the number of group members. From Table 4, it can be seen that the group public keys