Definition

Definition 1   A group signature scheme is a signature scheme which satisfies the following properties:
(i) Correctness: a signature produced by a group member is always valid.
(ii) Unforgeability: only group members are able to sign messages on behalf of the group.
(iii) Anonymity: given a valid group signature, it is infeasible for everyone but the group manager to identify the actual signer.
(iv) Unlinkability: deciding whether two different valid signatures were computed by the same group member is infeasible.
(v) Exculpability: neither a group member nor the group manager can sign on behalf of other group members.
(vi) Traceability: the group manager is always able to open a valid signature, i.e. to identify the actual signer.
(vii) Coalition-Resistance: a colluding subset of group members should not be able to generate a valid signature that the group manager cannot link to one of the colluding group members.