Accountable-Subgroup Multisignatures

Since their introduction by Itakura and Nakamura in [IN83], multisignatures have been extensively studied, and yet no formal definition of this notion has been provided to date. This lack of formalism has led to some confusion as to the precise meaning of multisignature, as well as to some proposals that have been subsequently broken. We thus wish to address both problems.