A sanitizable signature scheme is a signature scheme that allows the sanitizer to 
sanitize certain portions of the document and to generate the valid signature of 
the resulting document with no interaction with the signer.
There exist many models and schemes for sanitizable signature.
In this paper, we precisely formalize the algorithms and the security requirements of 
sanitizable signature with secret information.
We propose a sanitizable signature scheme based on the gap co-Diffie-Hellman groups
and prove that our scheme satisfies these security requirements.
Furthermore, we discuss various models for sanitizable signature.
In particular, we focus on three major properties, such as state controllability for signer, 
flags for the sanitized messages, and designation of the sanitizer.
We also classify the previously proposed schemes and our scheme.