Anonymous credentials

More documents

Recommendations

Info

• Single-show credential (Brands & Chaum) • Blind the issuing protocol • Show the credential in clear • Multiple shows are linkable – BAD • Protocols are simpler – GOOD We will Focus on these • Multi-show (Camenisch & Lysyanskaya) • Random oracle free signatures for issuing (CL) • Blinded showing ▪ Prover shows that they know a signature over a particular ciphertext. • Cannot link multiple shows of the credential • More complex – no implementations
• Cryptographic preliminaries • The discrete logarithm problem • Schnorr’s Identification protocol ▪ Unforgeability, simulator, Fiat-Shamir Heuristic ▪ Generalization to representation • Showing protocol • Linear relations of attributes • AND-connective • Issuing protocol • Blinded issuing
Page 1 and 2: George Danezis Microsoft Research,
Page 3 and 4: • Usual way: • Identity provide
Page 5: 1. Issuing protocol: Prover gets a
Page 9 and 10: • Exponentiation is computational
Page 11 and 12: • Exemplary of the zero-knowledge
Page 13 and 14: • Assume that Peggy (Prover) does
Page 15 and 16: • Need to fake a transcript (g w
Page 17 and 18: • Traditional Schnorr • For fix
Page 19 and 20: Knows: x 1 , ..., x l Public: g, p
Page 21 and 22: • Remember: • Attributes x i ,
Page 23 and 24: Knows: x 1 , x 2, x 3, x 4 Public:
Page 25 and 26: • Showing any relation implies kn
Page 27 and 28: 1. Issuing protocol: Prover gets a
Page 29 and 30: Knows: x 1 , x 2, ... , x l Public:
Page 31 and 32: Public: g, p , h 0 = g x 0, g i = g
Page 33 and 34: Public: g, p , h 0 = g x 0, g i = g
Page 35 and 36: • Issuer sees: c o , r 0 , h •
Page 37 and 38: • Putting it all together: • Is
Page 39 and 40: • Attribute based access control
Page 41 and 42: • Peggy wants to prove (A OR B)

Anonymous credentials

Create successful ePaper yourself

Delete template?

Save as template?