Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I implemented a pseudonymous PKI scheme (by K. Zeng @Springer Link), where all peers can change their public keys including its signature on their own. I am looking for a way to extend it with some authorisation functionality in that way, that an Authorisation Instance can provide specific credentials to a peer. (e.g. give their message credibility, or allow some special message types). Since such a credential could be linked with the identity of the peer, it also should be renewable without the reinvolvment of the Authorisation Instance. Some of the peers only us local communication and, therefore, are not able to contact the Authorisation Instance or the CA.

The papers I read so far, only offered interactive solutions in the form of a challenge response or required the involvement of the Authorisation Instance again. Maybe I searched for the wrong keywords.

share|improve this question
Could you please provide a pointer to the paper. Is that the one from EuroPKI 2006 (it's paywalled)? Could you update your question regarding the requirements. That's not really clear to me at the moment. Maybe group signatures with verifier local revocation or ring signatures could be of interest to you? – DrLecter May 4 '14 at 17:52
Sorry, unfortunately the paper is not available for free. It is about group signatues, the revocation is handled using a global key update, using special revocation data. (proboably it's more a signer-local revocation, because during the version update, the revoked peer fails). Its pairing based cryptography. I think including credentials directly would be hard. I was thinking about a second layer. (I was looking for a building block scheme, that I somehow could integrate) – Horst Lemke May 4 '14 at 18:43
@HorstLemke Please provide links anyway, even to non-free texts (but indicate they require payment). – Maarten Bodewes May 4 '14 at 19:27
I can sum up the protocol essentials during the next days if it's of interest. – Horst Lemke May 5 '14 at 7:21
up vote 1 down vote accepted

I could solve my question using the fundamental work of Eric Verheul: Self-Blindable Credential Certificates from the Weil Pairing.

What I didn't know was the basic principle of self-blinding. In its simplest form, a peer (sk: $x\in Z$, pk: $X=g_1^x\in G_1$) communicates with an authority (sk: $a\in Z$, pk: $A=g_2^a\in G_2$) to get a certificate for his pk. cert: $C=X^a \in G_1$. Now the peer is able to self blind his public key and the certificate using a random $k \in_R Z$: $X_b=X^f\in G_1$; $C_b=C^k \in G_1$. This can be verified using $e(X_b,g_2)=e(C_b,A)$ which is $e(g_1^{axf},g_2)=e(g_1^{xf},g_2^a)$.

To add authorisation, a hash of the authorisation information $c=hash(Authorisation Information)$ can be included: $C=X^{a+c}$. Now the verifier needs to recalculate $c=hash(..)$ to verify the authorisation: $e(X_b,g_2)=e(C_b,A \cdot g_2^c)$.

(Just for the record: this example is not secure, since the peer could remove its key from the certificate and then sign any other PK too.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.