# Is there an anonymous non-interactive authorisation scheme with peer-side auth. signature generation?

I implemented a pseudonymous PKI scheme (by K. Zeng @Springer Link), where all peers can change their public keys including its signature on their own. I am looking for a way to extend it with some authorisation functionality in that way, that an Authorisation Instance can provide specific credentials to a peer. (e.g. give their message credibility, or allow some special message types). Since such a credential could be linked with the identity of the peer, it also should be renewable without the reinvolvment of the Authorisation Instance. Some of the peers only us local communication and, therefore, are not able to contact the Authorisation Instance or the CA.

The papers I read so far, only offered interactive solutions in the form of a challenge response or required the involvement of the Authorisation Instance again. Maybe I searched for the wrong keywords.

-
Could you please provide a pointer to the paper. Is that the one from EuroPKI 2006 (it's paywalled)? Could you update your question regarding the requirements. That's not really clear to me at the moment. Maybe group signatures with verifier local revocation or ring signatures could be of interest to you? –  DrLecter May 4 at 17:52
Sorry, unfortunately the paper is not available for free. It is about group signatues, the revocation is handled using a global key update, using special revocation data. (proboably it's more a signer-local revocation, because during the version update, the revoked peer fails). Its pairing based cryptography. I think including credentials directly would be hard. I was thinking about a second layer. (I was looking for a building block scheme, that I somehow could integrate) –  Horst Lemke May 4 at 18:43
@HorstLemke Please provide links anyway, even to non-free texts (but indicate they require payment). –  owlstead May 4 at 19:27
I can sum up the protocol essentials during the next days if it's of interest. –  Horst Lemke May 5 at 7:21

What I didn't know was the basic principle of self-blinding. In its simplest form, a peer (sk: $x\in Z$, pk: $X=g_1^x\in G_1$) communicates with an authority (sk: $a\in Z$, pk: $A=g_2^a\in G_2$) to get a certificate for his pk. cert: $C=X^a \in G_1$. Now the peer is able to self blind his public key and the certificate using a random $k \in_R Z$: $X_b=X^f\in G_1$; $C_b=C^k \in G_1$. This can be verified using $e(X_b,g_2)=e(C_b,A)$ which is $e(g_1^{axf},g_2)=e(g_1^{xf},g_2^a)$.
To add authorisation, a hash of the authorisation information $c=hash(Authorisation Information)$ can be included: $C=X^{a+c}$. Now the verifier needs to recalculate $c=hash(..)$ to verify the authorisation: $e(X_b,g_2)=e(C_b,A \cdot g_2^c)$.