18 reputation
3
bio website
location
age
visits member for 9 months
seen Apr 21 at 10:18

Mar
21
awarded  Scholar
Mar
21
accepted Group membership with unique anonymous claims
Mar
14
comment Group membership with unique anonymous claims
Ricky, thanks for you answer. It looks like a perfect match for the question. I'll leave it open for some days for other users to answer and comment and then accept the best answer.
Mar
14
comment Group membership with unique anonymous claims
If I understood it correctly, V will know the real identities of the clients, so it'll be able to communicate to S that M' and M'v belong to a particular client, right? The main requirement is for the client to maintain its anonymity with the verification side (S split in 2 or more entities or as a single entity) when making a claim.
Mar
14
awarded  Student
Mar
14
comment Group membership with unique anonymous claims
At the same time, as the client and only it has its identifier, no other party could use the client's right for a claim. I think the perfectly binding commitment is not even necessary in this case.
Mar
14
comment Group membership with unique anonymous claims
Please confirm the following implementation would work without any issues for the defined requirements of the scheme: A client generates some identifier and asks S to blind sign it providing its real identity (the enrolment stage). Then it can later send the signed unblinded identifier to S, S verifies that it has a correct signature and that it was not previously accepted, so S accepts it as a claim without knowing the real identity of the client. S saves the identifier and as it's the only signed identifier the client has, it can't make a claim twice.
Mar
14
comment Group membership with unique anonymous claims
I've updated the quoted part in the question. The key/identifier the client receives from S should not necessarily be the one the client will later send as-is to the server and not necessarily be the one the server generates (could be some value generated by the client). Some derivations from it could be performed at the enrolment stage and at the claim stage. This is actually the part I'm not sure it's possible at all, and if it is, what it should be like. And blind signature indeed looks like solving the problem.
Mar
14
awarded  Editor
Mar
14
revised Group membership with unique anonymous claims
added 107 characters in body
Mar
14
revised Group membership with unique anonymous claims
tags added
Mar
13
asked Group membership with unique anonymous claims