3
$\begingroup$

I am looking at a scenario where I would like to claim to an authority (call it A) that I am indeed me without revealing my identity documents. I am guessing some zero knowledge protocol has to be used. We can assume a trusted authority where I will show my identity documents for authentication. But I do not want A to know these details. I also do not want A to be able to collude with the trusted authority and gain information about my identity. What are the possible schemes/areas I should be looking at?

From some reading I see that there is a Brands scheme and pairing based crypto schemes. One is interactive and the other noninteractive. Are there any other differences? Are there other schemes?

Improve this question
$\endgroup$
2
  • $\begingroup$ If you consider a context where Alice wants to be authenticated to Bob, and they establish a private channel between them: Alice can use a certificateless signature to sign: "It's Alice again+localtime". The point here is: what is your adversarial model? $\endgroup$
    – Crypto Learner
    Commented Aug 18, 2020 at 16:34
  • $\begingroup$ Alice has convinced a trusted authority (TA) about her identity (by showing her identity documents in person) and also conveyed other details like for example health details, vehicle details, etc). Now she would like to authenticate to Bob that indeed her with that specific health condition or that specific car without revealing her identity details. And even if Bob colludes with the TA (knowingly or unknowingly) he shouldnt get details of Alice. $\endgroup$
    – Zoey
    Commented Aug 18, 2020 at 17:14

1 Answer 1

Reset to default
1
$\begingroup$

The primitive you are looking at is called anonymous credentials. It deals exactly with your scenario, and there are dozen of papers on the subject. The introduction of this paper provides plenty of references to the literature on this subject.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Even I finally got to this P-signatures concept but now I had a few questions relating to that. I can pose it as a different question if you want me to. Are there any implementations of P-signatures? I could only find implementations of CL-signatures but not of P-signatures. Also it is a 2007 paper, has the community moved to something newer? $\endgroup$
    – Zoey
    Commented Sep 26, 2020 at 0:52
  • 1
    $\begingroup$ Implementations: I have no idea, though Melissa Chase is now working at Microsoft Research, so there might have been some work at Microsoft on implementing anonymous credentials. Has the community moved to something newer: yes, clearly, there have been many important improvements, here is a recent example, but choosing the best state of the art result strongly depends on what you care about exactly - e.g. the works I cited focus on non-interactive AC, but if interactivity is OK, there are more efficient solutions. $\endgroup$
    – Geoffroy Couteau
    Commented Sep 28, 2020 at 7:10
  • $\begingroup$ this new work seems interesting. let me pose implementations as a new question. $\endgroup$
    – Zoey
    Commented Sep 28, 2020 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.