3
$\begingroup$

Let us say that we have 3 entities: an Issuer I , a user/prover P and a verifier V.

  1. V trusts I but does not trust u
  2. u wants to show that he respects some kind of property (eg. being over 18yo) to V without revealing their whole birth day
  3. V possesses the data that u needs to convince V, eg. using a ZK-proof, but V would not trust such a proof because u could easily use a fake date

How would you design a protocol such that V is assured that the claim u makes is legitimate (that is, that claim was issued by I)?

A first idea would be to use both public key signature (so, V sends u a signature of its date, so that even if u decides to use a fake date, the cannot provide a correct signature for that) and ZK-proof so that u provides only the strictly required informations to V. V would then check that the ZK-proof is correct and that the private input fed into the ZK-circuit is signed by I.

Some clarifications after Geoffroy's comment:

  1. the user u should be aware of what information V wants to know, so we can't just let V and I communicate cutting out the user
  2. the user has one or more statements issued and signed by I and wants to convince V that a claim about a statement (eg. u wants to prove that he is 18yo, given a birth certificate/ID/passport signed by I) without revealing the entire statement.

Thanks in advance

Improve this question
$\endgroup$
2
  • $\begingroup$ Your setting is not clear to me: does the issuer know the data as well? Why can't he just tell V that P is over 18yo, if V trusts them? Should anything be hidden from the issuer? More generally, since you mention ZK proofs: what exactly do you want to hide? A generic non-hiding solution would be: P convinces I that he is 18yo (e.g. using his passport), and I issues a signature on the message "P is 18yo" which it hands to P. Then P can use this as a credential with V. $\endgroup$
    – Geoffroy Couteau
    Oct 24, 2022 at 12:15
  • $\begingroup$ The issuer knows the data, but we want P to be aware and consent to what information is given to V, so you can't really just let V ask the issuer or the user is completely cut out. The idea is that I issues a (digital and signed) document that states P date of birth (as an example) and P wants to prove a claim on that statement (eg. P is 18yo) without revealing the day of birth, so the user hides his date of birth but still convinced the verifier that they are 18yo. $\endgroup$
    – jacobi_matrix
    Oct 24, 2022 at 12:48

1 Answer 1

Reset to default
1
$\begingroup$

What you want looks very similar to anonymous credentials. Constructions usually go as follows: the issuer will sign the attribute of P (e.g. "P is 18yo"), usually using a blind issuance protocol. Then, P can send to V a commitment to his attribute, together with a ZK proof that he holds a signature on the committed value. In your specific setting where there is a unique verifier, there exist dedicated solutions using algebraic MACs, see here.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.