# Anonymous trust/reputation system

Suppose there are 3 persons, Alice, Bob and Peter.

They are identified by their pseudonyms (public RSA keys).

Alice has a key Alice, Bob has Bob-Work and Bob-Friends. Peter has Peter.

Peter knows Alice. Alice expresses trust to Bob-Work.

Peter knows Bob-Friends.

The question is, How can Bob-Friends prove to Peter, that Bob-Work he's being trusted by Alice (and therefore Bob-Friends too), without revealing that Bob-Work and Bob-Friends belong to the same person, and/or plausibly deny such a fact?

• NOTE: We do not discuss timing attacks here (such as "Please express trust to THAT pseudonym and I'll see who will appear as trusted to me afterwards")

• I have a possible solution involving a "credit system", where participants emit "trust tokens" which can then be transferred by their recipients. But, this has a downside of having to support a LONG credit transfer history. Is there a solution that does not need it?

P.S. Please retag this question appropriately (reputation, trust etc) - I can't create new tags yet :)

• The goal is not really clear - what exactly does Bob want to prove to Peter? That Bob-Friends is (somehow) trusted by Alice? – Paŭlo Ebermann Feb 5 '12 at 21:34
• Yes. Not necessary by Alice, "by someone who Peter knows" would be enough. – wizzard0 Feb 5 '12 at 23:03
• Probably doable as a proof of equality of two logarithms, if expressed/implemented with credentials systems from the book: Stefan Brands, "Rethinking PKI", see pdfs on credentica.com. – Vadym Fedyukovych Nov 18 '15 at 13:21