I work with U-Prove. In U-Prove they talk about a trusted Issuer, but I never saw how the trust is verified. The trust is essential, because the Verifier wants to know if the token was created with a trusted Issuer or not.
The U-Prove Cryptographic Specification V1.1 describes how to verify the signature of the Issuer. But there is no direct link if the signature is from a trusted Issuer or mayby from the Prover itself. The Issuer-Parameter could not be used, they are variable and created everytime a Prover wants to get a token.
Does someone has an idea or link where the trust establishment is described?
Updated question 24.02.2017
Maybe my first question was a bit unclear. Lets imagine that the Prover wants to create a token by himself. He creates the IssuerParameters and runs the protocol (Figure 8) by its own (this means he simulates the Issuer). Now he is the holder of the Issuer private key $y_0$. The Prover presents the created token to the Verifier. Signature (Figure 4) for the presented token is correct. But the Verifier does not know if it was a trusted or untrusted Issuer, who created the token with the Prover. The Verifier just knows that the received token relates to the private key $y_0$.
What I understand out of the Issuance protocol (Figure 8) and saw in the SDK-Implementation is, that every time the Prover requests a token, the IssuerParameters (generators $g_i$, $i$ = # attributes) and the private key $y_0$ (as well as $g_0$) are generated new.