There is an authority A with an associated public/private key pair (A.priv, A.pub).
A can issue new "identities" by signing data (numbers or bytestrings). Each number associated with a signature by A is an identity. Here are two examples:
identity_1 = (sign(A.privkey, 1), 1)
identity_2 = (sign(A.privkey, 2), 2)
How can owners of these identities prove on a public system that they
- have a valid identity without revealing their number
- have not done this proof on the public system before?
Assuming the authority doesn't sign any data more than once, is it sufficient if identity owners just send the signature to the public system or does it tell anything about the data?