In a CL-based or CKS-based anonymous credential system, how can a verifier $V$ prove that a credential holder $H$ has presented it a credential that has been issued by an issuer $I$ without identifying $H$? I could not come up with a simple solution using the anonymous credential.

I think that an additional mechanism different from anonymous credentials is necessary in order to make the verifier able to prove that some holder made it a proof presentation. Since the holders proof presentation must be "unrepeatable" by verifier, the holder must provide some additional data (data is just a very basic definition) to verifier so that verifier must be able to prove that this presentation happened to someone else with that data somehow. And in a multi-use credential system (such as CL-based or CKS-based) we can not apply this situation with the facilities of anonymous credentials as far as I know. I dont have a problem with applying this scenario by using additional mechanisms/cryptographic primitives. But I am wondering if it is possible to implement using the facilities of aforementioned anonymous credential systems.

  • $\begingroup$ Look, digital signatures are a useful tool in authentications systems; in fact, it is an important building block. When you restrict: "without ... encrypted values"... What do you mean specifically? $\endgroup$ Commented Mar 25, 2020 at 15:47
  • $\begingroup$ Thanks for your answer. I tried to edit and detail my question. $\endgroup$
    – kentakenta
    Commented Mar 26, 2020 at 3:19
  • $\begingroup$ In interactive systems, Prover is talking to a party that decides yes/not. This is why that party is called Verifier. It seems we have a special Verifier here that proves something to a SuperVerifier, or it might be me mis-interpreting your setup. $\endgroup$ Commented Apr 14, 2021 at 14:42
  • $\begingroup$ I fail to comprehend the necessity for the verifier to prove that the received credentials issued by an issuer. Can you tell me who the verifier needs to prove this point to? $\endgroup$
    – X.H. Yue
    Commented Mar 19 at 5:59

1 Answer 1


Seems alike with the question disscussed in https://eprint.iacr.org/2023/853. It's an usual scenario in the anonymous credential system:

"However, it poses an interesting problem: if the digital credential is privacy-preserving (e.g. based on BBS+ on CL signatures), but the holder is still forced to show an ID card or a passport to verify that the presented credential was indeed issued to the holder, what is the point of deploying privacy-preserving digital credential? "


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.