Alice would like to make public a proof that she is friends with Bob that has the following characteristics:
- Creation of the proof requires the agreement of both Alice and Bob
- Anyone who is also friends with Bob can identify Alice as a mutual friend of Bob
- Anyone who is not friends with Bob learns nothing from the proof (other than the total number of proofs Alice has published)
- Evaluating a proof to determine mutual friendship does not require interactive communication with either Alice or Bob
Is there any existing cryptographic construct which achieves these properties? I haven't been able to find anything that does this but maybe I haven't been searching for the right keywords.