How to prove in zero-knowledge that the attributes of Pointcheval Sanders signature is the opening of a commitment?

Question

In anonymous credentials schemes, it is possible to anonymously prove knowledge of a signature. Proposals for anonymous credentials with attributes also include a method for proving statements about the signed attributes in zero-knowledge, i.e. proving to a third party verifier that the signed values are the opening of a commitment. For example if I have a credential which is a signature on my current income, it is valuable to be able to prove to a third party that a committed value opens to the same income, without disclosing my actual income.

Reading the Pointcheval-Sanders proposal for anonymous credentials, I cannot find any description for how to prove relations of the signed attributes to a commitment. Is there any publication describing such a procedure?

Answer 1

Quoting the proposal page 10, just before Theorem 8:

..and carries out a zero-knowledge proof of knowledge $\pi$ (such as the Schnorr’s interactive protocol [Sch90]) of $(m_1, . . . , m_r)$ and $t$ such that..

That means introducing protocol responses $(M_1, \cdots, M_r, T)$ for secrets $(m_1, . . . , m_r)$ and challenge $c$ like $M_i = m_i \cdot c + \xi_i$.

Combine responses above and commitment components for Schnorr verification equations.