In anonymous credentials schemes, it is possible to anonymously prove knowledge of a signature. Proposals for anonymous credentials with attributes also include a method for proving statements about the signed attributes in zero-knowledge, i.e. proving to a third party verifier that the signed values are the opening of a commitment. For example if I have a credential which is a signature on my current income, it is valuable to be able to prove to a third party that a committed value opens to the same income, without disclosing my actual income.

Reading the Pointcheval-Sanders proposal for anonymous credentials, I cannot find any description for how to prove relations of the signed attributes to a commitment. Is there any publication describing such a procedure?


1 Answer 1


Quoting the proposal page 10, just before Theorem 8:

..and carries out a zero-knowledge proof of knowledge $\pi$ (such as the Schnorr’s interactive protocol [Sch90]) of $(m_1, . . . , m_r)$ and $t$ such that..

That means introducing protocol responses $(M_1, \cdots, M_r, T)$ for secrets $(m_1, . . . , m_r)$ and challenge $c$ like $M_i = m_i \cdot c + \xi_i$.

Combine responses above and commitment components for Schnorr verification equations.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.