6
$\begingroup$

After reading a series of papers CL01 CL02 CL04, I feel like I understand the intuition behind the anonymous credential framework but I don't understand some details the mathematics behind it.

I placed myself in a case example where this system might be useful, namely imagine that you want to prove to some organization that you are over 18 years old and that you eID have not expired. First, you issue an eID from the government, in which you "hide" (commit) your pseudonym. That is, the government have to issue a signature on all your data (name, birthday date, adres...) and on your committed secret information (pseudonym). I understand how (mathematically) this part is done in CL02, but I have no idea how to adapt it for CL04.

Done this, you would use a zero-knowledge proof of knowledge to prove that you have such a signature to $O$. Then, you would create this proof of knowledge to only reveal your birthday date. But, how would you only prove that you are over 18, without revealing your exact birthday date?

To summary:

  • How it is possible to use the CL signature based on pairings CL04 to issue a partially blinded signature? In other words, issue a signature on some hidden (committed) data and some known data.
  • How it is possible to use the CL signature protocols in CL04 to prove that you are over 18, without revealing your exact birthday date?
  • It is possible to combine credentials (i.e., signatures) to produce one zero-knowledge proof of some subset of data in both credentials at the same time?
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.