Practical Delegatable Anonymous Credentials From Equivalence Class Signatures
Authors: Omid Mir (Johannes Kepler University Linz, LIT Secure and Correct Systems Lab, Linz , Austria ), Daniel Slamanig (AIT Austrian Institute of Technology Vienna, Austria), Balthazar Bauer (IRIF, Université de Paris Cité Paris, France), René Mayrhofer (Johannes Kepler University Linz, Institute of Networks and Security, Linz , Austria)
Volume: 2023
Issue: 3
Pages: 488–513
DOI: https://doi.org/10.56553/popets-2023-0093
Abstract: Anonymous credentials (ACs) systems are a powerful cryptographic tool for privacy-preserving applications and provide strong user privacy guarantees for authentication and access control. ACs allow users to prove possession of attributes encoded in a credential without revealing any information beyond them. A delegatable AC (DAC) system is an enhanced AC system that allows the owners of credentials to delegate the obtained credential to other users. This allows to model hierarchies as usually encountered within public-key infrastructures (PKIs). DACs also provide stronger privacy guarantees than traditional AC systems since the identities of issuers and delegators can also be hidden. In this paper we present a novel DAC scheme that supports attributes, provides anonymity for delegations, allows the delegators to restrict further delegations, and also comes with an efficient construction. Our approach builds on a new primitive that we call structure-preserving signatures on equivalence classes on updatable commitments (SPSEQ-UC). The high-level idea is to use a special signature scheme that can sign vectors of set commitments, where signatures can be extended by additional set commitments. Signatures additionally include a user's public key, which can be switched. This allows us to efficiently realize delegation in the DAC. Similar to conventional SPSEQ, the signatures and messages can be publicly randomized and thus allow unlinkable delegation and showings in the DAC system. We present further optimizations such as cross-set commitment aggregation that, in combination, enable efficient selective showing of attributes in the DAC without using costly zero-knowledge proofs. We present an efficient instantiation that is proven to be secure in the generic group model and finally demonstrate the practical efficiency of our DAC by presenting performance benchmarks based on an implementation.
Keywords: delegatable anonymous credentials, equivalence-class signatures, set commitments
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
