Re: [CFRG] Partially blind issuance and proofs on revealed values (and a syntax change)

[Watson Ladd <[e-mail]>]

On Mon, Apr 8, 2024 at 11:18 AM Orie Steele <[e-mail]> wrote:
>
> Your second comment appears to be follow up to https://mailarchive.ietf.org/arch/msg/cfrg/QnAzetPq5KUzbl0QTUDMmJfVQpE/


I think thats the syntax change. Maybe I'm not clear on the current
properties: is it the case that if an issuer signs with attributes 1,
2 and a different one with attributes 1, 3, that when revealing just
attribute 1 there is no way for an attacker to tell which one was
signed? If so then this is probably worth keeping as is in the draft.
>
>
>
> Your first comment seems like possibly a significant change to:
>
> https://datatracker.ietf.org/doc/draft-irtf-cfrg-bbs-signatures/
>
> Or perhaps: https://datatracker.ietf.org/doc/draft-vasilis-bbs-per-verifier-linkability/ ?
>
>
> Is there a link to the privacy pass context / discussion?
>
> I see https://datatracker.ietf.org/doc/draft-ladd-privacypass-bbs/
>
> Is that the right document to review, in order to better understand your first comment?

Kind of. I had a telephone call today with researchers where we
determined this was the way to go for rate limiting.

Basically we would partially blind a credential where of the messages
say m1 is a random value x picked by the client (and blinded). On
redemption the client can send a value e=1/(x+k)H(site)+rG where k is
a counter value, and prove knowledge of a witness to the correctness
of the equation ve=zG+kH(site)+xH(site) and that k is small and x is
part of the message. To do this we need both partially blind issuance
and DL proofs over messages (which in extreme cases can link us to GS
if we want the big guns).

Sincerely,
Watson Ladd


-- 
Astra mortemque praestare gradatim