[CFRG] Partially blind issuance and proofs on revealed values (and a syntax change)

[Watson Ladd <[e-mail]>]

Dear CFRG,

In the course of working on BBS for privacy pass we've come up with
two additional features and a small tweak that I think are worth
discussing here.

The first change is we'd like partially blind issuance: there should
be an attribute where the signer doesn't know the value. This can be
done through the fully blind issuance protocol, with a proof of
correct representation for the hidden value.

The second change is doing proofs over messages. We'd like to be able
to show statements involving discrete logarithms in G1 where the
witness is one of the messages. This enables things like PRF
evaluations for rate limiting.

The syntax change is to have generators be hashes of key names, so
that we can have names not numbers for attributes. This just makes
life easier.

Sincerely,
Watson Ladd

-- 
Astra mortemque praestare gradatim