Re: [Privacy-pass] support for adoption of privacy pass documents

[Michele Orrù <[e-mail]>]

Dear Subodh,

thanks a lot for your email. I have a couple of questions regarding your
high-level feedback:

- When you say «Our deployment of blind signatures / privacy-pass is a
split server model […W]e minimize data-sharing between the application
server and the credential server by only sharing the final MAC validation
key rather than all the message data. », I don't understand what's your
setup (even after your blogpost):
Are you issuing blind signatures (are they deterministic?) and then using
them as a MAC key for authentication of a particular resource?
Are you suggesting that in the Privacy Pass standard there is a «split
server model» where an oracle provides the MAC key for the «application
server» (the server running the verification algorithm)?
I'd be very interested in knowing more in detail your solution, and I
believe it would be of interest for the whole standardization process.

- Could you please motivate your sentence «In most use cases we've been
using blind signature / Privacy Pass-based tokens, strict un-linkability
between redemption requests is not required.»?
I'm not sure I understand what your scenario is. If I can track users
across all servers except the one providing issuance, what's the point? It
seems to me that it completely breaks anonymity in the Tor/Cloudflare use
case for instance, or same-origin policy in the web. What's your use-case?

- You seem to suggest that in the Privacy Pass standard, the verifiers keep
a counter for each nonce, to allow for re-use of tokens. Have you already
thought about what are the tradeoffs between using a counter-based solution
like yours (with the associated problems in my previous question) or a
multi-use token (e.g. Algebraic MACs) that are active only for a certain
window of time?

If you want to avoid sending zk proofs to the client, I'm not sure that
challenging the server randomly is the way to go (to get a soundness error
of 10% you'd have to ask for a proof 90% of the time?), and we have much
better solutions already out there
<https://slides.com/micheleorru/anonymous-tokens/#/26> (
https://link.springer.com/chapter/10.1007/978-3-030-56784-2_11).

--
Michele.