[Privacy-pass] External verifiability: a concrete proposal

[Watson Ladd <[e-mail]>]

Dear WG members,

Recently I heard of some interesting applications of privacy pass
where external verifiability would be essential. These applications
where ones where a central server was issuing tokens that various
others could use.

My concrete proposal is blind Boneh-Lynn-Shacham signatures.
Concretely we use G1, G2, GT a type III pairing, and have the key of
the issuer be kg_2. As in vanilla privacy pass the tokens are kH(x)
where x is a string and H is a hash function into G_1. However to
verify a token (y, x) one verifies the pairing equations e(y,
g_2)=e(H(x), kg_2). One could use the BLS12-381 parameter set for
this.

Sincerely,
Watson Ladd