Re: [Privacy-pass] External verifiability: a concrete proposal

On Thu, Jul 9, 2020 at 6:36 PM Ben Schwartz <bemasc@google.com> wrote:
>
> How would you verify double-spend protection?

In the applications I've heard of double spending at different places
is fine, double spending at the same place is not.

>
> On Thu, Jul 9, 2020 at 5:46 PM Watson Ladd <watsonbladd@gmail.com> wrote:
>>
>> Dear WG members,
>>
>> Recently I heard of some interesting applications of privacy pass
>> where external verifiability would be essential. These applications
>> where ones where a central server was issuing tokens that various
>> others could use.
>>
>> My concrete proposal is blind Boneh-Lynn-Shacham signatures.
>> Concretely we use G1, G2, GT a type III pairing, and have the key of
>> the issuer be kg_2. As in vanilla privacy pass the tokens are kH(x)
>> where x is a string and H is a hash function into G_1. However to
>> verify a token (y, x) one verifies the pairing equations e(y,
>> g_2)=e(H(x), kg_2). One could use the BLS12-381 parameter set for
>> this.
>>
>> Sincerely,
>> Watson Ladd
>>
>> --
>> Privacy-pass mailing list
>> Privacy-pass@ietf.org
>> https://www.ietf.org/mailman/listinfo/privacy-pass

--
"Man is born free, but everywhere he is in chains".
--Rousseau.