Re: [Privacy-pass] External verifiability: a concrete proposal

[Ian Goldberg <[e-mail]>]

On Fri, Jul 10, 2020 at 02:28:06PM +0100, Alex Davidson wrote:
> Hi Watson,
> 
> Thanks for bringing this up, I like this idea.
> I’m not familiar with the Boneh-Lynn-Shacham signature scheme, but it seems what you’re proposing is only a minor modification on the redemption procedure used in the core protocol design.
> 
> When it comes to alternative designs for publicly verifiability, the only things that come to my mind are to use a different blind signature scheme, or to try a more general anonymous credential scheme such as https://eprint.iacr.org/2001/019.pdf <https://eprint.iacr.org/2001/019.pdf> (or something more recent). However, I like the simplicity of what you’re proposing, and the similarity that it enjoys with the existing versions of the protocol.
> 
> I’d be interested in hearing more opinions on this topic.

In the original design, we wanted to avoid pairings because implementing
them in javascript promised to be annoying.  But nowadays with the
ability to compile different languages to WebAssembly?  Perhaps it's
more reasonable.  The protocol is probably considerably more
straightforward, actually: the ZKPs can go away entirely, and the client
can still batch-verify that a pile of tokens are generated with the same
public key.