ABSTRACT
Anonymous credentials (ACs) systems are a powerful cryptographic
tool for privacy-preserving applications and provide strong user
privacy guarantees for authentication and access control. ACs allow users to prove possession of attributes encoded in a credential
without revealing any information beyond them. A delegatable AC
(DAC) system is an enhanced AC system that allows the owners
of credentials to delegate the obtained credential to other users.
This allows to model hierarchies as usually encountered within
public-key infrastructures (PKIs). DACs also provide stronger privacy guarantees than traditional AC systems since the identities of
issuers and delegators can also be hidden.
In this paper we present a novel DAC scheme that supports attributes, provides anonymity for delegations, allows the delegators
to restrict further delegations, and also comes with an efficient
construction. Our approach builds on a new primitive that we call
structure-preserving signatures on equivalence classes on updatable commitments (SPSEQ-UC). The high-level idea is to use a
special signature scheme that can sign vectors of set commitments,
where signatures can be extended by additional set commitments.
Signatures additionally include a user’s public key, which can be
switched. This allows us to efficiently realize delegation in the DAC.
Similar to conventional SPSEQ, the signatures and messages can
be publicly randomized and thus allow unlinkable delegation and
showings in the DAC system. We present further optimizations
such as cross-set commitment aggregation that, in combination,
enable efficient selective showing of attributes in the DAC without using costly zero-knowledge proofs. We present an efficient
instantiation that is proven to be secure in the generic group model
and finally demonstrate the practical efficiency of our DAC by
presenting performance benchmarks based on an implementation.