Anonymity
77
𝒜
𝑝𝑟𝑚
𝑢0
∗, 𝑐𝑖𝑑0,𝑖
∗ , 𝜑0,𝑖
∗
𝑖
𝑢1
∗, 𝑐𝑖𝑑1,𝑖
∗ , 𝜑1,𝑖
∗
𝑖
m∗
let honest user 𝑢 show
VP
show
𝑢
𝑐𝑖𝑑𝑖
, 𝜑𝑖 𝑖
m
𝜋
𝑝𝑟𝑚 ← prmGen 1𝜆, 𝐿
for 𝑢 ∈ 𝑈 :
𝑢𝑠𝑘𝑢
∗ ← uskGen 𝑝𝑟𝑚
let honest user 𝑢 store
bound VC issued by 𝒜
obt
𝑢, 𝑐𝑖𝑑, 𝑖𝑝𝑘, 𝐺
CRED𝑢0
∗ 𝑐𝑖𝑑0,𝑖
∗ → 𝑖𝑝𝑘0,𝑖
∗ , 𝐺0,𝑖
∗ , 𝜎0,𝑖
∗ , b0,𝑖
∗
CRED𝑢1
∗ 𝑐𝑖𝑑1,𝑖
∗ → 𝑖𝑝𝑘1,𝑖
∗ , 𝐺1,𝑖
∗ , 𝜎1,𝑖
∗ , b1,𝑖
∗
𝑏 ←𝑅
0,1
𝜋∗ ← show
𝑢𝑠𝑘
𝑢𝑏
∗
∗ ,
𝑖𝑝𝑘𝑏,𝑖
∗ , 𝐺𝑏,𝑖
∗ , 𝜎𝑏,𝑖
∗ , b𝑏,𝑖
∗ , 𝜑𝑏,𝑖
∗
𝑖
,
m∗
𝒜
𝜋∗ 𝑏∗
challenge pairs
user VC reveal
func
requirement
𝑖𝑝𝑘0,𝑖
∗ , 𝜑0,1
∗ 𝐺0,𝑖
∗ , b0,𝑖
∗
𝑖
= 𝑖𝑝𝑘1,𝑖
∗ , 𝜑1,1
∗ 𝐺1,𝑖
∗ , b1,𝑖
∗
𝑖
weak anonymity
𝑖𝑝𝑘0,𝑖
∗ , 𝜑0,1
∗ canon 𝐺0,𝑖
∗ , 𝐺0,𝑖
∗ , b0,𝑖
∗
𝑖
= 𝑖𝑝𝑘1,𝑖
∗ , 𝜑1,1
∗ canon 𝐺1,𝑖
∗ , 𝐺1,𝑖
∗ , b1,𝑖
∗
𝑖
If 𝒜 cannot guess 𝑏 → anonymous
original number and position of attributes
can be leaked