Non-transferable anonymous credential system with optimal anonymity revocation

Abstract

The present invention relates to a method and system for securely proving ownership of pseudonymous or anonymous electronic credentials. A credential system is described consisting of users and organizations. An organization knows a user only by a pseudonym. The pseudonyms of the same user, established for use with different organizations, cannot be linked. An organization can issue a credential to a pseudonym, and the corresponding user can prove possession of this credential to another organization that knows him under another pseudonym. During the prove of possession of the credential nothing besides the fact that he owns such a credential is revealed. A refinement of the credential system provides credentials for unlimited use, so called multiple-show credentials, and credentials for one-time use, so called one-show credentials.

1 . A method for establishing a pseudonym system by having a certificate authority accepting a user as a new participant in said pseudonym system, the method comprising the steps of 
 receiving a first public key provided by said user;    verifying that said user is allowed to join the system;    computing a credential by signing the first public key using a secret key owned by said certificate authority; and    publishing said first public key and said credential.    
   
   
       2 . The method according to  claim 1 , wherein 
 the step of receiving a first public key further includes receiving an external public key being registered for said user with an external public key infrastructure and receiving an encryption of a secret key encrypted by using said first public key;    the step of verifying that said user is allowed to join the system further includes verifying that said external public key is indeed registered with said external public key infrastructure;    the step of publishing said first public key and said credential comprises publishing said encryption and the name of the external public key infrastructure; and    additionally comprises the step of proving that the secret key corresponding to said external public key is encrypted in said received encryption.    
   
   
       3 . The method according to  claim 2 , wherein 
 said first public key of the user is derived from at least one first secret key composed by the user.    
   
   
       4 . The method according to  claim 3 , wherein 
 the step of receiving a first public key derived from a first secret key further comprises receiving a second public key which is derived from a second and a third secret key composed by the user; and    the step of computing a credential by signing the first public key using a secret key owned by said certificate authority further comprises computing a credential by signing the second public key using said secret key owned by said certificate authority.