Auditable Credential Anonymity Revocation Based on Privacy-Preserving Smart Contracts

David Galindo; Qi Wang; Rujia Li

REVIEW 4 major objections 4 minor 35 references

Auditable Credential Anonymity Revocation Based on Privacy-Preserving Smart Contracts

T0 review · 4 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A privacy-preserving smart contract can act as the revelator in an anonymous credential system, computing the matching identity or credential with a single exponentiation while leaving an immutable audit trail on the blockchain.

desk verdict A genuinely new combination of fair blind signatures and privacy-preserving smart contracts for anonymity revocation, but the tracing equations silently assume an unstated relation between user secrets and no security proof is given. read the letter →

arxiv 1908.02443 v2 pith:YQIIYYLZ submitted 2019-08-07 cs.CR

Rujia Li , David Galindo , Qi Wang This is my paper · ORCID

classification cs.CR

keywords anonymityrevocationauditabilitysmartcontractprivacy-preservinganonymouscredentialsblindsignaturetrustedexecutionenvironmentblockchain

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Anonymity revocation in credential systems has traditionally required either the user's voluntary cooperation or a trusted judge, neither of which is auditable or always available. This paper argues that a privacy-preserving smart contract can take the judge's role: the contract holds the tracing key in a trusted execution environment and, given a user identity or a credential, returns the matching counterpart through a single exponentiation. Because every contract invocation is confirmed as an immutable blockchain transaction, the revocation process becomes permanent and publicly auditable. The paper presents a concrete instantiation built on a fair blind signature scheme and a privacy-preserving smart contract platform, with performance measurements showing sub-second computation and roughly eighteen-second end-to-end latency for a trace.

What carries the argument

The construction's load-bearing object is the pairing of a fair blind signature scheme with a privacy-preserving smart contract. The contract's secret state includes a tracing key $x_t$ that is generated and used exclusively inside a trusted execution environment, so no party ever sees it. In the issuing protocol, the user blinds the tag values $(z_1,z_u)$ into $(\zeta_1,z)$ by raising them to a private exponent $\lambda$, and the session identity is stored as $\xi^{\upsilon}$ with $\xi = g^{\gamma}$. The tracing equations $\zeta_1 = (\xi^{\upsilon})^{x_t}$ and $\xi^{\upsilon} = \zeta_1^{1/x_t}$ then hold only when $\lambda = \gamma$; this equality is the algebraic pivot that turns a single exponentiation into a correct identity or credential trace.

What would settle it

Generate a credential using the published issuing code while sampling the blinding exponent independently of the identity exponent, then invoke the tracing contract: unless the code secretly forces $\lambda = \gamma$, the revealed value will not match the stored session identity, and the trace fails.

Watch

Extended reading notes

Core claim

The central claim is that the tracing operation in a blind credential system can be reduced to one exponentiation performed inside a privacy-preserving smart contract. For credential tracing, the contract receives the user's session identity $\xi^{\upsilon}$ and returns $\zeta_1 = (\xi^{\upsilon})^{x_t}$, where $x_t$ is a secret tracing key held only inside the contract's trusted execution environment. For identity tracing, the contract receives a credential component $\zeta_1$ and returns $\xi^{\upsilon} = \zeta_1^{1/x_t}$. The issuer can then match the returned value against the stored session identity to identify the user. The paper demonstrates the mechanism on a concrete instantiation and argues that the blockchain's immutable confirmation of the contract invocation makes each revocation auditable and the contract's self-execution makes it always available.

Load-bearing premise

The tracing equations only work if the user's blinding exponent $\lambda$ equals the user's identity exponent $\gamma$ that defines $\xi = g^{\gamma}$, but the paper never defines $\lambda$ or states this equality.

Editorial extensions

If this is right

Revocation no longer depends on a human judge or the user's consent: the smart contract executes automatically and is continuously available, so a trace can be performed whenever the issuer or verifier needs it.
Every revocation is recorded as a blockchain transaction with a public invoking record, so inspectors and users can audit who called the contract and when; this makes collusion or misuse far harder to hide.
Users gain a way to detect a compromised issuer or tracer by watching the contract's public calling records, something the prior judge-based systems did not provide.
Because a trace costs a single elliptic-curve exponentiation, batch tracing is straightforward: a group of credentials can be sent to the contract in one transaction, which mitigates the blockchain's throughput limits.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper leaves $\lambda$ undefined; if the issuing implementation samples the blinding exponent independently of the identity exponent $\gamma$, the one-exponentiation identity fails and the trace will not reveal the correct user. A correct implementation must enforce $\lambda = \gamma$ inside the issuing protocol.
The auditability guarantee is inherited from the underlying platform: if the trusted execution environment is compromised, the secret tracing key could leak without leaving any on-chain trace, so the audit trail is only as trustworthy as the TEE.
The construction naturally extends to threshold tracing by splitting the tracing key across several contracts or TEEs, which would let a group of inspectors authorise a trace without any single party holding the key.
The measured roughly eighteen-second latency makes real-time tracing impractical on today's platforms, but the architecture is suitable for forensic, after-the-fact investigations such as medical-record misuse or vehicle-accident liability.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

Here's my read of arXiv:1908.02443. What's actually new is the architecture: a privacy-preserving smart contract (Ekiden) acting as the revelator in an anonymous credential system, replacing a human judge and making revocation activities visible on a ledger. That's a sensible answer to a real gap in prior work, where revocation is either user-dependent or judge-dependent with no audit trail. The paper does real systems work too: an open-source prototype, performance numbers, gas costs, latency measurements. That counts.

The problem is the central tracing algebra doesn't close. In §5.1 the user binds a key pair (γ, ξ) with ξ = g^γ and then blinds (z1, zu) using a private key λ. The paper never defines λ or states that λ = γ. Equation (1) asserts Icred = (ξ^υ)^xt = g^(γυxt) = y_t^(γυ) = ζ1. But ζ1 = y_t^(υλ) by the blinding step, so the equality holds only if λ = γ. Same issue in the identity tracing equation. If λ is an independent random blinding factor, the contract returns something that doesn't match the stored identity, and both tracing directions fail. The stress-test note is right that this is not stylistic: it's the load-bearing step that makes the smart contract a functional revelator.

The secondary issues are real but less severe. No security proof accompanies the modified scheme; identity tracing is skipped with 'due to space limit,' which is unsatisfying for a core feature; and the auditability property is weaker than claimed—the ledger records that a tracing transaction occurred, but inputs and outputs are encrypted, so an inspector can't verify the trace request was legitimate or the answer correct. The TEE itself is also a trust anchor, tempering the neutrality claim.

Still, the idea is worth taking seriously. If the authors fix the λ = γ gap (or prove the blinding factor can be the identity exponent without breaking blind issuance) and provide a correctness argument, this becomes a decent systems/crypto contribution. As printed, it should not be accepted without revision.

My recommendation: send it to peer review with a flagged equation gap. It deserves a serious referee, just not acceptance in this form.

Referee Report

4 major / 4 minor

Summary. The paper proposes an auditable anonymity-revocation mechanism for blind credentials. A privacy-preserving smart contract on a TEE-backed blockchain (Ekiden/Oasis) serves as the 'revelator': given a user identity, the contract computes the corresponding credential via one exponentiation, and given a credential, it computes the identity, while on-chain invocation records make tracing auditable. The construction instantiates a modified Abe fair blind signature; the authors report a proof-of-concept implementation and measurements of runtime, gas, and latency.

Significance. If correct, the contribution is interesting: replacing a trusted judge with a neutral, always-on smart contract addresses availability and auditability concerns in anonymity revocation. The open-source implementation and the quantitative evaluation are concrete strengths. The paper also identifies a plausible system architecture. The central tracing algebra, however, is currently not justified, and the identity tracing protocol and security arguments are missing; these issues must be resolved before the claims can be accepted.

major comments (4)

[§5.1, §5.2, Eqs. (1)–(2)] The credential tracing equation Icred=(ξυ)^xt=g^(γυxt)=y_t^(γυ)=ζ1 and the identity tracing equation Iid=ζ1^(1/xt)=g^(υλ)=ξυ are both valid only if the user's blinding exponent λ equals the user's identity exponent γ. In §5.1, the user's key pair is defined as (γ, ξ) with ξ=g^γ, and the same paragraph introduces a separate private key λ used to blind (z1,zu); no relation λ=γ is stated, and §3.1 even uses λ as the security parameter. If λ is an independent random value, then ζ1=g^(xt υ λ) is not equal to g^(xt υ γ), so the contract's output Icred does not match any component of the issued credential, and ζ1^(1/xt)=g^(υλ) does not equal the stored identity ξυ=g^(υγ). The paper must either define λ:=γ explicitly and discuss the blindness implications of using the identity exponent as the blinding factor, or replace Eqs. (1)–(2) with a correct tracing computation.
[§5.2, Identity Tracing] The identity tracing protocol, which is one of the two central revocation operations asserted in the abstract and Table 1, is not described: the text states 'Due to the space limit, we skip its full description' and merely asserts Eq. (2). Without a specification of the credential-to-contract input encoding, the handling of ζ1 inside the contract, and the matching of g^(υλ) to the issuer-stored ξυ, the correctness and the smart-contract implementability of identity tracing cannot be checked. This is a load-bearing omission, not a presentational one.
[§5.2, Tracing Inspection / §4] The auditability claim is under-specified relative to the confidentiality guarantee. In the described protocol, the tracer's input and the contract's output are encrypted end-to-end with the contract TEE, and the on-chain transaction carries only an encrypted output and state plus an attestation. An inspector scanning the blockchain can therefore see that the tracer invoked the contract, but not which identity or credential was traced or whether the invocation satisfied any authorization policy. The paper states that the inspector 'checks all these transactions to recognise suspicious activities,' but no mechanism for recognising misuse from encrypted records is given. The auditability property needs a concrete definition (e.g., what exactly an auditor can verify) to support the paper's central claim.
[§5.1, Blind Issuance] No security proof or formal security model is provided for the modified Abe scheme, although the scheme is changed from the original: it is moved to elliptic-curve groups, the tracing key pair (x_t,y_t) is generated inside a smart contract, and the user blinds with an additional exponent. Blindness, unforgeability, and the two tracing properties are asserted only informally. A correctness and security argument for these modified algorithms is needed, especially because the equality in Eqs. (1)–(2) is exactly the kind of invariant that a proof would force to be stated.

minor comments (4)

[§3.1 / §5.1] §3.1 uses λ for the security parameter while §5.1 uses λ for the user's blinding private key; this collision makes the undefined-λ issue worse.
[§5.1] The phrase 'computes zu = z1/γ' should presumably read z^(1/γ), and 'blinds (z1,zu) into (ξ1,z)' should presumably read (ζ1,z); these typos obscure the protocol.
[§5.1] The statement that all arithmetic operations are based on addition of points in E(Zp) conflicts with the notation y = g^x mod q; point operations should be written as scalar multiplication and no 'mod q' on a point.
[Table 1 / §3.2] The algorithm identifiers are used inconsistently: Tracecred is defined to take id'_u but is called with a session identifier, and the notation for sig'_u and idu is not aligned with the instantiation.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the tracing equations are algebraic identities within the instantiated Abe-style blind credential scheme, and auditability is imported from blockchain/TEE platform properties rather than from the conclusion.

full rationale

The paper's central derivation is the smart-contract tracing computation in Section 5.2. Equation (1) computes Icred = (ξυ)^xt = g^{γυxt} = y_t^{γυ} = ζ1, and Equation (2) computes Iid = ζ1^{1/xt} = y_t^{υλ/xt} = g^{υλ} = ξυ. These are proposed as algebraic identities within the concrete instantiation of Abe's fair blind signature scheme; they do not take the claimed conclusion as an input. The auditability claim is supported by the public and immutable transaction records of the smart contract invocation and by Ekiden's TEE-based confidentiality, both of which are external platform properties rather than consequences of the revocation result. The paper does not fit parameters and then relabel them as predictions; the performance, gas cost, and latency measurements are empirical evaluations. The only notable flaw is that Section 5.1 introduces a blinding exponent λ without explicitly stating λ = γ, so the equalities in Equations (1) and (2) are not fully justified; that is a correctness gap rather than a circularity, because the derivation chain does not presuppose its own conclusion. No circular step can be quoted, so the appropriate circularity score is 0.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The central claim rests on standard cryptographic hardness assumptions, on the TEE and consensus trust model of Ekiden, and on an unstated relation between the user's blinding and identity secrets. No new particles or primitives are introduced, and no parameters are fitted to data.

assumptions (5)

domain assumption The modified Abe fair blind signature remains secure when instantiated with elliptic-curve groups.
Section 5 states the scheme is based on Abe's blind signature 'slightly modified' by using ECC, but no security proof for the modification is supplied.
standard math Hash functions H1, H2, H3 behave as random oracles in the Fiat-Shamir transform.
The verification equation in Section 5.1 uses H2 as a challenge hash; this is standard for blind signatures but is not stated as a formal assumption.
domain assumption TEE-powered nodes provide isolated execution, correct remote attestation, and secure key management for the contract state.
Section 5.2 relies on the contract TEE and key manager TEE to keep the tracing key xt secret and to prove correct execution before consensus accepts the transaction.
ad hoc to paper The user's blinding exponent lambda equals the identity exponent gamma, or the tracing equations do not close.
Equations (1) and (2) require g raised to gamma*upsilon*xt to equal g raised to xt*upsilon*lambda, and g raised to gamma*upsilon to equal g raised to upsilon*lambda; the paper never defines lambda or states lambda = gamma.
standard math Okamoto-Ohta diversion preserves the witness-indistinguishable proof when applied to (z1,zu).
Credential generation relies on the diversion technique from the cited literature, but the transferred proof is not re-verified in this paper.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Auditable Credential Anonymity Revocation Based on Privacy-Preserving Smart Contracts." pith.science (2026). https://pith.science/paper/YQIIYYLZ

@misc{pith2026190802443,
  author       = {Pith},
  title        = {Pith review of: Auditable Credential Anonymity Revocation Based on Privacy-Preserving Smart Contracts},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YQIIYYLZ}},
  note         = {Machine review of arXiv:1908.02443}
}

read the original abstract

Anonymity revocation is an essential component of credential issuing systems since unconditional anonymity is incompatible with pursuing and sanctioning credential misuse. However, current anonymity revocation approaches have shortcomings with respect to the auditability of the revocation process. In this paper, we propose a novel anonymity revocation approach based on privacy-preserving blockchain-based smart contracts, where the code self-execution property ensures availability and public ledger immutability provides auditability. We describe an instantiation of this approach, provide an implementation thereof and conduct a series of evaluations in terms of running time, gas cost and latency. The results show that our scheme is feasible and efficient.

Figures

Figures reproduced from arXiv: 1908.02443 by the authors.

**Figure 2.** Credential anonymity revocation records. in seconds through wall clock run time, where a time difference is obtained between the start and end of the code execution. To have an accurate and fair test result, we repeat the measure for each execution 300 times and calculate its average. Also, to simplify the performance evaluation, we measure the running time of each step and accumulate them together if there are many… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

35 extracted references · 32 canonical work pages

[1]

In: Boyd, C

Abe, M., Ohkub, M.: Provably Secure Fair Blind Signatures with Tight Revocation. In: Boyd, C. (ed.) Advances in Cryptology — ASIACRYPT 2001. pp. 583–601. Lecture Notes in Computer Science, Springer Berlin Heidelberg (2001)

work page 2001
[2]

In: International Conference on Cryptology in Africa

Blazy, O., Canard, S., Fuchsbauer, G., Gouget, A., Sibert, H., Traoré, J.: Achieving Optimal Anonymity in Transferable E-cash with a Judge. In: International Conference on Cryptology in Africa. pp. 206–223. Springer (2011)

work page 2011
[3]

In: SODA (1995)

Brickell, E.F., Gemmell, P., Kravitz, D.W.: Trustee-based Tracing Extensions to Anonymous Cash and the Making of Anonymous Change. In: SODA (1995)

work page 1995
[4]

IACR Cryptology ePrint Archive p

Bünz, B., Agrawal, S., Zamani, M., Boneh, D.: Zether: Towards privacy in a smart contract world. IACR Cryptology ePrint Archive p. 191 (2019)

work page 2019
[5]

Cryptology ePrint Archive, Report 2019/191 (2019),https://eprint.iacr.org/2019/191 14 R

Bünz, B., Agrawal, S., Zamani, M., Boneh, D.: Zether: Towards Privacy in a Smart Contract World. Cryptology ePrint Archive, Report 2019/191 (2019),https://eprint.iacr.org/2019/191 14 R. Li, D. Galindo, and Q. Wang

work page 2019
[6]

In: International Conference on the Theory and Applications of Cryptographic Techniques

Camenisch, J., Lysyanskaya, A.: An Eﬃcient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation. In: International Conference on the Theory and Applications of Cryptographic Techniques. pp. 93–118. Springer (2001)

work page 2001
[7]

In: Bertino, E., Kurth, H., Martella, G., Montolivo, E

Camenisch, J., Maurer, U., Stadler, M.: Digital Payment Systems with Passive Anonymity-Revoking Trustees. In: Bertino, E., Kurth, H., Martella, G., Montolivo, E. (eds.) Computer Security — ESORICS 96. pp. 33–43. Lecture Notes in Computer Science, Springer Berlin Heidelberg (1996)

work page 1996
[8]

In: International Workshop on Formal Methods for Industrial Critical Systems

Camenisch, J., Mödersheim, S., Sommer, D.: A Formal Model of Identity Mixer. In: International Workshop on Formal Methods for Industrial Critical Systems. pp. 198–214. Springer (2010)

work page 2010

Show all 35 references

[9]

In: Australasian Conference on Information Security and Privacy

Canard, S., Traoré, J.: On Fair E-cash Systems based on Group Signature Schemes. In: Australasian Conference on Information Security and Privacy. pp. 237–248. Springer (2003)

2003
[10]

In: Advances in Cryptology

Chaum, D.: Blind Signatures for Untraceable Payments. In: Advances in Cryptology. pp. 199–203. Springer (1983)

1983
[11]

arXiv:1804.05141 [cs] (Apr 2018)

Cheng, R., Zhang, F., Kos, J., He, W., Hynes, N., Johnson, N., Juels, A., Miller, A., Song, D.: Ekiden: A Platform for Conﬁdentiality-Preserving, Trustworthy, and Performant Smart Contract Execution. arXiv:1804.05141 [cs] (Apr 2018)

2018 arXiv
[12]

In: International Conference on Cryptology in Africa

Escala, A., Herranz, J., Morillo, P.: Revocable Attribute-Based Signatures with Adaptive Security in the Standard Model. In: International Conference on Cryptology in Africa. pp. 224–241. Springer (2011)

2011
[13]

In: 13th USENIX Symposium on Networked Systems Design and Implementation NSDI 16

Eyal, I., Gencer, A.E., Sirer, E.G., Van Renesse, R.: Bitcoin-ng: A scalable blockchain protocol. In: 13th USENIX Symposium on Networked Systems Design and Implementation NSDI 16. pp. 45–59 (2016)

2016
[14]

In: STOC (1990)

Feige, U., Shamir, A.: Witness Indistinguishable and Witness Hiding Protocols. In: STOC (1990)

1990
[15]

In: Bernstein, D.J., Lange, T

Fuchsbauer, G., Vergnaud, D.: Fair Blind Signatures without Random Oracles. In: Bernstein, D.J., Lange, T. (eds.) Progress in Cryptology – AFRICACRYPT 2010. pp. 16–33. Lecture Notes in Computer Science, Springer Berlin Heidelberg (2010)

2010
[16]

In: Takagi, T., Okamoto, T., Okamoto, E., Okamoto, T

Hufschmitt, E., Traoré, J.: Fair Blind Signatures Revisited. In: Takagi, T., Okamoto, T., Okamoto, E., Okamoto, T. (eds.) Pairing-Based Cryptography – Pairing 2007. pp. 268–292. Lecture Notes in Computer Science, Springer Berlin Heidelberg (2007)

2007
[17]

In: ACM Conference on Computer and Communications Security (1996)

Jakobsson, M., Yung, M.: Revokable and Versatile Electronic Money (extended abstract). In: ACM Conference on Computer and Communications Security (1996)

1996
[18]

Magic Ink

Jakobsson, M., Yung, M.: Distributed “Magic Ink” Signatures. In: Fumy, W. (ed.) Advances in Cryptology — EUROCRYPT ’97. pp. 450–464. Lecture Notes in Computer Science, Springer Berlin Heidelberg (1997)

1997
[19]

In: 27th USENIX Security Symposium

Kalodner, H., Goldfeder, S., Chen, X., Weinberg, S.M., Felten, E.W.: Arbitrum: Scalable, Private Smart Contracts. In: 27th USENIX Security Symposium. pp. 1353–1370 (2018)

2018
[20]

In: De Prisco, R., Yung, M

Kiayias, A., Zhou, H.S.: Concurrent Blind Signatures without Random Oracles. In: De Prisco, R., Yung, M. (eds.) Security and Cryptography for Networks. pp. 49–62. Lecture Notes in Computer Science, Springer Berlin Heidelberg (2006)

2006
[21]

In: 2016 IEEE Symposium on Security and Privacy (SP)

Kosba, A., Miller, A., Shi, E., Wen, Z., Papamanthou, C.: Hawk: The Blockchain Model of Cryptography and Privacy-Preserving Smart Contracts. In: 2016 IEEE Symposium on Security and Privacy (SP). pp. 839–858 (May 2016)

2016
[22]

Information Sciences181(13), 2906–2921 (Jul 2011)

Kwon, T.: Privacy Preservation with X.509 Standard Certiﬁcates. Information Sciences181(13), 2906–2921 (Jul 2011)

2011
[23]

In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security

Luu, L., Chu, D.H., Olickel, H., Saxena, P., Hobor, A.: Making Smart Contracts Smarter. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. pp. 254–269. CCS ’16, ACM, New York, NY, USA (2016)

2016
[24]

In: Kiayias, A

McCorry, P., Shahandashti, S.F., Hao, F.: A Smart Contract for Boardroom Voting with Maximum Voter Privacy. In: Kiayias, A. (ed.) Financial Cryptography and Data Security. pp. 357–375. Lecture Notes in Computer Science, Springer International Publishing (2017)

2017
[25]

In: Proceedings of the 2nd International Workshop on Hardware and Architectural Support for Security and Privacy - HASP ’13

McKeen, F., Alexandrovich, I., Berenzon, A., Rozas, C.V., Shaﬁ, H., Shanbhogue, V., Savagaonkar, U.R.: Innovative Instructions and Software Model for Isolated Execution. In: Proceedings of the 2nd International Workshop on Hardware and Architectural Support for Security and Pr...

2013
[26]

Nakamoto, S.: Bitcoin: A Peer-to-Peer Electronic Cash System (2008)

2008
[27]

In: Quisquater, J.J., Vandewalle, J

Okamoto, T., Ohta, K.: Divertible Zero Knowledge Interactive Proofs and Commutative Random Self- Reducibility. In: Quisquater, J.J., Vandewalle, J. (eds.) Advances in Cryptology — EUROCRYPT ’89. pp. 134–149. Lecture Notes in Computer Science, Springer Berlin Heidelberg (1990)

1990
[28]

Paquin, C., Zaverucha, G.: U-prove Cryptographic Speciﬁcation v1. 1. Technical Report, Microsoft Corporation (2011) Auditable Credential Anonymity Revocation 15

2011
[29]

Park, S., Park, H., Won, Y., Lee, J., Kent, S.: Traceable Anonymous Certiﬁcate. Tech. Rep. RFC5636, RFC Editor (Aug 2009). https://doi.org/10.17487/rfc5636,https://www.rfc-editor.org/info/rfc5636

2009 doi
[30]

Identity in the Information Society, Springer (2015)

Rannenberg, K., Camenisch, J., Sabouri, A.: Attribute-based Credentials for Trust. Identity in the Information Society, Springer (2015)

2015
[31]

Computers & Security11(6), 581–583 (Oct 1992)

von Solms, S., Naccache, D.: On Blind Signatures and Perfect Crimes. Computers & Security11(6), 581–583 (Oct 1992)

1992
[32]

arXiv preprint arXiv:1802.07344 (2018)

Sonnino, A., Al-Bassam, M., Bano, S., Meiklejohn, S., Danezis, G.: Coconut: Threshold issuance selective disclosure credentials with applications to distributed ledgers. arXiv preprint arXiv:1802.07344 (2018)

2018 arXiv
[33]

In: International Conference on the Theory and Applications of Cryptographic Techniques

Stadler, M., Piveteau, J.M., Camenisch, J.: Fair Blind Signatures. In: International Conference on the Theory and Applications of Cryptographic Techniques. pp. 209–219. Springer (1995)

1995
[34]

EXTROPY: The Journal of Transhumanist Thought,(16) (1996)

Szabo, N.: Smart Contracts: Building Blocks for Digital Markets. EXTROPY: The Journal of Transhumanist Thought,(16) (1996)

1996
[35]

Whitepaper: https://github.com/ethereum/research/blob/master/papers/caspertfg/caspertfg.pdf (2017)

Zamﬁr, V.: Casper the friendly ghost: A correct by construction blockchain consensus protocol. Whitepaper: https://github.com/ethereum/research/blob/master/papers/caspertfg/caspertfg.pdf (2017)

2017

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

In: Boyd, C

Abe, M., Ohkub, M.: Provably Secure Fair Blind Signatures with Tight Revocation. In: Boyd, C. (ed.) Advances in Cryptology — ASIACRYPT 2001. pp. 583–601. Lecture Notes in Computer Science, Springer Berlin Heidelberg (2001)

work page 2001

[2] [2]

In: International Conference on Cryptology in Africa

Blazy, O., Canard, S., Fuchsbauer, G., Gouget, A., Sibert, H., Traoré, J.: Achieving Optimal Anonymity in Transferable E-cash with a Judge. In: International Conference on Cryptology in Africa. pp. 206–223. Springer (2011)

work page 2011

[3] [3]

In: SODA (1995)

Brickell, E.F., Gemmell, P., Kravitz, D.W.: Trustee-based Tracing Extensions to Anonymous Cash and the Making of Anonymous Change. In: SODA (1995)

work page 1995

[4] [4]

IACR Cryptology ePrint Archive p

Bünz, B., Agrawal, S., Zamani, M., Boneh, D.: Zether: Towards privacy in a smart contract world. IACR Cryptology ePrint Archive p. 191 (2019)

work page 2019

[5] [5]

Cryptology ePrint Archive, Report 2019/191 (2019),https://eprint.iacr.org/2019/191 14 R

Bünz, B., Agrawal, S., Zamani, M., Boneh, D.: Zether: Towards Privacy in a Smart Contract World. Cryptology ePrint Archive, Report 2019/191 (2019),https://eprint.iacr.org/2019/191 14 R. Li, D. Galindo, and Q. Wang

work page 2019

[6] [6]

In: International Conference on the Theory and Applications of Cryptographic Techniques

Camenisch, J., Lysyanskaya, A.: An Eﬃcient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation. In: International Conference on the Theory and Applications of Cryptographic Techniques. pp. 93–118. Springer (2001)

work page 2001

[7] [7]

In: Bertino, E., Kurth, H., Martella, G., Montolivo, E

Camenisch, J., Maurer, U., Stadler, M.: Digital Payment Systems with Passive Anonymity-Revoking Trustees. In: Bertino, E., Kurth, H., Martella, G., Montolivo, E. (eds.) Computer Security — ESORICS 96. pp. 33–43. Lecture Notes in Computer Science, Springer Berlin Heidelberg (1996)

work page 1996

[8] [8]

In: International Workshop on Formal Methods for Industrial Critical Systems

Camenisch, J., Mödersheim, S., Sommer, D.: A Formal Model of Identity Mixer. In: International Workshop on Formal Methods for Industrial Critical Systems. pp. 198–214. Springer (2010)

work page 2010