Paper 2025/161

Stronger Security for Blind Signatures with Attributes

Abstract

Single-use anonymous credentials are issued once and allow users to unlinkably authenticate exactly once. Recent anonymous-token and age-verification systems increasingly rely on such credentials to minimize credential reuse and simplify revocation. These systems are typically instantiated from blind signatures, yielding lightweight credentials whose presentation reduces essentially to signature verification. Many deployments additionally require embedded attributes and selective attribute disclosure. While this functionality can be achieved through Blind Signatures with Attributes (BSAs), only a handful of blind-signature constructions support attributes, and the security guarantees of selective disclosure are not yet fully understood or properly formalized. We close this gap by first revisiting the security definitions for BSAs and introducing stronger notions capturing secure showing under partial attribute reveal. We then present a generic transformation that lifts a broad class of two- and three-move blind signatures into BSAs supporting embedded attributes and selective disclosure. Our construction uses Merkle commitments and cut-and-choose techniques to enforce attribute consistency and achieves concurrent one-more unforgeability, upgraded blindness, and the stronger secure-showing notion. Finally, we prove that the well-known Anonymous Credentials Light (ACL) construction satisfies these stronger notions without modification in the ROM+AGM.

Note: In this version, we provide a generic compiler that transforms a given blind signature scheme into a blind signature with attributes scheme.