Anonymous Credentials

Anonymous Credentials

The credential/identity proofs implementation details of anonymous credentials are described in detail under the Implementation and Optimizations of selectively disclosable identity forms. This uses a pairing-friendly elliptic curve with two prime-order elliptic curve groups G1 and G2, a subgroup GT of the degree 12 extension field Gal(q12), and a bilinear pairing function e: G1 x G2 → GT. The major computation costs comes from scalar multiplication in G1, evaluation of the pairing function e, and exponentiation in GT. Performance is reported based on an implementation of these groups and pairing function using BLS12-381, benchmarked on a 2.7 GHz Intel Core i5 with 8 GB of RAM. The cost of a 256-bit scalar multiplication in G1 is 1 ms, a 256-bit exponentiation in G2 is 0.3 ms, a 256-bit exponentiation in GT is 1.17 ms, and computation of the pairing function is 2.7 ms. 

The following benchmarks will be based on an anonymous credential where the maximum number m of attributes per credential is 10. 

The computational cost of ac_sign is a multi-exponentiation in G1 of size m and two additional exponentiations in G1, or approximately 2 + m / log m < 5 exponentiations in G1 overall. The benchmark time is 5 ms.  

The total computational cost to ac_reveal is approximately 3 exponentiations in G1and a multi-exponentiation in G2 of size at most m +1 < 11, which costs approximately 3.17  total exponentiations in G2. The total benchmark time is 4 ms. 

The total computational cost to ac_verify is approximately 2 executions of the pairing function, a single exponentiation in G2, a multi-exponentiation of size m+3 <13 in G2,approximately the cost of 3.5 exponentiations in G2, and 1 multiplication in GT. The total benchmark time is 6.45 ms. 

With batch verification, the amortized cost of ac_batch_verify per credential proof is dominated by the cost of a single pairing and a multi-exponentiation of size m < 10 in G2. The total amortized benchmark time is 3.7 ms per credential proof.  

The size of the ac_reveal proof is 1 element in G2 , 2 elements in G1, and at most m + 2 256-bit integers. The total size is thus approximately 480 bytes.  

The function ac_randomize_pubkey is a single exponentiation in G1, which costs just 1 ms.