# Anonymous Credentials

### Anonymous Credentials

The credential/identity proofs implementation details of anonymous credentials are described in detail under the Implementation and Optimizations of selectively disclosable identity forms. This uses a pairing-friendly elliptic curve with two prime-order elliptic curve groups G1 and G2, a subgroup GT of the degree 12 extension field *Gal*(*q**12*), and a bilinear pairing function *e: *G1 x G2 → GT. The major computation costs comes from scalar multiplication in *G*1, evaluation of the pairing function *e*, and exponentiation in *G**T*. Performance is reported based on an implementation of these groups and pairing function using BLS12-381, benchmarked on a 2.7 GHz Intel Core i5 with 8 GB of RAM. The cost of a 256-bit scalar multiplication in G1 is 1 ms, a 256-bit exponentiation in G2 is 0.3 ms, a 256-bit exponentiation in GT is 1.17 ms, and computation of the pairing function is 2.7 ms.

The following benchmarks will be based on an anonymous credential where the maximum number *m *of attributes per credential is 10.

The computational cost of *ac_sign* is a multi-exponentiation in G1 of size *m* and two additional exponentiations in G1, or approximately 2 + m / log m < 5 exponentiations in G1 overall. The benchmark time is 5 ms.

The total computational cost to *ac_reveal* is approximately 3 exponentiations in G1and a multi-exponentiation in G2 of size at most m +1 < 11, which costs approximately 3.17 total exponentiations in G2. The total benchmark time is 4 ms.

The total computational cost to *ac_verify* is approximately 2 executions of the pairing function, a single exponentiation in G2, a multi-exponentiation of size m+3 <13 in G2,approximately the cost of 3.5 exponentiations in G2, and 1 multiplication in GT. The total benchmark time is 6.45 ms.

With batch verification, the amortized cost of *ac_batch_verify* per credential proof is dominated by the cost of a single pairing and a multi-exponentiation of size *m* < 10 in G2. The total amortized benchmark time is 3.7 ms per credential proof.

The size of the *ac_reveal* proof is 1 element in *G**2* , 2 elements in *G**1*, and at most *m + 2* 256-bit integers. The total size is thus approximately 480 bytes.

The function *ac_randomize_pubkey* is a single exponentiation in G1, which costs just 1 ms.

Function: | Time: |

ac_sign | 5 ms |

ac_reveal | 4 ms |

ac_verify | 6.45 ms |

ac_batch_verify | 3.7 ms / proof |

ac_randomize_pubkey | 1 ms |