Anonymous and unlinkable authentication with membership test via private set intersection cardinality

3:

• The method of claim 1, the method further comprising:
• receiving, from the prover, a first commitment to the identity of the prover, a first zero-knowledge proof (ZKP) binding the identity of the prover to verifiable anonymous credentials (VAC) of the prover;
• and at least one of a pseudonym of the identity or a corresponding credentials, the VAC comprising the identity, the pseudonym, and the credentials;
• and
• verifying that the first ZKP is valid;
• and
• verifying the credentials.

4:

• The method of claim 1,
• wherein the inputs to the first committed-input-and-key-shares DOPRF protocol comprise:
• a first pseudorandom function (PRF) key share of the prover;
• a first commitment corresponding to a second PRF key share of the list holder;
• the second PRF key share of the list holder;
• a set of commitments corresponding to the elements in the checklist;
• a second commitment corresponding to the PRF key share of the prover;
• and the checklist, and
• wherein the set of first PRF results comprises values of a pseudorandom function evaluated on the plurality of elements of the checklist, using the first PRF key share and the second PRF key share.

5:

• The method of claim 1,
• wherein the inputs to the second committed-input-and-key-shares DOPRF protocol comprise:
• a first pseudorandom function (PRF) key share of the prover, a first commitment corresponding to a second PRF key share of the list holder, the identity of the prover;
• the second PRF key share of the list holder, and a second commitment corresponding to the first PRF key share of the prover, and
• wherein the second PRF result comprises a value of the pseudorandom function evaluated on the identity of the prover, using the first PRF key share and the second PRF key share.

7:

• The method of claim 1, the method further comprising, at a verifier, before executing the first committed-input-and-key-shares DOPRF protocol and the second committed-input-and-key-shares DOPRF protocol:
• receiving, from the list holder, a commitment to a first pseudorandom function (PRF) key share, commitments to the plurality of elements of the checklist, and a zero-knowledge proof (ZKP) that the checklist supplied for the first DOPRF protocol is consistent with the commitments to the plurality of elements of the checklist, and sending the commitment to the first PRF key share, the commitments to the plurality of elements of the checklist, and the ZKP to the prover;
• and
• receiving, from the prover, a commitment to a second PRF key share, and sending the commitment to the second PRF key share to the list holder,
• wherein the first PRF key share was selected uniformly at random by the list holder, and the second PRF key share was selected uniformly at random by the prover.

8:

• The method as claimed in claim 7, the method further comprising, at the verifier, after executing the first committed-input-and-key-shares DOPRF protocol and the second committed-input-and-key-shares DOPRF protocol:
• receiving, from the prover, a second ZKP of a consistency between the first commitment to the identity of the prover and a second commitment to the identity of the prover from in the second committed-input-and-key-shares DOPRF protocol;
• and
• verifying the second ZKP.

14:

• A computer system comprising one or more hardware processors which, alone or in combination, are configured to provide for execution of the following steps:
• executing a first committed-input-and-key-shares distributed oblivious pseudorandom function (DOPRF) protocol to obtain a set of first pseudorandom function (PRF) results, each result corresponding to one of a plurality of elements in a checklist held by a list holder;
• executing a second committed-input-and-key-shares DOPRF protocol to obtain a second PRF result corresponding to an identity of a prover;
• and
• determining whether one of the elements in the checklist corresponds to the identity of the prover based upon the set of first PRF results and the second PRF result.

15:

• A tangible, non-transitory computer-readable medium having instructions thereon which, upon being executed by one or more hardware processors, alone or in combination, provide for execution of the following steps:
• executing a first committed-input-and-key-shares distributed oblivious pseudorandom function (DOPRF) protocol to obtain a set of first pseudorandom function (PRF) results, each result corresponding to one of a plurality of elements in a checklist held by a list holder;
• executing a second committed-input-and-key-shares DOPRF protocol to obtain a second PRF result corresponding to an identity of a prover;
• and
• determining whether one of the elements in the checklist corresponds to the identity of the prover based upon the set of first PRF results and the second PRF result.