Cryptographic proofs in data processing systems

A prover mechanism of a data processing system for proving to a verifier of the system that a prover, comprising said prover mechanism, satisfies a condition imposed by the verifier, wherein the prover mechanism comprises a communications interface for communicating with the verifier and control logic adapted to:

• receive a biometric measurement of the prover;
• and
• communicate with the verifier via said communications interface to make a cryptographic proof demonstrating
• (a) possession of at least one cryptographic credential having encoded therein a biometric template characteristic of the prover and a set of prover attributes such that each of said template and attributes are bound to a common secret value of the prover,
• (b) that said biometric measurement matches the biometric template encoded in said at least one credential, and
• (c) that the set of prover attributes encoded in said at least one credential satisfies said condition imposed by the verifier;
• wherein the control logic is adapted to make said cryptographic proof without revealing the template or said at least one credential to the verifier.

A verifier of a data processing system for verifying that a prover satisfies a condition imposed by the verifier, the verifier comprising a communications interface for communicating with the prover and control logic adapted to:

• receive a biometric measurement of the prover;
• and
• communicate with the prover via said communications interface to effect a cryptographic proof demonstrating
• (a) possession by the prover of at least one cryptographic credential having encoded therein a biometric template characteristic of the prover and a set of prover attributes such that each of said template and attributes are bound to a common secret value of the prover,
• (b) that said biometric measurement matches the biometric template encoded in said at least one credential, and
• (c) that the set of prover attributes encoded in said at least one credential satisfies said condition imposed by the verifier;
• wherein the cryptographic proof is made without revealing the template or said at least one credential to the verifier.

A computer readable non-transitory medium containing executable program instructions for causing a prover computer of a data processing system to perform a method for proving to a verifier of the system that a prover, comprising said prover computer, satisfies a condition imposed by the verifier, said method comprising the steps of:

• receiving a biometric measurement of the prover;
• and
• communicating with the verifier to make a cryptographic proof demonstrating
• (a) possession of at least one cryptographic credential having encoded therein a biometric template characteristic of the prover and a set of prover attributes such that each of said template and attributes are bound to a common secret value of the prover,
• (b) that said biometric measurement matches the biometric template encoded in said at least one credential, and
• (c) that the set of prover attributes encoded in said at least one credential satisfies said condition imposed by the verifier;
• wherein the cryptographic proof is made without revealing the template or said at least one credential to the verifier.

A computer readable non-transitory medium containing executable program instructions for causing a verifier computer of a data processing system to perform a method for verifying that a prover satisfies a condition imposed by the verifier computer, the method comprising:

• receiving a biometric measurement of the prover;
• and
• communicating with the prover to effect a cryptographic proof demonstrating
• (a) possession by the prover of at least one cryptographic credential having encoded therein a biometric template characteristic of the prover and a set of prover attributes such that each of said template and attributes are bound to a common secret value of the prover,
• (b) that said biometric measurement matches the biometric template encoded in said at least one credential, and
• (c) that the set of prover attributes encoded in said at least one credential satisfies said condition imposed by the verifier;
• wherein the cryptographic proof is made without revealing the template or said at least one credential to the verifier computer.