Backup and invalidation of authentication credentials

A re-issuance system for an attribute-based credential of an issuer of the attribute-based credential for a user, wherein backup values of the user are derivable from a first credential previously obtained from the issuer, wherein the credential comprises a first value of at least one authentication pair, the re-issuance system comprising:

• a computer device having a processor and a tangible storage device;
• and
• a program embodied on the storage device for execution by the processor, the program having a plurality of program instructions to:
• receive, by the issuer from the user, a set of values derived from the backup values comprising a second value of the at least one authentication pair, and a request to invalidate the attribute-based credential;
• validate, by the issuer, that the second value is a valid authentication answer with respect to the first value and whether the set of values was derived from a valid first credential;
• check by the issuer that first value of the first authentication pair has never been used for a re-issuance session before;
• invalidate the first credential, based on providing the second credential to the user, before the providing by the issuer a second credential is performed;
• and
• provide by the issuer a second credential to the user based on the first set of values, based on invalidating the first credential.

A computer program product for a re-issuance of an attribute-based credential for an issuer, comprising a tangible storage device having program code embodied therewith, the program code executable by a processor of a computer to perform a method, the method comprising:

• receiving, by the issuer from the user, a set of values from the backup values comprising a second value of the at least one authentication pair, and a request to invalidate the attribute-based credential;
• validating, by the issuer, that the second value is a valid authentication answer with respect to the first value and whether the set of values was derived from a valid first credential;
• checking by the issuer that first value of the first authentication pair has never been used for a re-issuance session before;
• invalidating the first credential, based on providing the second credential to the user, before the providing by the issuer a second credential is performed;
• and
• providing by the issuer a second credential to the user based on the first set of values, based on invalidating the first credential.