Hecate: Threshold Anonymous Credentials With Private Verifiers and Issuer-Hiding

Anonymous Credentials (ACs) allow users to obtain attribute-based credentials from various trusted issuers and present them to verifiers in an unlinkable manner. Moreover, innovative ACs supporting threshold issuance and issuer-hiding have been proposed to fulfill the requirements of decentralized and privacy-enhanced systems. However, the privacy protection of verifiers, which is crucial for certain private services such as peer-to-peer discovery services, is not sufficiently considered in existing ACs. In this paper, we introduce Hecate, a framework of threshold anonymous credentials with private verifiers and issuer-hiding. Hecate allows the verifier to define a function policy that the user must satisfy before receiving the verifier's private information and being authorized to access, while preserving the functionalities of threshold issuance and issuer-hiding. Hecate adopts a double-threshold-credentials design that enables policy control of verifiers and users, realized through a functional credential and a signature credential, respectively. We propose a concrete construction using subset predicate encryption and threshold signatures, and prove that it satisfies unforgeability, privacy, anonymity, and issuer-hiding. We provide rigorous evaluations on a personal laptop and compare it with previous work to demonstrate its practicality. Experimental results show that the policy matching and credential presentation algorithms took only about 37ms and 60ms, respectively.