# Decentralized Identity Authentication with Auditability and Privacy
## 5 Privacy-Preserving Protocol
### Final Protocol
#### 5.2.1 New Token and Its Consistency
The smart contract is initialized and created; it keeps \(z_{vk}\) privately and sends \(z_{pk}\) to the client by invoking \((z_{vk},z_{pk})\gets zkGen(\mathcal{A},\mathcal{C})\) for a circuit \(\mathcal{C}\). In the registration phase, \(C_{i}\) generates the keys, derives the \(did\) from the public key, and then interacts with \(\mathcal{G}_{\text{LEDGER}}\) to obtain the inclusion proofs \(\beta_{in}^{did}and\beta_{in}^{\text{IdTr}cat}\), which it stores locally. In the authentication phase, the protocol receives the command \((\text{Login},sid,C_{i},authReq_{i})\) from the environment \(\mathcal{Z}\), which helps a client \(C_{i}\) to authenticate with a service provider. First, \(C_{i}\) derives a new token \(tkn\) and associates zero-knowledge proof of computation, as explained in Section 5.2.1. Once the proof is derived, it sends a command \((\text{ZKProver},sid)\) to \(\mathcal{F}_{\text{ZK}}\) and obtains \((zkproof,sid)\) as a response. The legitimacy of the new token and its consistency are verified as shown in Algorithm 3. Once validation is complete, \((\text{Login},sid,C_{i},authReq_{i})\) is sent to \(\mathcal{F}_{\text{AUTH}}\). After receiving, it sends (Token-match, \(sid\), \(SP\), \(authReq_{i}\)) to \(\mathcal{G}_{\text{LEDGER}}\). At the ledger, the smart contract verifies the new token request \(tknReq_{i}\) from a service provider, as shown in Algorithm 4, and returns the notification (Token-matched, \(sid\), \(SP\), \(Inclusion\)) from \(\mathcal{F}_{\text{AUTH}}\). \(\mathcal{F}_{\text{AUTH}}\) then fetches \(Inclusion\) from \(\mathcal{G}_{\text{LEDGER}}\) and validates the legitimacy, i.e., \(\mathcal{F}_{\text{AUTH}}\) returns (Login-verified, \(sid\), \(C_{i}\), \(authReq_{i}\)) to the client \(C_{i}\). **Theorem A1**. : _Let \(\mathcal{F}_{\text{DID}}\) and \(\mathcal{A}\) be an ideal functionality and a probabilistic polynomial-time (PPT) adversary for our proposed scheme, respectively, and let \(\mathcal{S}\) be an ideal-world PPT simulator for \(\mathcal{F}_{\text{DID}}\). Then, the proposed scheme UC-realizes the ideal functionality \(\mathcal{F}_{\text{DID}}\) for any PPT-distinguishing environment \(\mathcal{Z}\) in the \((\mathcal{F}_{\text{ZK}},\mathcal{G}_{\text{LEDGER}},\mathcal{F}_{\text{AUTH}})\)-hybrid model._

**Construction of**\(\mathcal{S}\). In a nutshell, if a message is sent by an honest party to \(\mathcal{F}_{\text{DID}}\), \(\mathcal{S}\) emulates appropriate real-world communications among participants for \(\mathcal{Z}\) with information obtained from \(\mathcal{F}_{\text{DID}}\). If a message is sent to \(\mathcal{F}_{\text{DID}}\) by a corrupted party, \(\mathcal{S}\) extracts the input and interacts with the corrupted party with the help of \(\mathcal{F}_{\text{DID}}\). **Hybrid** H.1 proceeds as in the real-world protocol, except that \(\mathcal{S}\) emulates \(\mathcal{G}_{\text{LEDGER}}\). In particular, \(\mathcal{S}\) invokes the signature scheme and generates a keypair \((sk_{\mathcal{C}},vk_{\mathcal{C}})\), and then keeps \(sk_{\mathcal{C}}\) and publishes \(vk_{\mathcal{C}}\). Whenever \(\mathcal{A}\) wants to communicate with \(\mathcal{G}_{\text{LEDGER}}\), \(\mathcal{S}\) records \(\mathcal{A}\)'s messages and faithfully emulates \(\mathcal{G}_{\text{LEDGER}}\)'s behavior. Similarly, \(\mathcal{S}\) emulates \(\mathcal{G}_{\text{LEDGER}}\) by storing items internally. As \(\mathcal{A}\)'s view in H.1 is perfectly simulated as in the real world, \(\mathcal{Z}\) cannot distinguish between H.1 and H.0. **Hybrid** H.2 proceeds as in H.1, except for a modification in how the signature is generated. The indistinguishability between H.1 and H.2 can be shown by the following reduction to the EU-CMA property of the signature scheme. In more detail, if \(\mathcal{A}\) sends forged attestations to \(\mathcal{G}_{\text{LEDGER}}\),the signature verification conducted by \(\mathcal{G}_{\text{LEDGER}}\) will fail with all but a negligible probability.