# Decentralized Identity Authentication with Auditability and Privacy
## 5 Privacy-Preserving Protocol
### Final Protocol
#### 5.2.1 New Token and Its Consistency
If \(\mathcal{Z}\) can distinguish H.2 from H.1, \(\mathcal{Z}\) and \(\mathcal{A}\) can be used to win the game of signature forgery. As assumed, unforgeability is guaranteed by the signature scheme used. **Hybrid** H.3 proceeds as in H.2, but it has \(\mathcal{S}\) emulate the authentication, which means that honest clients will send the command \((Login,sid)\) to \(\mathcal{F}_{\text{AUTH}}\). \(\mathcal{S}\) emulates messagesfrom \(\mathcal{G}_{\text{LEDGE}}\), as described above, and to \(\mathcal{F}_{\text{ZK}}\). It is clear that \(\mathcal{A}\)'s view is distributed exactly as in H.2, as \(\mathcal{S}\) can perfectly emulate \(\mathcal{G}_{\text{LEDGE}}\) and \(\mathcal{F}_{\text{ZK}}\). **Hybrid** H.4 proceeds as in H.3 except that, under the random oracle model, the adversary does not know the secret VRF key \(sk_{\
eq rsf}\), but must distinguish between pairs \((cnt,tkn)\), where \(tkn\) is the VRF hash output on the counter input \(cnt\), and pairs \((cnt,r)\), where \(r\) is a random value. This adversary knows the public values \(pk_{\
eq rsf}\), and it can easily compute \((tkn,\gamma)\gets VRF_{sk_{\
eq rsf}}(cnt)\) if they know \(sk_{\
eq rsf}\). However, \(sk_{\
eq rsf}\) is kept private. In addition, \(Sign_{sk_{\
eq}}(tkn)\) even looks random in the random oracles that know \(sk_{\
eq rsf}\); thus, pseudo-randomness is guaranteed because the adversary cannot distinguish \(tkn\) from a random distribution, and \(tkn\) is pseudo-random in the range of \(H\). Further, suppose an adversary, given the secret key \(sk_{\
eq rsf}\). The verification can satisfy both \(vrfyVRF_{pk_{\
eq rsf}}(cnt,\pi_{sk_{\
eq rsf}}(cnt))=1\) and \(vrfyVRF_{pk_{\
eq rsf}}(cnt,\pi^{\prime}_{sk_{\
eq rsf}}(input))=1\) for \(cnt\) and \(cnt^{\prime}\), and the uniqueness adversary cannot distinguish them unless \(cnt=cnt^{\prime}\) because of the uniqueness property of the VRF. Hence, the indistinguishability between H.4 and H.3 can be directly reduced to the uniqueness and the pseudo-randomness properties of the VRF. **Hybrid** H.5 proceeds as in H.4, except for a modification in how the hash value is generated. The indistinguishability between H.5 and H.4 can be shown by a reduction to the second pre-image resistance property of the hash function. In H.4, the output of the VRF will be hashed via \(H(\cdot)\); in H.5, a value is sampled from a uniform distribution at random and input into \(H(\cdot)\). If \(\mathcal{Z}\) can distinguish H.5 from H.4, this implies that \(\mathcal{A}\) can break the second pre-image resistance, which contradicts our assumptions. It remains to observe that H.5 is identical to the ideal protocol. Then, combining all of them together with this invariant ensures that H.5 precisely reflects the ideal execution of \(\mathcal{F}_{\text{DID}}\) in the \((\mathcal{F}_{\text{ZK}},\mathcal{G}_{\text{LEDGE}},\mathcal{F}_{\text{AUTH}})\)-hybrid model. ## References

* (1) Decentralized Identity Foundation. 2018. Available online: [[https://identity.foundation/](https://identity.foundation/)]([https://identity.foundation/](https://identity.foundation/)) (accessed on 19 October 2020). * (2) DID Specification. 2020. Available online: [[https://www.w3.org/TR/did-core/](https://www.w3.org/TR/did-core/)]([https://www.w3.org/TR/did-core/](https://www.w3.org/TR/did-core/)) (accessed on 21 June 2021). * (3) Hyperledger Indy. 2018. Available online: [[https://tinyurl.com/yyccaek](https://tinyurl.com/yyccaek)]([https://tinyurl.com/yyccaek](https://tinyurl.com/yyccaek)) (accessed on 19 October 2020). * (4) Hyperledger Aries. 2019. Available online: [[https://www.hyperledger.org/projects/aries](https://www.hyperledger.org/projects/aries)]([https://www.hyperledger.org/projects/aries](https://www.hyperledger.org/projects/aries)) (accessed on 19 October 2020). * (5) Evernym. 2018. Available online: [[https://www.evernym.com](https://www.evernym.com)]([https://www.evernym.com](https://www.evernym.com)) (accessed on 19 October 2020). * (6) Nuggets. 2018.