# PriSign, A Privacy-Preserving Single Sign-On System for Cloud Environments
## 5 Construction of PriSign
### New Results and Building Blocks
#### 5.2.2 Attribute-Based Credentials with Blindness  
We construct an attribute-based credential with blindness (ABCB) scheme by making two crucial modifications to the anonymous credential in [38]: (1) we streamline the threshold issuance functionality of the original scheme to ensure that there is only one issuer in the ABCB scheme and (2) we extend it to support both blind issuing of user attributes and adding non-blind attributes to user credentials by the issuer in the issuing credential algorithm. In short, attributes of user credentials can come from both user and issuer, and attributes from the user are hidden from the issuer. * ABCB.Setup\((1^{\lambda},l)\to pp\): On input of a security parameter \(1^{\lambda}\) and a positive integer \(l\), this algorithm generates a bilinear group \(\mathcal{BL}=(\mathbb{G}_{1},\mathbb{G}_{2},\mathbb{G}_{T},e,p,g,\widetilde{g})\) and sets \(pp=(B\mathcal{L},l)\). * ABCB.CredKeyGen\((pp)\to(isk,ipk)\): The issuer chooses \((a,b_{1},\cdots,b_{l})\xleftarrow{R}\mathbb{Z}_{p}^{*}\), then computes \(\widetilde{A}=\widetilde{g}^{a}\) and \(\widetilde{B}_{i}=\widetilde{g}^{b_{i}},B_{i}=g^{b_{i}}\) for \(i\in[1,l]\). Then, it outputs a private key \(isk=(a,b_{1},\cdots,b_{l})\) and public key \(ipk=(\widetilde{A},\widetilde{B}_{1},\cdots,\widetilde{B}_{l},B_{1},\cdots,B_{l})\). * ABCB.Issue.U\((\{m_{j}\}_{j\in[1,l^{\prime}]})\leftrightarrow\)ABCB.Issue.1\((isk,\,ipk,\{m_{j}\}_{j\in[l^{\prime}+1,l]}))\to\textit{ucred}\): This algorithm is used to issue attribute-based credentials for users, with attributes consisting of two parts: (1) attributes that the user owns are hidden from the issuer \(\{m_{j}\}_{j\in[1,l^{\prime}]}\) and (2) attributes that the issuer adds to the user \(\{m_{j}\}_{j\in[l^{\prime}+1,l]}\). * ABCB.PreBlind\((\{m_{j}\}_{j\in[1,l^{\prime}]},\mathsf{CTX})\to(d,C)\): The user chooses a secret key \(d\xleftarrow{R}\mathbb{Z}_{p}^{*}\), then computes a public key \(D=g^{d}\) and a group element \(h=\mathsf{HASH}^{\prime}(\mathsf{CTX},D)\in\mathbb{G}_{1}\), chooses a random \((r_{1},r_{2},\cdots,r_{l^{\prime}})\xleftarrow{R}\mathbb{Z}_{p}^{*}\), and computes the ElGamal encryption for each \(m_{j}\) (\(j\in[1,l^{\prime}]\)): \(C_{j}=(C_{j,D},C_{j,1})\xleftarrow{R}(g^{r_{j}},D^{\prime}jh^{m_{j}})\). The user computes a ZKSoK \(\Pi_{3}=\mathsf{ZKSoK}\{(d,r_{1},\cdots,r_{l^{\prime}},m_{1},\cdots,m_{l^{ \prime}}):D=g^{d},C_{j}=(g^{r_{j}},D^{\prime}jh^{m_{j}})\ \forall j\in[1,l^{\prime}]\}\) and sets \(C=(C_{1},\cdots,C_{l^{\prime}},\Pi_{3},D)\). * ABCB.BlindSign(\(isk\), \(ipk\), \(C\), \(\{m_{j}\}_{j\in[[t^{\prime}+1,t],\mathsf{CTX})\}\rightarrow\tau^{\prime}\): After \(\Pi_{3}\) is verified, the issuer recomputes \(h=\mathsf{HASH}^{\prime}(\mathsf{CTX},D)\) and returns \(\tau^{\prime}=(\tau^{\prime}_{1},\tau^{\prime}_{2})\), where \(\tau^{\prime}_{1},\tau^{\prime}_{2}\) are computed as follows: \(\tau^{\prime}_{1}=h^{a}\prod_{j=1}^{t^{\prime}}c^{b_{j}}_{j,1}\cdot h^{\sum_{j =t^{\prime}+1}^{j}b_{j}m_{j}}\), \(\tau^{\prime}_{2}=\prod_{j=1}^{t^{\prime}}c^{b_{j}}_{j,0}\). * ABCB.Unblind(\(d,\tau^{\prime},\{m_{j}\}_{j\in[1,t]}\)) \(\rightarrow\)\(ucred\). The user computes \(\tau_{1}=h\), \(\tau_{2}=\tau^{\prime}_{1}\tau^{\prime}_{2}-d\) and sets \(ucred=(\tau_{1},\tau_{2})\). The user accepts the credential \(ucred\) if \(e(\tau_{2},\widetilde{g})=e(\tau_{1},\widetilde{A}\prod_{j=1}^{t}\widetilde{ B}_{j}^{m_{j}})\) holds. * ABCB.Show(\(ucred,\{m_{j}\}_{j=1}^{l},\mathcal{D}\)) \(\rightarrow\)\(tok\): The user chooses \(r_{1},r_{2}\stackrel{{ R}}{{\leftarrow}}\mathbb{Z}_{p}^{*}\), computes \(\tau^{\prime}_{1}=\tau^{\prime_{1}}_{1},\tau^{\prime}_{2}=\tau^{\prime_{1}}_{ 1},\
u^{\prime}=\tau^{\prime_{2}}_{1},\kappa^{\prime}=\widetilde{A}\prod_{j \in[1,t],\mathcal{D}}\widetilde{B}_{j}^{m_{j}}\widetilde{g}^{\tau_{2}}\), and computes a ZKSoK \(\Pi_{4}=\mathsf{ZKSoK}\{(\{z,\{m_{j}\}_{j\in[1,t]/\mathcal{D}}\}):\
u^{\prime}= \tau^{\prime_{2}}_{1}\wedge\kappa^{\prime}=\widetilde{A}\prod_{j\in[1,t]/ \mathcal{D}}\widetilde{B}_{j}^{m_{j}}\widetilde{g}^{\tau_{2}}\}\).