# Decentralized Identity Authentication with Auditability and Privacy
## 5 Privacy-Preserving Protocol
### Final Protocol
#### 5.2.1 New Token and Its Consistency
Now, the \(SP\) input (Token-match, \(\mathit{sid}\), \(SP\), \(\mathit{authReq}_{i}\)) is received from \(\mathcal{F}_{\text{DID}}\), after which \(\mathcal{F}_{\text{DID}}\) checks for an entry \((\mathit{sid}\), \(SP\), \(\mathit{tknReg}_{i}\), 1). Once confirmed, it sends a notification (Token-match, \(\mathit{sid}\), \(SP\), \(\mathit{authReq}_{i}\)) to \(\mathcal{S}\); otherwise, the command is ignored. Lastly, it receives (Token-matched, \(\mathit{sid}\), \(SP\), \(\mathit{Inclusion}\)) from \(SP\), and it validates that no entry (\(\mathit{sid}\), \(SP\), \(\mathit{Inclusion}\), 0) has been recorded before. In the case of validation failure, \(\mathcal{F}_{\text{DID}}\) returns \((\text{Error},\mathit{sid})\) to \(SP\) and halts; otherwise, it returns (Retrive-matched, \(\mathit{sid}\), \(SP\), \(\mathit{Inclusion}\)) to \(SP\) and records the entry \((\mathit{sid}\), \(SP\), \(\mathit{Inclusion}\), 1). **Functionality \(\mathcal{F}_{\text{ZK}}\)**: \(\mathcal{F}_{\text{ZK}}\) is parameterized with a relation \(R\) and communicates with a prover \(P\), a verifier \(V\), and an adversary \(\mathcal{S}\). It receives a command (ZKPProver, \(\mathit{sid}\), \((x,w)\)) from \(P\) for a statement \(x\) associated with a witness \(w\); if \(R(x,w)=1\), then, it sends \((\mathit{zkproof},\mathit{sid},x)\) to \(V\) and \(\mathcal{S}\) and exits. Otherwise, it exits. **Functionality \(\mathcal{G}_{\text{LEDGE}}\)**: The ideal blockchain functionality \(\mathcal{G}_{\text{LEDGE}}\) runs with a set of clients \(C\in\mathcal{C}\), a service provider \(SP\), and an ideal adversary \(\mathcal{S}\). \(\mathcal{G}_{\text{LEDGE}}\) holds a database indexed on integers and initializes a counter \(\mathit{idx}=0\). First, it receives a command (Write, \(\mathit{sid}\), \(\mathit{C}_{i}\), \(\mathit{regReq}_{i}\)) from \(\text{C}_{i}\) in the registration phase, after which \(\mathcal{F}_{\text{DID}}\) checks whether \((C,\mathit{sid})\) is stored in the database under the index \(\mathit{idx}\) that corresponds to \(\mathit{cnt}\) from the client. It sends a notification (Write,\(\mathit{sid}\), \(\text{C}_{i}\)) to \(\mathcal{S}\) and updates the counter: \(\mathit{idx}=\mathit{idx}+1\). Next, it receives (Token-match, \(SP\), \(\mathit{sid}\), \(\mathit{authReq}_{i}\)) from \(\mathcal{F}_{\text{AUTH}}\) (i.e., the service provider \(SP\)) in the authentication phase; if there is an entry (\(\mathit{sid}\), \(SP\), \(\mathit{authReg}_{i}\), 1), then, it checks for a tuple \((\text{C}_{i},\mathit{tknReg}_{i})\) stored under the index \(\mathit{idx}\). If there is, then it passes (Token-matched, \(SP\), \(\mathit{authReq}_{i}\)) to \(SP\). **Functionality**\(\mathcal{F}_{\text{AUTH}}\): This functionality is parameterized with the participants and \(\mathcal{G}_{\text{LEDGER}}\) for authentication. It receives (Login, \(sid\), \(C_{i}\), \(authReq_{i}\)) from \(C_{i}\in\mathcal{C}\). If there is a record \((C_{i},authReq_{i},1)\), then it forwards it to \(\mathcal{S}\), and then returns (Login-verified, \(sid\), \(C_{i}\), \(authReq_{i}\)) to \(C_{i}\). After this, it interacts with \(\mathcal{G}_{\text{LEDGER}}\) by sending a command (Token-match, \(sid\), \(SP\), \(authReq_{i}\)), to which it responds with (Token-matched,\(sid\), \(SP\), \(authReq_{i}\)). \(\mathcal{F}_{\text{AUTH}}\) records \((C_{i},authReq_{i})\) and forwards (Login-verified, \(sid\), \(C_{i}\),\(authReq_{i}\)) to \(C_{i}\). ### Formalized Final Protocol

**Protocol**\(\pi_{\text{DID}}\): Our construction operates in the \((\mathcal{F}_{\text{ZK}}\), \(\mathcal{G}_{\text{LEDGER}}\), \(\mathcal{F}_{\text{AUTH}})\)-hybrid model and in the phases explained in the previous section. In the initialization phase, it receives a command \((\text{Start},sid)\) from the environment \(\mathcal{Z}\); then, the client \(C_{i}\) initializes the required keys. After this step, it sends the command (Write, \(sid\), \(C_{i}\), \(vk\), \(vk_{e}\), \(vk_{vrf}\)) to \(\mathcal{G}_{\text{LEDGER}}\) and \(SP\).