# Privacy-Preserving Solution for European Union Digital Vaccine Certificates
## 5 Privacy-Preserving Solution for EU Digital Vaccine Certificates
### Cryptographic Core  
In this section, cryptographic algorithms are described in more detail, including their input and output variables. 1. \((sk_{I},pk_{I},params_{I},pk_{\gamma},sk_{\gamma})\leftarrow\mathtt{Setup}(1^{ \kappa})\): This algorithm works in two phases. At first, on the input of the security parameter \(\kappa\), the I/RA generates and publishes the public parameters \(params_{I}\) and generates the private/public key pair \((sk_{I},pk_{I})\), where \(pk_{I}\) is published and \(sk_{I}\) is kept secret. Therefore, the I/RA works as follows: * Choose a bilinear map \(\mathbf{e}:\mathbb{G}_{1}\times\mathbb{G}_{2}\rightarrow\mathbb{G}_{T}\), where \(\mathbb{G}_{1}\), \(\mathbb{G}_{2}\), and \(\mathbb{G}_{T}\) are groups of the same prime order \(q\), \(g_{1}\) is a generator of \(\mathbb{G}_{1}\), and \(g_{2}\) is a generator of \(\mathbb{G}_{2}\). * Define a secure hash function : \(\mathbb{G}_{1}\times\mathbb{G}_{1}\times\mathbb{G}_{1}\rightarrow\mathbb{Z}_{q}\). * Choose a symmetric encryption scheme \(SYM=(Enc_{SYM},Dec_{SYM})\). * Choose \(sk_{I}=(x_{0},\ldots,x_{n})\in_{R}\mathbb{Z}_{q}\) as the issuer's private key, and set \(pk_{I}=(h_{0},\ldots,h_{n})=(g_{2}^{x_{0}},\ldots,g_{2}^{x_{n}})\) as the issuer's public key. * Publish the public system parameters \(params_{I}=(q,\mathbb{G}_{1},\mathbb{G}_{2},\mathbb{G}_{T},g_{1},g_{2},\mathbf{e})\). Second, on the input of the parameter \(\kappa\), the VER performs the following steps: * Randomly choose a private key \(sk_{V}\in_{R}\mathbb{Z}_{q}\). * Compute and publish its public key \(pk_{V}=g_{1}^{sk_{V}}\). 2. \((\sigma,\sigma_{x_{0}},\ldots,\sigma_{x_{n}})\leftarrow\mathtt{Issue}(sk_{I},( m_{1},\ldots,m_{n}))\): On the input of the issuer's private key \(sk_{I}\) and the user's attributes \((m_{1},\ldots,m_{n})\), this protocol outputs the issuer's signature of the user's attributes \(\sigma,\sigma_{x_{0}},\ldots,\sigma_{x_{n}}\). This algorithm is run as an interactive protocol between the I/RA and the USR as follows: * The USR sends all its attributes \((m_{1},\ldots,m_{n})\) to the I/RA. * The I/RA computes the signatures of the USR's attributes as \(\sigma=g_{1}^{\frac{1}{\mathbb{G}_{0}+\mathbb{m}_{1}x_{1}+\cdots+\mathbb{m}_{n }x_{n}}}\) where \(sk_{I}=(x_{0},\ldots,x_{n})\) is its private key. * The I/RA calculates the auxiliary values as \(\sigma_{x_{i}}=\sigma^{x_{i}}\), for \(i=0,1,\ldots n\). * The I/RA sends \(\sigma\) and \(\Lambda=(\sigma_{x_{0}},\ldots,\sigma_{x_{n}})\) to the USR. Issue protocol steps are sketched in Figure 4.
3. \((0,1)\leftarrow\mathtt{Show-Verify}(m_{z\in D},\Lambda,pk_{V},pk_{I},nonce)\): This algorithm works in two phases. At first, on the input of the verifier's public key \(pk_{V}\), signatures \(\sigma,\Lambda\), authentication challenge _nonce_, and disclosed attributes \(m_{z\in D}\) (where \(D\) denotes the set of all revealed attributes), the USR outputs the encryption of the disclosed attributes \(c_{z\in D}\), its cryptographic proof \(\pi\), and the randomized credential \(\hat{\sigma}\). This phase is defined as the Show algorithm. Secondly, on the input of the issuer's public key \(pk_{I}\), the encrypted attributes \(c_{z\in D}\), the proof \(\pi\), and the randomized credential \(\hat{\sigma}\), the VER outputs \(0/1\), i.e., rejection or acceptance of the proof of knowledge of attributes. This phase is defined as the Verify algorithm. Therefore, the steps are as follows: * The VER generates a random authentication challenge _nonce_ and sends it to the USR. * The USR randomizes its digital credential \(\sigma\) and \(\Lambda\) and constructs a proof of knowledge \((\hat{\sigma},\pi)\), including the VER's authentication challenge _nonce_. * The USR generates a symmetric key \(k_{\text{enc}}=KDF(j)\) and encrypts the attributes \(c_{i}=Enc_{SYM}(m_{i},k_{\text{enc}})\).