# Anonymous Access System with Limited Number of Uses in a Trustless Environment
## 3 Background  
As introduced earlier, this proposal builds upon the anonymous credential authentication protocol described in [4] based on verifiable attributes. This section offers a general overview of that protocol. Table 1 provides a detailed guide to the notation used throughout this work. The anonymous credential authentication protocol defines three distinct roles: the user (\(\mathcal{U}\)), who seeks authentication, the attribute provider (\(\mathcal{AP}\)), who holds information about the user, and the service provider (\(\mathcal{SP}\)) who offers services to the user contingent upon predefined conditions. Each of these roles has corresponding pairs of private and public keys, denoted by (\(sk_{\mathcal{U}}\), \(pk_{\mathcal{U}}\)), (\(sk_{\mathcal{AP}}\),\(pk_{\mathcal{AP}}\)), and (\(sk_{\mathcal{SP}}\), \(pk_{\mathcal{SP}}\)), respectively. The anonymous credential authentication protocol contains two sub-protocols. The credential issuance protocol, between \(\mathcal{U}\) and \(\mathcal{AP}\), and the credential presentation protocol, between \(\mathcal{U}\) and \(\mathcal{SP}\). The detailed steps for the credential issuance protocol are the following:  
1. \(\mathcal{U}\) sends the scope \(S\) and their public key \(pk_{\mathcal{U}}\) to \(\mathcal{AP}\). 2. \(\mathcal{AP}\) computes the verifiable attribute \(\delta_{\mathcal{AP}}\) as follows: \[\delta_{\mathcal{AP}}=(H(S)+sk_{\mathcal{AP}})^{-1}\cdot pk_{\mathcal{U}}\] that links the scope \(S\) with \(\mathcal{U}\)'s public key through the private key of \(\mathcal{AP}\). 3. \(\mathcal{AP}\) sends \(\mathcal{U}\) the computed \(\delta_{\mathcal{AP}}\). 4. \(\mathcal{U}\) computes their \(id_{\mathcal{U}}\): \[id_{\mathcal{U}}=H(S)^{-1}(sk_{\mathcal{U}}+H(S))^{-1}\cdot pk_{\mathcal{U}}\] (1)Once this protocol has been completed, \(\mathcal{U}\) can anonymously authenticate to \(\mathcal{SP}\) using the credential presentation protocol. This protocol has the following steps:  
1. \(\mathcal{U}\) chooses \(b\in_{R}\mathbb{F}_{q}^{*}\) as a factor to blind the values needed to obtain the anonymous credentials and computes \(\mathcal{C}^{\prime}\): \[ \begin{split}& sk_{\mathcal{U}}^{\prime}=b\cdot sk_{\mathcal{U}} \\ & pk_{\mathcal{U}}^{\prime}=sk_{\mathcal{U}}^{\prime}\cdot P\\ &\delta_{\mathcal{AP}}^{\prime}=b\cdot\delta_{\mathcal{AP}}\\ & P^{\prime}=b\cdot P\\ & pk_{\mathcal{AP}}^{\prime}=b\cdot pk_{\mathcal{AP}}\\ & C^{\prime}=b\cdot H(S)\cdot P\end{split} \] (2)
2. \(\mathcal{U}\) also computes a NI-Schnorr ZKP by choosing \(r^{\prime}\in_{R}\mathbb{F}_{q}^{*}\) and obtaining: \[ \begin{split}& R^{\prime}=r^{\prime}\cdot P\\ & h^{\prime}=H(R^{\prime})\\ & t^{\prime}=h^{\prime}\cdot sk_{\mathcal{U}}^{\prime}+r^{\prime} \end{split} \] (3)
3. \(\mathcal{U}\) sends \(\mathcal{SP}\) the identifier \(id_{\mathcal{U}}\), the anonymous credentials \(\delta_{\mathcal{AP}}^{\prime}\), \(pk_{\mathcal{U}}^{\prime}\), \(pk_{\mathcal{AP}}^{\prime}\), \(P^{\prime}\), \(C^{\prime}\), and the NI-Schnorr ZKP proof of the private key \((R^{\prime},h^{\prime},t^{\prime})\). 4. \(\mathcal{SP}\) verifies that \(pk_{\mathcal{AP}}^{\prime}\) is the blinded value of \(pk_{\mathcal{AP}}\) by computing: \[e(pk_{\mathcal{AP}}^{\prime},P)\stackrel{{\rightarrow}}{{=}}e(pk_{ \mathcal{AP}},P^{\prime})\] (4)