# Anonymous Access System with Limited Number of Uses in a Trustless Environment
## 4 The Proposal
### Access Counter Creation Protocol  
Once the credential issuance protocol has been executed, and before \(\mathcal{U}\) accesses the service for the first time, \(\mathcal{U}\) must establish the maximum number of uses \(n\) for which its credential can be accepted. This value is determined through the access counter creation protocol performed by \(\mathcal{U}\) and \(\mathcal{SP}\), and comprises Steps 4, 5, and 6 from Figure 1 as depicted in Figure 2.  
The detailed steps for this protocol are the following:  
1. \(\mathcal{U}\) currently has \(\delta_{\mathcal{AP}}\), \(H(S)\), \(sk_{\mathcal{U}}\), \(pk_{\mathcal{U}}\), \(n\), and \(id_{\mathcal{U}}\)
2. \(\mathcal{U}\) chooses \(b\in_{R}\mathbb{F}_{q}^{*}\) as a factor to blind the values needed to obtain the anonymous credentials.
3. \(\mathcal{U}\) computes: \[\begin{split} sk_{\mathcal{U}}^{\prime}&=b\cdot sk_ {\mathcal{U}}\\ pk_{\mathcal{U}}^{\prime}&=sk_{\mathcal{U}}^{ \prime}\cdot P\\ \delta_{\mathcal{AP}}^{\prime}&=b\cdot\delta_{ \mathcal{AP}}\\ P^{\prime}&=b\cdot P\\ pk_{\mathcal{AP}}^{\prime}&=b\cdot pk_{\mathcal{AP} }\\ C^{\prime}&=b\cdot H(S)\cdot P\end{split}\] (11)
4. \(\mathcal{U}\) also computes a NI-Schnorr ZKP by choosing \(r^{\prime}\in_{R}\mathbb{F}_{q}^{*}\) and doing: \[\begin{split} R^{\prime}&=r^{\prime}\cdot P\\ t_{n}&=(n+1)\cdot H(id_{\mathcal{U}})\cdot sk_{ \mathcal{U}}^{\prime}+r^{\prime}\end{split}\] (12)
5. \(\mathcal{U}\) sends \(\mathcal{SP}\) the identifier \(id_{\mathcal{U}}\), the anonymous credentials \(\delta_{\mathcal{AP}}^{\prime}\), \(pk_{\mathcal{U}}^{\prime}\), \(pk_{\mathcal{AP}}^{\prime}\), \(P^{\prime}\), \(C^{\prime}\), \(n\), and the NI-Schnorr ZKP proof of the private key \((R^{\prime},t_{n})\) by calling the Create function of \(\mathcal{SP}\) who, in turn, calls a Smart Contract with these values.
6. The Smart Contract verifies that \(pk_{\mathcal{AP}}^{\prime}\) is the blinded value of \(pk_{\mathcal{AP}}\) by computing: \[e(pk_{\mathcal{AP}}^{\prime},P)\overset{?}{=}e(pk_{\mathcal{AP}},P^{\prime})\] (13)
7. The Smart Contract also verifies that the credentials are valid: \[e(C^{\prime}+pk_{\mathcal{AP}}^{\prime},\delta_{\mathcal{AP}}^{\prime}) \overset{?}{=}e(P^{\prime},pk_{\mathcal{U}}^{\prime})\] (14)
8. The Smart Contract verifies that \(id_{\mathcal{U}}\) is also valid by computing: \[e(C^{\prime}+pk_{\mathcal{U}}^{\prime},H(S)\cdot id_{\mathcal{U}})\overset{?}{= }e(P,pk_{\mathcal{U}}^{\prime})\] (15)
9. The Smart Contract verifies that \(\mathcal{U}\) possesses the private key checking the correctness of the NI-Schnorr ZKP as follows: \[t_{n}\cdot P\overset{?}{=}R^{\prime}+(n+1)\cdot H(id_{\mathcal{U}})\cdot pk _{\mathcal{U}}^{\prime}\] (16)
10. Finally, the Smart Contract persists on an array indexed by \(H(id_{\mathcal{U}})\) an object containing \(n\), the maximum number of usages, the counter of usages (initialised to 0), and \(pk_{\mathcal{U}}^{\prime}\), the blinded public key of the user.  
If the Smart Contract execution is successful, the access counter is ready to use; otherwise, execution is reverted and no counter is created.