An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation
Secure hash-and-sign signatures without the random oracle