introduction of pseudonyms is a useful extension to anonymity. Pseudonyms allow users to choose a different name with each organization. While pseudonyms allow organizations to associate users with accounts, organizations cannot determine the real identities of their customers. Nevertheless, by using an anonymous credential, certain statements about the relationship of a user with one organization, under a pseudonym, can be proven to another organization that knows the user only under a different pseudonym. History Anonymous credential systems are related to the concept of untraceable or anonymous payments. In this important work, Chaum presents a new cryptographic primitive, blind signature protocols. In such a scheme the signer neither learns the message he signs, nor the signature the recipient obtains for his message. Blind signatures are an important building block of many privacy-sensitive applications, such as anonymous payments, voting, and credentials. The original idea for an anonymous credential system was derived from blind signatures, but relied on a trusted party for credential transfer—the translation from one pseudonym to another. The blind signature scheme introduced by Chaum was based on RSA signatures and based on the discrete logarithm problem can be used for constructing anonymous credential systems. Stefan Brands generalized digital credentials with secret-key certificate based credentials, improving on Chaum's basic blind-signature based system in both the discrete logarithm and strong RSA assumption settings. Brands credentials provide efficient algorithms and privacy in an unconditional commercial security setting, along with several other features such as a proof of non-membership blacklist. Another credential form that adds a new feature to anonymous credentials: multi-show unlinkability. These are the group signature related credentials of Camenisch et al. The introduction of Group signatures opened up the possibility of multi-show unlinkable showing protocols. While blind signatures are highly relevant for electronic cash and one-show credentials, a new cryptographic primitive, called group signature, opened new possibilities for the construction of privacy enhancing protocols. As is observed in their article, group signatures bear a resemblance to Chaum's concept of credential systems. Using a group signature scheme, the members of a group can sign a message with their respective secret keys. The resulting signature can be verified by everyone who knows the common public key, but the signature does not reveal any information about the signer except that she is a member of the group. Usually there exists another entity called the group manager, who can reveal the exact identity of the