How to verify a trusted Issuer in U-Prove I work with U-Prove. In U-Prove they talk about a trusted Issuer, but I never saw how the trust is verified. The trust is essential, because the Verifier wants to know if the token was created with a trusted Issuer or not.

The U-Prove Cryptographic Specification V1.1 describes how to verify the signature of the Issuer. But there is no direct link if the signature is from a trusted Issuer or mayby from the Prover itself. The Issuer-Parameter could not be used, they are variable and created everytime a Prover wants to get a token.

Does someone has an idea or link where the trust establishment is described?



Updated question 24.02.2017

Maybe my first question was a bit unclear. Lets imagine that the Prover wants to create a token by himself. He creates the IssuerParameters and runs the protocol (Figure 8) by its own (this means he simulates the Issuer). Now he is the holder of the Issuer private key $y_0$. The Prover presents the created token to the Verifier. Signature (Figure 4) for the presented token is correct. But the Verifier does not know if it was a trusted or untrusted Issuer, who created the token with the Prover. The Verifier just knows that the received token relates to the private key $y_0$.

What I understand out of the Issuance protocol (Figure 8) and saw in the SDK-Implementation is, that every time the Prover requests a token, the IssuerParameters (generators $g_i$, $i$ = # attributes) and the private key $y_0$ (as well as $g_0$) are generated new.
For any credentials scheme, trust is defined out of the scheme. It might be your employer or your government.

Please note there is no clear separation whether signature is coming from Issuer or Prover. Signature on token public key $h$ is verified with Issuer public key (Figure 4) as a proof of equality of two logarithms. However, it is created by running a blind signature protocol running both by Issuer and User (Figure 8). There is no chance to create this signature without Issuer private key $y_0$.

Please consider to double-check Issuer parameters generation (section 2.3.1): once on scheme setup.