Proving the possession of signature in zero-knowledge Does anybody know an efficient mechanism to prove the possession of a digital signature (e.g. RSA) on a certain attribute (message) in zero-knowledge? That is, without revealing the actual signature (against tracking, for privacy) prove that you have one? Thanks a lot in advance!
Guillou and Quisquater (link) present a zero-knowledge proof of an RSA signature. Basically, the scheme is as follows:

Public knowledge: RSA modulus $n$, public RSA exponent $v$, preimage $X$.

Secret knowledge for prover: $A$, such that $A^v = X \mod n$.

$$
\begin{matrix}
\mathcal{P} &amp; &amp; \mathcal{V} \\
r \xleftarrow{\$} \mathbb{Z}_n^* \phantom{\mod n} &amp; &amp; \\
T \leftarrow r^v \mod n &amp; &amp; \\
 &amp; \xrightarrow{\quad{}T\quad{}} &amp; \\
 &amp; &amp; d \xleftarrow{\$} \{0,1,\ldots,v-1\} \\
 &amp; \xleftarrow{d} &amp; \\
 t \leftarrow A^dr \mod n &amp; &amp; \\
 &amp; \xrightarrow{\quad{}t\quad} &amp; \\
 &amp; &amp; t^v \stackrel{?}{=} X^{d}T \mod n
\end{matrix}
$$

In this diagram, $\leftarrow$ denotes assignment of a value to a variable and $\xleftarrow{\$}$ denotes uniformly random selection from a finite set.