How can two UProve token holders prove to a 3rd party that they aren't the same user? Suppose I have two users who are issued two different UProve IDs.  The Issuer has guaranteed that one UProve token bearer will never have more than one UProve token ID.


How can I use UProve to guarantee that two users are "different" without disclosing their actual private ID?


Here is a scenario:  An online voting system wants to use UProve to anonymously collect votes.  They decide to trust an Issuer who has full knowledge of the end user, but the relying pary has to accept the fact that they will know nothing about the end user at all.

The polling station (relying party) only needs to know that the same UProve ID wasn't used to cast a second vote.  The only UProve scenario I know of that would work here is proving the user's SSN (or similar fixed ID).  

In this case I don't want to disclose anything.

Is this possible?
The U-Prove Technology Overview V1.1 shows that this can be done. The issuer knows who the individual is but can't correlate that with verifier or prover use.

Upon setup the issuer can have extra attributes available that upon request of authorization from the prover the verifier can have access to. The verifier could use such an attribute and only successfully verify if it hasn't seen that attribute before.