Anonymous authentication with subset queries (extended abstract).
We develop new schemes for anonymous authentication that support identity escrow. Our protocols also allow a prover to demonstrate membership in an arbitrary subset of users; key revocation is an important special case of this feature. Using the Fiat-Shamir heuristic, our interactive authentication protocols yield new constructions for non-interactive group signature schemes. We use the higher-residuosity assumption, which leads to greater efficiency and more natural security proofs than previous constructions. It also leads to an increased vulnerability to collusion attacks, although countermeasures are available.
Introduction
Consider an o-ce building where each employee is given
a smartcard for opening the front door to the building.
Employees are often concerned that their movements in
and out of the building are being recorded. Consequently
it is desirable that the authentication protocol carried out
between the smartcard (prover) and the door lock (ver-
ier) does not identify the employee. This is the basic
problem of Anonymous Authentication: a user wishes to
prove that she is a member of an authorized group (e.g.
employees that are allowed to enter the building), but
does not want to reveal her identity.
The simplest solution to anonymous authentication is
to give all employees a copy of the same secret key. This
way the door lock has no information as to which employee
it is authenticating. But then if a crime is committed
inside the building there is no authorized identity
escrow agent that can undo the anonymity and determine
who was present in the building at the time. More seri-
ously, there is no easy way to revoke a user's key without
Supported by NSF.
reissuing keys to all participants.
In this work, we develop new schemes for anonymous
authentication that support identity escrow and key re-
vocation. The identication transcript by itself reveals
nothing further about the prover's identity. The transcript
together with an \escrow" key reveals the prover's
identity completely. The security of our schemes rests
on the higher-residuosity assumption, rst considered by
Cohen and Fisher [14, 3], as well as on the di-culty of
computing modular roots. The use of higher-residuosity
leads to increased e-ciency and more natural security
proofs than previous constructions. It also increases vulnerability
to an attack by colluding provers to mask their
identities from the escrow agent, although countermeasures
are available.
We also extend our schemes to allow a prover to
demonstrate membership in an arbitrary subset of users,
anonymously and with identity escrow. In our o-ce building
scenario, each door might have a dierent list of authorized
employees. To gain access, an employee proves
to a door that is on its list. Revocation of a user's key
is an important special case of this feature | the subset
query is simply revised to exclude everyone on a revocation
hotlist.
Using the Fiat-Shamir heuristic [18], our interactive
authentication protocols yield non-interactive group signature
schemes of great e-ciency. A group signature on
a certain message can be veried by anyone, but the signature
no information as to which member of the
group generated it.
1.1 Related work
Group signatures [11, 12, 8, 24, 2] were rst described
by Chaum and van Heyst. Recently, Camenisch and
Stadler [10] present a solution that is much more ecient
than previous solutions, although it relies on somewhat
unusual security assumptions. In particular, given
an RSA key e; N and an element a 2 Z
N of large multiplicative
order, it must be infeasible to produce a triple
such that a
(mod N ). The heuristic nature of these security assumptions
is underscored by recent vulnerabilities found by
Ateniese and Tsudik [2]. Kilian and Petrank [22] present
anonymous authentication schemes with identity escrow,
based on similar security assumptions.
Anonymous authentication with subset queries, but
without identity escrow, follows as an application of
proofs of partial knowledge [15, 17, 16]. There are a
number of proposals for payment schemes with revocable
anonymity, beginning with Brickell, Gemmell and
Kravitz [7].
1.2 Terminology and Denitions
We give some terminology and denitions. For a more
formal treatment of an identity escrow model, we refer the
reader to Kilian and Petrank [22]. In our authentication
schemes, there are \users" who authenticate themselves
to \veriers". There is an \issuer" who gives a secret key
to each new user when the user is added to the system.
There is an \escrow agent" who examines the transcript
of an authentication protocol to determine the identity
of the user. A \subset query" enables the user to prove
membership in some subset of the user population.
We say that an authentication protocol is \sound" if
the verier rejects with overwhelming probability when
the prover is not a legitimate user. A subset query protocol
is sound if the verier rejects with overwhelming
probability when the prover is not in the designated sub-set
of users. We say that a subset query protocol is k-
resilient against an \outsider attack" if no coalition of k
users outside the designated subset can fool the verier.
An authentication protocol is \anonymous" if no information
about the prover's identity is revealed, other
than that the prover is a legitimate user (or for a subset
query protocol, that the prover is in a designated subset).
This includes inferences that might be drawn from multiple
executions of the protocol (\unlinkability"). Note that
anonymity implies that no information about the user's
secret is revealed to the verier.
An authentication protocol has \identity recovery" if
the escrow agent can determine the identity of the prover
from a transcript of the protocol together with some trap-door
information. We say that a protocol is k-resilient
against a \masking attack" if no coalition of k users can
cause the verier to accept while the escrow agent is unable
to determine any of their identities.
1.3 Summary of Results
In Section 2, we present our basic scheme for anonymous
authentication. It is sound if it is hard to extract
roots modulo a composite of unknown factorization. It is
anonymous if it is hard to distinguish high-order residues
from non-residues. It is only 1-resilient against a masking
attack. The scheme can be made k-resilient as discussed
below. In Section 2.3, an instantiation is given in which
the entire communication complexity is only ve RSA-
sized values sent over three rounds.
In Section 3, we present a scheme for anonymous authentication
with arbitrary subset queries. Soundness and
anonymity follow from the same hardness assumption as
the basic scheme. The communication complexity is un-
changed, although the work performed by prover and ver-
ier is proportional to the size of the query. It is only 1-
resilient against either an masking attack or an outsider
attack. It can be made k-resilient against an outsider attack
with an increase of a factor of O(m k ) in the work of
the verier and prover, where m is the total number of
users. Resilience against an outsider attack of any size is
possible at a work increase of O(), by limiting queries to
a predetermined collection of  subsets.
In Section 4, we show how to achieve k-resilience
against a masking attack for all of our schemes by applying
ideas from collusion-secure ngerprinting codes [6].
This countermeasure is not particularly e-cient. It is an
open problem to design more e-cient countermeasures
that are provably secure under natural cryptographic as-
sumptions. In Section 5, we give a summary and open
problems.
2 The basic scheme
We present an e-cient scheme that provides anonymous
authentication with identity escrow. The scheme is 1-
resilient against a masking attack. Let m be the total
number of users to be authenticated. Let ' > m be the
smallest prime larger than m. Our scheme is built on
top of any proof of knowledge for the the ''th root of a
number modulo pq. For example, the scheme can be
built on top of Guillou-Quisquater authentication [20].
Initialization To initialize the system the issuer performs
the following steps:
1. It generates an n-bit RSA modulus
that ' divides both p 1 and q 1 but ' 2 divides
neither. The factors p and q are kept secret.
2. It picks a random t 2 ZN and sets
In addition the issuer sets  2 ZN to be some
''th root of unity such that  6= 1 mod p and
The values N; T; ' are made public. The values t;
are kept secret.
Issuing a key To issue a key to user number i (recall
the issuer gives user i the secret key
. Note that  i is some ''th root of T .
Proving identity When user i wishes to authenticate
itself to a verier (e.g. a door lock) it executes the
protocol below. The protocol simultaneously checks
two things: (1) the user knows an ''th root of T , and
(2) the blinding factor r ' used during the protocol is
an ''th residue modulo N .
1: The user picks random r 2 Z
N . It computes
mod N and
It sends (u; y) to the the verier.
Step 2: The verier checks that y
and rejects if not.
Step 3: The user proves in zero-knowledge that u
is an ' 2 'th residue modulo N . He does so by
proving knowledge of an ' 2 'th root of u. Any
of a number of protocols can be used for this
purpose [21, 20].
The communication complexity of this protocol is logarithmic
in the number of users. This is optimal from an
information theoretic point of view since otherwise the
transcript does not contain enough information for the
escrow agent to recover the user's identity. In Section 2.3
we show an instantiation of this protocol with just three
rounds of communication and seven modular exponentiations

2.1 Proof of Security
We show that the identication protocol is sound, reveals
no information about the user's secret, and reveals no
information about the user's identity.
Lemma 2.1 Let P be a user for which the authentication
protocol succeeds with probability at least . Then there
exists a polynomial time (in n and 1=) extractor that extracts
an 'th root of T from P. Consequently, any prover
for which the authentication protocol succeeds knows an
''th root of T .
Proof In Step 3 we use a proof of knowledge of an
th root of u. Therefore, there exists a polynomial
time (in n and 1=) extractor that when interacting
with P extracts an ' 2 th root of u. Let r be the extracted
root. Since the verier accepts the interaction
with P we know that y
Therefore y
mod N and hence y=r ' mod N
is an 'th root of T . The extractor outputs y=r ' mod N .
To prove the protocol is zero knowledge we show a simu-
lator. Let
Z (2)
The correctness of the simulation relies on a standard
assumption that for N 2 Z (2) (n) the set of ''th residues
in Z
N is indistinguishable from all of Z
N .
Lemma 2.2 Assuming indistinguishability of ''th
residues of random N 2 Z (2) (n), the identication
protocol can be simulated by a polynomial time simulator
S.
Proof Let V be some verier. We show how to simulate
the interaction of the prover with V . First the simulator
S picks a random y 2 Z
N . It computes
and outputs (u; y) as the rst part of the simulation. Since
in Step 3 we use a zero-knowledge proof of ' 2 'th residuosity
there exists a simulator S 0 that takes u; N and V and
generates a transcript of Step 3 indistinguishable from a
real transcript. We show that by concatenating (u; y) and
the output of S 0 we get a transcript indistinguishable from
a real transcript.
Suppose a distinguisher D exists. We construct a
distinguisher D 0 that distinguishes between a random
N and a random y 2 Z
N . This will contradict the
assumption. On input x 2 Z
N algorithm D 0 works as
follows: First it picks a random t 2 Z
N and sets
It then computes It runs S 0 on
Finally it runs D on the concatenation of
(u; y) and the output of S 0 and outputs the same answer
as D. When x is an ''th residue modulo N we give D
the same distribution as in the real interaction. When x
is random in Z
N we give D the simulated distribution.
Hence, by denition of D algorithm D 0 will have the
required properties.
The simulation shows that no information about the
users identity is exposed during the protocol. The simulation
also proves unlinkability: the verier cannot determine
whether the same user interacts with the verier
multiple times.
We note that our hardness assumption is slightly different
from the one introduced by Cohen and Fisher [14].
In their setting, q 1 is not a multiple of ' (while p 1 is
still a multiple of ' but not ' 2 ). This would be quite dangerous
for our scheme, because two colluding users could
compute In our settings ' divides
both p 1 and q 1.
2.2 Recovery by Escrow Agent
We now show how an escrow agent can recover the user's
identity given the transcript of our identication protocol.
In the simplest version of the scheme the escrow agent is
given p and  mod p as its secrets. It recovers the user's
identity from the value y sent by the user during the iden-
tication protocol.
For an honest user i we know that
unknown r. Since
Indeed, r does not divide  it follows
that   has order '. Therefore, there exists a unique
To recover the user's
identity the escrow agent tries all until an i
is found satisfying condition 1. By using a \baby-step,
giant-step" trick, the work of the escrow agent can be
reduced to O(
log ') with O(
log ') precomputation
and O(
storage.
The proof that a single malicious user cannot hide its
identity from the escrow agent depends on a standard
assumption known as the ''th root of unity assumption.
Namely, for a prime ' > 2, no polynomial time algorithm
can nd (with non negligible probability) a non trivial
''th root of unity in Z
N for a random N 2 Z n
(2) .
Lemma 2.3 Suppose user i can employ a polynomial
time adversarial prover P so that (1) the verier accepts
the interaction with probability at least , and (2) the escrow
agent fails to recover the user's identity from the
transcript with probability at least . Then the ''th root of
unity assumption is false.
Proof Pick a random N 2 Z (2) . We show how P
can be used to nd an ''th root of unity modulo N
with probability at least . Pick a random t 2 Z
and compute
i to be  t. Then given N; T and  i prover P
will succeed in masking i's identity with probability
. Run the extractor of Lemma 2.1 on prover P . Let
t 0 be the result. We know t 0 is an ''th root of T .
One can show that with probability at least  we have
is a non-trivial ''th root of unity.
A coalition of two or more users can create a new key
that cannot be traced by the escrow agent. Indeed, if  i
and  j are keys belonging to two users then
N is a valid key whenever a+ b = 1. Furthermore,  does
not reveal the identity of either user. This attack will
frame an innocent user if the index ia
assigned. If the indices are issued secretly from a sparse
subset of size m << ', then the probability that a masking
attack will frame an innocent user can be greatly reduced.
We discuss how to make our scheme k-resilient against a
masking attack in Section 4.
2.3 An instantiation using Guillou-Quisquater
We describe an e-cient instantiation of our basic authentication
protocol.
1: The user picks random
N , and sends
mod N) to the verier.
Step 2: The verier sends back a random c 2 Z
N .
Step 3: The user responds with
Step 4: The verier accepts the authentication if
u c v mod N .
The protocol takes only three rounds of communication
and is e-cient in computation. The proof of security
follows from the proof of the Guillou-Quisquater protocol
and Lemmas 2.1 and 2.2. Recall that the GQ protocol
is only provably secure against a passive verier (i.e. a
verier that properly follows the protocol and then tries
to gain some information). Consequently our instantiated
protocol is provably secure in the same model. As always,
this is the price one has to pay for e-ciency [25].
2.4 Group Signature
Using the Fiat-Shamir heuristic [18], our scheme can give
an anonymous signature algorithm with identity escrow
(i.e., a \group signature" as introduced by Chaum and
van Heyst [11]). For example, consider the Guillou-
Quisquater instantiation from the previous subsection.
Let H be a cryptographically strong hash function. A
group signature of message m is (u; v;
mod
mod
and This technique can be applied whenever
the proof of knowledge from step 3 of the authentication
protocol is a public-coin protocol.
2.5 Security Enhancements
Here are some additional security enhancements that can
be applied to our basic scheme. These enhancements apply
to later schemes as well.
Untrusted escrow It is possible in all of our schemes
to prevent the escrow agent from being able to masquerade
as one of the users. The idea is that the
escrow agent need not know the full factorization of
N . For example, in the basic scheme we may use a
modulus N that is a product of three prime
The escrow agent need only be given p to recover the
user's identity. Thus, without knowing the complete
factorization of N it cannot masquerade as one of
the users.
Initialization There is no need for the issuer to generate
N and . Instead one can use the techniques of [5]
so that N and  are generated among k parties and
none of them know the factorization of N .
3 Subset Queries
In this section we discuss how to add subset queries to
our basic scheme. We show that the basic scheme can be
extended to enable a user to anonymously prove membership
in a given subset of users. Key revocation is a special
case of this feature: to revoke user i's key the verier (e.g.
the doorlock) asks the prover (e.g. a user's smartcard) to
prove membership in the subset P containing all users except
user i. All users except for user i will be successful
in their interaction with the verier. User i will be unable
to complete the proof.
We begin with a version that is simple to explain, allows
every subset query, and is very e-cient. Unfortu-
nately, it is only 1-resilient to both a masking attack and
an outsider attack. Then we give variations that increase
the resistance to an outsider attack. The communication
complexity of all of the protocols in this section is the
same as the basic scheme from Section 2, although there
is an increase in the computation performed by the prover
and verier. The ideas on which these constructions are
based have appeared and reappeared in the literature; our
work was most in
uenced by versions described in Chick-
Tavares [13] and Fiat-Naor [19].
3.1 Simple Subset Query Protocol
Here is a simple scheme that allows every subset query.
It is only 1-resilient against an outsider attack. The work
performed by the prover and verier increases over the
basic scheme, although the communication complexity remains
the same. Let m be the number of users.
Initialization The system issuer generates
in the basic scheme. The issuer then computes
are distinct
small primes dierent from '. The values
are made public (but not T ).
Issuing a key To issue a key to user number i (recall
the issuer gives user i the secret key
. Note that
i is as in the basic scheme.
Proving identity User i proves membership in an arbitrary
set of users P as follows:
1: The user picks random r 2 Z
N . It computes
mod N and
It sends (u; y) to the
verier.
Step 2: The verier checks that
and rejects if not.
Step 3: The user proves in zero-knowledge that u is
an ' 2 'th residue modN as in the basic scheme.
Instead of proving possession of an 'th root of T mod
N as in the basic scheme, here the user is proving possession
of an 'th root of T w P mod N . In fact, the user
does this by proving possession of an 'p1 ::pm=wP th root
of T  mod N . It is important that T  is used here while
T is secret, because a single user could mount a gcd-based
outsider attack from
Zero-knowledge follows as for the basic scheme. For
identity recovery, the escrow agent nds the unique solution
to y w 1)='. For
soundness, we can adapt our proof of Lemma 2.1, incorporating
ideas from a proof of Akl and Taylor [1]:
Lemma 3.1 If a user i 62 P can prove membership in P
with probability at least , then there exists a polynomial
time (in n and 1=) algorithm for taking arbitrary p i th
roots modulo N .
Proof We describe a root-nding algorithm that takes
as input an arbitrary z 2 Z
N , and outputs z 1=p i mod N .
The algorithm rst computes ^
It
then plays the role of the prover in the authentication
protocol with public values
In time polynomial in n and 1=, this produces
a that the verier accepts.
By the proof of knowledge in Step 3, there is
an extractor that can interact with the prover
and output an ' 2 th root of ^ u. Let ^
r be the extracted
root. By the verication in Step 2, we know
that
which implies that
we know that
and so there exist integers a; b such that
1. Then the root-nding algorithm can
compute (^y=^r ' ) b z a  z bw P =p i z ap i =p i  z 1=p i mod N .
The scheme is useful in environments where there is
no fear of users colluding. Unfortunately, if two users
outside of P get together they can combine their secret
j to create a new key
that will let them
prove membership in P . Indeed, from
j it is easy to
compute some 'th root of T , and thus some 'th root of
any P . We refer to such an attack as an
outsider attack. More generally, we say that a scheme is
k-resilient against an outsider attack if no k users outside
of P can combine their secret keys to create a new prover
that will fool the verier into thinking it is a user in P .
The above discussion shows that, as is, the scheme is only
1-resilient against an outsider attack. In the next subsec-
tion, we show how to increase the resilience against an
outsider attack.
As in the previous section, the above scheme is only
1-resilient against a masking attack. We discuss how to
make the scheme k-resilient against a masking attack in
Section 4.
3.2 Increased Resilience against Outsider Attack
We describe a generalization that achieves k-resilience
against an outsider attack. It also allows every subset
query. The work performed by the prover and verier
increases over the basic scheme, while the communication
complexity remains the same. Despite increased resilience
against an outsider attack, note that we still have
the same vulnerability to a masking attack as the basic
scheme.
all subsets of size at
least m k. Let be distinct primes. Let
issued the secret key
. The value T
public. For any subset P of users, let
and let
To prove membership in an
arbitrary subset P , the user proves possession of an 'th
root of T w P mod N . It is easy for any i 2 P to compute
such a root, since wP is a multiple of w i whenever
It is easy to prove possession of such a root to a verier
who knows T  , by proving possession of an '
wP th root of
as in the proof of identity in Section 3.1.
Zero-knowledge and identity escrow follow as for the
previous scheme. For soundness versus any coalition F of
size at most k, note that
Fg. But if F \
does not divide wP . That is a contradiction unless
the extractor can compute p j th roots of arbitrary values
modulo N [1].
3.3 Eliminating Outsider Attacks for Limited Queries
The subset query schemes that we have discussed so far
support every possible subset query. Sometimes there is a
smaller xed collection of subsets Pa from which
the queries will come. This is true for the o-ce building
scenario from Section 1 when there is no revocation, i.e.,
each door has a xed set of authorized entrants. In this
case, we can proceed as follows to get resistance against an
outsider attack of any size, with a work increase of O(a)
for the prover and verier. Choose primes corresponding
to the possible subset queries. Each user i is
issued
. The value
a mod N is made public. To prove membership
in P j , a user demonstrates possession of an 'p j th root
of T  mod N . The security analysis is similar to earlier
cases.
Other Variations It is possible to generalize further,
based on the idea of key distribution patterns (KDP's)
due to Mitchell and Piper [23]. This yields a subset query
scheme to prove membership in any qualied subset while
resisting an outsider attack by any disqualied subset.
KDP's are also a unifying idea for key predistribution
schemes [4] and broadcast encryption [19]; see Stinson [26]
for a helpful survey.
As with the basic scheme, the Fiat-Shamir heuristic
can be applied to our subset query schemes. The result is
a group signature scheme in which the signature demonstrates
membership (or non-membership) in a subset of
the signer's choice.
4 Defending against Masking Attacks
The schemes presented in Section 2 and Section 3 are
only 1-resilient with respect to a masking attack. In other
words, two users can combine their secret keys to create a
new key that hides their identity from the escrow agent.
This weakness is due to the fact that if are 'th
roots of T mod N , then so is  k
That gives an easy way for two or more
colluders to mask their identity by producing a new key
that cannot be traced back to them.
One way to protect against masking attacks is by using
constructions for collusion-secure ngerprinting due to
Boneh and Shaw [6]. We illustrate for the basic scheme
from Section 2. Assign to each user i a distinct length-K
codeword in a collusion-secure nger-
printing code over a binary alphabet. Create K instances
of our basic authentication scheme, where  j is a nontrivial
'th root of unity modulo N j , and where t j is an 'th
root of T j mod N j , 1  j  K. The secrets that are given
to user i will be t1  c i1
K mod Nk . To
authenticate, the verier and the prover execute the K
instances of the basic protocol in parallel.
The important observation is that if all of the collud-
ers' codewords agree in position j, then all of the colluders
have the same secret in the jth instance of the basic
scheme. Then they cannot nd a new 'th root for T j by
taking convex combinations. If the verier accepts, the
colluders must have used their common secrets in every
instance where all of their codewords agree. The escrow
agent will recover these codeword values, and might recover
arbitrary values for all of the other codeword posi-
tions. By the properties of ngerprint codes, this su-ces
to recover a colluder's identity. To protect against a coalition
of size k out of a population of size m with probability
1 , the best known ngerprinting construction requires
We can eliminate the need for multiple protocol instances
if we proceed as follows. Let K be the
rst K odd primes, and let
We construct a
single instance of the basic authentication scheme using
a modulus divides both p 1 and q 1.
As in the basic scheme let  be an 'th root of unity, and
let t be a random element of ZN . The secret given to
user i is
all j. As in the multi-instance construction, the escrow
agent will be able to use the underlying ngerprint code
to recover a colluder's identity from a convex combination
of k or fewer secrets. Hence, we achieve k-resilience using
a single instance of the protocol. The downside is that
the size of the modulus N depends on the length of the
ngerprinting code K.
5 Summary and open problems
In summary, the higher-residuosity assumption leads to
new constructions for anonymous authentication with
identity escrow and group signature schemes. Variations
of the basic scheme include the ability for a user to
prove membership in an arbitrary subset of users, which
gives a simple approach to the key revocation problem.
These constructions are e-cient, and provably secure under
standard security assumptions, although somewhat
more awkward to protect against collusion than previous
constructions.
It is an important open question to improve the defense
against masking attacks while maintaining the eciency
of the basic authentication protocol. It is tempting
to try to achieve this by encoding more information
in each user's secret, but this could be quite dan-
gerous. For example, let Let each
j be a non-trivial 'th root of unity modulo p j . Let
each  j be a Chinese Remainder Theorem coe-cient:
each
This could directly
encode an element of Z K
' in each user's secret.
However, two colluding users could factor the modulus:
It seems as though a large ' and a secret assignment of
encoded strings to users is necessary to prevent this factoring
attack. Then it is possible that this approach could
be developed into a defense against masking attacks, by
carefully choosing the encoding information given to each
user. This approach might also be useful in a setting with
multiple escrow agents. By the choice of which factors go
to each agent, and by the choice of each user's encoded
string, the ability of dierent escrow agents to recover
information about a user can be nely controlled.



--R


























--TR
An optimal class of symmetric key generation systems
Key storage in secure networks
A practical zero-knowledge protocol fitted to security microprocessor minimizing both transmission and memory
Zero-knowledge proofs of identity
The knowledge complexity of interactive proof systems
Flexible access control with master keys
Broadcast encryption
On Some Methods for Unconditionally Secure Key Distribution and Broadcast Encryption
Communication-efficient anonymous group identification
Trustee-based tracing extensions to anonymous cash and the making of anonymous change
Cryptographic solution to a problem of access control in a hierarchy
Proofs of Partial Knowledge and Simplified Design of Witness Hiding Protocols
Collusion-Secure Fingerprinting for Digital Data (Extended Abstract)
Efficient Generation of Shared RSA Keys (Extended Abstract)
Efficient Group Signature Schemes for Large Groups (Extended Abstract)
Escrow
How to Convert any Digital Signature Scheme into a Group Signature Scheme
Some Open Issues and New Directions in Group Signatures
Verifiable secret-ballot elections

--CTR
Wen-Guey Tzeng, A secure system for data access based on anonymous authentication and time-dependent hierarchical keys, Proceedings of the 2006 ACM Symposium on Information, computer and communications security, March 21-24, 2006, Taipei, Taiwan
Joachim Biskup , Ulrich Flegel, Threshold-based identity recovery for privacy enhanced applications, Proceedings of the 7th ACM conference on Computer and communications security, p.71-79, November 01-04, 2000, Athens, Greece
Y. G. Desmedt, Fighting entity authentication frauds by combining different technologies, BT Technology Journal, v.23 n.4, p.65-70, October   2005
Marina Blanton , Mikhail J. Atallah, Provable bounds for portable and flexible privacy-preserving access, Proceedings of the tenth ACM symposium on Access control models and technologies, June 01-03, 2005, Stockholm, Sweden
Marina Blanton , Mikhail Atallah, Succinct representation of flexible and privacy-preserving access rights, The VLDB Journal  The International Journal on Very Large Data Bases, v.15 n.4, p.334-354, November 2006
Keith Frikken , Mikhail Atallah , Marina Bykova, Remote revocation of smart cards in a private DRM system, Proceedings of the 2005 Australasian workshop on Grid computing and e-research, p.169-177, January 01, 2005, Newcastle, New South Wales, Australia
group signature;identity escrow;anonymous authentication