On Advances of Anonymous Credentials—From Traditional to Post-Quantum

Abstract

Anonymous credential (AC) systems are privacy-preserving authentication mech-anisms that allow users to prove that they have valid credentials anonymously. These systems provide a powerful tool for several practical applications, such as anonymous pay-ment systems in e-commerce, preserving robust privacy protection for users. Most existing AC systems are constructed using traditional number-theoretic approaches, making them insecure under quantum attacks. With four decades of research in anonymous credential systems, there is a need for a comprehensive review that identifies the design structures of AC systems, organizes the research trends, and highlights unaddressed gaps for the future development of AC, especially bringing AC to post-quantum cryptography. This work is a complete study describing AC systems, as well as their architecture, components, security, and performance. Additionally, real-world implementations of various applications are identified, analyzed, and compared according to the design structure. Lastly, the challenges hindering the shift toward the quantumly secure lattice-based AC designs are discussed.

1. Introduction

In 1976, Wilfred Diffie and Martin Hellman introduced digital signatures [1], which are widely used in authentication systems for e-signatures, e-passports, e-ticketing, and several other applications. However, verifying digital signatures necessitates disclosing users’ attributes, including their name, age, and address. Hence, digital signatures are not enough to address specific scenarios, and there is a growing demand for systems that allow customers to request services from providers without revealing their private information. For example, consider an online forum that requires users to verify their adult status before participating. In such a scenario, the verifier only needs to check that the user is over 18 years old without requiring knowledge of the user’s age, name, or other personal details. With digital signatures, the service needs to verify the user’s identity and check their date of birth to ensure the user is an adult. This raises privacy concerns, allowing the service to track users’ future activities or phishing. To overcome these kinds of concerns, by bridging authenticity and privacy, the two seemingly orthogonal security concepts for practical applications, anonymous credential (AC) systems have been introduced.

AC systems enable users to prove their possessions of valid credentials while keeping the privacy of their other undisclosed attributes. As an example, AC systems can be used to address the aforementioned issue; the forum can confirm the user’s status as an adult without knowing other personal information unnecessary to the service, thus protecting users’ privacy. For another example, ACs can be applied to electronic voting systems to enable voters to prove their eligibility for voting without disclosing their identities, ensuring privacy and maintaining the integrity and confidentiality of the election process. Research has indicated that AC systems play a crucial role in various real-world applications such as decentralized identity authentication [2], healthcare systems [3], payment systems [4,5], and so on and so forth.

AC systems were first proposed by Chaum [6], initially referred to as pseudonym systems. Later, AC systems were developed into well-defined attribute-based credential systems. In an attribute-based AC system, as depicted in Figure 1, three primary entities are involved: users, organizations (signers), and service providers (verifiers). The user holds anonymous credentials signed and issued by the service organization, and the service provider verifies the validity of the credentials. The core concept revolves around users having a set of attributes, and then organizations are responsible for issuing credentials to users for their attributes. Once receiving the credential, users can prove their possession of the credential to the verifier and gain service access. Unlike digital signatures, which directly link the signature to the signer’s (user) identity, AC systems allow users to prove their knowledge of the message–signature pair without revealing their identity. Hence, digital signatures are not generally anonymous; AC systems provide users with anonymity. In contrast to blind signatures, where the user unblinds the message during verification, AC systems allow users to selectively disclose only the necessary attributes without revealing the entire message. Although group signatures provide anonymity for group members, the group manager can revoke this anonymity if needed. However, anonymous credentials require full anonymity for users. These examples ensure AC systems differ fundamentally from other commonly used privacy-preserving cryptographic primitives.

1.1. Our Contribution

With four decades of research in anonymous credential systems, there is a need for a comprehensive review of the development, design principles, security properties, and relevant applications of AC. The contribution of this paper is fourfold. First, we provide a comprehensive review of the evolution of AC schemes from its start to the most recent development, identifying the necessary cryptographic primitives, key features, security notions, and efficiency for AC schemes. Second, we propose a construction-based approach to AC design principles. Our framework separately identifies AC design principles in the primary model and practical applications. Third, we investigate the most recent development in post-quantum AC schemes from lattices. Finally, we identify gaps in AC designs, particularly concerning the latest trends in post-quantum AC schemes that have not yet been addressed—a key area for future research.

Comparison with Kakvi et al.’s Recent Work

To the best of our knowledge, the only survey on AC is by Kakvi et al. [7]. Our work substantially differs from Kakvi et al.’s and brings new insights. We summarize the distinctive aspects of our work below.

• Design Principles: We propose a construction-based approach to AC design principles, focusing on the structure of AC schemes. We classify AC schemes in two dimensions, the design structure and application, which helps to unify and guide the design of the AC scheme.
  • Design Structures of Basic AC Schemes: We identify four design structures of the basic AC model: single-attribute AC, multi-attribute AC, multi-authority AC, and credential-modifiable AC. For each category, we identify the cryptographic primitives needed for the constructions. In addition, we highlight the associated advantages and disadvantages.
  • Application-Oriented Design Principles for Practical Use: We identify four major application-oriented types of AC: traceable AC, revocable AC, delegatable AC, and decentralized AC. We outline each type’s cryptographic principles used in the key designs.
• Post-Quantum AC Schemes: Recently, with the advancement of quantum computing, cryptography research has significantly focused on post-quantum solutions. Among post-quantum cryptographic approaches, lattice-based cryptography has gained prominence, especially due to NIST standardization [8] of lattice-based key encapsulation mechanisms (KEMs) and digital signatures. As a result, the design and analysis of post-quantum AC schemes from lattices have become increasingly important. Here, we provide a qualitative and quantitative analysis of the most recent proposed lattice-based AC schemes.
• Real-World Applications: We identify the real-world applications of AC systems and provide a comparative analysis of the security notions achieved by the applications.
• Open directions including Quantum-Resistant AC Schemes: Most AC systems are based on discrete-log-related problems and will become insecure with large-scale quantum computers. We identify research gaps based on the most recent development of post-quantum AC schemes, which is not covered in Kakvi et al. [7].

To conclude, Kakvi et al.’s work [7] provides an analysis of attribute-based AC systems and their features; our survey, being different from Kakvi et al. [7], takes a constructive approach by focusing on the design principles of AC that enable security and different application features for practical AC systems. First, we elaborate on how these design principles work, which allows readers to understand the fundamental mechanisms involved in constructing AC systems. Moreover, our review is more beneficial as it addresses the emerging domain of post-quantum AC systems, a topic that is becoming increasingly important with the advancements in quantum computing. Kakvi et al.’s work only covers the AC systems that are based on the traditional number-theoretic problems, e.g., integer factoring and discrete logarithm problems, and is hence insecure with the advent of quantum computers [9]. To make AC resistant to quantum attacks, it is necessary to design and implement AC systems (including their components) using new post-quantum objects, e.g., lattice-based ZKPs that prove the knowledge of digital signatures. In this work, we analyze existing post-quantum lattice-based AC systems systematically, identify their limitations, and explore open research directions in post-quantum AC.

1.2. Road Map

The subsequent sections of this paper are organized as follows. Moving on to Section 2, we identify three different trends in designing AC systems from 1985 onwards. Section 3 provides an analysis of the design of AC schemes with a complete categorization highlighting fundamental cryptographic primitives needed for each structure. Section 4 provides a security analysis of existing AC systems, and Section 5 provides a quantitative analysis of performance. Finally, we discuss the real-world applications of AC schemes and identify open directions in Section 6.

2. Evolution of Anonymous Credential Schemes

In this section, we will discuss the evolution of AC systems, which can be divided into three main parts: classical pseudonym systems before the booming of pairing-based cryptography, advances in pairing-based AC schemes, and new developments of AC focusing on post-quantum security. We will cover the design structure of each type, along with respective benefits and drawbacks and areas that need improvement.

2.1. Early Development

The concept of AC stems from the work of Chaum [6], which was initially termed as pseudonym systems. While Chaum’s seminal paper introduced the concept, it did not provide formal definitions, constructions, or security requirements; however, Chaum’s pioneering work laid out the fundamental idea of utilizing digital signature schemes for signing. Chaum and Evertse [10] constructed a pseudonym system based on RSA, which bears full trust to a trust center that transfers all credentials. Damgård addressed the trust issue using multi-party computations, limiting the trusted center’s job to pseudonym validation, i.e., ensuring each pseudonym links to some legitimate user but with an inefficient zero-knowledge system.

Chen [11] proposed another pseudonym system based on the discrete-log problem (DLog) in which the trust center participants in credential transfer must be, again, trusted to behave honestly. Lysyanskaya et al. [12] formalized a pseudonym system that minimizes the trust to the trust center and gives a construction from the DLog problem. This work marked a significant step forward in the evolution of AC schemes as it sets out the basic structure and security requirements for the subsequent pseudonym and AC systems.

Design of Pseudonym Systems: A pseudonym system allows users to maintain privacy while interacting with multiple organizations. In this system, the user possesses a single master secret key ($msk$) from which the user can generate multiple public keys, known as pseudonyms. As shown in Figure 2, an issuer (organization) issues a credential to a pseudonym ($ny{m}_1$) attached to the user. The user can then prove possession of this credential to a verifier under a different pseudonym ($ny{m}_2$) without revealing user identity [12,13,14,15]. It is important to note that the $nyms$ should be unlinkable to one another.

Subsequent advancements [16,17] in AC systems introduced several notable features. Firstly, the limitation of one-show credentials in pseudonym systems was addressed by Brands [16] with the first multi-show pseudonym system. Secondly, the evolution from a pseudonym system to an attribute-based AC system [16] enabled users to possess multiple attributes, enhancing anonymity. Thirdly, AC systems with selective attribute disclosure [17] emerged as a crucial enhancement, allowing users to retain privacy by revealing only a subset of their attributes to verifiers while keeping the rest concealed. These advancements have greatly improved the flexibility, security, and confidentiality of AC systems, meeting diverse application requirements.

2.1.1. Formalizing Attribute-Based Anonymous Credential Systems

The early research of pseudonym systems [12] led to the basic structure, as shown in Figure 2. It also forms today’s widely accepted definition of modern AC systems, Definition 1, due to Fuchsbauer et al. [18]. In an AC system, the user and the organization generate their keys; the user who holds a set of attributes runs the protocols (Obtain,Issue) with the organization to receive a credential to these attributes from the organization; then, the user runs the protocols (Show,Verify) with the verifier (also known as the service provider) to show its credential for verification. This structure and system definition are adapted by the most recent AC system constructions [18,19,20,21,22,23].

Definition 1.

([18]). Let λ be the security parameter and $\mathsf{A}={\left[{\mathsf{A}}_i\right]}_{i\in [\ell ]}$ be a set of attributes with $\ell >0$ as the size of the array of attributes the organization will certify. An anonymous credential system is defined as follows:

• (opk,osk) ← OrgKeyGen(1^λ): A probabilistic algorithm that outputs the organization’s public key opk and private key osk.
• (upk,usk) ← UserKeyGen(1^λ): A probabilistic algorithm that outputs the user’s public key upk and private key usk.
• (cred/⊥) ← (Obtain(opk, usk, A), issue(opk, upk, A)): An interactive protocol that outputs the credential (cred) over attribute set A or an error symbol ⊥.
• (1,/0, ⊥) ← (show(usk, A, D, cred), Verify(opk, D)): An interactive protocol that verifies the credential over that subset (D) of attributes (A). The protocol outputs 1 if the cred is a valid credential over D $\subset$ A and returns 0 otherwise.

An anonymous credential scheme is correct if for any ε negligible in λ, it holds that

$$Pr\left[\begin{array}{c}(\mathsf{opk},\mathsf{osk})\leftarrow \mathsf{OrgKeyGen}\left(1^{\lambda }\right),\\ (\mathsf{upk},\mathsf{usk})\leftarrow \mathsf{UserKeyGen}\left(1^{\lambda }\right),\\ cred\leftarrow \left(\mathsf{Obtain}\right(\mathsf{opk},\mathsf{usk},\mathsf{A}),\mathsf{Issue}(\mathsf{osk},\mathsf{upk},\mathsf{A}\left)\right),\\ 1\leftarrow \left(\mathsf{Show}\right(\mathsf{usk},\mathsf{A},\mathsf{D},cred),\mathsf{Verify}(\mathsf{opk},\mathsf{D}\left)\right)\end{array}\right]\ge 1-\epsilon$$

where the probability is taken over the random coins of the algorithms.

2.1.2. Cryptographic Components for Anonymous Credential Systems

The early research of pseudonym systems and attribute-based AC systems also contributes to the formal security definitions of modern AC systems. They especially enlighten the fundamental cryptographic primitives [13] that are needed to build AC systems to meet the requirements of real-world applications.

There are three fundamental cryptographic primitives identified for a basic AC system—cryptographic commitment, digital signatures, and zero-knowledge proofs—usually compatible with a cryptographic commitment scheme and a digital signature system.

A commitment scheme allows one to commit a message, which can be opened later by the message holder. It requires that (1) the commitment hides the message, known as hiding property, and (2) any commitment cannot be opened into another message different from the committed one, known as the binding property. As shown in Figure 3, when it comes to an AC, the user usually uses a commitment scheme to commit attributes without revealing them directly to the signer. The commitment scheme serves two key purposes: ensuring the attributes cannot be changed once committed (binding property) and keeping them concealed from the signer (hiding property). Famous commitment schemes, such as Pedersen [24], Fujisaki and Okamoto [25], and Moni Naor’s bit commitment [26], were used in the early pseudonym systems.

A (digital) signature system is a public-key cryptosystem in which the private key holder can digitally sign messages to obtain signatures that are verifiable using the user’s public key. A digital signature cannot be produced without the private key, known as the unforgeability property. In an AC system, the organization utilizes a signature scheme to endorse the (committed) attributes by signing the attribute commitments. The unforgeability ensures that no one can forge the endorsements. Classical pseudonym systems used signature schemes such as RSA signature [27], Fiat–Shamir signature [28], Schnorr’s signature [29], Brand’s signature [16], and Bellare and Micali’s BM signature [30,31].

A zero-knowledge proof (ZKP) system is a cryptographic protocol that enables one party (the prover) to demonstrate possession of certain information to another party (the verifier) without disclosing the actual information itself. As depicted by Figure 4, a ZKP system in an AC scheme is used by the user for dual purposes: (1) to prove the knowledge of committed attributes to the signer and (2) to demonstrate the knowledge of the message–signature pair to the verifier. It typically requires three security notions: completeness, soundness, and zero knowledge. It should be noted that there exists an interactive version and a non-interactive version of ZKPs. The former requires interactions [32] between the prover and the verifier, while the latter does not. When applying to AC, they correspond to interactive or non-interactive verification of commitment/credential. The choice shall depend on the application’s needs.

2.1.3. Summary

The early stage of development of AC systems determined a high-level design blueprint for constructing AC systems satisfying intuitive security requirements. However, these early systems contain drawbacks from both security and construction perspectives.

Security-wise, the early systems do not have clear and clean security definitions (especially formal adversarial models) for what is known now as the fundamental security properties of AC systems: credential unforgeability, credential unlinkability, and anonymity. In the early systems, the security requirements were argued to be met by the security of the individual underlying cryptographic primitives in ad hoc ways. In addition, the early developments of AC systems did not extend to achieve many useful features for practical applications, such as traceability, signer hiding, and credential revocation.

Construction-wise, the early systems fall short in scalability. For example, in scenarios where credentials are obtained from multiple organizations or credentials for multiple attributes, the size of credentials grows linearly with the number of organizations and the number of attributes. This limits the efficiency of the AC systems. Meanwhile, the early systems seemed to have difficulty enabling the aforementioned useful security properties. The fundamental obstacle to these is that the underlying building blocks lack flexible algebraic properties, which are offered by pairing-based cryptography.

2.2. Enhancement from Pairing-Based Cryptography

Pairing-based cryptography significantly advances the research of AC systems in nearly all the dimensions that the early systems fell short of: security, efficiency, and functionality.

The design of AC schemes has significantly improved through pairing-based digital signatures and zero-knowledge proof systems. Pairing-based signatures use pairings (also known as bilinear maps) from elliptic curves over finite fields. Their security is based on the elliptic curve Dlog problem, which has a much shorter parameter size than that of the Dlog problem over finite fields on integers for the same security level. The key sizes and signature sizes of pairing-based signature systems can be as short as 320 bits [33,34], which helps make anonymous credentials short and reduce the computational overhead. Another important feature of pairing-based signatures is that they work well with the versatile pairing-based ZKPs [35,36]. The combination of pairing-based signatures (examples: aggregate signatures [23,37], CL signatures [14,38], redactable/sanitizable signatures [22,39,40], and structure-preserving signatures [18,41]) and their compatible ZKPs shows great power in the design of AC systems.

Pairing-based AC systems have a distinct advantage when it comes to credential aggregation. Traditional AC schemes struggle to deal with situations where users hold credentials from multiple issuers and prove their knowledge of each signature to a verifier. This results in larger proof sizes due to separate proofs for each credential. As illustrated in Figure 5, with pairing-based aggregate signatures for AC schemes [23,37], a user can combine multiple signatures from different issuers into a single signature. The critical advantage of these schemes is that even when aggregating several signatures, they still end up with a constant-sized credential, keeping the prover cost independent of the number of attributes and issuers.

Initially, the early progress in AC systems encountered challenges in modifying or hiding certain parts of the issued credentials, necessitating users to present all information to the verifier. Pairing-based signatures addressed this issue with redactable signatures and sanitizable signatures. As depicted in Figure 6, redactable-signature-based AC systems [22,39] have the ability to selectively conceal or remove specific parts of the credential while proving the validity of the remaining information. Similarly, sanitizable signatures [40] allow, once a credential for ℓ attributes is received, the user (known as a sanitizer) to modify the signature for k out of ℓ attributes. However, the most efficient approach lies in constant-size redactable/sanitizable AC systems [22] instead of linearly growing ones, which are particularly beneficial for applications such as membership or age verification, which usually do not want to reveal personal information to the verifier.

Thus far, AC systems have proved secure using the security of individual cryptographic primitives, signature, commitment, and zero-knowledge proof, which is unsuitable as it does not define attackers and corresponding security goals for the whole system. However, pairing-based AC systems identified two fundamental security notions, unforgeability and anonymity, and these notions are analyzed in Section 4. Another feature added in pairing-based signatures to AC systems is randomization, which allows the user to randomize the credential once received, so different showings of the same credential cannot be linkable.

When deploying AC systems, several practical issues need to be considered. We discuss some examples of AC systems that have been successfully constructed using pairings to address these issues. Revocable AC systems are designed for situations where attributes in credentials may become outdated, or users may no longer be authorized to hold a specific credential. Partial revocation may also be necessary, such as when certificates are valid only for a particular period and must be revoked accordingly, such as electronic ID [42]. As digital cash [4], traceable AC systems have been proposed for applications where a tracing authority must track or link a user’s activities while maintaining the user’s anonymity. Additionally, delegatable AC systems enable users to delegate credentials, such as in access control [43,44]. Furthermore, signer-hiding AC systems [45,46] were designed for specific applications, such as national eIDs and remote attestations. Section 3.2 summarizes how these features were added, and the corresponding applications are listed in Section 6.1.

In conclusion, the rich structure of pairing-based signatures has added several properties that the classical AC systems have not achieved. However, the AC systems discussed thus far rely on computational problems whose hardness is ultimately based on the difficulties of solving the LRSW assumption (named after its authors [12]) and the bilinear Diffie–Hellman assumptions, such as BDH, DBDH, and DHBDH problems. These problems are known to be vulnerable to quantum attacks [9] and will be broken if large-scale quantum computers become available. Following the effort of transitioning classically secure public-key encryption and digital signature systems to quantum-resistant ones, exploring quantum-resistant AC systems is well motivated.

2.3. Next-Generation Post-Quantum

As mentioned, the development of quantum computing presents a vital threat to most of the existing AC systems due to them being based on quantumly tractable problems. This motivates the study of designing AC systems from computational problems that are not efficiently solvable by quantum computers, which are hard computational problems on high-dimensional lattices. To the best of our knowledge, four lattice-based AC schemes have been introduced recently ([19,20,21,47]), and a comparison of the designs of these schemes is provided in Section 5.

These recent constructions of lattice-based AC systems also follow the structural design of combining the three main cryptographic primitives: commitment, signature, and their compatible zero-knowledge proofs. Jeudy et al. [21] introduced a lattice-based AC system under the short integer solution problem and learning with errors problem over module lattices (respectively known as the MSIS problem and MLWE problem) (module lattices are a family of lattices that generalize the integer lattices and ring lattices). The construction modifies Libert et al.’s [48] zero-knowledge proof system for Boyen’s signature scheme [49] with more efficient proving systems, leading to a noticeable reduction in credential size, equivalent to 30 times less than using the original protocol by Libert et al. [48].

Another lattice-based AC scheme by Bootle et al. [19] introduces a new hard problem called Inhomogeneous Shortest Integer Solution (${\mathrm{ISIS}}_f$), unlike previously discussed schemes based on MSIS and Ring LWE. The ISIS problem asks to find a short non-zero vector over a system of linear equations modulo some vector. In contrast, the new problem ${\mathrm{ISIS}}_f$ asks to find a short non-zero vector over a system of linear equations modulo a target function f. The entire scheme [19] is based on the ${\mathrm{ISIS}}_f$ assumption, making the security of the scheme more challenging to analyze. In fact, the hardness of the ${\mathrm{ISIS}}_f$ problem depends on the choice of the function f, where f is modeled as a random oracle, or else, f is a cryptographic hash function. However, the scheme [19] uses NTRU lattices, which makes it more efficient compared to the previous two schemes [20,21] that used standard and structured lattices.

Lai et al. [20] introduced a commit transferable signature scheme (CTS) for AC based on MSIS and RLWE. The main advantage of this scheme is that it supports pseudonyms and obtains smaller credential sizes compared to the scheme of Jeudy et al. [21]. The scheme [20] (and also the scheme of Bootle et al. [19]) requires multi-theorem straight-line extractability, which allows the prover to extract witnesses directly from multiple pairs of statements of non-interactive zk proofs. In addition, the multi-theorem straight-line extractability makes the system have less soundness error compared to the single-proof extractability proof system with exact soundness error [50].

The aforementioned lattice-based AC systems follow the formal security model of AC established from the pairing-based AC systems. We discuss this matter for lattice-based AC schemes in Section 4. Moreover, we provide a detailed performance analysis of current lattice-based AC schemes in Section 5. In conclusion, lattice-based constructions have yet to be improved to obtain greater efficiency and functionality compared to pairing-based AC schemes, which leaves substantial room for further research, as we will discuss in Section 6.2.

2.4. Summary

In this section, we summarize the development of the AC systems discussed.

Figure 7 highlights the key papers outlining the evolution of AC systems. It is clear that AC schemes introduced before 2023 were primarily based on pre-quantum assumptions, the discrete logarithm problem, and the RSA problem, which are insecure according to Shor’s algorithm [9]. In contrast, recent developments focus on post-quantum security, addressing the need for AC schemes resistant to quantum attacks. Despite these advancements, significant challenges and problems remain in designing robust and efficient post-quantum AC systems, as discussed in Section 6.2.

3. Design and Structure of AC Schemes

In this section, we discuss the design of AC systems from the perspectives of system structures of AC and the security properties of AC. This allows us to further categorize AC systems into structural categories and application-oriented categories.

3.1. AC Categorization Based on Design Structure

We categorize existing AC schemes (under the unified notion of attribute-based AC) into four categories depending on their design structures.

• Single-Attribute Anonymous Credentials: As shown in Figure 2, single-attribute AC systems were introduced in the early stages of AC development. In this type of system, users receive one credential for each attribute. While having a simple structure, this type of AC falls short in terms of efficiency; the public/private key sizes, the credential size, and/or the computational overhead of credential verification all increase linearly with the number of attributes if multiple attributes are needed, i.e., users must demonstrate knowledge of each credential for every attribute [52].
• Multi-Attribute Anonymous Credentials: This category, as depicted by Figure 1, refers to the AC systems in which users have multiple attributes, such as name, age, university, and more, being able to obtain a single credential for all of these attributes [16]. Two main types within this category exist: (1) selective disclosure (s) of attributes and (2) proving relations (r) of attributes during the verification process. Selective disclosure allows users to share a subset of their attributes with verifiers while keeping the remaining attributes concealed [18,23,46]. In contrast, proving relationships enables users to demonstrate the connection between their attributes to the verifier [13,22,38].
• Multi-Authority Anonymous Credentials: Both above AC schemes struggle to deal with situations where users hold credentials from multiple issuers and prove their knowledge of each signature to a verifier. This potentially results in larger credential sizes, e.g., linear with the number of issuers, due to separate credentials to be received from different issuers. To address this challenge, aggregate signatures are adopted in the AC system design. AC incorporated with aggregate signatures is depicted in Figure 5. It allows users to combine credentials from multiple organizations into a single credential. The crucial advantage of these schemes is that even when aggregating several signatures, they still end up with a constant-sized credential that is the same length as a single credential, keeping the prover cost independent of the number of issuers while still allowing verification of validities of the credentials [23].
• Credential-Modifiable Anonymous Credentials: This category, as depicted in Figure 6, represents a type of AC system that allows users to modify or hide certain parts of the issued credentials. It is used to overcome challenges encountered when requiring users to present the entire credential or the originally received credential to the verifier. Firstly, self-blinding or re-randomizable signature schemes [46,53] are the primary cryptographic primitives used for this type of AC. Once a user obtains a credential from an issuer, the user can randomize the credential into a new credential under the same attributes. Hence, they often make the AC system multi-show-unlinkable. Secondly, redactable [22,39] or sanitizable [40] signatures are the main cryptographic primitives that enable credentials to be modifiable. They introduce the ability to conceal or remove specific parts of the credential selectively while proving the validity of the remaining information. Similarly, sanitizable signatures allow, once a credential for ℓ number of attributes is received, the user (known as a sanitizer) to modify the signature for k out of ℓ attributes. The most efficient approach lies in constant-size redactable/sanitizable AC systems instead of linearly growing ones, which are particularly beneficial for applications such as membership or age verification.

3.2. AC Categorization Based on Additional Properties

When it comes to practice, AC schemes usually need extra properties other than the basic security properties discussed before depending on the requirements of real-world applications. We identified that traceability, revocation, delegation, and decentralization are the widely used practical AC properties, and we give design guidelines for each mechanism.

3.2.1. Traceable Anonymous Credentials (TACs)

In real-world settings, users in AC systems may misbehave while remaining anonymous. Hence, there should be a mechanism in place to trace misbehaviors. Traceable anonymous credentials (TACs) are an extension of the AC framework designed to enable the tracing and de-anonymization or blacklisting of malicious users who violate the system’s rules. The purpose is to achieve two simultaneous notions of security: anonymity and accountability (also known as traceability).

The concept of TAC was proposed in 2001 by Camenisch and Lysyanskaya [51]. As depicted in Figure 8, a TAC system relies on a trusted third party (TTP), also known as tracing authority (TA), which is only involved when there is a request to reveal the user’s identity. However, the existing TACs do not allow the tracing authority to make decisions about tracing results; instead, another algorithm Judge is used to reveal the identities of the users who have been traced once the tracing process is completed. The security aspect of this concept is referred to as non-frameability in the context of TACs, which ensures that no party, including the credential issuer, can unjustly accuse or incriminate an honest user. This guarantees that no one can falsely generate a valid trace or proof of a user’s credential usage without the user’s participation. While TACs have been based on prior efforts in non-quantum settings [23,40,51,54], the challenge of building quantumly secure TAC schemes remains relatively new.

3.2.2. Revocable Anonymous Credentials (RACs)

RACs are important when the attributes of the credentials may change or expire or users may hold invalid credentials. Therefore, a mechanism should be in place to remove malicious or outdated credentials. RAC systems address this requirement by performing membership revocation for users who hold invalid credentials. The purpose of RACs is to determine whether a user’s credential is valid and, if not, revoke the credential to make it non-verifiable. We identify five types of revocation mechanisms:

• Setting Expiry Dates: This is the type of RAC where the credential issuer sets expiration dates for each credential, which becomes outdated after a specific period. Therefore, the user has to request a new credential from the issuer once it expires, which is inefficient because the user has to request new credentials every time they expire. However, if the issuer introduces a mechanism to update all the credentials without user interaction, the user will be able to download the updated version before the authentication. The protocol proposed by Camenisch et al. [42] introduces a method to update the credential once issued without requiring interaction between the user and the issuer.
• Blacklist/Whitelist: An additional entity, referred to as the revocation authority (RA), is introduced for the purpose of revocation. This entity may be a trusted third party (TTP), issuer, or verifier. Each credential is associated with a unique identifier, which can be categorized under a whitelist or a blacklist. The RA is responsible for maintaining a list of valid identifiers, known as a whitelist, or a list of invalid identifiers, known as a blacklist. Following the completion of the verification process by the user, the verifier will proceed to confirm whether the user’s credentials are present in the whitelist or absent from the blacklist. However, the revocation mechanism can also be implemented without relying on a trusted third party (TTP), as introduced by [55,56].
• Cryptographic Accumulator-Based: The construction of an RAC requires the RA to maintain a large list of identifiers (serial numbers) and continuously update the list, which is sometimes inefficient. To overcome this challenge, dynamic accumulators are introduced [57] to help the RA distribute a short accumulated value instead of a large set of identifiers. The term dynamic refers to an RA being able to add or delete identifiers to the accumulator, and it outputs a short value independent of the number of identifiers. Moreover, the term universal accumulator refers to accumulators which support membership proofs. The accumulator-based RAC systems operate as follows: Each credential is associated with a serial number, and the RA outputs the accumulated value of valid or invalid serial numbers, which it then publishes. When a user goes through the credential verification process, additionally, the user must prove that their credential has not been revoked. Hence, the user must prove that the serial number associated with their credential is included in the accumulated value of valid serial numbers. Alternatively, if the RA publishes the accumulated value of invalid serial numbers, the user must show that their serial number is not included in that accumulated value. Hence, the user has to prove the membership or non-membership of the accumulated value using a zero-knowledge proof [58,59,60] during the credential Show protocol.
• Verifier-Local Revocation (VLR): Verifier-local revocation (VLR) is commonly used for group signatures [34,61,62] and was later introduced for anonymous credentials [63]. Here, a trusted third party (TTP) or RA maintains and publishes a list of tokens associated with each credential. Users reveal the proof of knowledge of their tokens to the verifier during authentication. Then, the service provider (verifier) downloads the list of tokens associated with revoked credentials and checks whether the presented token has been revoked.
• Verifiable Encryption (VE): Verifiable encryption is a public key encryption scheme in which a prover can encrypt a piece of information using the public key of the receiver, and then the prover can convince a third party that the encrypted data satisfy certain properties. The VE-based RAC systems work as follows. In this type, a trusted revocation authority (RA) is involved, and the RA has a public–secret key pair. Let each credential be associated with a unique identifier; the user encrypts the credential identifier using the public key of the RA. After that, the user shares the encrypted version of the credential identifier with the verifier during the credential (Show, Verify) protocol. The verifier does not have direct access to the identifier but knows the encrypted version, so it cannot be decrypted. However, the verifier needs to confirm that the identifier has not been associated with a revoked credential. To achieve this, the verifier sends a request to the RA to check the validity of the identifier. The RA then decrypts the identifier using their secret key, checks whether it is on the revocation list, and informs the verifier about its revocation status. This method ensures that verifiers can verify the validity of credentials [64,65]; however, in VE-based RAC systems, the user put full trust in the RA.

Remark: Alongside the techniques discussed, additional revocation mechanisms such as hash chains [66] and combined methods [67,68] are found in the literature. In particular, the scheme by Lueks et al. [67] combines verifier-local revocation with setting expiration dates to blacklist misbehaviors. In contrast, the RAC system known as Nymble [66] is designed to blacklist misbehaviors in anonymizing networks, such as Tor. This system utilizes a hash chain; however, it is inefficient because it continuously stores pseudonyms, a collection of nymbles to track the future activities of the same user. In conclusion, various revocation mechanisms exist for AC systems, each suited to different application requirements, with no single approach being better than the others.

3.2.3. Delegatable Anonymous Credentials (DACs)

In the basic AC model, the issuer should always provide the credential directly to the user. However, in practical scenarios, the issuer may delegate their responsibility to authorized delegators, who can then issue credentials to other users. In such cases, users utilize the credentials delegated via a series (chain) of users from the original credential holder. DACs were introduced by Chase et al. [69], which hide the whole delegation chain, that is, the identities of the delegators and the delegates during the credential verification. In this system, the primary issuer is denoted as level 0, with a series of intermediate issuers known as delegators responsible for issuing or delegating credentials from one level to the next. It is crucial to note that despite the credential passing through multiple delegators, the final credential should not expose any information about the intermediate delegators during verification, preserving anonymity. Moreover, it is required that the number of delegations performed does not increase the credential size. Various methods for DACs have been proposed in the literature. The first proposed the DAC system [69], which was later developed by [43] using randomizable proofs. Subsequently, several DAC systems were introduced based on malleable signatures [70] and structure-preserving signatures [44,44].

3.2.4. Decentralized Anonymous Credentials

Traditional AC schemes follow a centralized model; that is, the credential issuer is trusted by the users (credential holders) and service providers. Blockchain technologies have been introduced to AC schemes [2] to overcome this issue, creating a public ledger that decentralizes the issuance process. Users register by submitting their personal information and a self-generated credential to the ledger. Then, servers collect these registration data to identify eligible users. This concept has been further developed into various applications, including blacklisting [71], smart grids [72], and more.

3.2.5. Summary of AC Additional Properties

However, in addition to the above-discussed mechanisms, there are a few extra mechanisms in the literature. Additional parties and cryptographic primitives can be added to enhance the schemes with extra features in practical applications, as outlined in

Table 1. Practical properties achieved in AC schemes.

Property	Description	Mechanism
Non-transferability [51]	Credentials should not be transferable between users.	Certification authority (CA) is introduced.
Traceability [23,40,54].	Ability to trace credentials to prevent misuse.	Tracing authority (TA) is introduced.
Revocability [42,58]	Revoke outdated credentials.	Revocation mechanism is introduced
Delegation [43,44,69,70]	Users can delegate credentials to other users.	A delegation chain/list is introduced.
Issuer Hiding [45,46]	The identity of the credential issuer is hidden.	A set of acceptable issuers/the signing key space is introduced by the verifier (verification policy).
Updatable [73]	After the credential was issued, its attributes were modified.	A protocol (update function) is introduced between the issuer and the user.
Self-Blinding [18]	The credential is randomized by the user before showing.	A randomizable signature scheme is utilized.
Keyed Verification [74]	The issuer of credentials is also the verifier.	A shared key/algebraic MAC is used between the issuer and verifier.

MAC denotes message authentication code.

. Apart from the properties discussed above, we also added AC systems with other properties from the literature.

4. Security of Anonymous Credentials

Attribute-based AC systems generally possess two fundamental security properties: unforgeability and anonymity. Unforgeability ensures that anyone cannot forge a valid credential, emphasizing that only credentials issued by the authorized entity are valid. Anonymity refers to there being no verifier or malicious organization that can identify or learn any information about the user except when possessing a valid credential for disclosed attributes. Beyond these core properties, various additional features are associated with practical applications. For example, property revocation is needed for e-passports, valid only for a specific period; then, the user needs to renew after the expiration date. In contrast, property accountability is required for e-cash systems to trace back an over-spender [4].

In the early stage of AC research, it was emphasized that the overall security of an AC scheme is based on the security of the individual cryptographic primitives used to build the whole AC system [13]. However, this approach was limited as the security model for the AC system may not necessarily reflect all attacking strategies that the adversary may use. Later, Camenisch et al. [39] proposed security notions for AC systems in the Universal Composability (UC) framework proposed by Ran Canetti [75]. Subsequently, in 2019, Fuchsbauer et al. give a formal security model for AC via the widely used game-based definitions, as detailed in [18], which is now one of the most widely adopted security models for AC.

Though it is certainly preferable to formalize the security of AC by treating AC as one primitive (rather than attributing its security simply to the security of its components), it is still very useful to examine how the individual components contribute to the security of AC, especially from a constructive perspective; this guides and motivates the development of cryptographic primitives for AC.

Table 2. The basic security notions of anonymous credentials.

Property	Requirement	Cryptographic Primitives
Unforgeability	It should be infeasible to forge credentials. Malicious provers must be prevented.	Signature Scheme: EUF-CMA security ZK Proof System: Soundness
Anonymity	Attributes must not be leaked to the issuer. The secret key must not be leaked.	Commitment Scheme: Hiding Zero-Knowledge Proof System
Unlinkability	Different showings of the credentials cannot be linked.	Zero-Knowledge Proof System/Self Blindable

EUF-CMA denotes the existential unforgeable under chosen message attack.

summarizes the contribution of each cryptographic primitive in constructing an AC scheme.

Hence, it is clear that the construction of an AC scheme necessitates the incorporation of a commitment scheme, a signature scheme, and a zero-knowledge proof system. In conclusion, the reader must select three cryptographic primitives to construct an AC scheme that preserves the following security notions:

• Commitment Scheme: hiding, binding;
• Signature Scheme: EUF-CMA security;
• Zero-Knowledge Proof System: completeness, soundness, zero Knowledge.

Here, the term self-blindable [46,53] refers to the fact that once the user receives the credential for their attributes from the issuer, the user modifies the credential into a new one under the same attributes. This randomization property of signature schemes makes the different showings of the same credential unlinkable. However, many AC schemes generate new zero-knowledge proofs for each showing to obtain a multi-show unlinkability property.

The security of TAC and RAC schemes must meet several security requirements to ensure robust functionality, in addition to the security notions outlined in Table 2. TAC schemes must satisfy two key principles: traceability and exculpability. Traceability ensures that each valid credential can be traced back to a specific (unique) user. Exculpability, also known as non-frameability, guarantees that the TA cannot falsely accuse an honest user of wrongdoing. Similarly, RAC systems have additional security requirements based on their revocation mechanisms. The revocation completeness ensures that an honest user with valid credentials will always pass verification successfully. Moreover, revocation soundness prevents a revoked credential from being incorrectly identified as unrevoked by an adversary, ensuring that the RA can declare valid revocations only. Furthermore, revocation privacy protects the identities of honest users by ensuring that adversaries cannot determine which unrevealed tokens the RA manages.

In the analysis of security models for AC schemes, researchers have used three security models to prove security: the standard model (known as the plain model), the random oracle model (ROM) [76], and the generic group model (GGM) [77]. The choice of a particular security model often depends upon how the security of the underlying signature scheme and zero-knowledge proof system are proved. For example, some AC schemes, such as the one presented in [51], demonstrate security under the standard model, specifically under strong RSA and additional Diffie–Hellman assumptions. However, certain schemes [37,40] utilize the random oracle model (ROM) [76], as security under the standard model is deemed inadequate for signature schemes such as RSA, Diffie–Hellman, Fiat–Shamir, and Schnorr. Conversely, many AC schemes based on pairing-based cryptography have used the generic group model to prove security.

5. Performance Analysis

The efficiency of AC systems has improved significantly from 1985 to the present. In this analysis, we aim to evaluate the performance of three types of AC schemes: classical, pairing-based, and lattice-based. Since classical, pairing-based, and post-quantum AC systems exist in different dimensions, the analysis varies significantly from one system to another. Several comparisons can be found in the literature for those interested [18,46].

Table 3. Efficiency comparison of anonymous credentials.

Scheme	Main Assumptions	Setting	$\left|\mathit{cred}\right|$	$\left|\mathit{cred}\right|$ (KB)	Model
[51]	sRSA, DDH	${\mathbb{Z}}_N$	$3{\mathbb{Z}}_N$	$06.00$	SM
[13]	sRSA	${\mathbb{Z}}_N$	$3{\mathbb{Z}}_N$	$06.00$	SM
[14]	LRSW, DDH	BG	$(2\ell +2){\mathbb{G}}_1$	$21.00$	SM
[37]	q-ADHSDH, DDH	BG	$\ell {\mathbb{G}}_1+{\mathbb{G}}_2$	$10.50$	ROM
[40]	DL, DDH, SDH	BG	$(2\ell +2)({\mathbb{G}}_1+{\mathbb{Z}}_p)$	$42.00$	ROM
[39]	CDH, q-SDH, SXDH	BG	$6{\mathbb{G}}_1+2{\mathbb{G}}_2+{\mathbb{Z}}_p$	$04.50$	CRS
[53]	LRSW	BG	$(2\ell +4)({\mathbb{G}}_1+{\mathbb{Z}}_p)$	$44.00$	SM
[18]	DDH, q-co-DL	BG	$3{\mathbb{G}}_1+{\mathbb{G}}_2+2{\mathbb{Z}}_p$	$03.00$	GGM
[22]	DDH, DL	BG	$2{\mathbb{G}}_1+2{\mathbb{G}}_2$	$02.00$	GGM
[78]	DL, DDH	BG	$4{\mathbb{G}}_1$	$02.00$	GGM
[38]	q-(co-)SDH, SDH	BG	${\mathbb{G}}_1+6{\mathbb{Z}}_p$	$03.50$	SM
[46]	DDH, q-co-DL	BG	$18{\mathbb{G}}_1+3{\mathbb{G}}_2+6{\mathbb{Z}}_p$	$13.50$	SM

The terms sRSA, Dlog, DDH, and CDH stand for strong RSA, the discrete logarithm problem, the decisional Diffie–Hellman problem, and the computational Diffie–Hellman problem, respectively. In addition, assumptions LRSW [12], q-SDH [33], and q-ADHSDH [79] were defined in the relevant literature. ${\mathbb{Z}}_N$ indicates the integer ring for RSA, and BG refers to the asymmetric bilinear maps ${\mathbb{G}}_1$, ${\mathbb{G}}_2$ with a bilinear map $e:{\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T$ with cyclic groups ${\mathbb{G}}_1$, ${\mathbb{G}}_2$, ${\mathbb{G}}_T$ of order p; ${\mathbb{Z}}_p$ denotes the set of integers under modulo p. Here, $\pi$ denotes the proof of knowledge of the message–signature pair while ℓ denotes the number of attributes. Finally, SM stands for the standard model, CRS stands for the common reference string model, GGM stands for the generic group model, and ROM stands for the random oracle model. Note: For credential size estimations, we assume ${\mathbb{Z}}_N$ has a 2048-bit size, ${\mathbb{Z}}_p$ has a 512-bit size, groups ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$ have 512-bit sizes, and the number of attributes ℓ is 20.

presents a comparative analysis of non-quantum AC schemes, underlying assumptions, credential sizes, and security models.

Table 3 clearly shows that the credential sizes of the schemes [14,37,40,53] increase linearly with the number of attributes. As a result, these schemes [14,37,40,53] have larger credential sizes compared to others [22,38,78]. However, when compared with the credential sizes of lattice-based AC schemes, pairing-based AC schemes are more efficient because lattice ACs have large credential sizes. Moreover, pairing-based ACs, such as in [22,78], achieve credential sizes less than half of classical AC schemes [13,51] due to the compactness of pairing-based techniques.

Classical AC systems rely on the RSA signature scheme, which necessitates large modulus sizes, typically approaching a modulus size of $2k$ where $k=2048$. This results in large proof-of-knowledge sizes, reducing the schemes’ efficiency. However, pairing-based schemes are more efficient in performance than classical AC systems, as they achieve the same security level as classical systems but with shorter key sizes. Additionally, nowadays, many schemes support the selective attribute disclosure [18,46,78] of property rather than proving relations [22,38]. However, a comprehensive comparison of recent pairing-based AC systems goes beyond credential sizes and assumptions. The efficiency of issuing and showing protocols is important but not analyzed here. Interested readers can calculate the number of pairings further.

Another factor in analyzing the efficiency is the size of the zero-knowledge proof used by the user to prove the knowledge of the message–signature pair. In this regard, the most efficient schemes minimize interactions between the user and verifier. Therefore, it is recommended to use non-interactive zero-knowledge proof systems instead of interactive proof of knowledge used in classical AC systems. However, researchers have proposed another method that involves using self-blindable schemes [53], which have been identified to be more efficient than zero-knowledge proofs.

Although lattice-based cryptography is widely researched for many other privacy-preserving cryptographic primitives, such as group signatures and blind signatures, there are only a few post-quantum anonymous credential schemes available in the literature.

Table 4. The design of lattice-based anonymous credentials.

Scheme	Assumption	Commitment	Signature	ZKPs
[21]	MSIS/MLWE	Ajtai [80]	[48] *	[81,82]
[20]	MSIS/RLWE	BDLOP [83], ABDLOP [82]	CTS [20]	[84]
[19]	NTRU-${\mathrm{ISIS}}_f$	ABDLOP [82]	[85]	[50]
[47]	MSIS/MLWE	ABDLOP	[21] *	[82]

* Scheme uses a modified version of the signature scheme. The term ZKP refers to zero-knowledge proof, a cryptographic protocol that allows proving a statement’s truth without revealing anything other than the fact that the statement being proven is true.

summarizes the cryptographic components utilized in current lattice-based AC schemes. However, some schemes have slightly modified the mentioned components for greater efficiency.

A comparison of quantum-resistant lattice-based AC systems is provided in

Table 5. Efficiency comparison of lattice-based AC Schemes with 128-bit security.

Scheme	Assumption	Setting	$\left|\mathsf{pk}\right|$ (KB)	$\left|\mathit{cred}\right|$ (KB)	$\left|\mathit{\pi }\right|$ (KB)	Security Model
[21]	MSIS/MLWE	standard	117.103	261	306.103	ROM
[21]	MSIS/MLWE	module	276.48	317	724	ROM
[20]	MSIS/RLWE	structured	440	236.56	372.56	ROM *
[20]	MSIS/RLWE	structured	276.5	16,711.68	25,364.48	ROM
[19]	${\mathrm{ISIS}}_f$	NTRU	17	243	473	ROM
[19]	${\mathrm{ISIS}}_f$	Int-NTRU	3.5	62	107	ROM
[47]	MSIS/MLWE	module	49.91	6.81	80	ROM

Int-NTRU denotes the interactive NTRU assumption. ROM denotes random oracle model. * Adaptive security proof involves an exponential loss.

, including public key size $\left|pk\right|$, credential (signature) size $\left|cred\right|$, the size of the zero-knowledge proof of possession of a message–signature pair $\left|\pi \right|$, and the security model.

According to Table 5, the schemes [20,21,47] were constructed based on trapdoor sampling of standard lattices and their ring setting. However, the structure of the paper [19] was different as it used NTRU trapdoors. Hence, it is clear that the use of NRTU lattices improved the efficiency of the scheme as it reduced the credential size noticeably. In addition, the zero-knowledge proof of that scheme [19] has fewer and simpler relations, so its proof size is low compared to the scheme in [21] (less than 750 KB). Furthermore, scheme [19] succeeded in ensuring that the prover and verifier’s running times are independent of the number of users but linear in terms of the number of attributes. Although these quantum-secure lattice-based AC schemes achieved the expected security goals, their larger key sizes can affect performance. Therefore, further research should be conducted to increase efficiency. In addition, although several practical AC systems have been implemented for classical and pairing-based structures, quantum-secure research must also be undertaken for practical applications as the power of quantum computers continues to grow, and cryptography research is actively working towards transitioning to post-quantum cryptographic algorithms.

6. Discussion

This discussion summarizes the researched real-world applications and the security properties needed by these applications. Furthermore, we identify research gaps and future directions.

6.1. Real-World Applications

To maintain privacy, AC schemes are utilized in various real-world applications. Microsoft’s U-Prove [86], which uses Brand’s signature in AC, and IBM’s Identity Mixer [87], which uses CL signatures in AC, are among these solutions that industry leaders have deployed since 2010. AC systems were frequently utilized in online transactions, allowing users to conduct transactions without exposing their identities. Smart cards [88], e-voting [89], e-cash transactions [4,5], and e-tokens [90] are popular examples. Furthermore, AC systems are used for authentication in applications such as electronic ID [17], membership revocation [57], access control [91], age verification [92], decentralized systems [2], and direct anonymous attestation (DAA) [93]. Moreover, research papers also explained how to employ AC systems for traffic communication [94] and the health industry [3]. In summary, the real-world uses of AC systems include digital authentication, healthcare privacy, and secure online transactions, making them a diverse solution for protecting personal information while allowing smooth access to services.

Table 6. Real-world applications of anonymous credentials.

AC Security Properties	Real-World Applications
Non-Transferability	E-Voting
Revocation	KYC Verification, Membership Revocation
Traceability	Smart Cards, Digital Cash
Selective attribute disclosure	Digital ID, Healthcare Systems
Delegation	Access Control, Transactions in Blockchain
Authenticity	Anonymous Survey
Verifiability	E-Voting
Transparency	E-Voting
Exculpability	Cryptocurrencies, Digital Cash

summarizes various real-world applications and the additional security properties that these applications achieve, in addition to the previously discussed unforgeability and anonymity.

In our analysis of the practical anonymous credentials, we have identified four basic properties that are widely utilized in real-world settings: traceability, revocability, delegation, and decentralization. TAC systems have found application in various domains, including anonymous certifications [95], smart cards [96], KAVC systems [54], digital cash and cryptocurrencies, and online transactions (e.g., e-Cash [4]). RAC systems have found applications in various domains, including direct anonymous attestation (DAA) [97], Identity Escrow schemes [57], Java cards [98], and e-tokens [90]. There are plenty of applications of DAC systems, including access control systems [99] and blockchain transaction authentication [100].

In real-world applications, it is essential to achieve the mentioned security notions to address the unique requirements inherent to each application. The property revocation allows the system to remove credentials that are no longer valid due to expiration, misuse, or violations. Without this feature, malicious users could still gain access to services. Revocation is primarily used in Know Your Customer (KYC) applications [24] to prevent customers from participating in fraudulent activities when accessing financial services. Similarly, revocation in membership systems [57] ensures that customers who violate system policies cannot continue using services. In contrast, particular applications require property traceability to link back to the origin user for different purposes. For instance, traceability in digital cash [4] can help prevent money laundering and double-spending, while smart cards [54] utilize traceability to manage access logs and detect misuse. Furthermore, the property-selective attribute disclosure allows users to reveal only the attributes required for a transaction or service while hiding some information, which prevents unnecessary exposure of sensitive data. For instance, in healthcare systems [3], patients can reveal their blood type to a clinic while keeping other medical history private. In conclusion, practical applications require additional security notions, which can vary depending on specific requirements.

Delegation and exculpability are important security notions often used in real-world AC (anonymous credential) applications. The property delegation allows the original credential owner to authorize another party to act on their behalf while restricting the scope of what the delegate can do. For instance, in access control [43,44], a manager can grant temporary access to a contractor to use the system, thereby minimizing the risk of system misuse. Moreover, the exculpability property protects users from being falsely accused of actions they did not take. For example, in e-cash [4], exculpability ensures users cannot be wrongly linked to a fraudulent transaction they did not initiate. Hence, exculpability in digital cash protects users from false accusations of double-spending or illegal activities.

E-voting systems in ACs [89,101] allow participants to vote remotely without moving to the polling station. However, when designing remote voting systems, several security notions must be achieved in addition to basic security notions of unforgeability and anonymity. Among these requirements, verifiability lets participants confirm that their votes are correctly recorded without revealing individual ballots, while transparency ensures the election process is transparent and open. However, security requirements can vary based on the application, and different notions may be achieved, so there is no guarantee that only these properties will be achieved.

6.2. Open Directions

In our analysis, we have identified several research gaps in the field of ACs. Researchers need to design AC systems that are secure against quantum computers, as early AC systems in classical cryptography and pairing-based designs were found to be vulnerable to quantum attacks. Interested researchers can focus on lattice-based designs, addressing the gaps mentioned below. Additionally, code-based, hash-based, and isogeny-based designs can be implemented, which were not analyzed in this study.

• The current literature indicates that the credential sizes of these lattice-based schemes are comparatively large compared to existing schemes. Interested readers can focus on minimizing the credential sizes of quantumly secure AC schemes.
• Although several AC systems have been proposed for specific properties in pairing-based cryptography, only a few designs have been proposed for lattice-based cryptography. Interested readers may explore constructions for properties such as revocability, traceability, signer hiding, and delegation in lattice-based AC systems.
• Although aggregate, redactable, and sanitizable signatures have been used in pairing-based designs, it is worth investigating their suitability for quantum-secure AC systems.
• To the best of our knowledge, the existing AC systems based on lattices remain less efficient than the classical and pairing-based AC systems and are not practical enough. Researchers are encouraged to address this gap and explore innovative solutions in developing quantum-resistant AC schemes for practical, real-world applications.

In addition, the construction lattice-based multi-authority AC systems face challenges due to the requirement of aggregate signatures, which allow multiple credentials from different issuers to be combined into a single credential. General aggregate signatures (ASs) enable offline aggregation of credentials without requiring the users’ private keys. In contrast, sequential aggregate signatures (SASs) require users to be online as signing and aggregation happen simultaneously. While lattice-based SAS schemes have been proposed [102,103], fully lattice-based aggregate signature schemes have recently been introduced [104], with high computational costs. Another challenge is compatibility with lattice-based ZK proofs. Further research is required to improve post-quantum lattice-based aggregation for shorter credential sizes and better verification efficiency to construct post-quantum multi-authority AC systems.

7. Conclusions

This paper comprehensively analyzed anonymous credentials from 1985 to the present. This research provides a systematic review, defining AC systems, discussing standard designs, and outlining crucial security definitions for practical applications. Moreover, the study provides a comprehensive review of the generation of AC systems in construction, covering classical, pairing-based, and post-quantum designs. Our aim of this thorough review of evolution is to identify the current trends in constructing AC systems and to determine what still needs to be achieved in the post-quantum lattice setting compared to pre-quantum constructions. Furthermore, this paper provides insights into real-world applications of current AC schemes in the application section. In conclusion, this paper serves as a road map for future post-quantum AC designers.