Reduction of certificates in an anonymous credential system with proofs for monotone formulas on attributes

Anonymous credential systems enable a user to assure a service provider anonymously the ownership of his certified attributes. We have previously proposed an anonymous credential system to prove that user's attributes satisfy a monotone formula, i.e., a logic relation with any AND/OR combinations without negations. However, this system has a limitation where the user can prove the formula only using a certificate of minimum attribute set, which is a subset of user's attribute set that contains one satisfying attribute for each OR relation. Thus, he is issued with 2|U| signatures of all subsets of U, where U is the set of user's attributes. In this paper, we propose an improvement to reduce the number of signatures to approximately √2|U| by dividing set U into two sets. We implemented the system using a fast pairing library, and measured the processing times and data sizes to show the effectiveness.