Anonymous Subscription Protocols

In this paper we discuss protocols that allow a user to subscribe to an electronic service, and then anonymously access the service. That is, the provider does not know who accesses the service at any time, and moreover he cannot link two accesses to the same person. On the other hand, the supplier obtains proof that the user is authorized to access the service. We formally define the problem, give practical examples, and discuss the security features these protocols should have. An important property for a protocol is termination: the access privileges can be used only a fixed number of times. In this paper, we state and analyze two practical schemes which are the first to have this property while maintaining anonymity and unlinkability. The protocols also achieve lower storage and communication requirements than related schemes. One protocol uses blind signatures, while the other is based on a group signature scheme. The analysis includes identifying a new equivalent variant of the Decisional Diffie-Hellman security assumption, which may be of independent interest. Key-Words: Subscription/rental services, group signatures, anonymity, blind signatures, authentication.