Skip to content

Back to the catalog

Nowhere Man: Device Binding for Post-Quantum Anonymous Credentials
eprint.iacr.orgpaper

Nowhere Man: Device Binding for Post-Quantum Anonymous Credentials

Presents a modular device-binding protocol for post-quantum anonymous credentials. The phone Secure Element signs a verifier challenge with an unmodified FIPS 204 ML-DSA interface, and the user proves knowledge of that signature in zero knowledge at each presentation. Using ML-DSA's structure avoids the cost of generic NIZK systems such as Longfellow. The most efficient variants assume weak-MLWR for unlinkability, and that assumption can be dropped at some efficiency cost. The protocol works with different anonymous credential schemes, and a proof-of-concept implementation is included. This matters for planned EU age-verification and Google Wallet/mDL rollouts, which need protection against credential sharing.

TL;DR Device binding for anonymous credentials using standard ML-DSA signatures from a phone Secure Element, proved in zero knowledge more efficiently than generic NIZKs; extended version of an IEEE S&P 2027 paper.
Open original ↗

Organisations named here

  • FIPS 204
  • mDL
  • ML-DSA
  • Vega
  • weak-MLWR assumption

Technologies named here

  • Anonymous credential deployments
  • Longfellow
  • Google Wallet
  • Vega
  • mobile Driver License framework
  • ML-DSA
  • Phone Secure Element
  • ML-DSA standardized post-quantum signature scheme

Techniques named here

  • Device binding

Related in Identity & Access