Paper 2026/2295 Original: eprint.iacr.org/2026/2295 ↗

Context-Blind Device-Bound Anonymous Credentials from Signatures and Proofs

Abstract

Anonymous credentials enable privacy preserving authentication, but their transferability motivates binding each credential to a key protected by a secure element (SE). Such binding should preserve privacy even when the SE is remote or corrupted: every presentation must require fresh SE participation without revealing its context to the SE (Friedrichs et al., EC'26). Existing context-blind device-bound constructions rely on classical assumptions, whereas existing plausibly post-quantum anonymous credentials do not provide this functionality. We give a modular construction of context-blind device-bound anonymous credentials from a position-binding vector commitment, a signature scheme, a round-optimal blind signature, and a non-interactive zero-knowledge argument. We prove correctness, one-more unforgeability, unlinkability against a colluding issuer, verifier, and fully corrupted SE, and SE-obliviousness. We instantiate the construction with the CAPSS framework (Feneuil and Rivain, TCHES'26), Griffin/Jive Merkle commitments, and proofs of the complete presentation relation. For 16 attributes and four disclosures, using the Ligero-based proof backend from Longfellow (Frigo and shelat, CiC'26) yields a presentation taking 2.60 s on the user side and 0.29 s to verify, with a 506.11 KB proof. We also evaluate an Aurora backend for the same relation. We complement these measurements with published results to explore the proof-size/proving-time trade-offs offered by alternative transparent, plausibly post-quantum proof systems for relations of comparable size. To the best of our knowledge, this is the first concrete construction and evaluation of context-blind device-bound anonymous credentials assembled entirely from plausibly post-quantum components.