Cryptographers Patch a Dangerous Flaw in Anonymous Credential Signatures

A team of cryptographers in China has uncovered a serious security weakness in an anonymous credential scheme that was presented at one of the world’s leading security conferences, and they have proposed a fix that could make privacy-preserving digital identity systems both safer and faster. The research, published in the journal Mobile Networks and Applications, targets an aggregate signature construction that underpins so-called issuer-hiding, multi-authority anonymous credentials — a technology designed to let people prove things about themselves online without revealing who they are or who issued their credentials.

Anonymous credentials have become one of the most promising tools for protecting user privacy in modern identity management. In an anonymous credential system, a user obtains a digitally signed set of attributes from an issuer — for example, a government agency confirming age or residency, or a university confirming student status. Later, the user can authenticate to a verifier in a manner that is both anonymous and unlinkable, disclosing only the specific attributes that are necessary for the transaction at hand. The verifier learns that the claim is legitimate without learning the user’s identity, and presentations made at different times cannot be linked back to the same person.

The scheme under scrutiny was proposed by Mir and colleagues at the 2023 ACM SIGSAC Conference on Computer and Communications Security, a flagship venue for computer security research. Their construction introduced an aggregate signature scheme with randomizable tags and public keys, enabling a powerful feature known as issuer hiding. In a multi-authority setting, where credentials may come from many different issuers, issuer hiding allows a user to present a credential without revealing which organization actually issued it. This matters in practice because knowledge of the issuer can itself be identifying: a credential from a specific clinic, shelter, or government program can leak sensitive information even when the user’s name remains hidden.

The scheme’s authors claimed that their aggregate signature was unforgeable in the random oracle model, a standard proof framework in which cryptographic hash functions are modeled as idealized random functions. Unforgeability of an aggregate signature means that no efficient adversary should be able to produce a compact aggregated signature that verifies correctly unless they genuinely possess valid signatures for every component. Aggregate signatures are attractive for anonymous credentials because they allow many individual signatures — one per credential attribute or per issuing authority — to be compressed into a single, constant-size object that can be verified efficiently.

The new analysis, conducted by Qiu Zhang, Yinxia Sun, Ge Wu, and Yang Lu, demonstrates that this security claim does not hold against a class of adversaries the original designers apparently overlooked: malicious issuers acting in coalition. In the attack, several corrupt issuers collude to produce individual signatures that are, in fact, invalid. Individually, these malformed signatures would fail verification if a user checked each one. But when combined, the invalid components aggregate into a signature that passes the aggregate verification check. In other words, the aggregation process can mask the invalidity of its parts, allowing a forged aggregate to be accepted by verifiers.

The implications for anonymous credential systems are significant. A user of the original scheme could be tricked into holding credentials that appear valid in aggregate form but rest on fraudulent underlying signatures. In a deployed system, malicious issuers exploiting this coalition attack could undermine the integrity guarantees that verifiers depend on — for instance, allowing improperly issued or manipulated credentials to circulate and be accepted at face value. Because the attack requires collusion among issuers rather than a break by an outside attacker, it sits squarely within the multi-authority threat model that issuer-hiding credentials are specifically designed to address.

Having identified the vulnerability, the researchers did not stop at criticism. They developed a targeted countermeasure: an improved aggregate signature scheme that mitigates coalition attacks by closing the loophole that allowed invalid components to combine into a valid aggregate. The improvement preserves the core functionality that made the original construction appealing — versatile randomization of tags and public keys, and support for issuer-hiding multi-authority credentials — while restoring the unforgeability guarantee that the coalition attack had broken.

Beyond repairing security, the improved scheme delivers a meaningful efficiency gain for users. In credential systems built on the original construction, a user had to verify each individual credential before aggregating them during a presentation, an expensive process of multiple independent verification computations. With the improved scheme, users can skip the verification of individual credentials entirely and aggregate them directly during the presentation phase. Because credential presentation is typically performed on resource-constrained devices such as smartphones, and because users may need to present several credentials simultaneously in multi-authority scenarios, this reduction in computational overhead on the user side is a substantial practical advantage.

The work fits into a broader and rapidly evolving research landscape on anonymous credentials and aggregate signatures. The bibliography of the new paper traces a lineage running from structure-preserving signatures on equivalence classes and constant-size anonymous credentials published in the Journal of Cryptology, through traceable constant-size multi-authority credentials, to issuer-hiding attribute-based credentials and recent delegatable attribute-based anonymous credential schemes with fine-grained delegation management. Applications cited in the surrounding literature range from privacy-enhanced traceable blockchain transactions to anonymous authentication protocols for vehicular networks and wireless medical sensor systems, underscoring how widely these cryptographic primitives are expected to be deployed.

For the privacy engineering community, the lesson of this study is a familiar but important one: security proofs must account for adversaries that match the real deployment model. In systems explicitly designed to tolerate many, potentially untrustworthy, issuing authorities, the possibility of issuer collusion is not an exotic assumption but a central case that any sound construction must withstand. By demonstrating a concrete coalition attack and providing a repair that also lightens the computational load on users, the Nanjing-based team has strengthened the foundations of issuer-hiding anonymous credentials at a moment when interest in privacy-preserving identity infrastructure — from digital identity wallets to anonymous access tokens — is accelerating across both industry and academia. The research was supported by the National Natural Science Foundation of China under grant number 62372177.

Subject of Research: Security analysis and improvement of aggregate signature schemes for issuer-hiding multi-authority anonymous credentials

Article Title: Improved Aggregate Signature With Versatile Randomization For Issuer-Hiding Multi-Authority Anonymous Credentials

Article References: Zhang, Q., Sun, Y., Wu, G., & Lu, Y. (2026). Improved Aggregate Signature With Versatile Randomization For Issuer-Hiding Multi-Authority Anonymous Credentials. Mobile Networks and Applications. https://doi.org/10.1007/s11036-026-02555-z

Image Credits: AI Generated

DOI: 10.1007/s11036-026-02555-z

Keywords: aggregate signature, anonymous credentials, coalition attack, issuer-hiding, multi-authority credentials, privacy protection, cryptography, identity management, randomizable tags, unforgeability, credential presentation, digital identity