Privacy Pass Issuance Protocol for Anonymous Credit Tokens

5.1. Credential Lifecycle and Distributed Transactions

ACT credentials follow a distributed transaction model where each spend operation creates a two-phase interaction between the client and the origin:¶

1. Spend Phase: The client commits to spending a credential by generating a spend proof containing a nullifier. At this point, the credential MUST be considered invalid and cannot be reused.¶

2. Refund Phase: The origin verifies the spend proof and, if valid, returns a refund that allows the client to construct a new credential with the remaining balance.¶

This two-phase model is critical for ACT's concurrency control properties. Because a credential becomes invalid immediately upon spend (before the refund is received), a client cannot perform multiple concurrent spend operations with the same credential. This enforces a strict serialization of operations per credential chain.¶

5.2. Client State Transitions

A client managing an ACT credential progresses through the following states:¶

State transitions:¶

• Initial: Client holds a valid credential with N credits (N > 0). The credential can be spent.¶

• Spent: Client has generated a spend proof and sent it to the origin. The original credential is now invalid and MUST NOT be used again. The client is blocked waiting for a refund response.¶

• Refunded: Client has received a valid refund and constructed a new credential with the remaining balance. If the new balance is greater than 0, the client returns to the Initial state with the new credential. If the balance is 0, the credential is exhausted.¶

The transition from Spent to Refunded may fail if the origin does not provide a valid refund. Error handling for this case is described in Section 5.5.¶

5.3. Concurrency Control Through Blocking

The key insight enabling ACT's concurrency control is that each credential instance can only be in one state at a time. When a client calls ProveSpend, it must immediately transition the credential to the Spent state, making it unavailable for any other operations. The client cannot perform another spend until it receives a refund and transitions to the Refunded state with a new credential instance.¶

This blocking behavior prevents credential sharing and concurrent usage:¶

• If a malicious party attempts to copy a credential and use it elsewhere, only one spend operation can succeed (whichever reaches the origin first). The second spend will be rejected as a double-spend when the origin checks the nullifier.¶

• Even if a single client attempts to perform concurrent spends with the same credential, the first spend invalidates the credential, preventing the second.¶

The origin can enforce session behavior by declining to issue a refund, effectively terminating the credential chain and preventing further operations.¶

5.4. Multiple Credential Management

Clients MAY maintain multiple independent credential chains simultaneously. This is useful when credentials are bound to different contexts via the credential_context field (Section 7).¶

Example: A client might hold:¶

• Credential A: Bound to issuer1.example, origin1.example, credential_context = "session-2024-01", with 100 credits¶

• Credential B: Bound to issuer1.example, origin2.example, credential_context = "session-2024-01", with 50 credits¶

• Credential C: Bound to issuer1.example, origin1.example, credential_context = "session-2024-02", with 75 credits¶

Each credential chain operates independently with its own state machine. A spend operation on Credential A does not affect Credentials B or C. The client can perform spend operations on different credentials concurrently, but each individual credential chain is strictly serialized through the spend-refund cycle.¶

When the client receives a TokenChallenge, it determines which credential to use based on the challenge's issuer_name, origin_info, and credential_context fields. If no matching credential exists or all matching credentials are in the Spent state (awaiting refund), the client SHOULD either wait for a refund or request a new credential through the issuance protocol.¶

5.5. Error Handling

6.1. Request Context Extension

This Privacy Pass integration binds credentials to application-specific contexts using a request_context parameter. This approach is inspired by the Anonymous Rate-Limited Credentials (ARC) protocol [ARC_PP], which threads a similar context parameter through its cryptographic operations for domain separation.¶

IMPORTANT: The current CFRG ACT specification [ACT] does not include request_context parameters in its cryptographic functions. To support the Privacy Pass integration described in this document, the ACT specification would need to be extended with the following changes:¶

1. IssueRequest: No changes needed - the client generates a blinded commitment without knowledge of the final context binding.¶

2. IssueResponse: Add request_context as an input parameter alongside the credit amount c. The issuer determines the appropriate context based on its policy (e.g., derived from TokenChallenge fields) and binds the credential to this context. The function would hash the context into a scalar and include it in the credential signature, similar to how ARC hashes requestContext into m2.¶

3. VerifyAndRefund: Add request_context as an input parameter to verify that the spend proof is bound to the correct application context. The issuer reconstructs the context from the TokenChallenge and uses it during verification.¶

4. Credential Structure: The Anonymous Credit Token structure would be extended to include the context-bound component within the BBS signature, analogous to how ARC credentials include m2 for presentation context binding.¶

The key insight is that request_context is determined by the issuer (like the credit amount), not by the client. The issuer sets the context during IssueResponse based on the TokenChallenge requirements, and both parties reconstruct it from TokenChallenge fields during spending.¶

Until these extensions are incorporated into the CFRG ACT specification, the function calls in this document should be understood as describing the intended behavior with request_context support. Implementations SHOULD coordinate with the CFRG ACT specification authors to ensure compatibility.¶

For reference on how request context threading works in practice, see Section 3 of [ARC_PP], which demonstrates the pattern of binding credentials to application-specific contexts through cryptographic commitments.¶

8.1. Client-to-Issuer Request

Given Origin-provided input tokenChallenge and the Issuer Public Key ID issuer_key_id, the Client first creates a credential request message using the IssueRequest function from [ACT] as follows:¶

(clientSecrets, request) = IssueRequest()

The Client then creates a TokenRequest structure as follows:¶

struct {
  uint16_t token_type = 0xE5AD; /* Type ACT(Ristretto255) */
  uint8_t truncated_issuer_key_id;
  uint8_t encoded_request[Nrequest];
} TokenRequest;

The structure fields are defined as follows:¶

• "token_type" is a 2-octet integer.¶

• "truncated_issuer_key_id" is the least significant byte of the issuer_key_id (Section 6) in network byte order (in other words, the last 8 bits of issuer_key_id). This value is truncated so that Issuers cannot use issuer_key_id as a way of uniquely identifying Clients; see Section 10 and referenced information for more details.¶

• "encoded_request" is the Nrequest-octet request, computed as the serialization of the request value as defined in Section 4.1.1 of [ACT].¶

The Client then generates an HTTP POST request to send to the Issuer Request URL, with the TokenRequest as the content. The media type for this request is "application/private-credential-request". An example request for the Issuer Request URL "https://issuer.example.net/request" is shown below.¶

POST /request HTTP/1.1
Host: issuer.example.net
Accept: application/private-credential-response
Content-Type: application/private-credential-request
Content-Length: <Length of TokenRequest>

<Bytes containing the TokenRequest>

8.2. Issuer-to-Client Response

Upon receipt of the request, the Issuer validates the following conditions:¶

• The TokenRequest contains a supported token_type equal to value 0xE5AD.¶

• The TokenRequest.truncated_token_key_id corresponds to the truncated key ID of an Issuer Public Key, with corresponding secret key skI, owned by the Issuer.¶

• The TokenRequest.encoded_request is of the correct size (Nrequest).¶

If any of these conditions is not met, the Issuer MUST return an HTTP 422 (Unprocessable Content) error to the client.¶

If these conditions are met, the Issuer then tries to deserialize TokenRequest.encoded_request according to Section 4.1.1 of [ACT], yielding request. If this fails, the Issuer MUST return an HTTP 422 (Unprocessable Content) error to the client. Otherwise, if the Issuer is willing to produce a credential for the Client, the Issuer determines both the number of initial credits and the request_context based on its policy (e.g., based on attestation results, payment verification, or TokenChallenge requirements). The request_context binds the credential to the specific application context:¶

request_context = concat(tokenChallenge.issuer_name,
  tokenChallenge.origin_info,
  tokenChallenge.credential_context,
  issuer_key_id)
response = IssueResponse(skI, request, initial_credits, request_context)

The Issuer then creates a TokenResponse structured as follows:¶

struct {
   uint8_t encoded_response[Nresponse];
} TokenResponse;

The structure fields are defined as follows:¶

• "encoded_response" is the Nresponse-octet encoded issuance response message, computed as the serialization of response as specified in Section 4.1.2 of [ACT].¶

The Issuer generates an HTTP response with status code 200 whose content consists of TokenResponse, with the content type set as "application/private-credential-response".¶

HTTP/1.1 200 OK
Content-Type: application/private-credential-response
Content-Length: <Length of TokenResponse>

<Bytes containing the TokenResponse>

8.3. Credential Finalization

Upon receipt, the Client handles the response and, if successful, deserializes the content values TokenResponse.encoded_response according to Section 4.1.2 of [ACT] yielding response. If deserialization fails, the Client aborts the protocol. Otherwise, the Client processes the response as follows:¶

credential = VerifyIssuance(pkI, request, response, clientSecrets)

The Client then saves the credential structure, associated with the given Issuer Name, to use when producing Token values in response to future token challenges.¶

9.1. Token Creation

Given a TokenChallenge value as input, denoted challenge, a cost, denoted cost, and a previously obtained credential that is valid for the Issuer identifier in the challenge, denoted credential, containing at least cost credits, Clients compute a spend request as follows:¶

spend_proof, state = ProveSpend(credential, cost)

Each credential instance MUST only ever be used for a single spend request. When the client receives the refunded credential from the server, the client uses that new credential instance for the next spend. If the same credential instance is used more than once, the privacy assumptions of ACT are violated by presenting the same nullifier twice.¶

The resulting Token value is then constructed as follows:¶

struct {
    uint16_t token_type = 0xE5AD; /* Type ACT(Ristretto255) */
    uint8_t challenge_digest[32];
    uint8_t issuer_key_id[Nid];
    uint8_t encoded_spend_proof[Nspend_proof];
} Token;

The structure fields are defined as follows:¶

• "token_type" is a 2-octet integer, in network byte order, equal to 0xE5AD.¶

• "challenge_digest" is a 32-octet value containing the hash of the original TokenChallenge, SHA-256(TokenChallenge).¶

• "issuer_key_id" is a Nid-octet identifier for the Issuer Public Key, computed as defined in Section 6.¶

• "encoded_spend_proof" is a Nspend_proof-octet encoded spend proof, set to the serialized spend_proof value as specified in Section 4.1.3 of [ACT]. The spend proof contains the nullifier (field 1) and spend amount (field 2), among other cryptographic values.¶

9.2. Token Refund

Upon receiving a Token from the Client, the Origin deserializes the spend_proof according to Section 4.1.3 of [ACT], yielding a SpendProofMsg structure. The Origin then extracts the relevant fields from the spend proof:¶

// Extract fields from SpendProofMsg (see Section 4.1.3 of ACT)
nullifier = spend_proof.k      // Field 1: nullifier (32 bytes)
spend_amount = spend_proof.s   // Field 2: spend amount (32 bytes)

The Origin SHOULD verify that the spend_amount matches the requested cost from TokenChallenge to ensure the client is spending the expected amount.¶

To verify the Token and issue a refund, the Origin constructs the request_context and invokes VerifyAndRefund:¶

request_context = concat(tokenChallenge.issuer_name,
  tokenChallenge.origin_info,
  tokenChallenge.credential_context,
  issuer_key_id)
refund = VerifyAndRefund(skI, request_context, spend_proof)

This function returns the refund serialized according to Section 4.1.4 of [ACT] if the spend proof is valid, and nil otherwise.¶

As mentioned in Section 2.2.2 of [AUTHSCHEME], Origins SHOULD implement some form of double-spend prevention that prevents a token with the same nonce from being redeemed twice. With ACT, the Origin SHOULD check that the nullifier has not previously been seen before calling VerifyAndRefund. It then stores the nullifier for use in future double-spending checks. To reduce the overhead of performing double spend checks, the Origin MAY store and look up the nullifiers corresponding to the associated request_context value.¶

struct {
    uint8_t refund[Nrefund];
} Refund;

The Origin sends the refund back to the client encoded as the above Refund struct.¶

9.3. New Credential from Refund

Unlike [ARC], clients must construct a new credential instance based on the Refund response. To do so, clients invoke the ConstructRefundToken function from Section 3.4.4 of [ACT] as follows:¶

credential = ConstructRefundToken(pkI, spend_proof, refund, state)

The client then uses this new credential instance for subsequent spend operations.¶

10.1. Privacy Properties

Privacy considerations for tokens based on deployment details, such as issuer configuration and issuer selection, are discussed in Section 6.1 of [ARCHITECTURE]. Note that ACT requires a joint Origin and Issuer configuration (where the Issuer and Origin are operated by the same entity) given that tokens produced from credentials are not publicly verifiable.¶

ACT credentials offer Origin-Client unlinkability, Issuer-Client unlinkability, and redemption context unlinkability, as described in Section 3.3 of [ARCHITECTURE]. The cryptographic security properties of the underlying ACT protocol, including unforgeability and unlinkability guarantees, are analyzed in [ACT].¶

10.2. Double-Spend Prevention

Section 2.2.2 of [AUTHSCHEME] specifies double spending requirements that Origin SHOULD follow.¶

For ACT, the double-spend prevention mechanism relies on Origins maintaining state to track nullifiers. As described in Section 9.2, Origins SHOULD check that a nullifier has not been previously seen before accepting a spend proof. This check is critical for preventing credential reuse attacks.¶

The nullifier space is large (32 bytes), making random collisions computationally unlikely. However, Origins SHOULD ensure that their nullifier storage is persistent and survives server restarts. If an Origin loses nullifier state (e.g., due to data loss or cache eviction), it becomes vulnerable to replay attacks where an attacker can resubmit previously spent credentials during the credential validity period.¶

Origins MAY scope nullifier storage by request_context to improve lookup performance and enable efficient storage management. Since nullifiers are only meaningful within the context of a specific credential binding (determined by issuer_name, origin_info, credential_context, and issuer_key_id), Origins can partition nullifier storage accordingly.¶

When an Origin implements a timeout for refund state (as described in Section 5.5), it MAY also expire the corresponding nullifier after the same timeout period, provided that no future spend attempts with that nullifier are possible.¶

10.3. Concurrency Control and Credential Sharing

The state machine described in Section 5 enforces that each credential instance can only be spent once. This prevents multiple parties from using the same credential concurrently, which is critical for preventing credential sharing attacks.¶

If an attacker copies a credential and attempts to use it from multiple locations simultaneously, only the first spend operation to reach the Origin will succeed. The Origin's nullifier check will reject all subsequent spends with the same credential as double-spend attempts. This property holds even if the spend operations occur in parallel from different network locations.¶

Clients MUST implement the state machine correctly and transition credentials to the Spent state immediately upon calling ProveSpend. A client implementation that allows multiple concurrent ProveSpend calls on the same credential would enable double-spend attempts and violate ACT's privacy guarantees by revealing that the same credential is being used multiple times.¶

10.4. Issuer Key Identification

As described in Section 8, the TokenRequest includes only a truncated issuer_key_id (the least significant byte) to prevent Issuers from using the key identifier as a client tracking mechanism.¶

Issuers MUST prevent truncated key ID collisions among simultaneously active keys. This can be accomplished by generating keys until the truncated key ID does not collide with any existing active key's truncated ID. With a 1-byte (256 value) truncated key space, this is straightforward for reasonable numbers of concurrent keys.¶

Additionally, Issuers SHOULD limit the total number of simultaneously active keys for privacy reasons, as a large number of active keys can enable partitioning attacks.¶

10.5. Dynamic Revocation and Origin Control

ACT's design allows Origins to terminate credential chains by declining to issue refunds. While this enables the dynamic revocation property described in Section 2, it also gives Origins significant control over client access.¶

Clients have no cryptographic recourse if an Origin refuses to provide refunds after accepting valid spend proofs. This is an intentional design property that enables Origins to enforce access policies and shed abusive traffic, but it does mean that clients must trust Origins to behave correctly within the protocol.¶

Clients MAY implement reputation systems or other mechanisms to track Origin behavior and avoid Origins that consistently fail to provide refunds. However, such mechanisms are outside the scope of this specification.¶