[Cryptography] Anonymous age verification

[Steven M. Bellovin]

On 16 Jul 2026, at 2:54, Ron Garret wrote:

>
>> On Jul 15, 2026, at 7:29 PM, Steven M. Bellovin <smb at cs.columbia.edu> wrote:
>>
>> It's possible using zero-knowledge proofs—*if* you can provide suitable evidence to what I call an "identity provider". This is not necessarily easy, though in some places it will be easier than others. See https://www.cs.columbia.edu/~smb/papers/age-verify.pdf  for details. (Also see that paper's reference 41, for a much more detailed look at how such a system could work—though that's a law paper, with a lot of US legal analysis, and has features that are not wanted here, e.g., a "deanonymization agent".)
>
> OK, my initial response here was a little too glib.  Yes, it's theoretically possible to design a protocol by which a person 1) documents their age to an identity provider (IDP), 2) receives a credential from that IDP which they can then use to 3) generate sub-credentials which they can provide to a relying party (RP) that 4) the RP can verify originated from someone who has documented their age to an IDP without learning who that person actually is.
>
> In practice, however, there are myriad problems.  The most obvious one is that there is nothing to stop a legal adult from giving sub-credentials to their friends, or, for the more enterprising, selling sub-credentials to strangers.  Providing fake IDs has a long and venerable history, and the fact that the sub-credentials cannot be traced back to their source means that you can do this with impunity.  So yeah, it looks good in a crypto journal, but it won't survive more than five minutes of contact with reality.
>

Some academics do think about such issues…

From the original Camenisch-Lysyanskaya paper:

	Here, sharing just one pseudonym or credential implies sharing all of the user’s other
	credentials and pseudonyms in the system, i.e., sharing all of the user’s secret
	keys inside the system.

From my paper:

	A security assumption behind the CL protocol is that the possessor of a subcredential’s
	private key will not share it with others—knowledge of such a private key allows
	derivation of the associated primary credential’s key. However, if the only use of the
	primary credential is obtaining age-verifying subcredentials, this isn’t much of a deterrent—
	many people simply won’t care. In other words, primary credentials need to be used for
	other sorts of things to create the proper disincentive for sharing.

	That, however, creates pressure for mission creep. A number of other possible uses for
	CL credentials are given in [3], including opening bank accounts, employment verification,
	and vaccination certificates [29]; however, this is also a major point of social control,
	since it is possible to revoke a primary credential and with it all derived subcredentials
	[2]. Those who are disfavored by authoritarian governments may lose access not just to
	pornography, but to social media and all of these other services. (Of course, the need for
	such revocability can be a good thing, to cope with compromised credentials, lost or stolen
	devices, etc.)


        --Steve Bellovin, https://www.cs.columbia.edu/~smb