[Cryptography] Anonymous age verification

[Ron Garret]

> On Jul 15, 2026, at 7:29 PM, Steven M. Bellovin <smb at cs.columbia.edu> wrote:
> 
> It's possible using zero-knowledge proofs—*if* you can provide suitable evidence to what I call an "identity provider". This is not necessarily easy, though in some places it will be easier than others. See https://www.cs.columbia.edu/~smb/papers/age-verify.pdf for details. (Also see that paper's reference 41, for a much more detailed look at how such a system could work—though that's a law paper, with a lot of US legal analysis, and has features that are not wanted here, e.g., a "deanonymization agent".)

OK, my initial response here was a little too glib.  Yes, it's theoretically possible to design a protocol by which a person 1) documents their age to an identity provider (IDP), 2) receives a credential from that IDP which they can then use to 3) generate sub-credentials which they can provide to a relying party (RP) that 4) the RP can verify originated from someone who has documented their age to an IDP without learning who that person actually is.

In practice, however, there are myriad problems.  The most obvious one is that there is nothing to stop a legal adult from giving sub-credentials to their friends, or, for the more enterprising, selling sub-credentials to strangers.  Providing fake IDs has a long and venerable history, and the fact that the sub-credentials cannot be traced back to their source means that you can do this with impunity.  So yeah, it looks good in a crypto journal, but it won't survive more than five minutes of contact with reality.

rg