Anonymous nym ratings

[Anonymous <nobody@replay.com>]

Adam Back writes:
> Probably a good rule of thumb is never to sign anything and always
> post via a mixmaster chain.

Good idea!

> Some messages don't need a persistent nym
> even.  Perhaps one could construct a zero knowledge proof of nym
> reputation rating without identityfing the nym which might be useful
> for filtering without linkability.

This could be done via some of the recent work on group signatures.
Efficient methods have been developed to show that a message is signed
by a key, without revealing what the key is, but proving that the key
itself is signed by a specific other key.

Imagine an editor who only signs keys belonging to people who deserve
to get through filters.  Call this "endorsing" a key.  If you respect
that editor, you set your filters to let messages through which are by
keys he has endorsed in this manner.  Now, people can submit messages
anonymously, but in such a way that they are provably written by an
endorsed key, without revealing which key it is.

The protocols are reasonably efficient, with signature verification taking
about 20 times longer than a regular DSS signature.  However the methods
involve blind signatures, and hence would infringe upon Chaum's patent.

The group signature was described at Crypto 97; an extension for blind
group signatures at Asiacrypt 98; and more work will be presented at
FC 99.