Batch Anonymous MAC Tokens from Lattices

Yingfei Yan, Sherman S. M. Chow, Lucien K. L. Ng, Harry W. H. Wong, Yongjun Zhao, Baocang Wang

Abstract: Solutions for DDoS protection employed by content delivery networks often burden honest users, especially those using privacy-enhancing tools like VPNs, by forcing them to solve many CAPTCHAs. Helping users avoid repeated CAPTCHAs, anonymous tokens (ATs) now offer a practical alternative to traditional anonymous credentials (ACs). Evolution of ATs, driven by IETF standardization, introduced features like the private metadata bit (Crypto ’20, Eurocrypt ’22), which encrypts challenge results for verifiers, preventing automated CAPTCHA solver. Regrettably, recent designs overlooked the original goal (PoPETS ’18) of batch-issuing tokens along with efficient batch proofs for validation. Moreover, most solutions lack post-quantum security, except a direct adaptation from ACs (ePrint ’23) that lacks private metadata support. Adopting lattice-based cryptography in existing AT designs is non-trivial, as they often employ intricate algebraic structures to ensure efficiency. Notably, a lattice-based AT in the keyed-verification setting that supports both batch proofs and private metadata bit remains absent.