Home > Resources > papers > CL02-CL-Signatures

A Signature Scheme with Efficient Protocols (Camenisch, Lysyanskaya 2002)

Last modified: 2026-10-27

DOI: 10.1007/3-540-36413-7_20 · URL: https://doi.org/10.1007/3-540-36413-7_20

Summary

Presents the CL signature scheme (strong RSA assumption) together with efficient protocols to obtain a signature on committed values and to prove knowledge of a signature on committed messages. These two protocols are exactly what anonymous credentials need, and CL signatures became the basis of IBM Idemix and Hyperledger AnonCreds. (SCN 2002.)

Related resources

• A Method for Obtaining Digital Signatures and Public-Key Cryptosystems (Rivest, Shamir, Adleman 1978) (paper, 1978)
• Constant-Size Dynamic k-TAA (Au, Susilo, Mu 2006) (paper, 2006)
• D2.2 Architecture for Attribute-based Credential Technologies — Final Version (ABC4Trust) (Bichsel et al. 2014) (paper, 2014)
• Proof Systems for General Statements about Discrete Logarithms (Camenisch-Stadler 1997) (paper, 1997)
• Signature Schemes and Anonymous Credentials from Bilinear Maps (Camenisch, Lysyanskaya 2004) (paper, 2004)
• SoK: Anonymous Credentials (Kakvi, Martin, Putman, Quaglia 2023) (paper, 2023)
• SoK: Anonymous Credentials for Digital Identity Wallets (Bormann, Lehmann 2026) (paper, 2026)