In an anonymous credential scheme there are three participants: issuer, user(prover), verifier. Issuer creates a certificate to user which contains a list of user's attributes and issuer's signature(use BBS+ signature). The user who is in possession of that credential can selectively disclose some parts to some verifier.
- Setup: generate a pairing-friendly curve G, and target group Gt, pairing func e: G x G -> Gt.
- KeyGen: sk = (x), pk = (g^x).