Open-sourcing Anonymous Credential Service

This post introduces and open-sources the Anonymous Credential Service (ACS), a highly available multitenant service for de-identified authentication. It details the underlying anonymous credential protocol based on VOPRFs and blind signatures, explaining the two-phase process of token issuance and redemption. Key technical challenges and solutions are discussed, including token redemption counting, key rotation strategies using attribute-based key derivation functions (KDFs) for transparency, and deployment at scale. The post also outlines the components of the ACS C library and provides a conceptual example of its use in a real system for scenarios like de-identified logging.