View source for Idemix and Higgins

== Idemix Overview ==

Private certificate protocols:

* Issuance: An identity provider issuing a private certificate to a user.
* Prove: A user creating a proof for an assertion using one or more private certificates.

A private certificate, once obtained, can be used multiple times for creating proofs for assertions; all uses are unlinkable unless the assertion itself establishes linkability. A private certificate is never provided to a relying party, only proofs computed with it are provided.


== Higgins Integration ==

For the architecture, idemix requires an STS plugin, preferably of a co-located STS, that can create idemix proofs for assertions. The creation of an idemix proof is an RST-RSTR pair. The RST contains the idemix private certificates, the assertion, involved public keys, and the user's private key as input. Thr RSTR contains the idemix proof token that is to be provided to the relying party.


=== Issuance and Prove Protocols ===

The following describes the abstract flow for obtaining and using idemix private certificates. Details to be provided.


==== Issuance ====

The issuance results in the user obtaining a new idemix private certificate from the identity provider and an I-Card describing the certificate. The protocol is an interactive multi-round protocol between the two parties.


==== Prove ====

Providing an assertion backed with an idemix proof consists of the following steps:
* Once the user's client receives the assertion request from the relying party, the ISS matches the policy against the attribute values of the available private certificates and the associated metadata (I-Cards).
* The user is challenged with the possible ways of fulfilling the assertion request.
* The user makes a choice and provides this choice to the ISS.
* The ISS creates an appropriate RST message targeted to the co-located STS and sends it.
* The STS replies with an RSTR containing the idemix proof token.
* The idemix proof token is conveyed to the relying party by the browser.