@techreport{irtf-cfrg-bbs-per-verifier-linkability-01,
    number =    {draft-irtf-cfrg-bbs-per-verifier-linkability-01},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-irtf-cfrg-bbs-per-verifier-linkability/01/},
    author =    {Vasilis Kalos and Greg M. Bernstein},
    title =     {{BBS per Verifier Linkability}},
    pagetotal = 76,
    year =      2025,
    month =     mar,
    day =       3,
    abstract =  {The BBS Signatures scheme defined in {[}I-D.irtf-cfrg-bbs-signatures{]}, describes a multi-message digital signature, that supports selectively disclosing the messages through unlinkable presentations, built using zero-knowledge proofs. Each BBS proof reveals no information other than the signed messages that the Prover chooses to disclose in that specific instance. As such, the Verifier (i.e., the recipient) of the BBS proof, may not be able to track those presentations over time. Although in many applications this is desirable, there are use cases that require the Verifier be able to track the BBS proofs they receive from the same Prover. Examples include monitoring the use of access credentials for abnormal activity, monetization etc.. This document presents the use of pseudonyms with BBS proofs. A pseudonym, is a value that will remain constant each time a Prover presents a BBS proof to the same Verifier, but will be different (and unlinkable), when the Prover interacts with a different Verifier. This provides a way for a recipient (Verifier) to track the presentations intended for them, while also hindering them from tracking the Prover's interactions with other Verifiers.},
}