Accountability Without Surveillance: What PRC Does—and Does Not—Deliver

The PRC-based anonymous-credential revocation system provides a conditional answer to the question that motivated this series: real-time accountability can coexist with anonymous presentation when the status check is redesigned as private record certification. The final judgment depends on seeing the whole system at once—the hidden index, the authorities' computation, the signed commitment, the zero-knowledge proof, the timestamp, and the deployment assumptions around them. Taken together, these elements show a credible research direction, not a guarantee that a credential system becomes private simply because it uses cryptography.

What PRC changes in the revocation bargain

The central insight is a change in what the revocation authority is asked to do. An ordinary service is asked to look up an identifier and return a status. That is operationally easy because the identifier tells the service which row to read, but it can turn the status endpoint into a record of use. In the PRC design, the authority is asked to certify the record at a hidden index. The holder sends a secret-shared query, the authorities jointly compute the associated status, and the result is a signed certificate that can later be linked to the anonymous credential in zero knowledge.

Each part of that sentence has a separate job. The hidden index prevents the authority from using the query as a direct credential identifier. Private computation lets the authorities find the corresponding record without receiving the clear index. The commitment binds the index and record into one object without exposing their values. The signature makes the authorities' statement recognizable to a client or verifier. The zero-knowledge proof connects the certificate to the presented credential while keeping the index out of the presentation. No single primitive supplies the entire property. The privacy result comes from how the boundaries are composed.

The lifecycle makes the composition visible. At issuance, the issuer creates an anonymous credential containing a private revocation index. The authorities maintain a replicated status database. Before a presentation, the holder requests a fresh certificate for that index and checks it against the expected valid record. If it matches, the holder prepares a proof that they know a valid credential whose hidden index is the one committed in the certificate and whose committed status is valid. The verifier checks the authority signature, the timestamp, and the proof. The verifier can decide whether to grant access without learning the index that could link this presentation to another one.

When the authority changes the status, the same lifecycle produces a different result. In the paper's convention, D[idx] = 1 means valid. A revocation changes the record so that a fresh certificate no longer verifies against the expected-valid value. The holder's local check fails, and they do not produce a non-revocation presentation. This is why the proposal can target a short revocation window without publishing a new credential identifier or invalidating a witness for every other holder. The record changes; the next private certification request sees the change.

The convention deserves emphasis because the adjacent W3C standard uses a different one. In the W3C Bitstring Status List's revocation purpose, a set bit represents a true revoked status and an unset bit represents validity. The systems are not made equivalent by both storing one bit. Their algorithms, publication models, and privacy boundaries differ. In PRC, the certificate is about a hidden pair selected through a private query. In a bitstring status list, a credential points to a position in a shared, signed list that a verifier can retrieve, cache, or receive from the holder.

This distinction clarifies what the phrase “without surveillance” can and cannot mean. PRC reduces the chance that the revocation authorities learn which credential is being checked. It does not prevent a malicious verifier from recording other information revealed during a presentation, nor can it repair a stable identifier disclosed through another channel. It does not make the issuer, authority consortium, or verifier incapable of colluding. It makes a particular high-value observation—the clear association between an authority query and a credential—harder to obtain under the protocol's assumptions.

The same architecture balances the three requirements established at the beginning of the series. Privacy requires the requested index and record to remain hidden from the authorities and the index to remain hidden from the verifier. Freshness requires a new status decision close to presentation, with a timestamp and an application-specific validity limit.