Universal reencryption is an interesting encryption primitive. Attempts to build signatures schemes or protocols with authentication incorporating it have frequently failed though.
A plausible application of a signature scheme employing universal reencryption might be:
Alice's software obtains a blind signed credential from a signing authority, perhaps stating her age. Alice wishes to use this credential with multiple websites, but obviously using the same signature on multiple websites violates the browser's cross origin policy because a typical signature depends upon a nonce that could be used to track Alice. A signature scheme based upon reencryption might allow Alice to mutate the nonce embedded in the signature.
There is an easy solution to this problem if the signing authority simply gives Alice thousands of single use blind singed tokens and keeps her stocked up, but that entails some logistical complications.
It'd be lovely if Alice could just use the same signature over and over, mutating it each time through universal reencryption or similar. Are there any signature schemes that support anonymizing the signature like this?
