# BBS# (called BBS sharp)
BBS# as described [here](https://github.com/user-attachments/files/15905230/BBS_Sharp_Short_TR.pdf)
This assumes that the messages/attributes have already been prepared before signing, i.e. attributes are hashed
with public salts, etc and whats called `H_i` in the paper is already created.
Implements support for both Schnorr signature and ECDSA (on secp256r1) generated by the user's secure hardware.
Implements both the offline and half-offline (HOL) mode.
In the former, the verifier is either the signer (has the secret key) or can ask the signer to verify the proof without revealing any user-specific info.
In the latter, the user needs to communicate with the signer before creating a proof and get "some helper data"
to create a proof which the verifier can check without needing the secret key or interacting with the issuer.
For efficiency and avoiding correlation (when signer and verifier collude), the user gets a batch of
"helper data" to let him create several proofs.
Also, the proof of knowledge of MAC protocol specified in footnote 31 in the paper is modified to allow integration with other
protocols, see the code comments in the relevant module.
Implements designated verifier proof for both issuer's signature (proof of validity of MAC) and user's proof of knowledge of MAC