\newcommand{\orange}[1]{{\color{orange}#1}} \newcommand{\blue}[1]{{\color{blue}#1}} \newcommand{\red}[1]{{\color{red}#1}} \newcommand{\Guardian}{\mathcal{G}} \newcommand{\Child}{\mathcal{C}} \newcommand{\Customer}{\mathcal{C}} \newcommand{\Merchant}{\mathcal{M}} \newcommand{\Exchange}{\mathcal{E}} \newcommand{\Commit}{\mathsf{Commit}} \newcommand{\Attest}{\mathsf{Attest}} \newcommand{\Verify}{\mathsf{Verify}} \newcommand{\Derive}{\mathsf{Derive}} \newcommand{\DeriveCompare}{\mathsf{DeriveCompare_\kappa}} \newcommand{\Compare}{\mathsf{Compare}} \newcommand{\AgeVer}{\mathsf{AgeVer}} \newcommand{\HashF}{\mathsf{H}} \newcommand{\Hash}{\mathsf{H}} \newcommand{\Block}{\mathbb{B}} \newcommand{\Pub}{\mathsf{Pub}} \newcommand{\Sign}{\mathsf{Sig}} \newcommand{\Ver}{\mathsf{Ver}} \newcommand{\Encoding}{\mathsf{Encoding}} \newcommand{\ECDSA}{\mathsf{ECDSA}} \newcommand{\Null}{\mathcal{O}} \newcommand{\EC}{\mathrm{ec}} \newcommand{\Curve}{\mathsf{Curve25519}} \newcommand{\SHA}{\mathsf{SHA256}} \newcommand{\SHAF}{\mathsf{SHA252}} \newcommand{\FDH}{\mathsf{FDH}} \newcommand{\negl}{\epsilon} \newcommand{\rand}{\mathsf{rand}} \newcommand{\age}{\mathsf{a}} \newcommand{\Age}{\mathsf{M}} \newcommand{\bage}{\mathsf{b}} \newcommand{\minage}{\mathsf{m}} \newcommand{\attest}{\mathsf{T}} \newcommand{\commitment}{\mathsf{Q}} \newcommand{\pruf}{\mathsf{P}} \newcommand{\Vcommitment}{\vec{\mathsf{Q}}} \newcommand{\Vpruf}{\vec{\mathsf{P}}} \newcommand{\blinding}{\beta} \newcommand{\ZN}{\mathbb{Z}_N} \newcommand{\Z}{\mathbb{Z}} \newcommand{\N}{\mathbb{N}} \newcommand{\A}{\mathbb{A}} \newcommand{\E}{\mathbb{E}} \newcommand{\F}{\mathbb{F}} \newcommand{\seck}{\mathsf{s}} \newcommand{\pubk}{\mathsf{P}} \renewcommand{\H}{\mathbb{H}} \newcommand{\K}{\mathbb{K}} \newcommand{\Proofs}{\mathbb{P}} \newcommand{\Commitments}{\mathbb{O}} \newcommand{\Attests}{\mathbb{T}} \newcommand{\Blindings}{\mathbb{B}} \newcommand{\Nil}{\perp} \newcommand{\p}{\mathsf{p}} \newcommand{\com}{\mathsf{com}} \newcommand{\prf}{\mathsf{prf}} \newcommand{\Adv}{\mathcal{A}} \newcommand{\PPT}{\mathfrak{A}} \newcommand{\Probability}{\mathrm{Pr}} \newcommand{\Algorithm}{f} \renewcommand{\Game}[1]{G_\Adv^\mathsf{#1}} \DeclareMathOperator{\Image}{Im} \DeclareMathOperator{\Mod}{mod} \newcommand{\Encode}[1]{\overbracket[0.5pt][2pt]{\,#1\,}} \newcommand{\Decode}[1]{\underbracket[0.5pt][3pt]{\,#1\,}} \newcommand{\FDHg}[1]{[#1]_g\,} \newcommand{\logg}{{\breve{g}}} \newcommand{\drawfrom}{\xleftarrow{\$}} \newcommand\Exists{% \mathop{\lower0.75ex\hbox{\ensuremath{% \mathlarger{\mathlarger{\mathlarger{\mathlarger{\exists}}}}}}}% \limits} \newcommand\Forall{% \mathop{\lower0.75ex\hbox{\ensuremath{% \mathlarger{\mathlarger{\mathlarger{\mathlarger{\forall}}}}}}}% \limits}