Jim Hart says:
Challenge: is a crypto protocol possible with the following properties: the doctor writes and signs the prescription, and it is not transferable, but the patient doesn't need to show ID to the pharmacist to fill the prescription? I don't want pharmacists, and whoever else they share the info with (insurance companies? investigators? potential blackmailers?), keeping track of what drugs I take.
It cannot be done. There is no way to prove that you didn't transfer some cryptographic credential. The only way to know that you are you is to check your credentials against unforgeable physical characteristics. All such characteristics can be used to identify you. On the other hand, I'll point out that a pharmacist has never asked me for ID. Perry