This paper presents an efficient anonymous credential system with optional anonymity revocation. The system is based on the strong RSA assumption and the decisional Diffie-Hellman assumption modulo a safe prime product. It offers several advantages over existing systems: (1) It allows users to unlinkably demonstrate possession of credentials without involving the issuing organization. (2) It provides optional anonymity revocation for particular transactions. (3) It offers separability, allowing organizations to choose their cryptographic keys independently. Additionally, it introduces all-or-nothing sharing, which prevents users from sharing their credentials with others. This is achieved through a new primitive called circular encryption. The system also supports one-show credentials with an off-line double-spending test, similar to known e-cash schemes. The system is efficient, with small communication and computation costs. It also allows for the optional revocation of anonymity, either globally or locally. The system is secure under the strong RSA assumption and the decisional Diffie-Hellman assumption modulo a safe prime product. The paper also provides a formal definition of the system and its security properties, along with a detailed protocol description.This paper presents an efficient anonymous credential system with optional anonymity revocation. The system is based on the strong RSA assumption and the decisional Diffie-Hellman assumption modulo a safe prime product. It offers several advantages over existing systems: (1) It allows users to unlinkably demonstrate possession of credentials without involving the issuing organization. (2) It provides optional anonymity revocation for particular transactions. (3) It offers separability, allowing organizations to choose their cryptographic keys independently. Additionally, it introduces all-or-nothing sharing, which prevents users from sharing their credentials with others. This is achieved through a new primitive called circular encryption. The system also supports one-show credentials with an off-line double-spending test, similar to known e-cash schemes. The system is efficient, with small communication and computation costs. It also allows for the optional revocation of anonymity, either globally or locally. The system is secure under the strong RSA assumption and the decisional Diffie-Hellman assumption modulo a safe prime product. The paper also provides a formal definition of the system and its security properties, along with a detailed protocol description.